@shware/security 9.1.0 → 9.2.1

package/dist/oauth2/provider/apple.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apple.mjs","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    // The web flow's id token echoes the request's nonce; the app's carries the one bound into\n    // ASAuthorizationAppleIDRequest, hashed or not (`nonce_supported`).\n    nonce: { web: true, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EAGxC,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAK;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAM,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAO,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAG,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GACpF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAM,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAW,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAO,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}
+{"version":3,"file":"apple.mjs","names":[],"sources":["../../../src/oauth2/provider/apple.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport { type AppleUser, cleanPersonName, nameClaims, parseAppleUser } from '../name';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  PersonNameComponents,\n  Provider,\n  UserInfo,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** `iss` of every Apple id token (https://appleid.apple.com/.well-known/openid-configuration). */\nconst APPLE_ISSUER = 'https://appleid.apple.com';\n\n// ref: https://account.apple.com/.well-known/openid-configuration\nexport function createAppleProvider(): Provider {\n  return {\n    // important notice: response_mode=form_post is required for apple\n    authorizationUri: 'https://appleid.apple.com/auth/authorize?response_mode=form_post',\n    tokenUri: 'https://appleid.apple.com/auth/token',\n    jwkSetUri: 'https://appleid.apple.com/auth/keys',\n    userNameAttribute: 'sub',\n    defaultScope: ['openid', 'name', 'email'],\n    // The web flow's id token echoes the request's nonce; the app's carries the one bound into\n    // ASAuthorizationAppleIDRequest, hashed or not (`nonce_supported`).\n    nonce: { web: true, native: true },\n    createAuthorizationUri({ pkce: _, ...params }) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode({ pkce: _, ...params }) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      return (await response.json()) as AppleToken;\n    },\n    async getUserInfo({ id_token }, { clientId, response }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // The audience is the client the code was exchanged as: the bundle id for an app, the\n      // Services ID for the web.\n      const token = await verifyIdToken<AppleIdToken>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: APPLE_ISSUER,\n        audience: clientId,\n      });\n      // Apple's id token never carries a name; on the first authorization of the web flow the\n      // name comes in the form_post `user` instead, unsigned, so only its name parts are used\n      // and the signed id token's email always wins over the one beside them.\n      const user = parseAppleUser(response?.user);\n      const data: AppleUserInfo = user ? { ...token, user } : token;\n      return {\n        data,\n        claims: {\n          sub: token.sub,\n          email: token.email,\n          email_verified: true,\n          ...nameClaims({\n            given_name: user?.name?.firstName,\n            family_name: user?.name?.lastName,\n          }),\n        },\n      };\n    },\n    async loginOAuth2Native({ pkce: _, credentials, ...params }: LoginOAuth2NativeParams) {\n      // The app's mistake, a 400 like any other malformed login body, not a server fault.\n      if (!credentials.code) throw new OAuth2Error(400, 'invalid_request', 'code is required');\n      const { tokenUri } = this;\n      const { code } = credentials;\n      const response = await exchangeAuthorizationCode({ code, tokenUri, ...params });\n      if (!response.ok) {\n        const { error } = (await response.json()) as AppleErrorResponse;\n        throw new OAuth2Error(response.status, error);\n      }\n      const token = (await response.json()) as AppleToken;\n      const { data, claims } = await this.getUserInfo(token, { clientId: params.clientId });\n      // The app gets the name from Apple on the first authorization only and passes it along in\n      // the login body as the platform's `fullName`.\n      const fullName = cleanPersonName(credentials.fullName);\n      const name = nameClaims({\n        given_name: fullName?.givenName ?? undefined,\n        family_name: fullName?.familyName ?? undefined,\n        middle_name: fullName?.middleName ?? undefined,\n        nickname: fullName?.nickname ?? undefined,\n      });\n      const userInfo: UserInfo<AppleUserInfo> = {\n        data: fullName ? { ...(data as AppleUserInfo), fullName } : (data as AppleUserInfo),\n        claims: { ...claims, ...name },\n      };\n      return { token, userInfo };\n    },\n  };\n}\n\nexport const apple = createAppleProvider();\n\n// Claims of Apple's id token. It carries no name or picture, not even on the first authorization.\n// https://developer.apple.com/documentation/signinwithapple/authenticating-users-with-sign-in-with-apple\nexport interface AppleIdToken {\n  iss: string;\n  aud: string;\n  exp: number;\n  iat: number;\n  sub: string;\n  email: string;\n  email_verified: true | 'true';\n  is_private_email: boolean;\n  /** Native flow, first authorization only: 0 unsupported, 1 unknown, 2 likely real. */\n  real_user_status?: number;\n  nonce?: string;\n  nonce_supported?: boolean;\n}\n\n/**\n * `userInfo.data` of an Apple login: the id token's claims, plus the unsigned name the client\n * passed on the first authorization, cleaned (see `nameClaims` for the standard claims made of it).\n */\nexport interface AppleUserInfo extends AppleIdToken {\n  /** Web flow: Apple's form_post `user`, as Apple names it. */\n  user?: AppleUser;\n  /** Native flow: the login body's `fullName`, which alone keeps `namePrefix` / `nameSuffix`. */\n  fullName?: PersonNameComponents;\n}\n\n// https://developer.apple.com/documentation/devicemanagement/implementing-the-oauth2-authentication-user-enrollment-flow\n// https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens\nexport interface AppleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n}\n\nexport interface AppleNativeCredential extends NativeCredential {\n  state: string;\n  code: string;\n  id_token: string;\n}\n\n// https://developer.apple.com/documentation/sign_in_with_apple/errorresponse\nexport interface AppleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'invalid_scope';\n}\n"],"mappings":";;;;;;AAcA,MAAM,eAAe;AAGrB,SAAgB,sBAAgC;CAC9C,OAAO;EAEL,kBAAkB;EAClB,UAAU;EACV,WAAW;EACX,mBAAmB;EACnB,cAAc;GAAC;GAAU;GAAQ;EAAO;EAGxC,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAK;EACjC,uBAAuB,EAAE,MAAM,GAAG,GAAG,UAAU;GAC7C,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,EAAE,MAAM,GAAG,GAAG,UAAU;GACtD,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,UAAU,YAAY;GACtD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAGjD,MAAM,QAAQ,MAAM,cAA4B,UAAU;IACxD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GAID,MAAM,OAAO,eAAe,UAAU,IAAI;GAE1C,OAAO;IACL,MAF0B,OAAO;KAAE,GAAG;KAAO;IAAK,IAAI;IAGtD,QAAQ;KACN,KAAK,MAAM;KACX,OAAO,MAAM;KACb,gBAAgB;KAChB,GAAG,WAAW;MACZ,YAAY,MAAM,MAAM;MACxB,aAAa,MAAM,MAAM;KAC3B,CAAC;IACH;GACF;EACF;EACA,MAAM,kBAAkB,EAAE,MAAM,GAAG,aAAa,GAAG,UAAmC;GAEpF,IAAI,CAAC,YAAY,MAAM,MAAM,IAAI,YAAY,KAAK,mBAAmB,kBAAkB;GACvF,MAAM,EAAE,aAAa;GACrB,MAAM,EAAE,SAAS;GACjB,MAAM,WAAW,MAAM,0BAA0B;IAAE;IAAM;IAAU,GAAG;GAAO,CAAC;GAC9E,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,UAAW,MAAM,SAAS,KAAK;IACvC,MAAM,IAAI,YAAY,SAAS,QAAQ,KAAK;GAC9C;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GACnC,MAAM,EAAE,MAAM,WAAW,MAAM,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GAGpF,MAAM,WAAW,gBAAgB,YAAY,QAAQ;GACrD,MAAM,OAAO,WAAW;IACtB,YAAY,UAAU,aAAa,KAAA;IACnC,aAAa,UAAU,cAAc,KAAA;IACrC,aAAa,UAAU,cAAc,KAAA;IACrC,UAAU,UAAU,YAAY,KAAA;GAClC,CAAC;GAKD,OAAO;IAAE;IAAO,UAAA;KAHd,MAAM,WAAW;MAAE,GAAI;MAAwB;KAAS,IAAK;KAC7D,QAAQ;MAAE,GAAG;MAAQ,GAAG;KAAK;IAER;GAAE;EAC3B;CACF;AACF;AAEA,MAAa,QAAQ,oBAAoB"}

package/dist/oauth2/provider/google.cjs

@@ -65,7 +65,7 @@ function createGoogleProvider() {
 			};
 		},
 		async loginOAuth2Native({ pkce, credentials, ...params }) {
-			(0, _shware_utils.invariant)(credentials.code, "code is required");
+			if (!credentials.code) throw new require_oauth2_error.OAuth2Error(400, "invalid_request", "code is required");
 			const { code } = credentials;
 			const { tokenUri } = this;
 			const { redirect_uri = params.redirectUri } = credentials;

package/dist/oauth2/provider/google.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    // The web flow and One Tap echo the nonce; an app signs in with a code it exchanges here,\n    // bound by PKCE, and Google's native SDKs put no nonce in that id token.\n    nonce: { web: true, native: false },\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EAGA,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAM;EAClC,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GACjF,CAAA,GAAA,cAAA,UAAA,CAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAMF,+BAAAA,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"google.cjs","names":["createAuthorizationUri","exchangeAuthorizationCode","OAuth2Error","verifyIdToken"],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    // The web flow and One Tap echo the nonce; an app signs in with a code it exchanges here,\n    // bound by PKCE, and Google's native SDKs put no nonce in that id token.\n    nonce: { web: true, native: false },\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      // The app's mistake, a 400 like any other malformed login body, not a server fault.\n      if (!credentials.code) throw new OAuth2Error(400, 'invalid_request', 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EAGA,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAM;EAClC,uBAAuB,QAAQ;GAC7B,OAAOA,+BAAAA,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAMC,+BAAAA,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GAEjF,IAAI,CAAC,YAAY,MAAM,MAAM,IAAID,qBAAAA,YAAY,KAAK,mBAAmB,kBAAkB;GACvF,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAMD,+BAAAA,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAIC,qBAAAA,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,CAAA,GAAA,cAAA,UAAA,CAAU,UAAU,sBAAsB;GAC1C,CAAA,GAAA,cAAA,UAAA,CAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAMC,+BAAAA,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/provider/google.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBA4F3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}
+{"version":3,"file":"google.d.cts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBA6F3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}

package/dist/oauth2/provider/google.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.mts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBA4F3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}
+{"version":3,"file":"google.d.mts","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"mappings":";wBA0BgB,wBAAwB;qBA6F3B,QAAM;iBAEF;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGe,oBAAoB;EACnC;EACA;EACA;EACA;EACA;EACA;;iBAIe,4BAA4B;EAC3C;EACA;EACA;EACA;;iBAGe;EACf;EAUA"}

package/dist/oauth2/provider/google.mjs

@@ -64,7 +64,7 @@ function createGoogleProvider() {
 			};
 		},
 		async loginOAuth2Native({ pkce, credentials, ...params }) {
-			invariant(credentials.code, "code is required");
+			if (!credentials.code) throw new OAuth2Error(400, "invalid_request", "code is required");
 			const { code } = credentials;
 			const { tokenUri } = this;
 			const { redirect_uri = params.redirectUri } = credentials;

package/dist/oauth2/provider/google.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"google.mjs","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    // The web flow and One Tap echo the nonce; an app signs in with a code it exchanges here,\n    // bound by PKCE, and Google's native SDKs put no nonce in that id token.\n    nonce: { web: true, native: false },\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      invariant(credentials.code, 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EAGA,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAM;EAClC,uBAAuB,QAAQ;GAC7B,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GACjF,UAAU,YAAY,MAAM,kBAAkB;GAC9C,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAM,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}
+{"version":3,"file":"google.mjs","names":[],"sources":["../../../src/oauth2/provider/google.ts"],"sourcesContent":["import { invariant } from '@shware/utils';\nimport { OAuth2Error } from '../error';\nimport type {\n  LoginOAuth2NativeParams,\n  NativeCredential,\n  OAuth2Token,\n  OneTapProvider,\n} from '../types';\nimport { createAuthorizationUri, exchangeAuthorizationCode, verifyIdToken } from './common';\n\n/** Google signs id tokens with either `iss`, the URL or the bare host. */\nconst GOOGLE_ISSUERS = ['https://accounts.google.com', 'accounts.google.com'];\n\nfunction claims(data: GoogleUserInfo) {\n  return {\n    sub: data.sub,\n    name: data.name,\n    picture: data.picture,\n    email: data.email,\n    email_verified: data.email_verified,\n    given_name: data.given_name,\n    family_name: data.family_name,\n    locale: data.locale,\n  };\n}\n\nexport function createGoogleProvider(): OneTapProvider {\n  return {\n    authorizationUri: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUri: 'https://oauth2.googleapis.com/token',\n    userInfoUri: 'https://www.googleapis.com/oauth2/v3/userinfo',\n    userNameAttribute: 'sub',\n    jwkSetUri: 'https://www.googleapis.com/oauth2/v3/certs',\n    // https://developers.google.com/identity/protocols/oauth2/scopes#oauth2\n    defaultScope: [\n      'https://www.googleapis.com/auth/userinfo.email',\n      'https://www.googleapis.com/auth/userinfo.profile',\n      'openid',\n    ],\n    // The web flow and One Tap echo the nonce; an app signs in with a code it exchanges here,\n    // bound by PKCE, and Google's native SDKs put no nonce in that id token.\n    nonce: { web: true, native: false },\n    createAuthorizationUri(params) {\n      return createAuthorizationUri({\n        ...params,\n        scope: params.scope ?? this.defaultScope,\n        authorizationUri: this.authorizationUri,\n      });\n    },\n    async exchangeAuthorizationCode(params) {\n      const response = await exchangeAuthorizationCode({ ...params, tokenUri: this.tokenUri });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      return (await response.json()) as GoogleToken;\n    },\n    async getUserInfo({ id_token }, { clientId }) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return { data, claims: claims(data) };\n    },\n    async loginOAuth2Native({ pkce, credentials, ...params }: LoginOAuth2NativeParams) {\n      // The app's mistake, a 400 like any other malformed login body, not a server fault.\n      if (!credentials.code) throw new OAuth2Error(400, 'invalid_request', 'code is required');\n      const { code } = credentials;\n      const { tokenUri } = this;\n      // An app signs in as its own installed-app client (the iOS / Android client id, custom-scheme\n      // redirect), and Google only exchanges a code for the client it was issued to, so the exchange\n      // runs as the client the app names, which the OAuth2 client has already checked is one of this\n      // provider's configured clients. Installed-app clients have no secret. The redirect URI is the\n      // one the app used, which only the app knows. So is the PKCE verifier, when the app sent a\n      // challenge: Google then refuses the code without it.\n      const { redirect_uri = params.redirectUri } = credentials;\n      const response = await exchangeAuthorizationCode({\n        code,\n        pkce,\n        tokenUri,\n        clientId: params.clientId,\n        clientSecret: params.clientSecret,\n        redirectUri: redirect_uri,\n      });\n      if (!response.ok) {\n        const { error, error_description } = (await response.json()) as GoogleErrorResponse;\n        throw new OAuth2Error(response.status, error, error_description);\n      }\n      const token = (await response.json()) as GoogleToken;\n      const userInfo = await this.getUserInfo(token, { clientId: params.clientId });\n      return { token, userInfo };\n    },\n    async getTokenInfo(id_token: string, clientId: string) {\n      invariant(id_token, 'id_token is required');\n      invariant(this.jwkSetUri, 'jwkSetUri is required');\n      // One Tap and FedCM issue the credential to the web client.\n      const data = await verifyIdToken<GoogleUserInfo>(id_token, {\n        jwkSetUri: this.jwkSetUri,\n        issuer: GOOGLE_ISSUERS,\n        audience: clientId,\n      });\n      return {\n        token: {\n          id_token,\n          access_token: '',\n          token_type: '',\n          expires_in: 0,\n          refresh_token: '',\n          scope: '',\n        },\n        userInfo: { data, claims: claims(data) },\n      };\n    },\n  };\n}\n\nexport const google = createGoogleProvider();\n\nexport interface GoogleUserInfo {\n  aud: string;\n  azp: string;\n  email: string;\n  email_verified: boolean;\n  exp: number;\n  family_name: string;\n  given_name: string;\n  hd?: string;\n  iat: number;\n  iss: string;\n  jti?: string;\n  locale?: string;\n  name: string;\n  nbf?: number;\n  picture: string;\n  sub: string;\n  nonce?: string;\n}\n\nexport interface GoogleToken extends OAuth2Token {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  refresh_token: string;\n  id_token: string;\n  scope: string;\n}\n\n// android,ios has different client_id and redirect_uri\nexport interface GoogleAppCredential extends NativeCredential {\n  state: string;\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n}\n\nexport interface GoogleErrorResponse {\n  error:\n    | 'invalid_request'\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_token'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n    | 'access_denied'\n    | 'server_error';\n  error_description: string;\n}\n"],"mappings":";;;;;AAWA,MAAM,iBAAiB,CAAC,+BAA+B,qBAAqB;AAE5E,SAAS,OAAO,MAAsB;CACpC,OAAO;EACL,KAAK,KAAK;EACV,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,KAAK;EACZ,gBAAgB,KAAK;EACrB,YAAY,KAAK;EACjB,aAAa,KAAK;EAClB,QAAQ,KAAK;CACf;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO;EACL,kBAAkB;EAClB,UAAU;EACV,aAAa;EACb,mBAAmB;EACnB,WAAW;EAEX,cAAc;GACZ;GACA;GACA;EACF;EAGA,OAAO;GAAE,KAAK;GAAM,QAAQ;EAAM;EAClC,uBAAuB,QAAQ;GAC7B,OAAO,uBAAuB;IAC5B,GAAG;IACH,OAAO,OAAO,SAAS,KAAK;IAC5B,kBAAkB,KAAK;GACzB,CAAC;EACH;EACA,MAAM,0BAA0B,QAAQ;GACtC,MAAM,WAAW,MAAM,0BAA0B;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACvF,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,OAAQ,MAAM,SAAS,KAAK;EAC9B;EACA,MAAM,YAAY,EAAE,YAAY,EAAE,YAAY;GAC5C,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GACjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IAAE;IAAM,QAAQ,OAAO,IAAI;GAAE;EACtC;EACA,MAAM,kBAAkB,EAAE,MAAM,aAAa,GAAG,UAAmC;GAEjF,IAAI,CAAC,YAAY,MAAM,MAAM,IAAI,YAAY,KAAK,mBAAmB,kBAAkB;GACvF,MAAM,EAAE,SAAS;GACjB,MAAM,EAAE,aAAa;GAOrB,MAAM,EAAE,eAAe,OAAO,gBAAgB;GAC9C,MAAM,WAAW,MAAM,0BAA0B;IAC/C;IACA;IACA;IACA,UAAU,OAAO;IACjB,cAAc,OAAO;IACrB,aAAa;GACf,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,EAAE,OAAO,sBAAuB,MAAM,SAAS,KAAK;IAC1D,MAAM,IAAI,YAAY,SAAS,QAAQ,OAAO,iBAAiB;GACjE;GACA,MAAM,QAAS,MAAM,SAAS,KAAK;GAEnC,OAAO;IAAE;IAAO,UAAA,MADO,KAAK,YAAY,OAAO,EAAE,UAAU,OAAO,SAAS,CAAC;GACnD;EAC3B;EACA,MAAM,aAAa,UAAkB,UAAkB;GACrD,UAAU,UAAU,sBAAsB;GAC1C,UAAU,KAAK,WAAW,uBAAuB;GAEjD,MAAM,OAAO,MAAM,cAA8B,UAAU;IACzD,WAAW,KAAK;IAChB,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,OAAO;IACL,OAAO;KACL;KACA,cAAc;KACd,YAAY;KACZ,YAAY;KACZ,eAAe;KACf,OAAO;IACT;IACA,UAAU;KAAE;KAAM,QAAQ,OAAO,IAAI;IAAE;GACzC;EACF;CACF;AACF;AAEA,MAAa,SAAS,qBAAqB"}

package/dist/oauth2/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * The `nonce` sent with the authorization request when the provider echoes one in its id token\n   * (`Provider.nonce.web`); the callback refuses an id token that does not carry it back. Absent\n   * for a provider without one, and on requests stored before this field existed.\n   */\n  nonce?: string;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  /** OpenID Connect `nonce`, sent when `Provider.nonce.web` is set. */\n  nonce?: string;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  /**\n   * Set only by providers that state it (Google, Apple, GitHub from the primary address's\n   * `verified` flag, X when it returns `confirmed_email`); Facebook leaves it unset. Trust the\n   * address only when this is `true`.\n   */\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /**\n   * Whether the provider's id token carries back the `nonce` of the request it was issued for\n   * (OpenID Connect), per flow. `web`: the redirect flow and One Tap, where `Auth` sends a nonce\n   * with the authorization request (or the front end passes an issued one to One Tap) and refuses\n   * an id token without it. `native`: the app's sign-in, where the app binds a nonce issued by\n   * `GET /oauth2/nonce/:provider` into the platform's request and the login refuses an id token\n   * without it. A flow set here is protected by default; a host relaxes it per provider with\n   * `oauth2.nonce.optional`. Absent for a plain OAuth2 provider, which has no id token.\n   */\n  nonce?: { web?: boolean; native?: boolean };\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";;AA0KA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * The `nonce` sent with the authorization request when the provider echoes one in its id token\n   * (`Provider.nonce.web`); the callback refuses an id token that does not carry it back. Absent\n   * for a provider without one, and on requests stored before this field existed.\n   */\n  nonce?: string;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n  /** Added to the callback's redirect back to the app (`oauth2Authorization` options). */\n  redirectParams?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  /** OpenID Connect `nonce`, sent when `Provider.nonce.web` is set. */\n  nonce?: string;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  /**\n   * Set only by providers that state it (Google, Apple, GitHub from the primary address's\n   * `verified` flag, X when it returns `confirmed_email`); Facebook leaves it unset. Trust the\n   * address only when this is `true`.\n   */\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /**\n   * Whether the provider's id token carries back the `nonce` of the request it was issued for\n   * (OpenID Connect), per flow. `web`: the redirect flow and One Tap, where `Auth` sends a nonce\n   * with the authorization request (or the front end passes an issued one to One Tap) and refuses\n   * an id token without it. `native`: the app's sign-in, where the app binds a nonce issued by\n   * `GET /oauth2/nonce/:provider` into the platform's request and the login refuses an id token\n   * without it. A flow set here is protected by default; a host relaxes it per provider with\n   * `oauth2.nonce.optional`. Absent for a plain OAuth2 provider, which has no id token.\n   */\n  nonce?: { web?: boolean; native?: boolean };\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";;AA4KA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/oauth2/types.d.cts

@@ -21,6 +21,8 @@ export interface OAuth2AuthorizationRequest {
    * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.
    */
   attributes?: Record<string, string>;
+  /** Added to the callback's redirect back to the app (`oauth2Authorization` options). */
+  redirectParams?: Record<string, string>;
 }
 interface CreateAuthorizationUriParams {
   state: string;

package/dist/oauth2/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":"A,iBACiB;EACf;EACA;EACA;;iBAGe;EACf;;EAEA;EACA;EACA,sBAAsB;;;;;;EAMtB;;;;;;EAMA,aAAa;;UAGL;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;EAEZ;;iBAGe;EACf;EACA;;EAEA;EACA;EACA,OAAO,KAAK;;iBAGG;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA;;iBAGe;;;;;EAKf;EACA;EACA;;;;;;EAMA,OAAO,KAAK;;EAEZ,aAAa;;iBAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;iBAGc,kBAAkB;EACjC;;YAGU;EACV;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;;;;;;;;;;;EAYA,WAAW;;;iBAII;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;iBAQe;EACf;;qBAGW;YASD,oBAAoB;iBAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;iBAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;iBAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;;;;;;;;;EAWA;IAAU;IAAe;;;EAGzB,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;;;;;EAOnE,cAAc,OAAO,aAAa,SAAS,oBAAoB,QAAQ;;EAGvE,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;iBAG9B;EACf;EACA,WAAW;;iBAGI,uBAAuB;;EAEtC,eACE,kBACA,qBACG;IAAU,OAAO;IAAa,UAAU;;;;;;;;YAQnC,0BAA0B,8BAA8B;;iBAGnD;EACf;;EAEA,eAAe;;EAEf;;EAEA;;;;;;iBAOe;EACf;;EAEA,eAAe;;;;;EAKf;;;;;;;;iBASe;;EAEf,UAAU;;EAEV,MAAM;;;;;EAKN,SAAS;;YAGC;GAAqB,cAAc;;iBAE9B;EACf;EACA;EACA;;EAEA,WAAW,yBAAyB,QAAQ"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":"A,iBACiB;EACf;EACA;EACA;;iBAGe;EACf;;EAEA;EACA;EACA,sBAAsB;;;;;;EAMtB;;;;;;EAMA,aAAa;;EAEb,iBAAiB;;UAGT;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;EAEZ;;iBAGe;EACf;EACA;;EAEA;EACA;EACA,OAAO,KAAK;;iBAGG;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA;;iBAGe;;;;;EAKf;EACA;EACA;;;;;;EAMA,OAAO,KAAK;;EAEZ,aAAa;;iBAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;iBAGc,kBAAkB;EACjC;;YAGU;EACV;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;;;;;;;;;;;EAYA,WAAW;;;iBAII;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;iBAQe;EACf;;qBAGW;YASD,oBAAoB;iBAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;iBAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;iBAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;;;;;;;;;EAWA;IAAU;IAAe;;;EAGzB,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;;;;;EAOnE,cAAc,OAAO,aAAa,SAAS,oBAAoB,QAAQ;;EAGvE,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;iBAG9B;EACf;EACA,WAAW;;iBAGI,uBAAuB;;EAEtC,eACE,kBACA,qBACG;IAAU,OAAO;IAAa,UAAU;;;;;;;;YAQnC,0BAA0B,8BAA8B;;iBAGnD;EACf;;EAEA,eAAe;;EAEf;;EAEA;;;;;;iBAOe;EACf;;EAEA,eAAe;;;;;EAKf;;;;;;;;iBASe;;EAEf,UAAU;;EAEV,MAAM;;;;;EAKN,SAAS;;YAGC;GAAqB,cAAc;;iBAE9B;EACf;EACA;EACA;;EAEA,WAAW,yBAAyB,QAAQ"}

package/dist/oauth2/types.d.mts

@@ -21,6 +21,8 @@ export interface OAuth2AuthorizationRequest {
    * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.
    */
   attributes?: Record<string, string>;
+  /** Added to the callback's redirect back to the app (`oauth2Authorization` options). */
+  redirectParams?: Record<string, string>;
 }
 interface CreateAuthorizationUriParams {
   state: string;

package/dist/oauth2/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":"A,iBACiB;EACf;EACA;EACA;;iBAGe;EACf;;EAEA;EACA;EACA,sBAAsB;;;;;;EAMtB;;;;;;EAMA,aAAa;;UAGL;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;EAEZ;;iBAGe;EACf;EACA;;EAEA;EACA;EACA,OAAO,KAAK;;iBAGG;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA;;iBAGe;;;;;EAKf;EACA;EACA;;;;;;EAMA,OAAO,KAAK;;EAEZ,aAAa;;iBAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;iBAGc,kBAAkB;EACjC;;YAGU;EACV;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;;;;;;;;;;;EAYA,WAAW;;;iBAII;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;iBAQe;EACf;;qBAGW;YASD,oBAAoB;iBAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;iBAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;iBAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;;;;;;;;;EAWA;IAAU;IAAe;;;EAGzB,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;;;;;EAOnE,cAAc,OAAO,aAAa,SAAS,oBAAoB,QAAQ;;EAGvE,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;iBAG9B;EACf;EACA,WAAW;;iBAGI,uBAAuB;;EAEtC,eACE,kBACA,qBACG;IAAU,OAAO;IAAa,UAAU;;;;;;;;YAQnC,0BAA0B,8BAA8B;;iBAGnD;EACf;;EAEA,eAAe;;EAEf;;EAEA;;;;;;iBAOe;EACf;;EAEA,eAAe;;;;;EAKf;;;;;;;;iBASe;;EAEf,UAAU;;EAEV,MAAM;;;;;EAKN,SAAS;;YAGC;GAAqB,cAAc;;iBAE9B;EACf;EACA;EACA;;EAEA,WAAW,yBAAyB,QAAQ"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/oauth2/types.ts"],"mappings":"A,iBACiB;EACf;EACA;EACA;;iBAGe;EACf;;EAEA;EACA;EACA,sBAAsB;;;;;;EAMtB;;;;;;EAMA,aAAa;;EAEb,iBAAiB;;UAGT;EACR;EACA;EACA;EACA;EACA,OAAO,KAAK;;EAEZ;;iBAGe;EACf;EACA;;EAEA;EACA;EACA,OAAO,KAAK;;iBAGG;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA;;iBAGe;;;;;EAKf;EACA;EACA;;;;;;EAMA,OAAO,KAAK;;EAEZ,aAAa;;iBAIE;;;;;EAKf;;;;;EAMA;;;;;;;;EASA;;;;;;EAOA;;;;;;EAOA;EAEA;GAEC;;iBAGc,kBAAkB;EACjC;;YAGU;EACV;EACA;EACA;EACA;;;;;;;;EAQA;EACA;EACA;;;;;;;;;;;;EAYA,WAAW;;;iBAII;EACf;EACA;EACA;EACA;EACA;EACA;;;;;;;iBAQe;EACf;;qBAGW;YASD,oBAAoB;iBAGf;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;EAMA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;IACE;IACA;IACA;IACA;IACA;IACA;;EAEF;;iBAGe,SAAS;EACxB,QAAQ;EACR,MAAM;;iBAGS;;EAEf;;EAGA;;EAGA;;EAGA;;EAGA;;EAGA;;;;EAKA;;EAGA;;;;;EAMA;;EAGA;;;;;;;;;;EAWA;IAAU;IAAe;;;EAGzB,yBAAyB,QAAQ,iCAAiC;;EAGlE,4BAA4B,QAAQ,uBAAuB,QAAQ;;;;;;EAOnE,cAAc,OAAO,aAAa,SAAS,oBAAoB,QAAQ;;EAGvE,sBAAsB,QAAQ,uBAAuB,QAAQ;;EAG7D,eAAe,QAAQ,sBAAsB;EAE7C,qBACE,QAAQ,4BACL;IAAU,OAAO;IAAa,UAAU;;;iBAG9B;EACf;EACA,WAAW;;iBAGI,uBAAuB;;EAEtC,eACE,kBACA,qBACG;IAAU,OAAO;IAAa,UAAU;;;;;;;;YAQnC,0BAA0B,8BAA8B;;iBAGnD;EACf;;EAEA,eAAe;;EAEf;;EAEA;;;;;;iBAOe;EACf;;EAEA,eAAe;;;;;EAKf;;;;;;;;iBASe;;EAEf,UAAU;;EAEV,MAAM;;;;;EAKN,SAAS;;YAGC;GAAqB,cAAc;;iBAE9B;EACf;EACA;EACA;;EAEA,WAAW,yBAAyB,QAAQ"}

package/dist/oauth2/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * The `nonce` sent with the authorization request when the provider echoes one in its id token\n   * (`Provider.nonce.web`); the callback refuses an id token that does not carry it back. Absent\n   * for a provider without one, and on requests stored before this field existed.\n   */\n  nonce?: string;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  /** OpenID Connect `nonce`, sent when `Provider.nonce.web` is set. */\n  nonce?: string;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  /**\n   * Set only by providers that state it (Google, Apple, GitHub from the primary address's\n   * `verified` flag, X when it returns `confirmed_email`); Facebook leaves it unset. Trust the\n   * address only when this is `true`.\n   */\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /**\n   * Whether the provider's id token carries back the `nonce` of the request it was issued for\n   * (OpenID Connect), per flow. `web`: the redirect flow and One Tap, where `Auth` sends a nonce\n   * with the authorization request (or the front end passes an issued one to One Tap) and refuses\n   * an id token without it. `native`: the app's sign-in, where the app binds a nonce issued by\n   * `GET /oauth2/nonce/:provider` into the platform's request and the login refuses an id token\n   * without it. A flow set here is protected by default; a host relaxes it per provider with\n   * `oauth2.nonce.optional`. Absent for a plain OAuth2 provider, which has no id token.\n   */\n  nonce?: { web?: boolean; native?: boolean };\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";AA0KA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * The `nonce` sent with the authorization request when the provider echoes one in its id token\n   * (`Provider.nonce.web`); the callback refuses an id token that does not carry it back. Absent\n   * for a provider without one, and on requests stored before this field existed.\n   */\n  nonce?: string;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n  /** Added to the callback's redirect back to the app (`oauth2Authorization` options). */\n  redirectParams?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n  /** OpenID Connect `nonce`, sent when `Provider.nonce.web` is set. */\n  nonce?: string;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  /**\n   * Set only by providers that state it (Google, Apple, GitHub from the primary address's\n   * `verified` flag, X when it returns `confirmed_email`); Facebook leaves it unset. Trust the\n   * address only when this is `true`.\n   */\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /**\n   * Whether the provider's id token carries back the `nonce` of the request it was issued for\n   * (OpenID Connect), per flow. `web`: the redirect flow and One Tap, where `Auth` sends a nonce\n   * with the authorization request (or the front end passes an issued one to One Tap) and refuses\n   * an id token without it. `native`: the app's sign-in, where the app binds a nonce issued by\n   * `GET /oauth2/nonce/:provider` into the platform's request and the login refuses an id token\n   * without it. A flow set here is protected by default; a host relaxes it per provider with\n   * `oauth2.nonce.optional`. Absent for a plain OAuth2 provider, which has no id token.\n   */\n  nonce?: { web?: boolean; native?: boolean };\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";AA4KA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "9.1.0",
+  "version": "9.2.1",
   "private": false,
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@shware/utils": "^2.0.2",
+    "@shware/utils": "^2.0.3",
     "cookie": "^2.0.1",
     "jose": "^6.2.13",
     "path-to-regexp": "^8.4.2"