@simple-login/sdk 1.0.0 → 1.2.0

package/dist/index.cjs

@@ -27,6 +27,9 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/client.ts
+var import_jose = require("jose");
+
 // src/errors.ts
 var SousaError = class extends Error {
   constructor(message, code, statusCode) {
@@ -56,6 +59,17 @@ function generateState() {
   crypto.getRandomValues(array);
   return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return btoa(String.fromCharCode(...array)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
 function getEnv(key) {
   if (typeof process !== "undefined" && process.env) {
     return process.env[key];
@@ -66,6 +80,20 @@ function parseCookie(cookieHeader, name) {
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
   return match ? decodeURIComponent(match[1]) : void 0;
 }
+var publicKeyCache = /* @__PURE__ */ new Map();
+var PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1e3;
+function createTokenCookies(tokens) {
+  return [
+    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,
+    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`
+  ];
+}
+function clearTokenCookies() {
+  return [
+    "SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0",
+    "SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+  ];
+}
 var SimpleLogin = class {
   clientId;
   clientSecret;
@@ -93,50 +121,57 @@ var SimpleLogin = class {
     }
   }
   /**
-   * Returns a Response that redirects to the authorization URL with the state cookie set.
+   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.
    * @param options - Optional scopes or custom state
    * @returns A 302 redirect Response ready to be returned from your route handler
    */
-  redirectToAuth(options = {}) {
-    const { url, cookie } = this.getAuthorizationUrl(options);
-    return new Response(null, {
-      status: 302,
-      headers: {
-        Location: url,
-        "Set-Cookie": cookie
-      }
-    });
+  async redirectToAuth(options = {}) {
+    const { url, cookies } = await this.getAuthorizationUrl(options);
+    const headers = new Headers();
+    headers.set("Location", url);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
   }
   /**
    * Generate the authorization URL to redirect users for sign-in
-   * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value
+   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values
    */
-  getAuthorizationUrl(options = {}) {
+  async getAuthorizationUrl(options = {}) {
     const state = options.state ?? generateState();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
     const params = new URLSearchParams({
       client_id: this.clientId,
       redirect_uri: this.redirectUri,
       response_type: "code",
-      state
+      state,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256"
     });
     if (options.scopes?.length) {
       params.set("scope", options.scopes.join(" "));
     }
-    const cookie = `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`;
+    const cookies = [
+      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
+      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`
+    ];
     return {
       url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,
       state,
-      cookie
+      codeVerifier,
+      cookies
     };
   }
   /**
-   * Verify the OAuth callback request and exchange the code for tokens.
-   * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.
+   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.
    * @param request - The incoming Request object from the callback
-   * @returns The token response if verification succeeds
+   * @param redirectTo - URL to redirect to after successful authentication (default: '/')
+   * @returns CallbackResult with redirect Response (cookies set) and user info to store
    * @throws AuthorizationError if state is missing or doesn't match
    */
-  async handleCallback(request) {
+  async handleCallback(request, redirectTo = "/") {
     const url = new URL(request.url);
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
@@ -148,18 +183,41 @@ var SimpleLogin = class {
     }
     const cookieHeader = request.headers.get("cookie") ?? "";
     const expectedState = parseCookie(cookieHeader, "SIMPLELOGIN_STATE");
+    const codeVerifier = parseCookie(cookieHeader, "SIMPLELOGIN_CODE_VERIFIER");
     if (!expectedState) {
       throw new AuthorizationError("Missing SIMPLELOGIN_STATE cookie");
     }
     if (state !== expectedState) {
       throw new AuthorizationError("Invalid state parameter");
     }
-    return this.exchangeCode(code);
+    if (!codeVerifier) {
+      throw new AuthorizationError("Missing SIMPLELOGIN_CODE_VERIFIER cookie");
+    }
+    const tokens = await this.exchangeCode(code, codeVerifier);
+    const user = await this.getUserInfo(tokens.access_token);
+    const cookies = createTokenCookies(tokens);
+    const headers = new Headers();
+    headers.set("Location", redirectTo);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    headers.append(
+      "Set-Cookie",
+      "SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+    );
+    headers.append(
+      "Set-Cookie",
+      "SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+    );
+    const response = new Response(null, { status: 302, headers });
+    return { response, user };
   }
   /**
    * Exchange an authorization code for access and refresh tokens
+   * @param code - The authorization code from the callback
+   * @param codeVerifier - The PKCE code verifier
    */
-  async exchangeCode(code) {
+  async exchangeCode(code, codeVerifier) {
     const response = await fetch(`${this.baseUrl}/v1/auth/token`, {
       method: "POST",
       headers: {
@@ -170,7 +228,8 @@ var SimpleLogin = class {
         client_id: this.clientId,
         client_secret: this.clientSecret,
         redirect_uri: this.redirectUri,
-        code
+        code,
+        code_verifier: codeVerifier
       })
     });
     if (!response.ok) {
@@ -215,6 +274,98 @@ var SimpleLogin = class {
     }
     return response.json();
   }
+  /**
+   * Fetch and cache the public key for JWT verification
+   */
+  async getPublicKey() {
+    const cached = publicKeyCache.get(this.clientId);
+    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {
+      return cached.key;
+    }
+    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`);
+    if (!response.ok) {
+      throw new AuthorizationError("Failed to fetch public key");
+    }
+    const pem = await response.text();
+    const key = await (0, import_jose.importSPKI)(pem, "RS256");
+    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() });
+    return key;
+  }
+  /**
+   * Authenticate a request by verifying the access token from cookies.
+   * No network calls except when refreshing expired tokens.
+   * @param request - The incoming Request object
+   * @param options - Optional settings for CSRF protection
+   * @returns AuthResult if authenticated, null if not authenticated
+   */
+  async authenticate(request, options) {
+    const method = request.method.toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && options?.allowedOrigin) {
+      const origin = request.headers.get("origin") || request.headers.get("referer");
+      if (!origin?.startsWith(options.allowedOrigin)) {
+        return null;
+      }
+    }
+    const cookieHeader = request.headers.get("cookie") ?? "";
+    const accessToken = parseCookie(cookieHeader, "SIMPLELOGIN_ACCESS_TOKEN");
+    const refreshTokenValue = parseCookie(cookieHeader, "SIMPLELOGIN_REFRESH_TOKEN");
+    if (!accessToken) {
+      return null;
+    }
+    const publicKey = await this.getPublicKey();
+    try {
+      await (0, import_jose.jwtVerify)(accessToken, publicKey);
+      const claims = (0, import_jose.decodeJwt)(accessToken);
+      return { claims, accessToken };
+    } catch (error) {
+      const isExpired = error instanceof Error && "code" in error && error.code === "ERR_JWT_EXPIRED";
+      if (!isExpired || !refreshTokenValue) {
+        return null;
+      }
+      try {
+        const tokens = await this.refreshToken(refreshTokenValue);
+        const claims = (0, import_jose.decodeJwt)(tokens.access_token);
+        const cookies = createTokenCookies(tokens);
+        return { claims, accessToken: tokens.access_token, cookies };
+      } catch {
+        return null;
+      }
+    }
+  }
+  /**
+   * Revoke a refresh token on the IdP
+   */
+  async revokeToken(refreshToken) {
+    await fetch(`${this.baseUrl}/v1/auth/revoke`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token: refreshToken,
+        client_id: this.clientId,
+        client_secret: this.clientSecret
+      })
+    });
+  }
+  /**
+   * Logout: revoke refresh token on IdP and clear cookies.
+   * @param request - The incoming Request object (to read refresh token from cookies)
+   * @param redirectTo - URL to redirect to after logout (default: '/')
+   */
+  async logout(request, redirectTo = "/") {
+    const cookieHeader = request.headers.get("cookie") ?? "";
+    const refreshToken = parseCookie(cookieHeader, "SIMPLELOGIN_REFRESH_TOKEN");
+    if (refreshToken) {
+      this.revokeToken(refreshToken).catch(() => {
+      });
+    }
+    const cookies = clearTokenCookies();
+    const headers = new Headers();
+    headers.set("Location", redirectTo);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { SimpleLogin } from './client'\nexport { AuthorizationError, SousaError, TokenError } from './errors'\nexport type {\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n","export class SousaError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number\n  ) {\n    super(message);\n    this.name = \"SousaError\";\n  }\n}\n\nexport class AuthorizationError extends SousaError {\n  constructor(message: string) {\n    super(message, \"AUTHORIZATION_ERROR\", 401);\n    this.name = \"AuthorizationError\";\n  }\n}\n\nexport class TokenError extends SousaError {\n  constructor(message: string) {\n    super(message, \"TOKEN_ERROR\", 400);\n    this.name = \"TokenError\";\n  }\n}\n","import { AuthorizationError, TokenError } from './errors'\nimport type {\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with the state cookie set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  redirectToAuth(options: AuthorizationUrlOptions = {}): Response {\n    const { url, cookie } = this.getAuthorizationUrl(options)\n    return new Response(null, {\n      status: 302,\n      headers: {\n        Location: url,\n        'Set-Cookie': cookie,\n      },\n    })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value\n   */\n  getAuthorizationUrl(options: AuthorizationUrlOptions = {}): AuthorizationUrlResult {\n    const state = options.state ?? generateState()\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookie = `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      cookie,\n    }\n  }\n\n  /**\n   * Verify the OAuth callback request and exchange the code for tokens.\n   * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.\n   * @param request - The incoming Request object from the callback\n   * @returns The token response if verification succeeds\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request): Promise<TokenResponse> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    return this.exchangeCode(code)\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   */\n  async exchangeCode(code: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,WAAW;AAAA,EACzC,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ACZA,IAAM,WAAW;AAEjB,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,UAAmC,CAAC,GAAa;AAC9D,UAAM,EAAE,KAAK,OAAO,IAAI,KAAK,oBAAoB,OAAO;AACxD,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,oBAAoB,UAAmC,CAAC,GAA2B;AACjF,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAE7C,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,SAAS,qBAAqB,KAAK;AAEzC,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAA0C;AAC7D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AAEnE,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,WAAO,KAAK,aAAa,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAsC;AACvD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/errors.ts"],"sourcesContent":["export { SimpleLogin } from './client'\nexport { AuthorizationError, SousaError, TokenError } from './errors'\nexport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n","import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(options: AuthorizationUrlOptions = {}): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const pem = await response.text()\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * @param request - The incoming Request object\n   * @param options - Optional settings for CSRF protection\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(\n    request: Request,\n    options?: { allowedOrigin?: string },\n  ): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD' && options?.allowedOrigin) {\n      const origin = request.headers.get('origin') || request.headers.get('referer')\n      if (!origin?.startsWith(options.allowedOrigin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    if (!accessToken) {\n      return null\n    }\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(accessToken, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(accessToken) as AccessTokenClaims\n\n      return { claims, accessToken }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n        const cookies = createTokenCookies(tokens)\n\n        return { claims, accessToken: tokens.access_token, cookies }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP and clear cookies.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   * @param redirectTo - URL to redirect to after logout (default: '/')\n   */\n  async logout(request: Request, redirectTo: string = '/'): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Clear cookies regardless\n    const cookies = clearTokenCookies()\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SousaError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number\n  ) {\n    super(message);\n    this.name = \"SousaError\";\n  }\n}\n\nexport class AuthorizationError extends SousaError {\n  constructor(message: string) {\n    super(message, \"AUTHORIZATION_ERROR\", 401);\n    this.name = \"AuthorizationError\";\n  }\n}\n\nexport class TokenError extends SousaError {\n  constructor(message: string) {\n    super(message, \"TOKEN_ERROR\", 400);\n    this.name = \"TokenError\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,kBAAiD;;;ACA1C,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,WAAW;AAAA,EACzC,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW;AAEjB,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AAEvC,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY;AAAA,IAC/C,6BAA6B,OAAO,aAAa;AAAA,EACnD;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,UAAmC,CAAC,GAAoC;AAChG,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAM,MAAM,UAAM,wBAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aACJ,SACA,SAC4B;AAE5B,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,UAAU,SAAS,eAAe;AACnE,YAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AAC7E,UAAI,CAAC,QAAQ,WAAW,QAAQ,aAAa,GAAG;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAE/E,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,gBAAM,uBAAU,aAAa,SAAS;AAGtC,YAAM,aAAS,uBAAU,WAAW;AAEpC,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,aAAS,uBAAU,OAAO,YAAY;AAC5C,cAAM,UAAU,mBAAmB,MAAM;AAEzC,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAAkB,aAAqB,KAAwB;AAC1E,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,UAAU,kBAAkB;AAClC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;","names":[]}

package/dist/index.d.cts

@@ -10,15 +10,39 @@ interface AuthorizationUrlOptions {
 interface AuthorizationUrlResult {
     url: string;
     state: string;
-    /** Ready-to-use Set-Cookie header value for the state parameter */
-    cookie: string;
+    codeVerifier: string;
+    /** Ready-to-use Set-Cookie header values for state and code verifier */
+    cookies: string[];
 }
 interface TokenResponse {
     access_token: string;
     refresh_token: string;
+    token_id: string;
     token_type: string;
     expires_in: number;
 }
+interface AccessTokenClaims {
+    sub: string;
+    application_id: string;
+    organization_id?: string;
+    is_master?: boolean;
+    type: 'access';
+    exp: number;
+    iat: number;
+}
+interface AuthResult {
+    /** Decoded claims from the access token JWT (no network call) */
+    claims: AccessTokenClaims;
+    accessToken: string;
+    /** Set-Cookie headers to set if tokens were refreshed */
+    cookies?: string[];
+}
+interface CallbackResult {
+    /** Redirect Response with token cookies set */
+    response: Response;
+    /** Full user info fetched from userinfo endpoint (store this in your BFF) */
+    user: UserInfo;
+}
 interface UserInfo {
     sub: string;
     id: string;
@@ -48,28 +72,30 @@ declare class SimpleLogin {
     private baseUrl;
     constructor(config?: SimpleLoginConfig);
     /**
-     * Returns a Response that redirects to the authorization URL with the state cookie set.
+     * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.
      * @param options - Optional scopes or custom state
      * @returns A 302 redirect Response ready to be returned from your route handler
      */
-    redirectToAuth(options?: AuthorizationUrlOptions): Response;
+    redirectToAuth(options?: AuthorizationUrlOptions): Promise<Response>;
     /**
      * Generate the authorization URL to redirect users for sign-in
-     * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value
+     * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values
      */
-    getAuthorizationUrl(options?: AuthorizationUrlOptions): AuthorizationUrlResult;
+    getAuthorizationUrl(options?: AuthorizationUrlOptions): Promise<AuthorizationUrlResult>;
     /**
-     * Verify the OAuth callback request and exchange the code for tokens.
-     * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.
+     * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.
      * @param request - The incoming Request object from the callback
-     * @returns The token response if verification succeeds
+     * @param redirectTo - URL to redirect to after successful authentication (default: '/')
+     * @returns CallbackResult with redirect Response (cookies set) and user info to store
      * @throws AuthorizationError if state is missing or doesn't match
      */
-    handleCallback(request: Request): Promise<TokenResponse>;
+    handleCallback(request: Request, redirectTo?: string): Promise<CallbackResult>;
     /**
      * Exchange an authorization code for access and refresh tokens
+     * @param code - The authorization code from the callback
+     * @param codeVerifier - The PKCE code verifier
      */
-    exchangeCode(code: string): Promise<TokenResponse>;
+    exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse>;
     /**
      * Refresh an access token using a refresh token
      */
@@ -78,6 +104,30 @@ declare class SimpleLogin {
      * Get user information using an access token
      */
     getUserInfo(accessToken: string): Promise<UserInfo>;
+    /**
+     * Fetch and cache the public key for JWT verification
+     */
+    private getPublicKey;
+    /**
+     * Authenticate a request by verifying the access token from cookies.
+     * No network calls except when refreshing expired tokens.
+     * @param request - The incoming Request object
+     * @param options - Optional settings for CSRF protection
+     * @returns AuthResult if authenticated, null if not authenticated
+     */
+    authenticate(request: Request, options?: {
+        allowedOrigin?: string;
+    }): Promise<AuthResult | null>;
+    /**
+     * Revoke a refresh token on the IdP
+     */
+    private revokeToken;
+    /**
+     * Logout: revoke refresh token on IdP and clear cookies.
+     * @param request - The incoming Request object (to read refresh token from cookies)
+     * @param redirectTo - URL to redirect to after logout (default: '/')
+     */
+    logout(request: Request, redirectTo?: string): Promise<Response>;
 }
 
 declare class SousaError extends Error {
@@ -92,4 +142,4 @@ declare class TokenError extends SousaError {
     constructor(message: string);
 }
 
-export { AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, SimpleLogin, type SimpleLoginConfig, SousaError, TokenError, type TokenResponse, type UserInfo };
+export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, SimpleLogin, type SimpleLoginConfig, SousaError, TokenError, type TokenResponse, type UserInfo };

package/dist/index.d.ts

@@ -10,15 +10,39 @@ interface AuthorizationUrlOptions {
 interface AuthorizationUrlResult {
     url: string;
     state: string;
-    /** Ready-to-use Set-Cookie header value for the state parameter */
-    cookie: string;
+    codeVerifier: string;
+    /** Ready-to-use Set-Cookie header values for state and code verifier */
+    cookies: string[];
 }
 interface TokenResponse {
     access_token: string;
     refresh_token: string;
+    token_id: string;
     token_type: string;
     expires_in: number;
 }
+interface AccessTokenClaims {
+    sub: string;
+    application_id: string;
+    organization_id?: string;
+    is_master?: boolean;
+    type: 'access';
+    exp: number;
+    iat: number;
+}
+interface AuthResult {
+    /** Decoded claims from the access token JWT (no network call) */
+    claims: AccessTokenClaims;
+    accessToken: string;
+    /** Set-Cookie headers to set if tokens were refreshed */
+    cookies?: string[];
+}
+interface CallbackResult {
+    /** Redirect Response with token cookies set */
+    response: Response;
+    /** Full user info fetched from userinfo endpoint (store this in your BFF) */
+    user: UserInfo;
+}
 interface UserInfo {
     sub: string;
     id: string;
@@ -48,28 +72,30 @@ declare class SimpleLogin {
     private baseUrl;
     constructor(config?: SimpleLoginConfig);
     /**
-     * Returns a Response that redirects to the authorization URL with the state cookie set.
+     * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.
      * @param options - Optional scopes or custom state
      * @returns A 302 redirect Response ready to be returned from your route handler
      */
-    redirectToAuth(options?: AuthorizationUrlOptions): Response;
+    redirectToAuth(options?: AuthorizationUrlOptions): Promise<Response>;
     /**
      * Generate the authorization URL to redirect users for sign-in
-     * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value
+     * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values
      */
-    getAuthorizationUrl(options?: AuthorizationUrlOptions): AuthorizationUrlResult;
+    getAuthorizationUrl(options?: AuthorizationUrlOptions): Promise<AuthorizationUrlResult>;
     /**
-     * Verify the OAuth callback request and exchange the code for tokens.
-     * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.
+     * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.
      * @param request - The incoming Request object from the callback
-     * @returns The token response if verification succeeds
+     * @param redirectTo - URL to redirect to after successful authentication (default: '/')
+     * @returns CallbackResult with redirect Response (cookies set) and user info to store
      * @throws AuthorizationError if state is missing or doesn't match
      */
-    handleCallback(request: Request): Promise<TokenResponse>;
+    handleCallback(request: Request, redirectTo?: string): Promise<CallbackResult>;
     /**
      * Exchange an authorization code for access and refresh tokens
+     * @param code - The authorization code from the callback
+     * @param codeVerifier - The PKCE code verifier
      */
-    exchangeCode(code: string): Promise<TokenResponse>;
+    exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse>;
     /**
      * Refresh an access token using a refresh token
      */
@@ -78,6 +104,30 @@ declare class SimpleLogin {
      * Get user information using an access token
      */
     getUserInfo(accessToken: string): Promise<UserInfo>;
+    /**
+     * Fetch and cache the public key for JWT verification
+     */
+    private getPublicKey;
+    /**
+     * Authenticate a request by verifying the access token from cookies.
+     * No network calls except when refreshing expired tokens.
+     * @param request - The incoming Request object
+     * @param options - Optional settings for CSRF protection
+     * @returns AuthResult if authenticated, null if not authenticated
+     */
+    authenticate(request: Request, options?: {
+        allowedOrigin?: string;
+    }): Promise<AuthResult | null>;
+    /**
+     * Revoke a refresh token on the IdP
+     */
+    private revokeToken;
+    /**
+     * Logout: revoke refresh token on IdP and clear cookies.
+     * @param request - The incoming Request object (to read refresh token from cookies)
+     * @param redirectTo - URL to redirect to after logout (default: '/')
+     */
+    logout(request: Request, redirectTo?: string): Promise<Response>;
 }
 
 declare class SousaError extends Error {
@@ -92,4 +142,4 @@ declare class TokenError extends SousaError {
     constructor(message: string);
 }
 
-export { AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, SimpleLogin, type SimpleLoginConfig, SousaError, TokenError, type TokenResponse, type UserInfo };
+export { type AccessTokenClaims, type AuthResult, AuthorizationError, type AuthorizationUrlOptions, type AuthorizationUrlResult, type CallbackResult, SimpleLogin, type SimpleLoginConfig, SousaError, TokenError, type TokenResponse, type UserInfo };

package/dist/index.js

@@ -1,3 +1,6 @@
+// src/client.ts
+import { decodeJwt, importSPKI, jwtVerify } from "jose";
+
 // src/errors.ts
 var SousaError = class extends Error {
   constructor(message, code, statusCode) {
@@ -27,6 +30,17 @@ function generateState() {
   crypto.getRandomValues(array);
   return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
 }
+function generateCodeVerifier() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return btoa(String.fromCharCode(...array)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const hash = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(hash))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
 function getEnv(key) {
   if (typeof process !== "undefined" && process.env) {
     return process.env[key];
@@ -37,6 +51,20 @@ function parseCookie(cookieHeader, name) {
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
   return match ? decodeURIComponent(match[1]) : void 0;
 }
+var publicKeyCache = /* @__PURE__ */ new Map();
+var PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1e3;
+function createTokenCookies(tokens) {
+  return [
+    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,
+    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`
+  ];
+}
+function clearTokenCookies() {
+  return [
+    "SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0",
+    "SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+  ];
+}
 var SimpleLogin = class {
   clientId;
   clientSecret;
@@ -64,50 +92,57 @@ var SimpleLogin = class {
     }
   }
   /**
-   * Returns a Response that redirects to the authorization URL with the state cookie set.
+   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.
    * @param options - Optional scopes or custom state
    * @returns A 302 redirect Response ready to be returned from your route handler
    */
-  redirectToAuth(options = {}) {
-    const { url, cookie } = this.getAuthorizationUrl(options);
-    return new Response(null, {
-      status: 302,
-      headers: {
-        Location: url,
-        "Set-Cookie": cookie
-      }
-    });
+  async redirectToAuth(options = {}) {
+    const { url, cookies } = await this.getAuthorizationUrl(options);
+    const headers = new Headers();
+    headers.set("Location", url);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
   }
   /**
    * Generate the authorization URL to redirect users for sign-in
-   * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value
+   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values
    */
-  getAuthorizationUrl(options = {}) {
+  async getAuthorizationUrl(options = {}) {
     const state = options.state ?? generateState();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
     const params = new URLSearchParams({
       client_id: this.clientId,
       redirect_uri: this.redirectUri,
       response_type: "code",
-      state
+      state,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256"
     });
     if (options.scopes?.length) {
       params.set("scope", options.scopes.join(" "));
     }
-    const cookie = `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`;
+    const cookies = [
+      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,
+      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`
+    ];
     return {
       url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,
       state,
-      cookie
+      codeVerifier,
+      cookies
     };
   }
   /**
-   * Verify the OAuth callback request and exchange the code for tokens.
-   * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.
+   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.
    * @param request - The incoming Request object from the callback
-   * @returns The token response if verification succeeds
+   * @param redirectTo - URL to redirect to after successful authentication (default: '/')
+   * @returns CallbackResult with redirect Response (cookies set) and user info to store
    * @throws AuthorizationError if state is missing or doesn't match
    */
-  async handleCallback(request) {
+  async handleCallback(request, redirectTo = "/") {
     const url = new URL(request.url);
     const code = url.searchParams.get("code");
     const state = url.searchParams.get("state");
@@ -119,18 +154,41 @@ var SimpleLogin = class {
     }
     const cookieHeader = request.headers.get("cookie") ?? "";
     const expectedState = parseCookie(cookieHeader, "SIMPLELOGIN_STATE");
+    const codeVerifier = parseCookie(cookieHeader, "SIMPLELOGIN_CODE_VERIFIER");
     if (!expectedState) {
       throw new AuthorizationError("Missing SIMPLELOGIN_STATE cookie");
     }
     if (state !== expectedState) {
       throw new AuthorizationError("Invalid state parameter");
     }
-    return this.exchangeCode(code);
+    if (!codeVerifier) {
+      throw new AuthorizationError("Missing SIMPLELOGIN_CODE_VERIFIER cookie");
+    }
+    const tokens = await this.exchangeCode(code, codeVerifier);
+    const user = await this.getUserInfo(tokens.access_token);
+    const cookies = createTokenCookies(tokens);
+    const headers = new Headers();
+    headers.set("Location", redirectTo);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    headers.append(
+      "Set-Cookie",
+      "SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+    );
+    headers.append(
+      "Set-Cookie",
+      "SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0"
+    );
+    const response = new Response(null, { status: 302, headers });
+    return { response, user };
   }
   /**
    * Exchange an authorization code for access and refresh tokens
+   * @param code - The authorization code from the callback
+   * @param codeVerifier - The PKCE code verifier
    */
-  async exchangeCode(code) {
+  async exchangeCode(code, codeVerifier) {
     const response = await fetch(`${this.baseUrl}/v1/auth/token`, {
       method: "POST",
       headers: {
@@ -141,7 +199,8 @@ var SimpleLogin = class {
         client_id: this.clientId,
         client_secret: this.clientSecret,
         redirect_uri: this.redirectUri,
-        code
+        code,
+        code_verifier: codeVerifier
       })
     });
     if (!response.ok) {
@@ -186,6 +245,98 @@ var SimpleLogin = class {
     }
     return response.json();
   }
+  /**
+   * Fetch and cache the public key for JWT verification
+   */
+  async getPublicKey() {
+    const cached = publicKeyCache.get(this.clientId);
+    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {
+      return cached.key;
+    }
+    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`);
+    if (!response.ok) {
+      throw new AuthorizationError("Failed to fetch public key");
+    }
+    const pem = await response.text();
+    const key = await importSPKI(pem, "RS256");
+    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() });
+    return key;
+  }
+  /**
+   * Authenticate a request by verifying the access token from cookies.
+   * No network calls except when refreshing expired tokens.
+   * @param request - The incoming Request object
+   * @param options - Optional settings for CSRF protection
+   * @returns AuthResult if authenticated, null if not authenticated
+   */
+  async authenticate(request, options) {
+    const method = request.method.toUpperCase();
+    if (method !== "GET" && method !== "HEAD" && options?.allowedOrigin) {
+      const origin = request.headers.get("origin") || request.headers.get("referer");
+      if (!origin?.startsWith(options.allowedOrigin)) {
+        return null;
+      }
+    }
+    const cookieHeader = request.headers.get("cookie") ?? "";
+    const accessToken = parseCookie(cookieHeader, "SIMPLELOGIN_ACCESS_TOKEN");
+    const refreshTokenValue = parseCookie(cookieHeader, "SIMPLELOGIN_REFRESH_TOKEN");
+    if (!accessToken) {
+      return null;
+    }
+    const publicKey = await this.getPublicKey();
+    try {
+      await jwtVerify(accessToken, publicKey);
+      const claims = decodeJwt(accessToken);
+      return { claims, accessToken };
+    } catch (error) {
+      const isExpired = error instanceof Error && "code" in error && error.code === "ERR_JWT_EXPIRED";
+      if (!isExpired || !refreshTokenValue) {
+        return null;
+      }
+      try {
+        const tokens = await this.refreshToken(refreshTokenValue);
+        const claims = decodeJwt(tokens.access_token);
+        const cookies = createTokenCookies(tokens);
+        return { claims, accessToken: tokens.access_token, cookies };
+      } catch {
+        return null;
+      }
+    }
+  }
+  /**
+   * Revoke a refresh token on the IdP
+   */
+  async revokeToken(refreshToken) {
+    await fetch(`${this.baseUrl}/v1/auth/revoke`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token: refreshToken,
+        client_id: this.clientId,
+        client_secret: this.clientSecret
+      })
+    });
+  }
+  /**
+   * Logout: revoke refresh token on IdP and clear cookies.
+   * @param request - The incoming Request object (to read refresh token from cookies)
+   * @param redirectTo - URL to redirect to after logout (default: '/')
+   */
+  async logout(request, redirectTo = "/") {
+    const cookieHeader = request.headers.get("cookie") ?? "";
+    const refreshToken = parseCookie(cookieHeader, "SIMPLELOGIN_REFRESH_TOKEN");
+    if (refreshToken) {
+      this.revokeToken(refreshToken).catch(() => {
+      });
+    }
+    const cookies = clearTokenCookies();
+    const headers = new Headers();
+    headers.set("Location", redirectTo);
+    for (const cookie of cookies) {
+      headers.append("Set-Cookie", cookie);
+    }
+    return new Response(null, { status: 302, headers });
+  }
 };
 export {
   AuthorizationError,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/client.ts"],"sourcesContent":["export class SousaError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number\n  ) {\n    super(message);\n    this.name = \"SousaError\";\n  }\n}\n\nexport class AuthorizationError extends SousaError {\n  constructor(message: string) {\n    super(message, \"AUTHORIZATION_ERROR\", 401);\n    this.name = \"AuthorizationError\";\n  }\n}\n\nexport class TokenError extends SousaError {\n  constructor(message: string) {\n    super(message, \"TOKEN_ERROR\", 400);\n    this.name = \"TokenError\";\n  }\n}\n","import { AuthorizationError, TokenError } from './errors'\nimport type {\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with the state cookie set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  redirectToAuth(options: AuthorizationUrlOptions = {}): Response {\n    const { url, cookie } = this.getAuthorizationUrl(options)\n    return new Response(null, {\n      status: 302,\n      headers: {\n        Location: url,\n        'Set-Cookie': cookie,\n      },\n    })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state parameter, and a ready-to-use Set-Cookie header value\n   */\n  getAuthorizationUrl(options: AuthorizationUrlOptions = {}): AuthorizationUrlResult {\n    const state = options.state ?? generateState()\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookie = `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      cookie,\n    }\n  }\n\n  /**\n   * Verify the OAuth callback request and exchange the code for tokens.\n   * Automatically extracts state from SIMPLELOGIN_STATE cookie and code/state from URL.\n   * @param request - The incoming Request object from the callback\n   * @returns The token response if verification succeeds\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request): Promise<TokenResponse> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    return this.exchangeCode(code)\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   */\n  async exchangeCode(code: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n}\n"],"mappings":";AAAO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,WAAW;AAAA,EACzC,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ACZA,IAAM,WAAW;AAEjB,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,UAAmC,CAAC,GAAa;AAC9D,UAAM,EAAE,KAAK,OAAO,IAAI,KAAK,oBAAoB,OAAO;AACxD,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,oBAAoB,UAAmC,CAAC,GAA2B;AACjF,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAE7C,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,SAAS,qBAAqB,KAAK;AAEzC,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAA0C;AAC7D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AAEnE,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,WAAO,KAAK,aAAa,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAsC;AACvD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/errors.ts"],"sourcesContent":["import { decodeJwt, importSPKI, jwtVerify } from 'jose'\nimport { AuthorizationError, TokenError } from './errors'\nimport type {\n  AccessTokenClaims,\n  AuthResult,\n  AuthorizationUrlOptions,\n  AuthorizationUrlResult,\n  CallbackResult,\n  SimpleLoginConfig,\n  TokenResponse,\n  UserInfo,\n} from './types'\n\ndeclare const __SIMPLELOGIN_BASE_URL__: string\n\nconst BASE_URL = __SIMPLELOGIN_BASE_URL__\n\nfunction generateState(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  return Array.from(array, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction generateCodeVerifier(): string {\n  const array = new Uint8Array(32)\n  crypto.getRandomValues(array)\n  // Base64url encode (RFC 7636)\n  return btoa(String.fromCharCode(...array))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nasync function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const hash = await crypto.subtle.digest('SHA-256', data)\n  // Base64url encode the hash\n  return btoa(String.fromCharCode(...new Uint8Array(hash)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=/g, '')\n}\n\nfunction getEnv(key: string): string | undefined {\n  if (typeof process !== 'undefined' && process.env) {\n    return process.env[key]\n  }\n  return undefined\n}\n\nfunction parseCookie(cookieHeader: string, name: string): string | undefined {\n  const match = cookieHeader.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`))\n  return match ? decodeURIComponent(match[1]) : undefined\n}\n\n// Public key cache: clientId -> { key, fetchedAt }\nconst publicKeyCache = new Map<string, { key: CryptoKey; fetchedAt: number }>()\nconst PUBLIC_KEY_CACHE_TTL = 60 * 60 * 1000 // 1 hour\n\nfunction createTokenCookies(tokens: TokenResponse): string[] {\n  return [\n    `SIMPLELOGIN_ACCESS_TOKEN=${tokens.access_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n    `SIMPLELOGIN_REFRESH_TOKEN=${tokens.refresh_token}; HttpOnly; Secure; SameSite=Lax; Path=/`,\n  ]\n}\n\nfunction clearTokenCookies(): string[] {\n  return [\n    'SIMPLELOGIN_ACCESS_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    'SIMPLELOGIN_REFRESH_TOKEN=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n  ]\n}\n\nexport class SimpleLogin {\n  private clientId: string\n  private clientSecret: string\n  private redirectUri: string\n  private baseUrl: string\n\n  constructor(config: SimpleLoginConfig = {}) {\n    this.clientId = config.clientId ?? getEnv('SIMPLELOGIN_CLIENT_ID') ?? ''\n    this.clientSecret = config.clientSecret ?? getEnv('SIMPLELOGIN_CLIENT_SECRET') ?? ''\n    this.redirectUri = config.redirectUri ?? getEnv('SIMPLELOGIN_REDIRECT_URI') ?? ''\n    this.baseUrl = BASE_URL\n\n    if (!this.clientId) {\n      throw new Error(\n        'clientId is required. Pass it in config or set SIMPLELOGIN_CLIENT_ID env var.',\n      )\n    }\n    if (!this.clientSecret) {\n      throw new Error(\n        'clientSecret is required. Pass it in config or set SIMPLELOGIN_CLIENT_SECRET env var.',\n      )\n    }\n    if (!this.redirectUri) {\n      throw new Error(\n        'redirectUri is required. Pass it in config or set SIMPLELOGIN_REDIRECT_URI env var.',\n      )\n    }\n  }\n\n  /**\n   * Returns a Response that redirects to the authorization URL with state and PKCE cookies set.\n   * @param options - Optional scopes or custom state\n   * @returns A 302 redirect Response ready to be returned from your route handler\n   */\n  async redirectToAuth(options: AuthorizationUrlOptions = {}): Promise<Response> {\n    const { url, cookies } = await this.getAuthorizationUrl(options)\n    const headers = new Headers()\n    headers.set('Location', url)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n\n  /**\n   * Generate the authorization URL to redirect users for sign-in\n   * @returns The authorization URL, state, code verifier, and ready-to-use Set-Cookie header values\n   */\n  async getAuthorizationUrl(options: AuthorizationUrlOptions = {}): Promise<AuthorizationUrlResult> {\n    const state = options.state ?? generateState()\n    const codeVerifier = generateCodeVerifier()\n    const codeChallenge = await generateCodeChallenge(codeVerifier)\n\n    const params = new URLSearchParams({\n      client_id: this.clientId,\n      redirect_uri: this.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    })\n\n    if (options.scopes?.length) {\n      params.set('scope', options.scopes.join(' '))\n    }\n\n    const cookies = [\n      `SIMPLELOGIN_STATE=${state}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n      `SIMPLELOGIN_CODE_VERIFIER=${codeVerifier}; HttpOnly; Secure; SameSite=Lax; Max-Age=600; Path=/`,\n    ]\n\n    return {\n      url: `${this.baseUrl}/v1/auth/authorize?${params.toString()}`,\n      state,\n      codeVerifier,\n      cookies,\n    }\n  }\n\n  /**\n   * Handle the OAuth callback: verify state, exchange code, fetch user info, and return a redirect Response.\n   * @param request - The incoming Request object from the callback\n   * @param redirectTo - URL to redirect to after successful authentication (default: '/')\n   * @returns CallbackResult with redirect Response (cookies set) and user info to store\n   * @throws AuthorizationError if state is missing or doesn't match\n   */\n  async handleCallback(request: Request, redirectTo: string = '/'): Promise<CallbackResult> {\n    const url = new URL(request.url)\n    const code = url.searchParams.get('code')\n    const state = url.searchParams.get('state')\n\n    if (!code) {\n      throw new AuthorizationError('Missing authorization code in callback')\n    }\n\n    if (!state) {\n      throw new AuthorizationError('Missing state parameter in callback')\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const expectedState = parseCookie(cookieHeader, 'SIMPLELOGIN_STATE')\n    const codeVerifier = parseCookie(cookieHeader, 'SIMPLELOGIN_CODE_VERIFIER')\n\n    if (!expectedState) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_STATE cookie')\n    }\n\n    if (state !== expectedState) {\n      throw new AuthorizationError('Invalid state parameter')\n    }\n\n    if (!codeVerifier) {\n      throw new AuthorizationError('Missing SIMPLELOGIN_CODE_VERIFIER cookie')\n    }\n\n    // Exchange code for tokens (with PKCE code_verifier)\n    const tokens = await this.exchangeCode(code, codeVerifier)\n\n    // Fetch user info (only time we do this)\n    const user = await this.getUserInfo(tokens.access_token)\n\n    // Build redirect response with token cookies\n    const cookies = createTokenCookies(tokens)\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    // Clear the state and code verifier cookies\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_STATE=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n    headers.append(\n      'Set-Cookie',\n      'SIMPLELOGIN_CODE_VERIFIER=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',\n    )\n\n    const response = new Response(null, { status: 302, headers })\n\n    return { response, user }\n  }\n\n  /**\n   * Exchange an authorization code for access and refresh tokens\n   * @param code - The authorization code from the callback\n   * @param codeVerifier - The PKCE code verifier\n   */\n  async exchangeCode(code: string, codeVerifier: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'authorization_code',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        redirect_uri: this.redirectUri,\n        code,\n        code_verifier: codeVerifier,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to exchange authorization code')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Refresh an access token using a refresh token\n   */\n  async refreshToken(refreshToken: string): Promise<TokenResponse> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'refresh_token',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        refresh_token: refreshToken,\n      }),\n    })\n\n    if (!response.ok) {\n      const error = await response.json().catch(() => ({}))\n      throw new TokenError(error.error_description || 'Failed to refresh token')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Get user information using an access token\n   */\n  async getUserInfo(accessToken: string): Promise<UserInfo> {\n    const response = await fetch(`${this.baseUrl}/v1/auth/userinfo`, {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    })\n\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch user info')\n    }\n\n    return response.json()\n  }\n\n  /**\n   * Fetch and cache the public key for JWT verification\n   */\n  private async getPublicKey(): Promise<CryptoKey> {\n    const cached = publicKeyCache.get(this.clientId)\n    if (cached && Date.now() - cached.fetchedAt < PUBLIC_KEY_CACHE_TTL) {\n      return cached.key\n    }\n\n    const response = await fetch(`${this.baseUrl}/api/applications/${this.clientId}/public-key`)\n    if (!response.ok) {\n      throw new AuthorizationError('Failed to fetch public key')\n    }\n\n    const pem = await response.text()\n    const key = await importSPKI(pem, 'RS256')\n\n    publicKeyCache.set(this.clientId, { key, fetchedAt: Date.now() })\n    return key\n  }\n\n  /**\n   * Authenticate a request by verifying the access token from cookies.\n   * No network calls except when refreshing expired tokens.\n   * @param request - The incoming Request object\n   * @param options - Optional settings for CSRF protection\n   * @returns AuthResult if authenticated, null if not authenticated\n   */\n  async authenticate(\n    request: Request,\n    options?: { allowedOrigin?: string },\n  ): Promise<AuthResult | null> {\n    // CSRF protection for state-changing requests\n    const method = request.method.toUpperCase()\n    if (method !== 'GET' && method !== 'HEAD' && options?.allowedOrigin) {\n      const origin = request.headers.get('origin') || request.headers.get('referer')\n      if (!origin?.startsWith(options.allowedOrigin)) {\n        return null\n      }\n    }\n\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const accessToken = parseCookie(cookieHeader, 'SIMPLELOGIN_ACCESS_TOKEN')\n    const refreshTokenValue = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    if (!accessToken) {\n      return null\n    }\n\n    const publicKey = await this.getPublicKey()\n\n    try {\n      // Verify the token (local, no network call)\n      await jwtVerify(accessToken, publicKey)\n\n      // Decode claims from JWT (no network call)\n      const claims = decodeJwt(accessToken) as AccessTokenClaims\n\n      return { claims, accessToken }\n    } catch (error) {\n      // Check if token is expired\n      const isExpired =\n        error instanceof Error &&\n        'code' in error &&\n        (error as { code: string }).code === 'ERR_JWT_EXPIRED'\n\n      if (!isExpired || !refreshTokenValue) {\n        return null\n      }\n\n      // Token expired, try to refresh\n      try {\n        const tokens = await this.refreshToken(refreshTokenValue)\n        const claims = decodeJwt(tokens.access_token) as AccessTokenClaims\n        const cookies = createTokenCookies(tokens)\n\n        return { claims, accessToken: tokens.access_token, cookies }\n      } catch {\n        return null\n      }\n    }\n  }\n\n  /**\n   * Revoke a refresh token on the IdP\n   */\n  private async revokeToken(refreshToken: string): Promise<void> {\n    await fetch(`${this.baseUrl}/v1/auth/revoke`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        token: refreshToken,\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n      }),\n    })\n  }\n\n  /**\n   * Logout: revoke refresh token on IdP and clear cookies.\n   * @param request - The incoming Request object (to read refresh token from cookies)\n   * @param redirectTo - URL to redirect to after logout (default: '/')\n   */\n  async logout(request: Request, redirectTo: string = '/'): Promise<Response> {\n    const cookieHeader = request.headers.get('cookie') ?? ''\n    const refreshToken = parseCookie(cookieHeader, 'SIMPLELOGIN_REFRESH_TOKEN')\n\n    // Revoke token on IdP (fire and forget - don't block logout on failure)\n    if (refreshToken) {\n      this.revokeToken(refreshToken).catch(() => {})\n    }\n\n    // Clear cookies regardless\n    const cookies = clearTokenCookies()\n    const headers = new Headers()\n    headers.set('Location', redirectTo)\n    for (const cookie of cookies) {\n      headers.append('Set-Cookie', cookie)\n    }\n    return new Response(null, { status: 302, headers })\n  }\n}\n","export class SousaError extends Error {\n  constructor(\n    message: string,\n    public code: string,\n    public statusCode?: number\n  ) {\n    super(message);\n    this.name = \"SousaError\";\n  }\n}\n\nexport class AuthorizationError extends SousaError {\n  constructor(message: string) {\n    super(message, \"AUTHORIZATION_ERROR\", 401);\n    this.name = \"AuthorizationError\";\n  }\n}\n\nexport class TokenError extends SousaError {\n  constructor(message: string) {\n    super(message, \"TOKEN_ERROR\", 400);\n    this.name = \"TokenError\";\n  }\n}\n"],"mappings":";AAAA,SAAS,WAAW,YAAY,iBAAiB;;;ACA1C,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACE,SACO,MACA,YACP;AACA,UAAM,OAAO;AAHN;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,qBAAN,cAAiC,WAAW;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,SAAS,uBAAuB,GAAG;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,aAAN,cAAyB,WAAW;AAAA,EACzC,YAAY,SAAiB;AAC3B,UAAM,SAAS,eAAe,GAAG;AACjC,SAAK,OAAO;AAAA,EACd;AACF;;;ADRA,IAAM,WAAW;AAEjB,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;AAEA,SAAS,uBAA+B;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAE5B,SAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,EACtC,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,eAAe,sBAAsB,UAAmC;AACtE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAEvD,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC,EACrD,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AACrB;AAEA,SAAS,OAAO,KAAiC;AAC/C,MAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,cAAsB,MAAkC;AAC3E,QAAM,QAAQ,aAAa,MAAM,IAAI,OAAO,cAAc,IAAI,UAAU,CAAC;AACzE,SAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAChD;AAGA,IAAM,iBAAiB,oBAAI,IAAmD;AAC9E,IAAM,uBAAuB,KAAK,KAAK;AAEvC,SAAS,mBAAmB,QAAiC;AAC3D,SAAO;AAAA,IACL,4BAA4B,OAAO,YAAY;AAAA,IAC/C,6BAA6B,OAAO,aAAa;AAAA,EACnD;AACF;AAEA,SAAS,oBAA8B;AACrC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAA4B,CAAC,GAAG;AAC1C,SAAK,WAAW,OAAO,YAAY,OAAO,uBAAuB,KAAK;AACtE,SAAK,eAAe,OAAO,gBAAgB,OAAO,2BAA2B,KAAK;AAClF,SAAK,cAAc,OAAO,eAAe,OAAO,0BAA0B,KAAK;AAC/E,SAAK,UAAU;AAEf,QAAI,CAAC,KAAK,UAAU;AAClB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAK,aAAa;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAe,UAAmC,CAAC,GAAsB;AAC7E,UAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,oBAAoB,OAAO;AAC/D,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,GAAG;AAC3B,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,UAAmC,CAAC,GAAoC;AAChG,UAAM,QAAQ,QAAQ,SAAS,cAAc;AAC7C,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAE9D,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,eAAe;AAAA,MACf;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,QAAI,QAAQ,QAAQ,QAAQ;AAC1B,aAAO,IAAI,SAAS,QAAQ,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9C;AAEA,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK;AAAA,MAC1B,6BAA6B,YAAY;AAAA,IAC3C;AAEA,WAAO;AAAA,MACL,KAAK,GAAG,KAAK,OAAO,sBAAsB,OAAO,SAAS,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAe,SAAkB,aAAqB,KAA8B;AACxF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAE1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,mBAAmB,wCAAwC;AAAA,IACvE;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,mBAAmB,qCAAqC;AAAA,IACpE;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,gBAAgB,YAAY,cAAc,mBAAmB;AACnE,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAE1E,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,mBAAmB,kCAAkC;AAAA,IACjE;AAEA,QAAI,UAAU,eAAe;AAC3B,YAAM,IAAI,mBAAmB,yBAAyB;AAAA,IACxD;AAEA,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,mBAAmB,0CAA0C;AAAA,IACzE;AAGA,UAAM,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY;AAGzD,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,YAAY;AAGvD,UAAM,UAAU,mBAAmB,MAAM;AACzC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAE5D,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,MAAc,cAA8C;AAC7E,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,cAAc,KAAK;AAAA,QACnB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,uCAAuC;AAAA,IACzF;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,cAA8C;AAC/D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,kBAAkB;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,QACpB,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,YAAM,IAAI,WAAW,MAAM,qBAAqB,yBAAyB;AAAA,IAC3E;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,aAAwC;AACxD,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB;AAAA,MAC/D,SAAS;AAAA,QACP,eAAe,UAAU,WAAW;AAAA,MACtC;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,eAAmC;AAC/C,UAAM,SAAS,eAAe,IAAI,KAAK,QAAQ;AAC/C,QAAI,UAAU,KAAK,IAAI,IAAI,OAAO,YAAY,sBAAsB;AAClE,aAAO,OAAO;AAAA,IAChB;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,qBAAqB,KAAK,QAAQ,aAAa;AAC3F,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB,4BAA4B;AAAA,IAC3D;AAEA,UAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAM,MAAM,MAAM,WAAW,KAAK,OAAO;AAEzC,mBAAe,IAAI,KAAK,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,EAAE,CAAC;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,aACJ,SACA,SAC4B;AAE5B,UAAM,SAAS,QAAQ,OAAO,YAAY;AAC1C,QAAI,WAAW,SAAS,WAAW,UAAU,SAAS,eAAe;AACnE,YAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,IAAI,SAAS;AAC7E,UAAI,CAAC,QAAQ,WAAW,QAAQ,aAAa,GAAG;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,cAAc,YAAY,cAAc,0BAA0B;AACxE,UAAM,oBAAoB,YAAY,cAAc,2BAA2B;AAE/E,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,MAAM,KAAK,aAAa;AAE1C,QAAI;AAEF,YAAM,UAAU,aAAa,SAAS;AAGtC,YAAM,SAAS,UAAU,WAAW;AAEpC,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B,SAAS,OAAO;AAEd,YAAM,YACJ,iBAAiB,SACjB,UAAU,SACT,MAA2B,SAAS;AAEvC,UAAI,CAAC,aAAa,CAAC,mBAAmB;AACpC,eAAO;AAAA,MACT;AAGA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,aAAa,iBAAiB;AACxD,cAAM,SAAS,UAAU,OAAO,YAAY;AAC5C,cAAM,UAAU,mBAAmB,MAAM;AAEzC,eAAO,EAAE,QAAQ,aAAa,OAAO,cAAc,QAAQ;AAAA,MAC7D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YAAY,cAAqC;AAC7D,UAAM,MAAM,GAAG,KAAK,OAAO,mBAAmB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,OAAO;AAAA,QACP,WAAW,KAAK;AAAA,QAChB,eAAe,KAAK;AAAA,MACtB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,SAAkB,aAAqB,KAAwB;AAC1E,UAAM,eAAe,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACtD,UAAM,eAAe,YAAY,cAAc,2BAA2B;AAG1E,QAAI,cAAc;AAChB,WAAK,YAAY,YAAY,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAC/C;AAGA,UAAM,UAAU,kBAAkB;AAClC,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,YAAY,UAAU;AAClC,eAAW,UAAU,SAAS;AAC5B,cAAQ,OAAO,cAAc,MAAM;AAAA,IACrC;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EACpD;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-login/sdk",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Official SDK for Simple Login",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -42,5 +42,8 @@
   },
   "engines": {
     "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "jose": "^6.1.3"
   }
 }