@symbiote-native/auth-session 0.0.0-stage → 0.1.0

package/build-ngc/core/providers/google-exchange-controller.js

@@ -0,0 +1,74 @@
+// The automatic code exchange of upstream's Google `useAuthRequest`, as a cell that follows the
+// prompt result and swaps in the exchanged authentication once it arrives
+import { createResourceController } from '@symbiote-native/engine';
+import { createAuthCell } from '../auth-request-controllers';
+import { isSuccessResult } from '../session-result';
+import { AccessTokenRequest } from '../token-request';
+import { discovery as googleDiscovery } from './google';
+// The result to exchange, or null when there is nothing to do: a code and no authentication yet,
+// unless the caller decided explicitly
+function exchangeableResult(result, override) {
+    if (!isSuccessResult(result))
+        return null;
+    const shouldExchange = override ?? (Boolean(result.params.code) && !result.authentication);
+    return shouldExchange ? result : null;
+}
+// Trades the code for tokens and folds them into the result, as the hook does upstream
+async function exchangeCode(toExchange, request, exchange) {
+    const exchangeRequest = new AccessTokenRequest({
+        clientId: exchange.clientId,
+        clientSecret: exchange.clientSecret,
+        redirectUri: exchange.redirectUri,
+        scopes: exchange.scopes,
+        code: toExchange.params.code ?? '',
+        extraParams: { code_verifier: request?.codeVerifier || '' },
+    });
+    const authentication = await exchangeRequest.performAsync(googleDiscovery);
+    return {
+        ...toExchange,
+        params: {
+            id_token: authentication?.idToken || '',
+            access_token: authentication.accessToken,
+            ...toExchange.params,
+        },
+        authentication,
+    };
+}
+function isSameKey(a, b) {
+    return (a.result === b.result &&
+        a.request?.codeVerifier === b.request?.codeVerifier &&
+        a.exchange.clientId === b.exchange.clientId &&
+        a.exchange.redirectUri === b.exchange.redirectUri &&
+        a.exchange.clientSecret === b.exchange.clientSecret &&
+        a.exchange.shouldAutoExchangeCode === b.exchange.shouldAutoExchangeCode &&
+        a.exchange.scopes?.join(',') === b.exchange.scopes?.join(','));
+}
+export function createGoogleExchangeController() {
+    // The last published value stays visible while the next exchange runs
+    let lastPublished = null;
+    const controller = createResourceController(({ result, request, exchange }) => {
+        let isMounted = true;
+        const stop = () => {
+            isMounted = false;
+        };
+        const toExchange = exchangeableResult(result, exchange.shouldAutoExchangeCode);
+        if (!toExchange) {
+            lastPublished = result;
+            return { cell: createAuthCell(result), stop };
+        }
+        const cell = createAuthCell(lastPublished);
+        void exchangeCode(toExchange, request, exchange).then(merged => {
+            if (!isMounted)
+                return;
+            lastPublished = merged;
+            cell.set(merged);
+        });
+        return { cell, stop };
+    }, resource => resource.stop(), isSameKey);
+    return {
+        resolve: (result, request, exchange) => controller.resolve({ result, request, exchange }).cell,
+        flushDispose: controller.flushDispose,
+        dispose: controller.dispose,
+    };
+}
+//# sourceMappingURL=google-exchange-controller.js.map

package/build-ngc/core/providers/google-exchange-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-exchange-controller.js","sourceRoot":"","sources":["../../../src/core/providers/google-exchange-controller.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,0EAA0E;AAE1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AAYxD,iGAAiG;AACjG,uCAAuC;AACvC,SAAS,kBAAkB,CACzB,MAAiC,EACjC,QAA6B;IAE7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,cAAc,GAClB,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,YAAY,CACzB,UAAoC,EACpC,OAA2B,EAC3B,QAA+B;IAE/B,MAAM,eAAe,GAAG,IAAI,kBAAkB,CAAC;QAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE;QAClC,WAAW,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE,EAAE;KAC5D,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;IAC3E,OAAO;QACL,GAAG,UAAU;QACb,MAAM,EAAE;YACN,QAAQ,EAAE,cAAc,EAAE,OAAO,IAAI,EAAE;YACvC,YAAY,EAAE,cAAc,CAAC,WAAW;YACxC,GAAG,UAAU,CAAC,MAAM;SACrB;QACD,cAAc;KACf,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAe,EAAE,CAAe;IACjD,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,OAAO,EAAE,YAAY,KAAK,CAAC,CAAC,OAAO,EAAE,YAAY;QACnD,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ;QAC3C,CAAC,CAAC,QAAQ,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW;QACjD,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY;QACnD,CAAC,CAAC,QAAQ,CAAC,sBAAsB,KAAK,CAAC,CAAC,QAAQ,CAAC,sBAAsB;QACvE,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B;IAS5C,sEAAsE;IACtE,IAAI,aAAa,GAA8B,IAAI,CAAC;IAEpD,MAAM,UAAU,GAAG,wBAAwB,CACzC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;QAChC,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,kBAAkB,CACnC,MAAM,EACN,QAAQ,CAAC,sBAAsB,CAChC,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,aAAa,GAAG,MAAM,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAA4B,aAAa,CAAC,CAAC;QACtE,KAAK,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC7D,IAAI,CAAC,SAAS;gBAAE,OAAO;YACvB,aAAa,GAAG,MAAM,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC,EACD,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAC3B,SAAS,CACV,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CACrC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI;QACxD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC"}

package/build-ngc/core/providers/google.d.ts

@@ -0,0 +1,22 @@
+import type { IAuthRequestConfig } from '../auth-request.types';
+import { AuthRequest } from '../auth-request';
+import type { IDiscoveryDocument } from '../discovery';
+import type { IProviderAuthRequestConfig } from './provider.types';
+export declare const discovery: IDiscoveryDocument;
+export type IGoogleAuthRequestConfig = IProviderAuthRequestConfig & {
+    /** If the user's email is known ahead of time, supply it as the default option. */
+    loginHint?: string;
+    /** Lets the user switch accounts, where possible. @default false */
+    selectAccount?: boolean;
+    webClientId?: string;
+    iosClientId?: string;
+    androidClientId?: string;
+    /** Exchange the response code for a token in the hook, on by default for the code flow */
+    shouldAutoExchangeCode?: boolean;
+};
+/** Extends `AuthRequest`, applying Google's minimum scopes and an id-token nonce. */
+export declare class GoogleAuthRequest extends AuthRequest {
+    nonce?: string;
+    constructor({ language, loginHint, selectAccount, extraParams, clientSecret, ...config }: IGoogleAuthRequestConfig);
+    getAuthRequestConfigAsync(): Promise<IAuthRequestConfig>;
+}

package/build-ngc/core/providers/google.js

@@ -0,0 +1,53 @@
+import { Prompt, ResponseType } from '../auth-request.types';
+import { AuthRequest } from '../auth-request';
+import { generateHexStringAsync } from '../pkce';
+import { applyRequiredScopes } from './provider-utils';
+const MINIMUM_SCOPES = [
+    'openid',
+    'https://www.googleapis.com/auth/userinfo.profile',
+    'https://www.googleapis.com/auth/userinfo.email',
+];
+export const discovery = {
+    authorizationEndpoint: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenEndpoint: 'https://oauth2.googleapis.com/token',
+    revocationEndpoint: 'https://oauth2.googleapis.com/revoke',
+    userInfoEndpoint: 'https://openidconnect.googleapis.com/v1/userinfo',
+};
+/** Extends `AuthRequest`, applying Google's minimum scopes and an id-token nonce. */
+export class GoogleAuthRequest extends AuthRequest {
+    nonce;
+    constructor({ language, loginHint, selectAccount, extraParams = {}, clientSecret, ...config }) {
+        const inputParams = { ...extraParams };
+        if (language)
+            inputParams.hl = language;
+        if (loginHint)
+            inputParams.login_hint = loginHint;
+        if (selectAccount)
+            inputParams.prompt = Prompt.SelectAccount;
+        const scopes = applyRequiredScopes(config.scopes, MINIMUM_SCOPES);
+        const isImplicit = config.responseType === ResponseType.Token ||
+            config.responseType === ResponseType.IdToken;
+        if (isImplicit) {
+            config.usePKCE = false;
+        }
+        // Google rejects a client secret unless the code flow is used.
+        const inputClientSecret = config.responseType && config.responseType !== ResponseType.Code
+            ? clientSecret
+            : undefined;
+        super({
+            ...config,
+            clientSecret: inputClientSecret,
+            scopes,
+            extraParams: inputParams,
+        });
+    }
+    async getAuthRequestConfigAsync() {
+        const { extraParams = {}, ...config } = await super.getAuthRequestConfigAsync();
+        if (config.responseType === ResponseType.IdToken && !extraParams.nonce) {
+            this.nonce = this.nonce ?? (await generateHexStringAsync(16));
+            extraParams.nonce = this.nonce;
+        }
+        return { ...config, extraParams };
+    }
+}
+//# sourceMappingURL=google.js.map

package/build-ngc/core/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/core/providers/google.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,kDAAkD;IAClD,gDAAgD;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAuB;IAC3C,qBAAqB,EAAE,8CAA8C;IACrE,aAAa,EAAE,qCAAqC;IACpD,kBAAkB,EAAE,sCAAsC;IAC1D,gBAAgB,EAAE,kDAAkD;CACrE,CAAC;AAcF,qFAAqF;AACrF,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,KAAK,CAAU;IAEf,YAAY,EACV,QAAQ,EACR,SAAS,EACT,aAAa,EACb,WAAW,GAAG,EAAE,EAChB,YAAY,EACZ,GAAG,MAAM,EACgB;QACzB,MAAM,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACvC,IAAI,QAAQ;YAAE,WAAW,CAAC,EAAE,GAAG,QAAQ,CAAC;QACxC,IAAI,SAAS;YAAE,WAAW,CAAC,UAAU,GAAG,SAAS,CAAC;QAClD,IAAI,aAAa;YAAE,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;QAE7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAClE,MAAM,UAAU,GACd,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,KAAK;YAC1C,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,OAAO,CAAC;QAC/C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,+DAA+D;QAC/D,MAAM,iBAAiB,GACrB,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,IAAI;YAC9D,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;QAEhB,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,YAAY,EAAE,iBAAiB;YAC/B,MAAM;YACN,WAAW,EAAE,WAAW;SACzB,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,yBAAyB;QACtC,MAAM,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,GACnC,MAAM,KAAK,CAAC,yBAAyB,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9D,WAAW,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;CACF"}

package/build-ngc/core/providers/provider-hook-setup.d.ts

@@ -0,0 +1,19 @@
+import type { IAuthSessionRedirectUriOptions } from '../auth-session.types';
+import type { IFacebookAuthRequestConfig } from './facebook';
+import type { IGoogleAuthRequestConfig } from './google';
+/** What the automatic code exchange needs, upstream reads the same fields off the hook config */
+export type IGoogleExchangeParams = {
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    scopes?: string[];
+    shouldAutoExchangeCode?: boolean;
+};
+export type IGoogleRequestSetup = {
+    requestConfig: IGoogleAuthRequestConfig;
+    exchange: IGoogleExchangeParams;
+};
+export declare function resolveGoogleRequestSetup(config?: Partial<IGoogleAuthRequestConfig>, redirectUriOptions?: Partial<IAuthSessionRedirectUriOptions>): IGoogleRequestSetup;
+/** Upstream only asks for `id_token` directly on web, so off web the default flow applies */
+export declare function toGoogleIdTokenConfig(config: Partial<IGoogleAuthRequestConfig>): Partial<IGoogleAuthRequestConfig>;
+export declare function resolveFacebookRequestSetup(config?: Partial<IFacebookAuthRequestConfig>, redirectUriOptions?: Partial<IAuthSessionRedirectUriOptions>): IFacebookAuthRequestConfig;

package/build-ngc/core/providers/provider-hook-setup.js

@@ -0,0 +1,79 @@
+// The config each provider hook derives before it loads a request, kept pure so every adapter's
+// hook shares one copy of upstream's `useMemo` blocks
+import { Platform } from 'react-native';
+import { applicationId } from '@symbiote-native/application';
+import { Prompt, ResponseType } from '../auth-request.types';
+import { makeRedirectUri } from '../auth-session';
+import { invariantClientId } from './provider-utils';
+function clientIdProperty() {
+    return Platform.select({
+        ios: 'iosClientId',
+        android: 'androidClientId',
+        default: 'webClientId',
+    });
+}
+function pickClientId(config, providerName) {
+    const propertyName = clientIdProperty();
+    const clientId = config[propertyName] ?? config.clientId;
+    invariantClientId(propertyName, clientId, providerName);
+    return clientId;
+}
+function resolveGoogleResponseType(config) {
+    // Allow overrides
+    if (typeof config.responseType !== 'undefined')
+        return config.responseType;
+    // Installed apps auto exchange the code for the token and the id token, no secret needed
+    return ResponseType.Code;
+}
+function resolveGoogleExtraParams(config) {
+    const output = { ...config.extraParams };
+    if (config.language)
+        output.hl = config.language;
+    if (config.loginHint)
+        output.login_hint = config.loginHint;
+    if (config.selectAccount)
+        output.prompt = Prompt.SelectAccount;
+    return output;
+}
+export function resolveGoogleRequestSetup(config = {}, redirectUriOptions = {}) {
+    const clientId = pickClientId(config, 'Google');
+    const redirectUri = config.redirectUri ??
+        makeRedirectUri({
+            native: `${applicationId}:/oauthredirect`,
+            ...redirectUriOptions,
+        });
+    return {
+        requestConfig: {
+            ...config,
+            responseType: resolveGoogleResponseType(config),
+            extraParams: resolveGoogleExtraParams(config),
+            clientId,
+            redirectUri,
+        },
+        exchange: {
+            clientId,
+            clientSecret: config.clientSecret,
+            redirectUri,
+            scopes: config.scopes,
+            shouldAutoExchangeCode: config.shouldAutoExchangeCode,
+        },
+    };
+}
+/** Upstream only asks for `id_token` directly on web, so off web the default flow applies */
+export function toGoogleIdTokenConfig(config) {
+    return { ...config, responseType: undefined };
+}
+export function resolveFacebookRequestSetup(config = {}, redirectUriOptions = {}) {
+    const clientId = pickClientId(config, 'Facebook');
+    const redirectUri = config.redirectUri ??
+        makeRedirectUri({
+            // The redirect URI is fb + client ID on native
+            native: `fb${clientId}://authorize`,
+            ...redirectUriOptions,
+        });
+    const extraParams = { ...config.extraParams };
+    if (config.language)
+        extraParams.locale = config.language;
+    return { ...config, extraParams, clientId, redirectUri };
+}
+//# sourceMappingURL=provider-hook-setup.js.map

package/build-ngc/core/providers/provider-hook-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-hook-setup.js","sourceRoot":"","sources":["../../../src/core/providers/provider-hook-setup.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,sDAAsD;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD,SAAS,gBAAgB;IACvB,OAAO,QAAQ,CAAC,MAAM,CAAoB;QACxC,GAAG,EAAE,aAAa;QAClB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,MAAsE,EACtE,YAAoB;IAEpB,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC;IACzD,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAgBD,SAAS,yBAAyB,CAChC,MAAyC;IAEzC,kBAAkB;IAClB,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAC3E,yFAAyF;IACzF,OAAO,YAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAyC;IAEzC,MAAM,MAAM,GAA2B,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjD,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3D,IAAI,MAAM,CAAC,aAAa;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,SAA4C,EAAE,EAC9C,qBAA8D,EAAE;IAEhE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,WAAW,GACf,MAAM,CAAC,WAAW;QAClB,eAAe,CAAC;YACd,MAAM,EAAE,GAAG,aAAa,iBAAiB;YACzC,GAAG,kBAAkB;SACtB,CAAC,CAAC;IACL,OAAO;QACL,aAAa,EAAE;YACb,GAAG,MAAM;YACT,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC;YAC/C,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;YAC7C,QAAQ;YACR,WAAW;SACZ;QACD,QAAQ,EAAE;YACR,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;SACtD;KACF,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CACnC,MAAyC;IAEzC,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAA8C,EAAE,EAChD,qBAA8D,EAAE;IAEhE,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,WAAW,GACf,MAAM,CAAC,WAAW;QAClB,eAAe,CAAC;YACd,+CAA+C;YAC/C,MAAM,EAAE,KAAK,QAAQ,cAAc;YACnC,GAAG,kBAAkB;SACtB,CAAC,CAAC;IACL,MAAM,WAAW,GAA2B,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ;QAAE,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1D,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC3D,CAAC"}

package/build-ngc/core/providers/provider-utils.d.ts

@@ -0,0 +1,2 @@
+export declare function applyRequiredScopes(scopes: string[] | undefined, requiredScopes: string[]): string[];
+export declare function invariantClientId(idName: string, value: string | undefined, providerName: string): asserts value is string;

package/build-ngc/core/providers/provider-utils.js

@@ -0,0 +1,9 @@
+export function applyRequiredScopes(scopes = [], requiredScopes) {
+    return [...new Set([...scopes, ...requiredScopes])];
+}
+export function invariantClientId(idName, value, providerName) {
+    if (typeof value === 'undefined') {
+        throw new Error(`Client Id property \`${idName}\` must be defined to use ${providerName} auth on this platform.`);
+    }
+}
+//# sourceMappingURL=provider-utils.js.map

package/build-ngc/core/providers/provider-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-utils.js","sourceRoot":"","sources":["../../../src/core/providers/provider-utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,mBAAmB,CACjC,SAAmB,EAAE,EACrB,cAAwB;IAExB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,KAAyB,EACzB,YAAoB;IAEpB,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,6BAA6B,YAAY,yBAAyB,CACjG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build-ngc/core/providers/provider.types.d.ts

@@ -0,0 +1,5 @@
+import type { IAuthRequestConfig } from '../auth-request.types';
+export type IProviderAuthRequestConfig = IAuthRequestConfig & {
+    /** ISO 639-1 code, optionally `-<ISO 3166-1 alpha-2>` (e.g. `it`, `pt-PT`). */
+    language?: string;
+};

package/build-ngc/core/providers/provider.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.types.js.map

package/build-ngc/core/providers/provider.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.types.js","sourceRoot":"","sources":["../../../src/core/providers/provider.types.ts"],"names":[],"mappings":""}

package/build-ngc/core/query-params.d.ts

@@ -0,0 +1,5 @@
+export type IQueryParamsResult = {
+    errorCode: string | null;
+    params: Record<string, string>;
+};
+export declare function getQueryParams(input: string): IQueryParamsResult;

package/build-ngc/core/query-params.js

@@ -0,0 +1,13 @@
+export function getQueryParams(input) {
+    const url = new URL(input, 'https://phony.example');
+    const errorCode = url.searchParams.get('errorCode');
+    url.searchParams.delete('errorCode');
+    const params = Object.fromEntries(url.searchParams);
+    if (url.hash) {
+        new URLSearchParams(url.hash.replace(/^#/, '')).forEach((value, key) => {
+            params[key] = value;
+        });
+    }
+    return { errorCode, params };
+}
+//# sourceMappingURL=query-params.js.map

package/build-ngc/core/query-params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-params.js","sourceRoot":"","sources":["../../src/core/query-params.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IAEpD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/build-ngc/core/session-result.d.ts

@@ -0,0 +1,6 @@
+import type { IAuthSessionResult } from './auth-session.types';
+/** The variant that carries params and authentication */
+export type IAuthSessionParamsResult = Extract<IAuthSessionResult, {
+    params: unknown;
+}>;
+export declare function isSuccessResult(result: IAuthSessionResult | null): result is IAuthSessionParamsResult;

package/build-ngc/core/session-result.js

@@ -0,0 +1,5 @@
+const SUCCESS_TYPE = 'success';
+export function isSuccessResult(result) {
+    return result?.type === SUCCESS_TYPE;
+}
+//# sourceMappingURL=session-result.js.map

package/build-ngc/core/session-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-result.js","sourceRoot":"","sources":["../../src/core/session-result.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,SAA8C,CAAC;AAQpE,MAAM,UAAU,eAAe,CAC7B,MAAiC;IAEjC,OAAO,MAAM,EAAE,IAAI,KAAK,YAAY,CAAC;AACvC,CAAC"}

package/build-ngc/core/token-request.d.ts

@@ -0,0 +1,89 @@
+import type { IDiscoveryDocument } from './discovery';
+import type { IFetchHeaders } from './fetch';
+import type { IAccessTokenRequestConfig, IRefreshTokenRequestConfig, IRevokeTokenRequestConfig, ITokenRequestConfig, ITokenResponseConfig, ITokenType, TokenTypeHint } from './token-request.types';
+import { GrantType } from './token-request.types';
+export declare function getCurrentTimeInSeconds(): number;
+/** https://tools.ietf.org/html/rfc6749#section-5.1 */
+export declare class TokenResponse implements ITokenResponseConfig {
+    static isTokenFresh(token: Pick<TokenResponse, 'expiresIn' | 'issuedAt'>, 
+    /** -10 minutes in seconds. */
+    secondsMargin?: number): boolean;
+    static fromQueryParams(params: Record<string, string>): TokenResponse;
+    accessToken: string;
+    tokenType: ITokenType;
+    expiresIn?: number;
+    refreshToken?: string;
+    scope?: string;
+    state?: string;
+    idToken?: string;
+    issuedAt: number;
+    /** Unprocessed token response, for fields outside RFC 6749. */
+    rawResponse?: unknown;
+    constructor(response: ITokenResponseConfig, rawResponse?: unknown);
+    private applyResponseConfig;
+    getRequestConfig(): ITokenResponseConfig;
+    refreshAsync(config: Omit<ITokenRequestConfig, 'grantType' | 'refreshToken'>, discovery: Pick<IDiscoveryDocument, 'tokenEndpoint'>): Promise<TokenResponse>;
+    shouldRefresh(): boolean;
+}
+declare abstract class BaseRequest<TConfig, TResult> {
+    protected request: TConfig;
+    constructor(request: TConfig);
+    abstract performAsync(discovery: IDiscoveryDocument): Promise<TResult>;
+    abstract getRequestConfig(): TConfig;
+    abstract getQueryBody(): Record<string, string>;
+}
+/** A generic token request. */
+export declare class TokenRequest<T extends ITokenRequestConfig> extends BaseRequest<T, TokenResponse> implements ITokenRequestConfig {
+    grantType: GrantType;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly scopes?: string[];
+    readonly extraParams?: Record<string, string>;
+    readonly extraHeaders?: Record<string, string>;
+    constructor(request: T, grantType: GrantType);
+    getHeaders(): IFetchHeaders;
+    performAsync(discovery: Pick<IDiscoveryDocument, 'tokenEndpoint'>): Promise<TokenResponse>;
+    getRequestConfig(): T;
+    getQueryBody(): Record<string, string>;
+}
+/** https://tools.ietf.org/html/rfc6749#section-4.1.3 */
+export declare class AccessTokenRequest extends TokenRequest<IAccessTokenRequestConfig> implements IAccessTokenRequestConfig {
+    readonly code: string;
+    readonly redirectUri: string;
+    constructor(options: IAccessTokenRequestConfig);
+    getQueryBody(): Record<string, string>;
+    getRequestConfig(): IAccessTokenRequestConfig & {
+        grantType: GrantType;
+    };
+}
+/** https://tools.ietf.org/html/rfc6749#section-6 */
+export declare class RefreshTokenRequest extends TokenRequest<IRefreshTokenRequestConfig> implements IRefreshTokenRequestConfig {
+    readonly refreshToken?: string;
+    constructor(options: IRefreshTokenRequestConfig);
+    getQueryBody(): Record<string, string>;
+    getRequestConfig(): IRefreshTokenRequestConfig & {
+        grantType: GrantType;
+    };
+}
+/** https://tools.ietf.org/html/rfc7009#section-2.1 */
+export declare class RevokeTokenRequest extends BaseRequest<IRevokeTokenRequestConfig, boolean> implements IRevokeTokenRequestConfig {
+    readonly clientId?: string;
+    readonly clientSecret?: string;
+    readonly token: string;
+    readonly tokenTypeHint?: TokenTypeHint;
+    readonly extraHeaders?: Record<string, string>;
+    constructor(request: IRevokeTokenRequestConfig);
+    getHeaders(): IFetchHeaders;
+    performAsync(discovery: Pick<IDiscoveryDocument, 'revocationEndpoint'>): Promise<boolean>;
+    getRequestConfig(): IRevokeTokenRequestConfig;
+    getQueryBody(): Record<string, string>;
+}
+/** Exchange an authorization code for an access token. */
+export declare function exchangeCodeAsync(config: IAccessTokenRequestConfig, discovery: Pick<IDiscoveryDocument, 'tokenEndpoint'>): Promise<TokenResponse>;
+/** Refresh an access token. See `TokenResponse.isTokenFresh()`/`shouldRefresh()`. */
+export declare function refreshAsync(config: IRefreshTokenRequestConfig, discovery: Pick<IDiscoveryDocument, 'tokenEndpoint'>): Promise<TokenResponse>;
+/** Revoke a token, effectively requiring the user to sign in again. */
+export declare function revokeAsync(config: IRevokeTokenRequestConfig, discovery: Pick<IDiscoveryDocument, 'revocationEndpoint'>): Promise<boolean>;
+/** Fetch generic user info from the provider's OpenID Connect `userInfoEndpoint`, if supported. */
+export declare function fetchUserInfoAsync(config: Pick<TokenResponse, 'accessToken'>, discovery: Pick<IDiscoveryDocument, 'userInfoEndpoint'>): Promise<Record<string, unknown>>;
+export {};