@synqauth/js 0.0.0 → 0.2.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as problemError, i as isSynqError, n as secureUrl, o as toSynqError, r as SynqError, t as createApiClient } from "./api-Cf9K1Rc9.js";
+import { a as readSavedSignIn, c as problemError, i as newSignIn, l as toSynqError, n as secureUrl, o as SynqError, r as SignInFlow, s as isSynqError, t as createApiClient } from "./api-CeYAjkvX.js";
 import * as oauth from "oauth4webapi";
 //#region src/storage.ts
 /**
@@ -159,6 +159,7 @@ var Client = class {
 			redirectUri: this.#options.redirectUri,
 			resource: options.resource ?? this.#options.resource,
 			maxAge: options.maxAge,
+			...options.acr?.essential ? { acr: [...options.acr.values] } : {},
 			createdAt: now()
 		};
 		const url = new URL(server.authorization_endpoint);
@@ -181,6 +182,15 @@ var Client = class {
 		if (options.maxAge !== void 0) params.set("max_age", String(options.maxAge));
 		if (options.loginHint) params.set("login_hint", options.loginHint);
 		if (options.method) params.set("synq_method", options.method);
+		if (options.acr) {
+			if (options.acr.values.length === 0) throw new SynqError("invalid_options", "acr needs at least one value");
+			if (params.has("acr_values") || params.has("claims")) throw new SynqError("invalid_options", "acr_values and claims come from the acr option");
+			if (options.acr.essential) params.set("claims", JSON.stringify({ id_token: { acr: {
+				essential: true,
+				values: [...options.acr.values]
+			} } }));
+			else params.set("acr_values", options.acr.values.join(" "));
+		}
 		await this.#transactions.set(TRANSACTION_PREFIX + transaction.state, JSON.stringify(transaction));
 		if (!options.pushed) return url;
 		if (!server.pushed_authorization_request_endpoint) throw new SynqError("discovery_failed", "The issuer takes no pushed authorization requests");
@@ -224,6 +234,7 @@ var Client = class {
 				requireIdToken: true
 			});
 			const claims = oauth.getValidatedIdTokenClaims(result);
+			if (transaction.acr && !(claims?.acr && transaction.acr.includes(claims.acr))) throw new SynqError("unmet_authentication_requirements", "The sign-in did not reach the level this app requires");
 			this.#generation += 1;
 			await this.#clear();
 			const session = await this.#save(result, claims);
@@ -271,6 +282,39 @@ var Client = class {
 			this.#listeners.delete(listener);
 		};
 	}
+	startSignIn({ endUserIp, ...options } = {}) {
+		return new SignInFlow(this.#signInPort(endUserIp), newSignIn(options.scope ?? this.#options.scope ?? "openid", {
+			...options,
+			resource: options.resource ?? this.#options.resource
+		}));
+	}
+	resumeSignIn(saved, options = {}) {
+		return new SignInFlow(this.#signInPort(options.endUserIp), readSavedSignIn(saved));
+	}
+	/** What a flow needs of this client: its issuer, its credentials, and keeping the session. */
+	#signInPort(endUserIp) {
+		return {
+			...endUserIp ? { headers: { "synq-end-user-ip": endUserIp } } : {},
+			server: () => this.#discover(),
+			client: this.#client,
+			auth: this.#auth,
+			fetch: this.#options.fetch ?? globalThis.fetch.bind(globalThis),
+			finish: async (result, claims) => {
+				this.#generation += 1;
+				await this.#clear();
+				const session = await this.#save(result, claims, void 0, "app");
+				this.#emit({
+					type: "signed-in",
+					session
+				});
+				return session;
+			},
+			hosted: (options) => this.signIn({
+				...options.method ? { method: options.method } : {},
+				...options.loginHint ? { loginHint: options.loginHint } : {}
+			})
+		};
+	}
 	async signOut(options = {}) {
 		const stored = await this.#load();
 		const refreshToken = await this.#readRefreshToken();
@@ -291,7 +335,7 @@ var Client = class {
 		} catch (error) {
 			if (attempt === 2) console.warn("@synqauth/js: revoking the refresh token at sign-out failed; it stays usable until it expires", toSynqError(error).code);
 		}
-		if (!server.end_session_endpoint) return null;
+		if (!server.end_session_endpoint || stored?.via === "app") return null;
 		const url = new URL(server.end_session_endpoint);
 		url.searchParams.set("client_id", this.#options.clientId);
 		if (stored?.idToken) url.searchParams.set("id_token_hint", stored.idToken);
@@ -394,14 +438,15 @@ var Client = class {
 		})();
 		return this.#server;
 	}
-	async #save(result, claims, previous) {
+	async #save(result, claims, previous, via = previous?.via ?? "hosted") {
 		const stored = {
 			accessToken: result.access_token,
 			tokenType: result.token_type,
 			expiresAt: result.expires_in === void 0 ? void 0 : now() + result.expires_in,
 			scope: result.scope ?? previous?.scope,
 			idToken: result.id_token ?? previous?.idToken,
-			claims
+			claims,
+			via
 		};
 		this.#session = stored;
 		await this.#storage.set(SESSION_KEY, JSON.stringify(stored));
@@ -432,6 +477,7 @@ var Client = class {
 	async #public(stored) {
 		return {
 			...stored,
+			via: stored.via ?? "hosted",
 			refreshable: await this.#readRefreshToken() !== void 0
 		};
 	}
@@ -534,6 +580,12 @@ function createAccountClient(options) {
 			list: (opts) => list("/v1/consents", opts),
 			withdraw: (consent, opts) => change("delete", "/v1/consents/{consent}", opts, { path: { consent } })
 		},
+		apiKeys: {
+			apis: (opts) => list("/v1/apis", opts),
+			list: (opts) => list("/v1/api-keys", opts),
+			create: (input, opts) => change("post", "/v1/api-keys", opts, { body: input }),
+			revoke: (key, opts) => change("delete", "/v1/api-keys/{key}", opts, { path: { key } })
+		},
 		activity: (opts) => list("/v1/sign-ins", opts),
 		deletion: {
 			schedule: (opts) => change("post", "/v1/deletion", opts),
@@ -542,6 +594,37 @@ function createAccountClient(options) {
 	};
 }
 //#endregion
+//#region src/generated/challenge.ts
+/** The ways in an app's own screens sign people in with (`synq_method`). */
+const CHALLENGE_METHODS = [
+	"password",
+	"email",
+	"passkey"
+];
+/** What went wrong with a step (`synq_problem`): branch on it, never on the English. */
+const CHALLENGE_PROBLEMS = [
+	"missing",
+	"invalid_email",
+	"wrong_credentials",
+	"email_taken",
+	"password_too_short",
+	"password_too_long",
+	"password_guessable",
+	"password_breached",
+	"wrong_code",
+	"code_expired",
+	"code_used_up",
+	"address_suppressed",
+	"team_only",
+	"send_failed",
+	"passkey_failed",
+	"passkey_unknown",
+	"passkey_expired",
+	"slow_down",
+	"locked",
+	"limited"
+];
+//#endregion
 //#region src/generated/errors.ts
 /** Each `code` a Synq API's problem documents carry, with its HTTP status. */
 const ERROR_CODES = {
@@ -597,9 +680,11 @@ const ERROR_CODES = {
 	upload_expired: 410,
 	file_rejected: 422,
 	upload_limit_reached: 409,
+	api_keys_not_allowed: 403,
+	api_key_limit_reached: 409,
 	rate_limited: 429,
 	internal_error: 500,
 	service_unavailable: 503
 };
 //#endregion
-export { ERROR_CODES, SynqError, accountApiUrl, browserLocalStorage, browserSessionStorage, createAccountClient, createSynqClient, isSynqError, linkSignIn, memoryStorage, problemError };
+export { CHALLENGE_METHODS, CHALLENGE_PROBLEMS, ERROR_CODES, SignInFlow, SynqError, accountApiUrl, browserLocalStorage, browserSessionStorage, createAccountClient, createSynqClient, isSynqError, linkSignIn, memoryStorage, problemError };