@tdacorp/identity-client 0.2.2 → 0.2.4

package/dist/{chunk-TTFIPEZ3.js → chunk-HO6U23GY.js}

@@ -31,23 +31,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -129,6 +142,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -159,7 +182,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -179,7 +202,7 @@ async function exchangeAuthorizationCode(options) {
   return toTokenSet(body);
 }
 async function clientCredentialsGrant(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,

package/dist/index.cjs

@@ -68,23 +68,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -166,6 +179,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -196,7 +219,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -216,7 +239,7 @@ async function exchangeAuthorizationCode(options) {
   return toTokenSet(body);
 }
 async function clientCredentialsGrant(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-TTFIPEZ3.js";
+} from "./chunk-HO6U23GY.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -59,23 +59,36 @@ function assertHttps(url, label) {
     throw new Error(`Discovery: ${label} "${url}" must be https (loopback hosts are the only http exception)`);
   }
 }
+var ENDPOINT_FIELDS = [
+  { field: "jwks_uri", required: true },
+  { field: "token_endpoint", required: true },
+  { field: "authorization_endpoint", required: true },
+  { field: "userinfo_endpoint", required: false },
+  { field: "end_session_endpoint", required: false },
+  { field: "revocation_endpoint", required: false },
+  { field: "introspection_endpoint", required: false },
+  { field: "registration_endpoint", required: false }
+];
+function validateEndpointField(field, url, issuerOrigin) {
+  assertHttps(url, field);
+  if (new URL(url).origin !== issuerOrigin) {
+    throw new Error(`Discovery: ${field} "${url}" is not same-origin as issuer`);
+  }
+}
 function validateDiscoveryDocument(document, issuerUrl) {
   assertHttps(issuerUrl, "issuer");
-  assertHttps(document.jwks_uri, "jwks_uri");
-  assertHttps(document.token_endpoint, "token_endpoint");
-  assertHttps(document.authorization_endpoint, "authorization_endpoint");
   if (document.issuer !== issuerUrl) {
     throw new Error(`Discovery: document issuer "${document.issuer}" does not match the configured issuer "${issuerUrl}"`);
   }
   const issuerOrigin = new URL(issuerUrl).origin;
-  if (new URL(document.jwks_uri).origin !== issuerOrigin) {
-    throw new Error(`Discovery: jwks_uri "${document.jwks_uri}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.token_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: token_endpoint "${document.token_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
-  }
-  if (new URL(document.authorization_endpoint).origin !== issuerOrigin) {
-    throw new Error(`Discovery: authorization_endpoint "${document.authorization_endpoint}" is not same-origin as issuer "${issuerUrl}"`);
+  for (const { field, required } of ENDPOINT_FIELDS) {
+    const value = document[field];
+    if (value === void 0 && !required) continue;
+    if (typeof value !== "string") {
+      const requirement = required ? "is required and must be a string" : ", if present, must be a string";
+      throw new Error(`Discovery: ${field} ${requirement}`);
+    }
+    validateEndpointField(field, value, issuerOrigin);
   }
 }
 async function fetchDiscovery(issuerUrl) {
@@ -157,6 +170,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -187,7 +210,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-TTFIPEZ3.js";
+} from "./chunk-HO6U23GY.js";
 import {
   seal,
   unseal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {
@@ -55,7 +55,7 @@
   ],
   "dependencies": {
     "jose": "^6.2.9",
-    "@tdacorp/identity-authz": "^0.2.0"
+    "@tdacorp/identity-authz": "^0.2.1"
   },
   "peerDependencies": {
     "next": ">=14"