@telecrypt-io/storage 0.2.8 → 0.2.9

package/dist/core/oidc.d.ts

@@ -61,12 +61,18 @@ export declare function isDeviceAccessTokenError(result: DeviceAccessTokenRespon
  * internally by matrix-js-sdk/oidc-client-ts (`mx_oidc_`-prefixed keys) — the
  * caller does not need to manage them; `completeAuthorizationCodeFlow` reads
  * them back after the redirect.
+ *
+ * `deviceId` is optional: when supplied, it is embedded in the requested
+ * scope (MSC2967) so MAS grants THAT device instead of minting a fresh one —
+ * the web UI passes a stable per-browser device id so repeated logins reuse
+ * the same Matrix device instead of accumulating one device per login.
  */
 export declare function beginAuthorizationCodeFlow(opts: {
     authMetadata: OidcClientConfig;
     clientId: string;
     homeserverUrl: string;
     redirectUri: string;
+    deviceId?: string;
 }): Promise<string>;
 /** Completes the authorization-code exchange after the `?code&state` redirect. */
 export declare function completeAuthorizationCodeFlow(code: string, state: string): Promise<{

package/dist/core/oidc.js

@@ -10,6 +10,7 @@
  */
 import { createClient } from "matrix-js-sdk";
 import { registerOidcClient, generateScope, generateOidcAuthorizationUrl, completeAuthorizationCodeGrant, startDeviceAuthorization, waitForDeviceAuthorization, } from "matrix-js-sdk/lib/oidc/index.js";
+import { OidcClient, WebStorageStateStore } from "oidc-client-ts";
 import { CliError } from "./errors.js";
 /**
  * Discovers the OIDC/MAS issuer + endpoints for a homeserver, via
@@ -84,9 +85,41 @@ export function isDeviceAccessTokenError(result) {
  * internally by matrix-js-sdk/oidc-client-ts (`mx_oidc_`-prefixed keys) — the
  * caller does not need to manage them; `completeAuthorizationCodeFlow` reads
  * them back after the redirect.
+ *
+ * `deviceId` is optional: when supplied, it is embedded in the requested
+ * scope (MSC2967) so MAS grants THAT device instead of minting a fresh one —
+ * the web UI passes a stable per-browser device id so repeated logins reuse
+ * the same Matrix device instead of accumulating one device per login.
  */
 export async function beginAuthorizationCodeFlow(opts) {
     const nonce = crypto.randomUUID();
+    if (opts.deviceId) {
+        // matrix-js-sdk's generateOidcAuthorizationUrl hardcodes
+        // generateScope() with no device id, so every login would mint a fresh
+        // Matrix device. Build the URL ourselves with the stable device id in
+        // the requested scope (MSC2967) so MAS grants THAT device — mirroring
+        // matrix-js-sdk's construction exactly (same state store, same user
+        // state shape) so completeAuthorizationCodeFlow still works unchanged.
+        const scope = generateScope(opts.deviceId);
+        const oidcClient = new OidcClient({
+            ...opts.authMetadata,
+            signingKeys: opts.authMetadata.signingKeys ?? undefined,
+            metadata: opts.authMetadata,
+            client_id: opts.clientId,
+            redirect_uri: opts.redirectUri,
+            authority: opts.authMetadata.issuer,
+            response_mode: "query",
+            response_type: "code",
+            scope,
+            stateStore: new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage }),
+        });
+        const userState = { homeserverUrl: opts.homeserverUrl, nonce };
+        const request = await oidcClient.createSigninRequest({
+            state: userState,
+            nonce,
+        });
+        return request.url;
+    }
     return generateOidcAuthorizationUrl({
         metadata: opts.authMetadata,
         clientId: opts.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telecrypt-io/storage",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "license": "BUSL-1.1",
   "type": "module",
   "main": "dist/index.js",