@tempoxyz/auth 0.0.0-pr-21.sha-ca15e9a → 0.0.0-pr-19.sha-2c8fa8e

package/dist/Actions.d.ts

@@ -52,9 +52,9 @@ export declare namespace authorizeDevice {
     };
 }
 /**
- * Returns the URL that signs the user in on Tempo Auth's pages and redirects back with a code
- * and the key authorization, and the {@link Pending} state to keep until then, such as in a
- * sealed cookie. {@link handleCallback} finishes it.
+ * Returns the URL that signs the user in on Tempo Auth's pages and redirects back with a code,
+ * and the {@link Pending} state to keep until then, such as in a sealed cookie.
+ * {@link handleCallback} redeems the code for the tokens and the key authorization.
  *
  * @example
  * ```ts
@@ -130,8 +130,8 @@ export declare namespace getTempoAccounts {
     type ReturnType = readonly TempoAccount[];
 }
 /**
- * Finishes a sign-in redirect: checks its state, redeems the code with the PKCE verifier (and the
- * client secret, for a backend), and reads the key authorization from the callback URL.
+ * Finishes a sign-in redirect: checks its state, and redeems the code with the PKCE verifier (and
+ * the client secret, for a backend) for the tokens and the key authorization.
  *
  * @example
  * ```ts

package/dist/Actions.js

@@ -89,9 +89,9 @@ export async function authorizeDevice(auth, options) {
     };
 }
 /**
- * Returns the URL that signs the user in on Tempo Auth's pages and redirects back with a code
- * and the key authorization, and the {@link Pending} state to keep until then, such as in a
- * sealed cookie. {@link handleCallback} finishes it.
+ * Returns the URL that signs the user in on Tempo Auth's pages and redirects back with a code,
+ * and the {@link Pending} state to keep until then, such as in a sealed cookie.
+ * {@link handleCallback} redeems the code for the tokens and the key authorization.
  *
  * @example
  * ```ts
@@ -171,8 +171,8 @@ export async function getTempoAccounts(auth) {
     return tempo.map(({ address }) => ({ address }));
 }
 /**
- * Finishes a sign-in redirect: checks its state, redeems the code with the PKCE verifier (and the
- * client secret, for a backend), and reads the key authorization from the callback URL.
+ * Finishes a sign-in redirect: checks its state, and redeems the code with the PKCE verifier (and
+ * the client secret, for a backend) for the tokens and the key authorization.
  *
  * @example
  * ```ts
@@ -186,25 +186,26 @@ export async function handleCallback(auth, options) {
     const { pending } = options;
     const params = new URL(options.url).searchParams;
     const code = params.get('code');
-    const account = params.get('account');
-    const keyAuthorization = params.get('key_authorization');
-    if (!code ||
-        !account ||
-        !keyAuthorization ||
-        params.get('state') !== pending.state)
+    if (!code || params.get('state') !== pending.state)
+        throw new RequestError({
+            message: 'Sign-in failed. Start again.',
+            status: 400,
+        });
+    const body = await token(auth, {
+        code,
+        code_verifier: pending.verifier,
+        grant_type: 'authorization_code',
+        redirect_uri: pending.redirectUri,
+    });
+    if (!body.account || !body.key_authorization)
         throw new RequestError({
             message: 'Sign-in failed. Start again.',
             status: 400,
         });
     return authorization({
-        account: account,
-        keyAuthorization: JSON.parse(Base64.toString(keyAuthorization)),
-        tokens: await token(auth, {
-            code,
-            code_verifier: pending.verifier,
-            grant_type: 'authorization_code',
-            redirect_uri: pending.redirectUri,
-        }),
+        account: body.account,
+        keyAuthorization: body.key_authorization,
+        tokens: body,
     }, pending);
 }
 /**
@@ -223,13 +224,16 @@ export function handleRedirect(auth) {
         const stored = storage(auth).getItem(storageKey);
         storage(auth).removeItem(storageKey);
         const url = new URL(window.location.href);
-        if (!stored || !url.searchParams.has('code'))
+        if (!url.searchParams.has('code'))
             return undefined;
-        // The app keeps its own query and fragment, without the callback's parameters.
+        // The app keeps its own query and fragment, without the callback's parameters. A code this page
+        // did not request is dropped too, since it redeems for whoever crafted its request.
         const clean = new URL(url);
-        for (const name of ['account', 'code', 'key_authorization', 'state'])
+        for (const name of ['code', 'state'])
             clean.searchParams.delete(name);
         window.history.replaceState(null, '', clean.pathname + clean.search + clean.hash);
+        if (!stored)
+            return undefined;
         return handleCallback(auth, { pending: JSON.parse(stored), url });
     })();
     return redirected;
@@ -257,11 +261,11 @@ export async function redirect(auth, options) {
  * })
  * ```
  */
-export function refresh(auth, options) {
-    return token(auth, {
+export async function refresh(auth, options) {
+    return tokens(await token(auth, {
         grant_type: 'refresh_token',
         refresh_token: options.refreshToken,
-    });
+    }));
 }
 /**
  * Emails the user a sign-in code. The response is the same for every address.
@@ -383,14 +387,14 @@ function storage(auth) {
  * OAuth form posts to WorkOS.
  */
 async function token(auth, body) {
-    return tokens(await json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
+    return json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
         body: new URLSearchParams({
             ...body,
             client_id: auth.clientId,
             ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
         }),
         method: 'POST',
-    })));
+    }));
 }
 /** Reads a token response into `Tokens`. */
 function tokens(response) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-21.sha-ca15e9a",
+  "version": "0.0.0-pr-19.sha-2c8fa8e",
   "description": "Signs users in to Tempo through Tempo Auth, and returns viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {