@tempoxyz/id 0.0.0-stage → 0.0.1

package/src/client/internal/verifier.ts

@@ -0,0 +1,75 @@
+/**
+ * Keeps the part of a redirect's state that redeems its code in the tab's `sessionStorage`, beside
+ * the default IndexedDB storage: its `state`, redirect URI, and PKCE verifier, and whether it
+ * authorizes a key. The callback page reads it at once, so the code exchange starts before
+ * IndexedDB's first read, which waits behind the page's first tasks. It holds no key material.
+ * @module
+ */
+/* istanbul ignore file -- `sessionStorage` exists only in a browser. */
+import type { Auth } from '../Auth.js'
+import type * as Pending from '../Pending.js'
+
+/** The part of a redirect's state that redeems its code. */
+export type Ticket = {
+  /** Whether the redirect authorizes a key, whose material only the instance's storage holds. */
+  key: boolean
+  /** Where Tempo ID redirects back to. The code exchange repeats it. */
+  redirectUri: string
+  /** The value that the callback must echo. */
+  state: string
+  /** The PKCE verifier that redeems the code. */
+  verifier: string
+}
+
+/** Keeps the ticket of `pending` for the tab, unless the instance has a `storage` of its own. */
+export function save(
+  auth: Auth,
+  pending: Pending.Pending | Pending.WithoutKey,
+) {
+  const storage = session(auth)
+  if (!storage) return
+  try {
+    storage.setItem(storageKey, JSON.stringify(ticket(pending)))
+  } catch {
+    // A full or blocked storage leaves the callback to read the instance's storage.
+  }
+}
+
+/** Returns the tab's ticket and removes it, or `undefined` without one. */
+export function take(auth: Auth): Ticket | undefined {
+  const storage = session(auth)
+  if (!storage) return undefined
+  try {
+    const value = storage.getItem(storageKey)
+    storage.removeItem(storageKey)
+    return value ? (JSON.parse(value) as Ticket) : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Returns the ticket of `pending`, without its key material. */
+function ticket(pending: Pending.Pending | Pending.WithoutKey): Ticket {
+  return {
+    key: pending.key !== false,
+    redirectUri: pending.redirectUri,
+    state: pending.state,
+    verifier: pending.verifier,
+  }
+}
+
+/**
+ * Returns the tab's `sessionStorage`, or `undefined` for an instance with a `storage` of its own,
+ * which then holds the verifier alone, and where the browser blocks storage.
+ */
+function session(auth: Auth) {
+  if (auth.storage) return undefined
+  try {
+    return typeof sessionStorage === 'undefined' ? undefined : sessionStorage
+  } catch {
+    return undefined
+  }
+}
+
+/** Where a redirect keeps its ticket in `sessionStorage`. */
+const storageKey = 'tempo-id:redirect'

package/src/client.ts

@@ -0,0 +1,17 @@
+/**
+ * The client for apps that sign in through Tempo ID, which returns Viem access key accounts. It
+ * imports no server code.
+ * @module
+ */
+export * as Actions from './client/Actions.js'
+export * as Auth from './client/Auth.js'
+export * as Authorization from './client/Authorization.js'
+export * as Decorator from './client/Decorator.js'
+export { tempoId } from './client/Decorator.js'
+export * as Key from './client/Key.js'
+export * as Pending from './client/Pending.js'
+export * as Permissions from './client/Permissions.js'
+export * as Storage from './client/Storage.js'
+export * as TempoAccount from './client/TempoAccount.js'
+export * as Tokens from './client/Tokens.js'
+export * as User from './client/User.js'

package/src/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Types that Tempo ID's client, server, and admin entry points share.
+ * @module
+ */
+export {}