@tern-secure/auth 1.1.0-canary.v20251008131428 → 1.1.0-canary.v20251019190011

package/dist/esm/resources/Session.js

@@ -0,0 +1,81 @@
+import { eventBus, events } from "../instance/events";
+import { TernSecureBase } from "./Base";
+class Session extends TernSecureBase {
+  pathRoot = "/sessions/createsession";
+  status;
+  token;
+  claims;
+  authTime;
+  expirationTime;
+  issuedAtTime;
+  signInProvider;
+  signInSecondFactor;
+  user;
+  constructor(sessionData) {
+    super();
+    this.initializeFromSessionData(sessionData);
+  }
+  /**
+   * Initialize session from existing session data
+   */
+  initializeFromSessionData(sessionData) {
+    this.status = sessionData.status || "pending";
+    this.token = sessionData.token || "";
+    this.claims = sessionData.claims || {};
+    this.authTime = sessionData.authTime || "";
+    this.expirationTime = sessionData.expirationTime || "";
+    this.issuedAtTime = sessionData.issuedAtTime || "";
+    this.signInProvider = sessionData.signInProvider || null;
+    this.signInSecondFactor = sessionData.signInSecondFactor || null;
+    this.user = sessionData.user;
+  }
+  /**
+   * Create custom token from current session for server-side sync
+   * This calls the backend API to create a custom token from the current ID token
+   */
+  createSession = (idToken, csrfToken) => {
+    return this._post({
+      path: this.pathRoot,
+      body: {
+        idToken,
+        csrfToken
+      }
+    });
+  };
+  /**
+   * FIXED: Now properly returns the custom token string instead of the full API response
+   * This method correctly extracts the token from the API response structure
+   */
+  getIdAndRefreshToken = async (idToken, csrfToken) => {
+    await this.createSession(idToken, csrfToken);
+  };
+  /**
+   * NEW: create method that calls API to create session
+   * API handles everything, no return value needed
+   * This method works with the existing sessionData passed to constructor
+   */
+  create = async (csrfToken) => {
+    await this.createSession(this.token, csrfToken);
+    eventBus.emit(events.SessionChanged, null);
+  };
+  /**
+   * Convert session to plain object for serialization
+   */
+  toJSON() {
+    return {
+      status: this.status,
+      token: this.token,
+      claims: this.claims,
+      authTime: this.authTime,
+      expirationTime: this.expirationTime,
+      issuedAtTime: this.issuedAtTime,
+      signInProvider: this.signInProvider,
+      signInSecondFactor: this.signInSecondFactor,
+      user: this.user
+    };
+  }
+}
+export {
+  Session
+};
+//# sourceMappingURL=Session.js.map

package/dist/esm/resources/Session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/resources/Session.ts"],"sourcesContent":["import type {\n  IdTokenResult,\n  SessionJson,\n  SessionResource,\n  SessionStatus,\n  TernSecureUser,\n} from '@tern-secure/types';\n\nimport { eventBus, events } from '../instance/events';\nimport { TernSecureBase } from './Base';\n\n/**\n * Enhanced Session class that handles custom token authentication for client-server sync.\n *\n * Key Features:\n * - Manages custom tokens for server-side verification\n * - Uses TernSecureUser object directly (no Firebase Auth instance needed)\n * - Provides seamless client-server session synchronization\n * - Works with in-memory persistence by using custom tokens to restore auth state\n */\nexport class Session extends TernSecureBase implements SessionResource {\n  pathRoot = '/sessions/createsession';\n\n  status!: SessionStatus;\n  token!: string;\n  claims!: IdTokenResult['claims'];\n  authTime!: string;\n  expirationTime!: string;\n  issuedAtTime!: string;\n  signInProvider!: string | null;\n  signInSecondFactor!: string | null;\n  user?: TernSecureUser;\n\n  constructor(sessionData: Partial<SessionResource>) {\n    super();\n    this.initializeFromSessionData(sessionData);\n  }\n\n  /**\n   * Initialize session from existing session data\n   */\n  private initializeFromSessionData(sessionData: Partial<SessionResource>): void {\n    this.status = sessionData.status || 'pending';\n    this.token = sessionData.token || '';\n    this.claims = sessionData.claims || {};\n    this.authTime = sessionData.authTime || '';\n    this.expirationTime = sessionData.expirationTime || '';\n    this.issuedAtTime = sessionData.issuedAtTime || '';\n    this.signInProvider = sessionData.signInProvider || null;\n    this.signInSecondFactor = sessionData.signInSecondFactor || null;\n    this.user = sessionData.user;\n  }\n\n  /**\n   * Create custom token from current session for server-side sync\n   * This calls the backend API to create a custom token from the current ID token\n   */\n  private createSession = (idToken: string, csrfToken: string) => {\n    return this._post({\n      path: this.pathRoot,\n      body: {\n        idToken,\n        csrfToken,\n      },\n    });\n  };\n\n\n  /**\n   * FIXED: Now properly returns the custom token string instead of the full API response\n   * This method correctly extracts the token from the API response structure\n   */\n  getIdAndRefreshToken = async (idToken: string, csrfToken: string): Promise<void> => {\n    await this.createSession(idToken, csrfToken);\n  };\n\n  /**\n   * NEW: create method that calls API to create session\n   * API handles everything, no return value needed\n   * This method works with the existing sessionData passed to constructor\n   */\n  create = async (csrfToken: string): Promise<void> => {\n    await this.createSession(this.token, csrfToken);\n    eventBus.emit(events.SessionChanged, null);\n  };\n\n  /**\n   * Convert session to plain object for serialization\n   */\n  toJSON(): SessionJson {\n    return {\n      status: this.status,\n      token: this.token,\n      claims: this.claims,\n      authTime: this.authTime,\n      expirationTime: this.expirationTime,\n      issuedAtTime: this.issuedAtTime,\n      signInProvider: this.signInProvider,\n      signInSecondFactor: this.signInSecondFactor,\n      user: this.user,\n    };\n  }\n}\n"],"mappings":"AAQA,SAAS,UAAU,cAAc;AACjC,SAAS,sBAAsB;AAWxB,MAAM,gBAAgB,eAA0C;AAAA,EACrE,WAAW;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAY,aAAuC;AACjD,UAAM;AACN,SAAK,0BAA0B,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKQ,0BAA0B,aAA6C;AAC7E,SAAK,SAAS,YAAY,UAAU;AACpC,SAAK,QAAQ,YAAY,SAAS;AAClC,SAAK,SAAS,YAAY,UAAU,CAAC;AACrC,SAAK,WAAW,YAAY,YAAY;AACxC,SAAK,iBAAiB,YAAY,kBAAkB;AACpD,SAAK,eAAe,YAAY,gBAAgB;AAChD,SAAK,iBAAiB,YAAY,kBAAkB;AACpD,SAAK,qBAAqB,YAAY,sBAAsB;AAC5D,SAAK,OAAO,YAAY;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,gBAAgB,CAAC,SAAiB,cAAsB;AAC9D,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAuB,OAAO,SAAiB,cAAqC;AAClF,UAAM,KAAK,cAAc,SAAS,SAAS;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,OAAO,cAAqC;AACnD,UAAM,KAAK,cAAc,KAAK,OAAO,SAAS;AAC9C,aAAS,KAAK,OAAO,gBAAgB,IAAI;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,SAAsB;AACpB,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,cAAc,KAAK;AAAA,MACnB,gBAAgB,KAAK;AAAA,MACrB,oBAAoB,KAAK;AAAA,MACzB,MAAM,KAAK;AAAA,IACb;AAAA,EACF;AACF;","names":[]}

package/dist/esm/resources/SignIn.js

@@ -34,22 +34,25 @@ class SignIn extends TernSecureBase {
   withEmailAndPassword = async (params) => {
     try {
       const { email, password } = params;
-      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);
-      await this.signInWithCredential(userCredential);
-      const { user } = userCredential;
+      const { user, providerId, operationType } = await signInWithEmailAndPassword(
+        this.auth,
+        email,
+        password
+      );
       return {
-        success: true,
-        message: "Authentication successful",
+        status: "success",
         user,
+        providerId,
+        operationType,
+        message: "Authentication successful",
         error: !user.emailVerified ? "REQUIRES_VERIFICATION" : "AUTHENTICATED"
       };
     } catch (error) {
       const authError = handleFirebaseAuthError(error);
       return {
-        success: false,
+        status: "error",
         message: authError.message,
-        error: authError.code,
-        user: null
+        error: authError.code
       };
     }
   };
@@ -68,7 +71,7 @@ class SignIn extends TernSecureBase {
       if ((options == null ? void 0 : options.mode) === "redirect") {
         const redirectResult = await this.authRedirectResult();
         if (redirectResult) {
-          if (redirectResult.success) {
+          if (redirectResult.status === "success") {
             console.log("Redirect after sign in");
           }
           return redirectResult;
@@ -78,16 +81,15 @@ class SignIn extends TernSecureBase {
       } else {
         await this._signInWithPopUp(provider);
         return {
-          success: true,
+          status: "success",
           message: "Sign in successful"
         };
       }
     } catch (error) {
       return {
-        success: false,
+        status: "error",
         message: error.message || `Sign in with ${provider} failed`,
-        error,
-        user: null
+        error
       };
     }
   };
@@ -105,8 +107,6 @@ class SignIn extends TernSecureBase {
     await user.reload();
     if (user.emailVerified) {
       return {
-        success: true,
-        message: "Email is already verified. You can sign in.",
         isVerified: true
       };
     }
@@ -117,8 +117,6 @@ class SignIn extends TernSecureBase {
     };
     await sendEmailVerification(user, actionCodeSettings);
     return {
-      success: true,
-      message: "Verification email sent. Please check your inbox.",
       isVerified: false
     };
   };
@@ -151,20 +149,21 @@ class SignIn extends TernSecureBase {
     try {
       const result = await getRedirectResult(this.auth);
       if (result) {
-        const user = result.user;
+        const { user, providerId, operationType } = result;
         return {
-          success: true,
-          user
+          status: "success",
+          user,
+          providerId,
+          operationType
         };
       }
       return null;
     } catch (error) {
       const authError = handleFirebaseAuthError(error);
       return {
-        success: false,
+        status: "error",
         message: authError.message,
-        error: authError.code,
-        user: null
+        error: authError.code
       };
     }
   }
@@ -173,14 +172,13 @@ class SignIn extends TernSecureBase {
     config.provider.setCustomParameters(config.customParameters);
     try {
       await authMethod(this.auth, config.provider);
-      return { success: true, message: "Authentication initiated" };
+      return { status: "success", message: "Authentication initiated" };
     } catch (error) {
       const authError = handleFirebaseAuthError(error);
       return {
-        success: false,
+        status: "error",
         message: authError.message,
-        error: authError.code,
-        user: null
+        error: authError.code
       };
     }
   }

package/dist/esm/resources/SignIn.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/resources/SignIn.ts"],"sourcesContent":["import { handleFirebaseAuthError } from '@tern-secure/shared/errors';\nimport type {\n  ResendEmailVerification,\n  SignInFormValuesTree,\n  SignInResource,\n  SignInResponseTree,\n  SignInStatus,\n  TernSecureUser,\n} from '@tern-secure/types';\nimport type { Auth, UserCredential } from 'firebase/auth';\nimport {\n  getRedirectResult,\n  GoogleAuthProvider,\n  OAuthProvider,\n  sendEmailVerification,\n  signInWithEmailAndPassword,\n  signInWithPopup,\n  signInWithRedirect,\n} from 'firebase/auth';\n\nimport { TernSecureBase } from './Base';\n\ninterface ProviderConfig {\n  provider: GoogleAuthProvider | OAuthProvider;\n  customParameters: Record<string, string>;\n}\n\nexport type TernRequestInit = RequestInit;\n\nexport type SignInParams = {\n  idToken: string;\n  csrfToken: string | undefined;\n};\n\ntype FirebaseAuthResult = UserCredential | void;\n\ntype AuthMethodFunction = (\n  auth: Auth,\n  provider: GoogleAuthProvider | OAuthProvider,\n) => Promise<FirebaseAuthResult>;\n\nexport class SignIn extends TernSecureBase implements SignInResource {\n  pathRoot = '/sessions/createsession';\n\n  status?: SignInStatus | undefined;\n  private auth: Auth;\n  private csrfToken: string | undefined;\n  private _currentUser: TernSecureUser | null = null;\n\n  constructor(auth: Auth, csrfToken: string | undefined) {\n    super();\n    this.auth = auth;\n    this.csrfToken = csrfToken;\n  }\n\n  signInWithCredential = async (credential: UserCredential) => {\n    const idToken = await credential.user.getIdToken();\n    const params = {\n      idToken: idToken,\n      csrfToken: this.csrfToken,\n    };\n\n    return this._post({\n      path: this.pathRoot,\n      body: params,\n    });\n  };\n\n  withEmailAndPassword = async (params: SignInFormValuesTree): Promise<SignInResponseTree> => {\n    try {\n      const { email, password } = params;\n      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);\n\n      await this.signInWithCredential(userCredential);\n\n      const { user } = userCredential;\n      return {\n        success: true,\n        message: 'Authentication successful',\n        user,\n        error: !user.emailVerified ? 'REQUIRES_VERIFICATION' : 'AUTHENTICATED',\n      };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        success: false,\n        message: authError.message,\n        error: authError.code,\n        user: null,\n      };\n    }\n  };\n\n  withCredential = async (params: SignInFormValuesTree): Promise<void> => {\n    try {\n      const { email, password } = params;\n      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);\n      await this.signInWithCredential(userCredential);\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      console.error(authError);\n    }\n  };\n\n  withSocialProvider = async (\n    provider: string,\n    options?: {\n      mode?: 'popup' | 'redirect';\n    },\n  ): Promise<SignInResponseTree | void> => {\n    try {\n      if (options?.mode === 'redirect') {\n        const redirectResult = await this.authRedirectResult();\n\n        if (redirectResult) {\n          if (redirectResult.success) {\n            console.log('Redirect after sign in');\n          }\n          return redirectResult;\n        }\n\n        await this._signInWithRedirect(provider);\n        return;\n      } else {\n        await this._signInWithPopUp(provider);\n        return {\n          success: true,\n          message: 'Sign in successful',\n        };\n      }\n    } catch (error: any) {\n      return {\n        success: false,\n        message: error.message || `Sign in with ${provider} failed`,\n        error,\n        user: null,\n      };\n    }\n  };\n\n  completeMfaSignIn = async (_mfaToken: string, _mfaContext?: any): Promise<SignInResponseTree> => {\n    throw new Error('Method not implemented.');\n  };\n\n  sendPasswordResetEmail = async (email: string): Promise<void> => {\n    console.log(`Sending password reset email to ${email}`);\n  };\n\n  resendEmailVerification = async (): Promise<ResendEmailVerification> => {\n    const user = this._currentUser;\n    if (!user) {\n      throw new Error('No user is currently signed in');\n    }\n\n    await user.reload();\n\n    if (user.emailVerified) {\n      return {\n        success: true,\n        message: 'Email is already verified. You can sign in.',\n        isVerified: true,\n      };\n    }\n\n    const actionCodeSettings = {\n      url: '/sign-in', // TODO: Make this configurable\n      handleCodeInApp: true,\n    };\n\n    await sendEmailVerification(user, actionCodeSettings);\n    return {\n      success: true,\n      message: 'Verification email sent. Please check your inbox.',\n      isVerified: false,\n    };\n  };\n\n  private getProviderConfig(providerName: string): ProviderConfig {\n    switch (providerName.toLowerCase()) {\n      case 'google': {\n        const googleProvider = new GoogleAuthProvider();\n        return {\n          provider: googleProvider,\n          customParameters: {\n            login_hint: 'user@example.com',\n            prompt: 'select_account',\n          },\n        };\n      }\n      case 'microsoft': {\n        const microsoftProvider = new OAuthProvider('microsoft.com');\n        return {\n          provider: microsoftProvider,\n          customParameters: {\n            prompt: 'consent',\n          },\n        };\n      }\n      default:\n        throw new Error(`Unsupported provider: ${providerName}`);\n    }\n  }\n\n  private async authRedirectResult(): Promise<SignInResponseTree | null> {\n    try {\n      const result = await getRedirectResult(this.auth);\n\n      if (result) {\n        const user = result.user;\n        return {\n          success: true,\n          user,\n        };\n      }\n      return null;\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        success: false,\n        message: authError.message,\n        error: authError.code,\n        user: null,\n      };\n    }\n  }\n\n  private async executeAuthMethod(\n    authMethod: AuthMethodFunction,\n    providerName: string,\n  ): Promise<SignInResponseTree> {\n    const config = this.getProviderConfig(providerName);\n    config.provider.setCustomParameters(config.customParameters);\n    try {\n      await authMethod(this.auth, config.provider);\n      return { success: true, message: 'Authentication initiated' };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        success: false,\n        message: authError.message,\n        error: authError.code,\n        user: null,\n      };\n    }\n  }\n\n  private async _signInWithRedirect(providerName: string): Promise<SignInResponseTree> {\n    return this.executeAuthMethod(signInWithRedirect, providerName);\n  }\n\n  private async _signInWithPopUp(providerName: string): Promise<SignInResponseTree> {\n    return this.executeAuthMethod(signInWithPopup, providerName);\n  }\n\n  public async checkRedirectResult(): Promise<SignInResponseTree | null> {\n    return this.authRedirectResult();\n  }\n}\n"],"mappings":"AAAA,SAAS,+BAA+B;AAUxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,sBAAsB;AAqBxB,MAAM,eAAe,eAAyC;AAAA,EACnE,WAAW;AAAA,EAEX;AAAA,EACQ;AAAA,EACA;AAAA,EACA,eAAsC;AAAA,EAE9C,YAAY,MAAY,WAA+B;AACrD,UAAM;AACN,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,uBAAuB,OAAO,eAA+B;AAC3D,UAAM,UAAU,MAAM,WAAW,KAAK,WAAW;AACjD,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,uBAAuB,OAAO,WAA8D;AAC1F,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,iBAAiB,MAAM,2BAA2B,KAAK,MAAM,OAAO,QAAQ;AAElF,YAAM,KAAK,qBAAqB,cAAc;AAE9C,YAAM,EAAE,KAAK,IAAI;AACjB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,QACA,OAAO,CAAC,KAAK,gBAAgB,0BAA0B;AAAA,MACzD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,QACjB,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,iBAAiB,OAAO,WAAgD;AACtE,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,iBAAiB,MAAM,2BAA2B,KAAK,MAAM,OAAO,QAAQ;AAClF,YAAM,KAAK,qBAAqB,cAAc;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,cAAQ,MAAM,SAAS;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,qBAAqB,OACnB,UACA,YAGuC;AACvC,QAAI;AACF,WAAI,mCAAS,UAAS,YAAY;AAChC,cAAM,iBAAiB,MAAM,KAAK,mBAAmB;AAErD,YAAI,gBAAgB;AAClB,cAAI,eAAe,SAAS;AAC1B,oBAAQ,IAAI,wBAAwB;AAAA,UACtC;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,KAAK,oBAAoB,QAAQ;AACvC;AAAA,MACF,OAAO;AACL,cAAM,KAAK,iBAAiB,QAAQ;AACpC,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,MAAM,WAAW,gBAAgB,QAAQ;AAAA,QAClD;AAAA,QACA,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,OAAO,WAAmB,gBAAmD;AAC/F,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EAEA,yBAAyB,OAAO,UAAiC;AAC/D,YAAQ,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACxD;AAAA,EAEA,0BAA0B,YAA8C;AACtE,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AAEA,UAAM,KAAK,OAAO;AAElB,QAAI,KAAK,eAAe;AACtB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,qBAAqB;AAAA,MACzB,KAAK;AAAA;AAAA,MACL,iBAAiB;AAAA,IACnB;AAEA,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEQ,kBAAkB,cAAsC;AAC9D,YAAQ,aAAa,YAAY,GAAG;AAAA,MAClC,KAAK,UAAU;AACb,cAAM,iBAAiB,IAAI,mBAAmB;AAC9C,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,YAAY;AAAA,YACZ,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,aAAa;AAChB,cAAM,oBAAoB,IAAI,cAAc,eAAe;AAC3D,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA;AACE,cAAM,IAAI,MAAM,yBAAyB,YAAY,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAc,qBAAyD;AACrE,QAAI;AACF,YAAM,SAAS,MAAM,kBAAkB,KAAK,IAAI;AAEhD,UAAI,QAAQ;AACV,cAAM,OAAO,OAAO;AACpB,eAAO;AAAA,UACL,SAAS;AAAA,UACT;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,QACjB,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,kBACZ,YACA,cAC6B;AAC7B,UAAM,SAAS,KAAK,kBAAkB,YAAY;AAClD,WAAO,SAAS,oBAAoB,OAAO,gBAAgB;AAC3D,QAAI;AACF,YAAM,WAAW,KAAK,MAAM,OAAO,QAAQ;AAC3C,aAAO,EAAE,SAAS,MAAM,SAAS,2BAA2B;AAAA,IAC9D,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,QACjB,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,cAAmD;AACnF,WAAO,KAAK,kBAAkB,oBAAoB,YAAY;AAAA,EAChE;AAAA,EAEA,MAAc,iBAAiB,cAAmD;AAChF,WAAO,KAAK,kBAAkB,iBAAiB,YAAY;AAAA,EAC7D;AAAA,EAEA,MAAa,sBAA0D;AACrE,WAAO,KAAK,mBAAmB;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../../../src/resources/SignIn.ts"],"sourcesContent":["import { handleFirebaseAuthError } from '@tern-secure/shared/errors';\nimport type {\n  ResendEmailVerification,\n  SignInFormValues,\n  SignInResource,\n  SignInResponse as SignInResponseFromTypes,\n  SignInStatus,\n  TernSecureUser,\n} from '@tern-secure/types';\nimport type { Auth, UserCredential } from 'firebase/auth';\nimport {\n  getRedirectResult,\n  GoogleAuthProvider,\n  OAuthProvider,\n  sendEmailVerification,\n  signInWithEmailAndPassword,\n  signInWithPopup,\n  signInWithRedirect,\n} from 'firebase/auth';\n\nimport { TernSecureBase } from './Base';\n\ntype SignInResponse = SignInResponseFromTypes;\n\ninterface ProviderConfig {\n  provider: GoogleAuthProvider | OAuthProvider;\n  customParameters: Record<string, string>;\n}\n\nexport type TernRequestInit = RequestInit;\n\nexport type SignInParams = {\n  idToken: string;\n  csrfToken: string | undefined;\n};\n\ntype FirebaseAuthResult = UserCredential | void;\n\ntype AuthMethodFunction = (\n  auth: Auth,\n  provider: GoogleAuthProvider | OAuthProvider,\n) => Promise<FirebaseAuthResult>;\n\nexport class SignIn extends TernSecureBase implements SignInResource {\n  pathRoot = '/sessions/createsession';\n\n  status?: SignInStatus | undefined;\n  private auth: Auth;\n  private csrfToken: string | undefined;\n  private _currentUser: TernSecureUser | null = null;\n\n  constructor(auth: Auth, csrfToken: string | undefined) {\n    super();\n    this.auth = auth;\n    this.csrfToken = csrfToken;\n  }\n\n  signInWithCredential = async (credential: UserCredential) => {\n    const idToken = await credential.user.getIdToken();\n    const params = {\n      idToken: idToken,\n      csrfToken: this.csrfToken,\n    };\n\n    return this._post({\n      path: this.pathRoot,\n      body: params,\n    });\n  };\n\n  withEmailAndPassword = async (params: SignInFormValues): Promise<SignInResponse> => {\n    try {\n      const { email, password } = params;\n      const { user, providerId, operationType } = await signInWithEmailAndPassword(\n        this.auth,\n        email,\n        password,\n      );\n      return {\n        status: 'success',\n        user,\n        providerId,\n        operationType,\n        message: 'Authentication successful',\n        error: !user.emailVerified ? 'REQUIRES_VERIFICATION' : 'AUTHENTICATED',\n      };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  };\n\n  withCredential = async (params: SignInFormValues): Promise<void> => {\n    try {\n      const { email, password } = params;\n      const userCredential = await signInWithEmailAndPassword(this.auth, email, password);\n      await this.signInWithCredential(userCredential);\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      console.error(authError);\n    }\n  };\n\n  withSocialProvider = async (\n    provider: string,\n    options?: {\n      mode?: 'popup' | 'redirect';\n    },\n  ): Promise<SignInResponse | void> => {\n    try {\n      if (options?.mode === 'redirect') {\n        const redirectResult = await this.authRedirectResult();\n\n        if (redirectResult) {\n          if (redirectResult.status === 'success') {\n            console.log('Redirect after sign in');\n          }\n          return redirectResult;\n        }\n\n        await this._signInWithRedirect(provider);\n        return;\n      } else {\n        await this._signInWithPopUp(provider);\n        return {\n          status: 'success',\n          message: 'Sign in successful',\n        };\n      }\n    } catch (error: any) {\n      return {\n        status: 'error',\n        message: error.message || `Sign in with ${provider} failed`,\n        error,\n      };\n    }\n  };\n\n  completeMfaSignIn = async (_mfaToken: string, _mfaContext?: any): Promise<SignInResponse> => {\n    throw new Error('Method not implemented.');\n  };\n\n  sendPasswordResetEmail = async (email: string): Promise<void> => {\n    console.log(`Sending password reset email to ${email}`);\n  };\n\n  resendEmailVerification = async (): Promise<ResendEmailVerification> => {\n    const user = this._currentUser;\n    if (!user) {\n      throw new Error('No user is currently signed in');\n    }\n\n    await user.reload();\n\n    if (user.emailVerified) {\n      return {\n        isVerified: true,\n      };\n    }\n\n    const actionCodeSettings = {\n      url: '/sign-in', // TODO: Make this configurable\n      handleCodeInApp: true,\n    };\n\n    await sendEmailVerification(user, actionCodeSettings);\n    return {\n      isVerified: false,\n    };\n  };\n\n  private getProviderConfig(providerName: string): ProviderConfig {\n    switch (providerName.toLowerCase()) {\n      case 'google': {\n        const googleProvider = new GoogleAuthProvider();\n        return {\n          provider: googleProvider,\n          customParameters: {\n            login_hint: 'user@example.com',\n            prompt: 'select_account',\n          },\n        };\n      }\n      case 'microsoft': {\n        const microsoftProvider = new OAuthProvider('microsoft.com');\n        return {\n          provider: microsoftProvider,\n          customParameters: {\n            prompt: 'consent',\n          },\n        };\n      }\n      default:\n        throw new Error(`Unsupported provider: ${providerName}`);\n    }\n  }\n\n  private async authRedirectResult(): Promise<SignInResponse | null> {\n    try {\n      const result = await getRedirectResult(this.auth);\n\n      if (result) {\n        const { user, providerId, operationType } = result;\n        return {\n          status: 'success',\n          user,\n          providerId,\n          operationType,\n        };\n      }\n      return null;\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  }\n\n  private async executeAuthMethod(\n    authMethod: AuthMethodFunction,\n    providerName: string,\n  ): Promise<SignInResponse> {\n    const config = this.getProviderConfig(providerName);\n    config.provider.setCustomParameters(config.customParameters);\n    try {\n      await authMethod(this.auth, config.provider);\n      return { status: 'success', message: 'Authentication initiated' };\n    } catch (error) {\n      const authError = handleFirebaseAuthError(error);\n      return {\n        status: 'error',\n        message: authError.message,\n        error: authError.code,\n      };\n    }\n  }\n\n  private async _signInWithRedirect(providerName: string): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithRedirect, providerName);\n  }\n\n  private async _signInWithPopUp(providerName: string): Promise<SignInResponse> {\n    return this.executeAuthMethod(signInWithPopup, providerName);\n  }\n\n  public async checkRedirectResult(): Promise<SignInResponse | null> {\n    return this.authRedirectResult();\n  }\n}\n"],"mappings":"AAAA,SAAS,+BAA+B;AAUxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,sBAAsB;AAuBxB,MAAM,eAAe,eAAyC;AAAA,EACnE,WAAW;AAAA,EAEX;AAAA,EACQ;AAAA,EACA;AAAA,EACA,eAAsC;AAAA,EAE9C,YAAY,MAAY,WAA+B;AACrD,UAAM;AACN,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,uBAAuB,OAAO,eAA+B;AAC3D,UAAM,UAAU,MAAM,WAAW,KAAK,WAAW;AACjD,UAAM,SAAS;AAAA,MACb;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,uBAAuB,OAAO,WAAsD;AAClF,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,EAAE,MAAM,YAAY,cAAc,IAAI,MAAM;AAAA,QAChD,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,OAAO,CAAC,KAAK,gBAAgB,0BAA0B;AAAA,MACzD;AAAA,IACF,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,iBAAiB,OAAO,WAA4C;AAClE,QAAI;AACF,YAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,YAAM,iBAAiB,MAAM,2BAA2B,KAAK,MAAM,OAAO,QAAQ;AAClF,YAAM,KAAK,qBAAqB,cAAc;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,cAAQ,MAAM,SAAS;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,qBAAqB,OACnB,UACA,YAGmC;AACnC,QAAI;AACF,WAAI,mCAAS,UAAS,YAAY;AAChC,cAAM,iBAAiB,MAAM,KAAK,mBAAmB;AAErD,YAAI,gBAAgB;AAClB,cAAI,eAAe,WAAW,WAAW;AACvC,oBAAQ,IAAI,wBAAwB;AAAA,UACtC;AACA,iBAAO;AAAA,QACT;AAEA,cAAM,KAAK,oBAAoB,QAAQ;AACvC;AAAA,MACF,OAAO;AACL,cAAM,KAAK,iBAAiB,QAAQ;AACpC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,SAAS,OAAY;AACnB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,MAAM,WAAW,gBAAgB,QAAQ;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,oBAAoB,OAAO,WAAmB,gBAA+C;AAC3F,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EAEA,yBAAyB,OAAO,UAAiC;AAC/D,YAAQ,IAAI,mCAAmC,KAAK,EAAE;AAAA,EACxD;AAAA,EAEA,0BAA0B,YAA8C;AACtE,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AAEA,UAAM,KAAK,OAAO;AAElB,QAAI,KAAK,eAAe;AACtB,aAAO;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,UAAM,qBAAqB;AAAA,MACzB,KAAK;AAAA;AAAA,MACL,iBAAiB;AAAA,IACnB;AAEA,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,WAAO;AAAA,MACL,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEQ,kBAAkB,cAAsC;AAC9D,YAAQ,aAAa,YAAY,GAAG;AAAA,MAClC,KAAK,UAAU;AACb,cAAM,iBAAiB,IAAI,mBAAmB;AAC9C,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,YAAY;AAAA,YACZ,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,aAAa;AAChB,cAAM,oBAAoB,IAAI,cAAc,eAAe;AAC3D,eAAO;AAAA,UACL,UAAU;AAAA,UACV,kBAAkB;AAAA,YAChB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA;AACE,cAAM,IAAI,MAAM,yBAAyB,YAAY,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqD;AACjE,QAAI;AACF,YAAM,SAAS,MAAM,kBAAkB,KAAK,IAAI;AAEhD,UAAI,QAAQ;AACV,cAAM,EAAE,MAAM,YAAY,cAAc,IAAI;AAC5C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,kBACZ,YACA,cACyB;AACzB,UAAM,SAAS,KAAK,kBAAkB,YAAY;AAClD,WAAO,SAAS,oBAAoB,OAAO,gBAAgB;AAC3D,QAAI;AACF,YAAM,WAAW,KAAK,MAAM,OAAO,QAAQ;AAC3C,aAAO,EAAE,QAAQ,WAAW,SAAS,2BAA2B;AAAA,IAClE,SAAS,OAAO;AACd,YAAM,YAAY,wBAAwB,KAAK;AAC/C,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,cAA+C;AAC/E,WAAO,KAAK,kBAAkB,oBAAoB,YAAY;AAAA,EAChE;AAAA,EAEA,MAAc,iBAAiB,cAA+C;AAC5E,WAAO,KAAK,kBAAkB,iBAAiB,YAAY;AAAA,EAC7D;AAAA,EAEA,MAAa,sBAAsD;AACjE,WAAO,KAAK,mBAAmB;AAAA,EACjC;AACF;","names":[]}

package/dist/esm/resources/Token.js

@@ -0,0 +1,8 @@
+import { TernSecureBase } from "./Base";
+class Token extends TernSecureBase {
+  pathroot = "tokens";
+}
+export {
+  Token
+};
+//# sourceMappingURL=Token.js.map

package/dist/esm/resources/Token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/resources/Token.ts"],"sourcesContent":["import { TernSecureBase } from './Base';\n\nexport class Token extends TernSecureBase {\n    pathroot = 'tokens';\n}\n"],"mappings":"AAAA,SAAS,sBAAsB;AAExB,MAAM,cAAc,eAAe;AAAA,EACtC,WAAW;AACf;","names":[]}

package/dist/esm/resources/UserData.js

@@ -0,0 +1,19 @@
+import { TernSecureBase } from "./Base";
+class UserData extends TernSecureBase {
+  pathRoot = "/accounts/lookup";
+  idToken;
+  constructor(idToken) {
+    super();
+    this.idToken = idToken;
+  }
+  get = async () => {
+    return this._post({
+      path: this.pathRoot,
+      method: "POST"
+    });
+  };
+}
+export {
+  UserData
+};
+//# sourceMappingURL=UserData.js.map

package/dist/esm/resources/UserData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/resources/UserData.ts"],"sourcesContent":["import { TernSecureBase } from './Base';\n\nexport class UserData extends TernSecureBase {\n  pathRoot = '/accounts/lookup';\n\n  private idToken: string | undefined;\n\n  constructor(idToken?: string) {\n    super();\n    this.idToken = idToken;\n  }\n\n  get = async () => {\n    return this._post({\n      path: this.pathRoot,\n      method: 'POST',\n    });\n  }\n}\n"],"mappings":"AAAA,SAAS,sBAAsB;AAExB,MAAM,iBAAiB,eAAe;AAAA,EAC3C,WAAW;AAAA,EAEH;AAAA,EAER,YAAY,SAAkB;AAC5B,UAAM;AACN,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,YAAY;AAChB,WAAO,KAAK,MAAM;AAAA,MAChB,MAAM,KAAK;AAAA,MACX,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/esm/resources/cookie.js

@@ -0,0 +1,130 @@
+import { TernSecureBase } from "./Base";
+class Cookie extends TernSecureBase {
+  pathroot = "cookies";
+  idToken;
+  sessionToken;
+  refreshToken;
+  customToken;
+  constructor() {
+    super();
+  }
+  getTokenInCookie = (tokenName) => {
+    return this.baseGet({
+      path: `${this.pathroot}/get`,
+      search: { tokenName }
+    });
+  };
+  parseTokenResponse = (apiResponse, tokenType) => {
+    if (!apiResponse) {
+      return {
+        success: false,
+        error: `${tokenType} not found in httpOnly cookies`
+      };
+    }
+    const { success, token, error } = apiResponse;
+    return {
+      success,
+      token,
+      error
+    };
+  };
+  getIdToken = async () => {
+    const res = await this.getTokenInCookie("idToken");
+    return this.parseTokenResponse(res, "idToken");
+  };
+  getSessionToken = async () => {
+    var _a;
+    try {
+      const response = await this.getTokenInCookie("sessionToken");
+      if (!response || !((_a = response.response) == null ? void 0 : _a.token)) {
+        return {
+          success: false,
+          error: "Session token not found in httpOnly cookies"
+        };
+      }
+      return {
+        success: true,
+        token: response.response.token
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: `Failed to retrieve session token: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  };
+  getRefreshToken = async () => {
+    var _a;
+    try {
+      const response = await this.getTokenInCookie("refreshToken");
+      if (!response || !((_a = response.response) == null ? void 0 : _a.token)) {
+        return {
+          success: false,
+          error: "Refresh token not found in httpOnly cookies"
+        };
+      }
+      return {
+        success: true,
+        token: response.response.token
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: `Failed to retrieve refresh token: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  };
+  getCustomToken = async () => {
+    var _a;
+    try {
+      const response = await this.getTokenInCookie("customToken");
+      if (!response || !((_a = response.response) == null ? void 0 : _a.token)) {
+        return {
+          success: false,
+          error: "Custom token not found in httpOnly cookies"
+        };
+      }
+      return {
+        success: true,
+        token: response.response.token
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: `Failed to retrieve custom token: ${error instanceof Error ? error.message : String(error)}`
+      };
+    }
+  };
+  getAllTokens = async () => {
+    const [idToken, sessionToken, refreshToken, customToken] = await Promise.all([
+      this.getIdToken(),
+      this.getSessionToken(),
+      this.getRefreshToken(),
+      this.getCustomToken()
+    ]);
+    return {
+      idToken,
+      sessionToken,
+      refreshToken,
+      customToken
+    };
+  };
+  hasToken = async (tokenType) => {
+    switch (tokenType) {
+      case "idToken":
+        return (await this.getIdToken()).success;
+      case "sessionToken":
+        return (await this.getSessionToken()).success;
+      case "refreshToken":
+        return (await this.getRefreshToken()).success;
+      case "customToken":
+        return (await this.getCustomToken()).success;
+      default:
+        return false;
+    }
+  };
+}
+export {
+  Cookie
+};
+//# sourceMappingURL=cookie.js.map

package/dist/esm/resources/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/resources/cookie.ts"],"sourcesContent":["import type { CookieResource } from '@tern-secure/types';\n\n//import { eventBus, events } from '../instance/events';\nimport { TernSecureBase } from './Base';\n\nexport type TokenResult = {\n  success: boolean;\n  token?: string;\n  error?: string;\n};\n\ntype CookieTokenResponse = {\n  success: boolean;\n  token?: string;\n  error?: string;\n};\n\nexport class Cookie extends TernSecureBase implements CookieResource {\n  pathroot = 'cookies';\n\n  idToken?: string;\n  sessionToken?: string;\n  refreshToken?: string;\n  customToken?: string;\n\n  constructor() {\n    super();\n  }\n\n  private getTokenInCookie = (tokenName: string) => {\n    return this.baseGet({\n      path: `${this.pathroot}/get`,\n      search: { tokenName },\n    });\n  };\n\n\n  private parseTokenResponse = (\n    apiResponse: any,\n    tokenType: string,\n  ): TokenResult => {\n    if (!apiResponse) {\n      return {\n        success: false,\n        error: `${tokenType} not found in httpOnly cookies`,\n      };\n    }\n\n    const { success, token, error } = apiResponse as CookieTokenResponse;\n\n    return {\n      success,\n      token,\n      error,\n    };\n  };\n\n  getIdToken = async (): Promise<TokenResult> => {\n    const res = await this.getTokenInCookie('idToken');\n    //eventBus.emit(events.TokenJwt, { tokenType: 'idToken', response: res });\n    return this.parseTokenResponse(res, 'idToken');\n  };\n\n  getSessionToken = async (): Promise<TokenResult> => {\n    try {\n      const response = await this.getTokenInCookie('sessionToken');\n\n      if (!response || !response.response?.token) {\n        return {\n          success: false,\n          error: 'Session token not found in httpOnly cookies',\n        };\n      }\n\n      return {\n        success: true,\n        token: response.response.token,\n      };\n    } catch (error) {\n      return {\n        success: false,\n        error: `Failed to retrieve session token: ${error instanceof Error ? error.message : String(error)}`,\n      };\n    }\n  };\n\n  getRefreshToken = async (): Promise<TokenResult> => {\n    try {\n      const response = await this.getTokenInCookie('refreshToken');\n\n      if (!response || !response.response?.token) {\n        return {\n          success: false,\n          error: 'Refresh token not found in httpOnly cookies',\n        };\n      }\n\n      return {\n        success: true,\n        token: response.response.token,\n      };\n    } catch (error) {\n      return {\n        success: false,\n        error: `Failed to retrieve refresh token: ${error instanceof Error ? error.message : String(error)}`,\n      };\n    }\n  };\n\n  getCustomToken = async (): Promise<TokenResult> => {\n    try {\n      const response = await this.getTokenInCookie('customToken');\n\n      if (!response || !response.response?.token) {\n        return {\n          success: false,\n          error: 'Custom token not found in httpOnly cookies',\n        };\n      }\n\n      return {\n        success: true,\n        token: response.response.token,\n      };\n    } catch (error) {\n      return {\n        success: false,\n        error: `Failed to retrieve custom token: ${error instanceof Error ? error.message : String(error)}`,\n      };\n    }\n  };\n\n  getAllTokens = async (): Promise<Record<string, TokenResult>> => {\n    const [idToken, sessionToken, refreshToken, customToken] = await Promise.all([\n      this.getIdToken(),\n      this.getSessionToken(),\n      this.getRefreshToken(),\n      this.getCustomToken(),\n    ]);\n\n    return {\n      idToken,\n      sessionToken,\n      refreshToken,\n      customToken,\n    };\n  };\n\n  hasToken = async (tokenType: keyof CookieResource): Promise<boolean> => {\n    switch (tokenType) {\n      case 'idToken':\n        return (await this.getIdToken()).success;\n      case 'sessionToken':\n        return (await this.getSessionToken()).success;\n      case 'refreshToken':\n        return (await this.getRefreshToken()).success;\n      case 'customToken':\n        return (await this.getCustomToken()).success;\n      default:\n        return false;\n    }\n  };\n}\n"],"mappings":"AAGA,SAAS,sBAAsB;AAcxB,MAAM,eAAe,eAAyC;AAAA,EACnE,WAAW;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA,cAAc;AACZ,UAAM;AAAA,EACR;AAAA,EAEQ,mBAAmB,CAAC,cAAsB;AAChD,WAAO,KAAK,QAAQ;AAAA,MAClB,MAAM,GAAG,KAAK,QAAQ;AAAA,MACtB,QAAQ,EAAE,UAAU;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAGQ,qBAAqB,CAC3B,aACA,cACgB;AAChB,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,GAAG,SAAS;AAAA,MACrB;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,OAAO,MAAM,IAAI;AAElC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAa,YAAkC;AAC7C,UAAM,MAAM,MAAM,KAAK,iBAAiB,SAAS;AAEjD,WAAO,KAAK,mBAAmB,KAAK,SAAS;AAAA,EAC/C;AAAA,EAEA,kBAAkB,YAAkC;AA/DtD;AAgEI,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,iBAAiB,cAAc;AAE3D,UAAI,CAAC,YAAY,GAAC,cAAS,aAAT,mBAAmB,QAAO;AAC1C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,SAAS,SAAS;AAAA,MAC3B;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,qCAAqC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACpG;AAAA,IACF;AAAA,EACF;AAAA,EAEA,kBAAkB,YAAkC;AAtFtD;AAuFI,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,iBAAiB,cAAc;AAE3D,UAAI,CAAC,YAAY,GAAC,cAAS,aAAT,mBAAmB,QAAO;AAC1C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,SAAS,SAAS;AAAA,MAC3B;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,qCAAqC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACpG;AAAA,IACF;AAAA,EACF;AAAA,EAEA,iBAAiB,YAAkC;AA7GrD;AA8GI,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,iBAAiB,aAAa;AAE1D,UAAI,CAAC,YAAY,GAAC,cAAS,aAAT,mBAAmB,QAAO;AAC1C,eAAO;AAAA,UACL,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,SAAS,SAAS;AAAA,MAC3B;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AAAA,EAEA,eAAe,YAAkD;AAC/D,UAAM,CAAC,SAAS,cAAc,cAAc,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3E,KAAK,WAAW;AAAA,MAChB,KAAK,gBAAgB;AAAA,MACrB,KAAK,gBAAgB;AAAA,MACrB,KAAK,eAAe;AAAA,IACtB,CAAC;AAED,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,WAAW,OAAO,cAAsD;AACtE,YAAQ,WAAW;AAAA,MACjB,KAAK;AACH,gBAAQ,MAAM,KAAK,WAAW,GAAG;AAAA,MACnC,KAAK;AACH,gBAAQ,MAAM,KAAK,gBAAgB,GAAG;AAAA,MACxC,KAAK;AACH,gBAAQ,MAAM,KAAK,gBAAgB,GAAG;AAAA,MACxC,KAAK;AACH,gBAAQ,MAAM,KAAK,eAAe,GAAG;AAAA,MACvC;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;","names":[]}

package/dist/esm/resources/internal.js

@@ -1,7 +1,8 @@
+export * from "./Session";
 export * from "./SignUp";
 export * from "./SignIn";
 export * from "./Base";
-export * from "./AuthCookieManager";
+export * from "../auth/AuthCookieManager";
 export * from "../utils";
 export * from "./Error";
 //# sourceMappingURL=internal.js.map

package/dist/esm/resources/internal.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/resources/internal.ts"],"sourcesContent":["export type { TernSecureAuth } from '../instance/TernAuth';\nexport * from './SignUp';\nexport * from './SignIn';\nexport * from './Base';\nexport * from './AuthCookieManager';\nexport * from '../utils';\nexport * from './Error';"],"mappings":"AACA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../../../src/resources/internal.ts"],"sourcesContent":["export type { TernSecureAuth } from '../instance/TernAuth';\nexport * from './Session';\nexport * from './SignUp';\nexport * from './SignIn';\nexport * from './Base';\nexport * from '../auth/AuthCookieManager';\nexport * from '../utils';\nexport * from './Error';\n"],"mappings":"AACA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/esm/utils/jwt.js

@@ -0,0 +1,22 @@
+import { decodeJwt, decodeProtectedHeader } from "jose";
+import { mapJwtPayloadToDecodedIdToken } from "./mapDecode";
+function decode(token) {
+  const header = decodeProtectedHeader(token);
+  const payload = decodeJwt(token);
+  const parts = (token || "").split(".");
+  const [signature] = parts;
+  const data = {
+    header,
+    payload,
+    signature
+  };
+  const decoded = mapJwtPayloadToDecodedIdToken(payload);
+  return {
+    encoded: data,
+    decoded
+  };
+}
+export {
+  decode
+};
+//# sourceMappingURL=jwt.js.map

package/dist/esm/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/jwt.ts"],"sourcesContent":["import { decodeJwt, decodeProtectedHeader } from 'jose';\n\nimport type { DecodedIdToken, JWTPayload, JWTProtectedHeader } from './mapDecode';\nimport { mapJwtPayloadToDecodedIdToken } from './mapDecode';\n\ntype JWT = {\n  encoded: { header: JWTProtectedHeader; payload: JWTPayload; signature: string };\n  decoded: DecodedIdToken;\n};\n\nexport function decode(token: string): JWT {\n  const header = decodeProtectedHeader(token);\n  const payload = decodeJwt(token);\n\n  const parts = (token || '').split('.');\n  const [signature] = parts;\n\n  const data = {\n    header,\n    payload,\n    signature,\n  };\n\n  const decoded = mapJwtPayloadToDecodedIdToken(payload);\n\n  return {\n    encoded: data,\n    decoded,\n  };\n}\n"],"mappings":"AAAA,SAAS,WAAW,6BAA6B;AAGjD,SAAS,qCAAqC;AAOvC,SAAS,OAAO,OAAoB;AACzC,QAAM,SAAS,sBAAsB,KAAK;AAC1C,QAAM,UAAU,UAAU,KAAK;AAE/B,QAAM,SAAS,SAAS,IAAI,MAAM,GAAG;AACrC,QAAM,CAAC,SAAS,IAAI;AAEpB,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,UAAU,8BAA8B,OAAO;AAErD,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/esm/utils/mapDecode.js

@@ -0,0 +1,9 @@
+function mapJwtPayloadToDecodedIdToken(payload) {
+  const decodedIdToken = payload;
+  decodedIdToken.uid = decodedIdToken.sub;
+  return decodedIdToken;
+}
+export {
+  mapJwtPayloadToDecodedIdToken
+};
+//# sourceMappingURL=mapDecode.js.map

package/dist/esm/utils/mapDecode.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/mapDecode.ts"],"sourcesContent":["import type { DecodedIdToken, JWTPayload, JWTProtectedHeader } from '@tern-secure/types';\n\nexport function mapJwtPayloadToDecodedIdToken(payload: JWTPayload) {\n  const decodedIdToken = payload as DecodedIdToken;\n  decodedIdToken.uid = decodedIdToken.sub;\n  return decodedIdToken;\n}\n\nexport type { DecodedIdToken, JWTPayload, JWTProtectedHeader };\n"],"mappings":"AAEO,SAAS,8BAA8B,SAAqB;AACjE,QAAM,iBAAiB;AACvB,iBAAe,MAAM,eAAe;AACpC,SAAO;AACT;","names":[]}

package/dist/types/{resources → auth}/AuthCookieManager.d.ts

@@ -6,17 +6,21 @@ type CSRFToken = {
  */
 export declare class AuthCookieManager {
     private readonly csrfCookieHandler;
+    private sessionCookie;
+    private idTokenCookie;
     constructor();
     private generateCSRFToken;
     private ensureCSRFToken;
     /**
      * Set CSRFcookie
-    */
+     */
     setCSRFToken(token: CSRFToken): void;
     /**
      * Get CSRF token from cookies
      */
     getCSRFToken(): string | undefined;
+    getSessionCookie(): string | undefined;
+    getIdTokenCookie(): string | undefined;
     /**
      * Clear all authentication cookies
      */

package/dist/types/auth/AuthCookieManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthCookieManager.d.ts","sourceRoot":"","sources":["../../../src/auth/AuthCookieManager.ts"],"names":[],"mappings":"AAQA,KAAK,SAAS,GAAG;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAUF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IACrE,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,aAAa,CAAuB;;IAQ5C,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,eAAe;IASvB;;OAEG;IAEH,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAWpC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,SAAS;IAS3B,gBAAgB;IAIhB,gBAAgB;IAIvB;;OAEG;IACH,SAAS,IAAI,IAAI;CAOlB"}

package/dist/types/auth/cookies/session.d.ts

@@ -0,0 +1,8 @@
+export type SessionCookieHandler = {
+    set: (token: string) => void;
+    remove: () => void;
+    get: () => string | undefined;
+};
+export declare const createSessionCookie: () => SessionCookieHandler;
+export declare const createIdTokenCookie: () => SessionCookieHandler;
+//# sourceMappingURL=session.d.ts.map

package/dist/types/auth/cookies/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/auth/cookies/session.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAO,oBA2BtC,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAO,oBA2BtC,CAAC"}

package/dist/types/auth/request.d.ts

@@ -0,0 +1,49 @@
+import type { TernSecureUserData } from '@tern-secure/types';
+import type { TokenResult } from '../resources/cookie';
+export interface UserDataParams {
+    idToken: string;
+}
+/**
+ * Client-side authentication request functionality
+ * Uses backend API calls through the configured apiUrl
+ */
+export declare class ClientAuthRequest {
+    private cookie;
+    private userData;
+    constructor();
+    /**
+     * Get UserData
+     */
+    getUserData(): Promise<TernSecureUserData | null>;
+    /**
+     * Get ID token from httpOnly cookies
+     */
+    getIdTokenFromCookie(): Promise<TokenResult>;
+    /**
+     * Get session token from httpOnly cookies
+     */
+    getSessionTokenFromCookie(): Promise<TokenResult>;
+    /**
+     * Get refresh token from httpOnly cookies
+     */
+    getRefreshTokenFromCookie(): Promise<TokenResult>;
+    /**
+     * Get custom token from httpOnly cookies
+     */
+    getCustomTokenFromCookie(): Promise<TokenResult>;
+    /**
+     * Get all tokens from httpOnly cookies
+     */
+    getAllTokensFromCookies(): Promise<Record<string, TokenResult>>;
+    /**
+     * Check if a specific token exists in cookies
+     */
+    hasTokenInCookie(tokenType: 'idToken' | 'sessionToken' | 'refreshToken' | 'customToken'): Promise<boolean>;
+    /**
+     * Get user data using token from cookies
+     * First tries to get ID token from cookies, then uses it for user data request
+     */
+    getUserDataWithCookieToken(): Promise<TernSecureUserData | null>;
+}
+export declare function createClientAuthRequest(): ClientAuthRequest;
+//# sourceMappingURL=request.d.ts.map

package/dist/types/auth/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/auth/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAW;;IAO3B;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAevD;;OAEG;IACG,oBAAoB,IAAI,OAAO,CAAC,WAAW,CAAC;IAWlD;;OAEG;IACG,yBAAyB,IAAI,OAAO,CAAC,WAAW,CAAC;IAWvD;;OAEG;IACG,yBAAyB,IAAI,OAAO,CAAC,WAAW,CAAC;IAWvD;;OAEG;IACG,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC;IAWtD;;OAEG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAcrE;;OAEG;IACG,gBAAgB,CACpB,SAAS,EAAE,SAAS,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,GACrE,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACG,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;CAsBvE;AAED,wBAAgB,uBAAuB,IAAI,iBAAiB,CAE3D"}

package/dist/types/index.d.ts

@@ -4,6 +4,6 @@ export { TernServerAuth } from './instance/TernAuthServer';
 export type { TernServerAuthOptions, AuthenticatedApp } from './instance/TernAuthServer';
 export { CoreApiClient, coreApiClient } from './instance/coreApiClient';
 export type { ApiResponse, ApiResponseJSON, RequestOptions, BeforeRequestHook, AfterResponseHook } from './instance/coreApiClient';
-export { SignIn, TernSecureBase } from './resources/internal';
-export type { TernSecureConfig, SignInFormValuesTree, SignInResponseTree, ResendEmailVerification, TernSecureUser, TernSecureState } from '@tern-secure/types';
+export { SignIn, TernSecureBase, buildURL } from './resources/internal';
+export type { AuthErrorTree, TernSecureConfig, SignInFormValues, SignInProps, SignUpProps, SignInResponse, SignInRedirectUrl, SignUpRedirectUrl, ResendEmailVerification, TernSecureUser, TernSecureState } from '@tern-secure/types';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EACR,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE9D,YAAY,EACR,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,eAAe,EAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACxE,YAAY,EACR,WAAW,EACX,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAExE,YAAY,EACR,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,eAAe,EAClB,MAAM,oBAAoB,CAAC"}