@thunderid/browser 1.3.1 → 1.4.0

package/dist/index.d.ts

@@ -3,6 +3,8 @@
  */
 export { default as ThunderIDBrowserClient } from './ThunderIDBrowserClient';
 export { default as FetchHttpClient } from './FetchHttpClient';
+export { default as BackendClient, BACKEND_REQUEST_HEADER } from './BackendClient';
+export { default as BackendHttpClient } from './BackendHttpClient';
 export { default as Hooks, Hooks as BrowserHooks } from './constants/Hooks';
 export * from './constants/SPAConstants';
 export { default as BrowserStorage } from './models/BrowserStorage';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAE,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,aAAa,EAAE,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAE,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getUsersMe, isEmojiUri, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -33,38 +33,226 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 
 //#endregion
-//#region src/constants/Hooks.ts
+//#region src/BackendClient.ts
 /**
-* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
+* Header every backend request carries. A cross-origin page cannot set it without a CORS preflight,
+* which the backend never answers, so it keeps the cookie from being used cross-site.
 */
-let Hooks = /* @__PURE__ */ function(Hooks$1) {
-	Hooks$1["SignIn"] = "sign-in";
-	Hooks$1["SignOut"] = "sign-out";
-	Hooks$1["Initialize"] = "initialize";
-	Hooks$1["HttpRequestStart"] = "http-request-start";
-	Hooks$1["HttpRequestFinish"] = "http-request-finish";
-	Hooks$1["HttpRequestError"] = "http-request-error";
-	Hooks$1["HttpRequestSuccess"] = "http-request-success";
-	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
-	Hooks$1["CustomGrant"] = "custom-grant";
-	Hooks$1["SignOutFailed"] = "sign-out-failed";
-	return Hooks$1;
-}({});
-var Hooks_default = Hooks;
-
-//#endregion
-//#region src/constants/SPAConstants.ts
-const ERROR = "error";
-const ERROR_DESCRIPTION = "error_description";
-const CUSTOM_GRANT_CONFIG = "custom_grant_config";
-const STATE_QUERY = "state";
-const SILENT_SIGN_IN_STATE = "sign-in-silently";
-const SILENT_SIGN_IN_TIMEOUT = 1e4;
-const ACCESS_TOKEN_INVALID = "Access token is invalid";
-const REFRESH_ACCESS_TOKEN_ERR0R = "refresh-access-token-error";
-const TOKEN_REQUEST_CONFIG_KEY = "token_request_config";
-const SILENT_SIGN_IN_SIGNED_IN = "silent_sign_in_signed_in";
-const SILENT_SIGN_IN_SIGNED_OUT = "silent_sign_in_signed_out";
+const BACKEND_REQUEST_HEADER = "X-Requested-With";
+const BACKEND_REQUEST_HEADER_VALUE = "XMLHttpRequest";
+/** A check on focus is skipped when the last one is more recent than this, in milliseconds. */
+const FOCUS_CHECK_THROTTLE = 5e3;
+/**
+* Talks to the app's backend when sign-in runs there: reads the session, refreshes it, and starts and ends it. The
+* browser never holds a token; the backend keeps them behind an `HttpOnly` cookie.
+*/
+var BackendClient = class BackendClient {
+	session;
+	refreshing;
+	hasLoadedSession = false;
+	/** Whether the session last seen was signed in, so a later read can tell it has ended. */
+	wasSignedIn = false;
+	lastCheck = 0;
+	signedOutListeners = [];
+	constructor(endpoints) {
+		this.endpoints = endpoints;
+	}
+	/**
+	* Calls the listener when a signed-in session turns out to have ended without this client signing
+	* out: another app signed the user out, an administrator ended the session, or it timed out.
+	*/
+	onSignedOut(listener) {
+		this.signedOutListeners.push(listener);
+	}
+	/**
+	* Records that the session has ended, and tells the listeners when it had been signed in.
+	*/
+	markSignedOut() {
+		this.session = Promise.resolve({ isSignedIn: false });
+		this.hasLoadedSession = true;
+		if (this.wasSignedIn) {
+			this.wasSignedIn = false;
+			this.signedOutListeners.forEach((listener) => listener());
+		}
+	}
+	/**
+	* Asks the backend whether the session is still live. The check neither refreshes the session nor
+	* counts as activity, so it can be polled without keeping an idle session alive.
+	*
+	* @returns Whether the session is live. A failed check reports the last known state.
+	*/
+	async checkSession() {
+		this.lastCheck = Date.now();
+		try {
+			const response = await this.send(this.endpoints.checkSession, "GET");
+			if (!response.ok) return this.wasSignedIn;
+			const { isSignedIn } = await response.json();
+			if (!isSignedIn) this.markSignedOut();
+			return isSignedIn;
+		} catch {
+			return this.wasSignedIn;
+		}
+	}
+	/**
+	* Watches for the session ending while the page is open: checks it whenever the page gets focus or
+	* becomes visible again, and every `pollSeconds` while it is visible when that is positive.
+	*
+	* @returns A function that stops watching.
+	*/
+	watch(pollSeconds) {
+		const checkIfSignedIn = () => {
+			if (this.wasSignedIn && document.visibilityState === "visible") this.checkSession();
+		};
+		const onFocus = () => {
+			if (Date.now() - this.lastCheck >= FOCUS_CHECK_THROTTLE) checkIfSignedIn();
+		};
+		document.addEventListener("visibilitychange", onFocus);
+		window.addEventListener("focus", onFocus);
+		const timer = pollSeconds > 0 ? setInterval(checkIfSignedIn, pollSeconds * 1e3) : void 0;
+		return () => {
+			document.removeEventListener("visibilitychange", onFocus);
+			window.removeEventListener("focus", onFocus);
+			if (timer) clearInterval(timer);
+		};
+	}
+	/**
+	* Returns the session. The result is cached until a sign-in, sign-out, or refresh changes it, so
+	* repeated sign-in checks do not reach the server each time.
+	*
+	* @param reload - Read the session from the server even when one is cached.
+	*/
+	getSession(reload = false) {
+		if (reload) this.session = void 0;
+		this.session ??= this.loadSession().catch((error) => {
+			this.session = void 0;
+			throw error;
+		}).finally(() => {
+			this.hasLoadedSession = true;
+		});
+		return this.session;
+	}
+	/**
+	* Whether this client talks to exactly these endpoints.
+	*/
+	hasEndpoints(endpoints) {
+		return Object.keys(endpoints).every((key) => key === "bypass" ? JSON.stringify(this.endpoints.bypass) === JSON.stringify(endpoints.bypass) : this.endpoints[key] === endpoints[key]);
+	}
+	/**
+	* Whether the first session read is still in flight, so it is not yet known whether the user is
+	* signed in.
+	*/
+	isLoading() {
+		return !this.hasLoadedSession;
+	}
+	/**
+	* Refreshes the session once, sharing one request between concurrent callers.
+	*
+	* @returns Whether the session was refreshed. When it was not, the session is now signed out.
+	*/
+	refresh() {
+		this.refreshing ??= this.send(this.endpoints.refresh, "POST").then((response) => {
+			if (response.ok) this.session = void 0;
+			else this.markSignedOut();
+			return response.ok;
+		}).finally(() => {
+			this.refreshing = void 0;
+		});
+		return this.refreshing;
+	}
+	/**
+	* The URL that starts sign-in at the backend and comes back to `returnTo`.
+	*/
+	getSignInUrl(returnTo) {
+		return `${this.endpoints.signIn}?${new URLSearchParams({ returnTo }).toString()}`;
+	}
+	/**
+	* Ends the backend session.
+	*
+	* @returns The URL the browser visits to end the session at the authorization server.
+	*/
+	async signOut() {
+		const response = await this.send(this.endpoints.signOut, "POST");
+		this.wasSignedIn = false;
+		this.session = Promise.resolve({ isSignedIn: false });
+		if (!response.ok) throw new ThunderIDAuthException("SPA-BACKEND_CLIENT-SO-SE01", "Sign out failed.", `The backend sign-out endpoint returned ${response.status}.`);
+		return (await response.json()).redirectUrl;
+	}
+	/**
+	* Maps an API URL to its backend proxy URL.
+	*
+	* @returns The proxy URL, or `undefined` when the URL is not under the API base and so cannot be
+	* sent with the session's credentials.
+	*/
+	toProxyUrl(url) {
+		const { apiBaseUrl, proxy } = this.endpoints;
+		let rest;
+		if (url === apiBaseUrl || url.startsWith(`${apiBaseUrl}/`) || url.startsWith(`${apiBaseUrl}?`)) rest = url.slice(apiBaseUrl.length);
+		else if (url.startsWith("/") && !url.startsWith("//")) rest = url;
+		else return;
+		return `${proxy}${rest.startsWith("/") ? rest : `/${rest}`}`;
+	}
+	/**
+	* Whether a request to this URL skips the proxy and goes straight from the browser.
+	*/
+	isBypassed(url) {
+		return this.endpoints.bypass.urls.some((base) => url === base || url.startsWith(`${base}/`) || url.startsWith(`${base}?`));
+	}
+	/**
+	* Whether requests that skip the proxy carry the access token.
+	*/
+	attachesTokenOnBypass() {
+		return this.endpoints.bypass.attachToken;
+	}
+	/**
+	* Gets an access token for the requests that skip the proxy from the backend's token endpoint. It comes without a
+	* refresh token: when it expires, the caller asks again.
+	*
+	* @returns The token response, as the backend sent it.
+	*/
+	async requestAccessToken() {
+		let response = await this.send(this.endpoints.token, "POST");
+		if (response.status === 401) {
+			const { error } = await response.json().catch(() => ({}));
+			if (error === "session_expired" && await this.refresh()) response = await this.send(this.endpoints.token, "POST");
+			else if (error === "login_required") this.markSignedOut();
+		}
+		if (!response.ok) throw new ThunderIDAuthException("SPA-BACKEND_CLIENT-RAT-SE01", "Failed to get an access token.", `The backend token endpoint returned ${response.status}.`);
+		return await response.json();
+	}
+	/**
+	* The headers and credentials mode every backend request is sent with.
+	*/
+	static requestInit(headers = {}) {
+		return {
+			credentials: "same-origin",
+			headers: {
+				...headers,
+				[BACKEND_REQUEST_HEADER]: BACKEND_REQUEST_HEADER_VALUE
+			}
+		};
+	}
+	async loadSession() {
+		let response = await this.send(this.endpoints.session, "GET");
+		if (response.status === 401 && await this.refresh()) response = await this.send(this.endpoints.session, "GET");
+		if (response.status === 401) return this.signedOutSession();
+		if (!response.ok) throw new ThunderIDAuthException("SPA-BACKEND_CLIENT-GS-SE01", "Failed to read the session.", `The backend session endpoint returned ${response.status}.`);
+		const session = await response.json();
+		if (!session.isSignedIn) return this.signedOutSession();
+		this.wasSignedIn = true;
+		return session;
+	}
+	signedOutSession() {
+		if (this.wasSignedIn) queueMicrotask(() => this.markSignedOut());
+		return { isSignedIn: false };
+	}
+	send(url, method) {
+		return fetch(url, {
+			method,
+			...BackendClient.requestInit({ Accept: "application/json" })
+		});
+	}
+};
+var BackendClient_default = BackendClient;
 
 //#endregion
 //#region src/FetchHttpClient.ts
@@ -82,6 +270,9 @@ var FetchHttpClient = class FetchHttpClient extends HttpClient {
 		if (!this.instances.has(instanceId)) this.instances.set(instanceId, new FetchHttpClient(isHandlerEnabled, attachToken));
 		return this.instances.get(instanceId);
 	}
+	static setInstance(instanceId, client) {
+		this.instances.set(instanceId, client);
+	}
 	static destroyInstance(instanceId = 0) {
 		this.instances.delete(instanceId);
 	}
@@ -141,6 +332,108 @@ var FetchHttpClient = class FetchHttpClient extends HttpClient {
 };
 var FetchHttpClient_default = FetchHttpClient;
 
+//#endregion
+//#region src/BackendHttpClient.ts
+/**
+* The HTTP client used when sign-in runs on the backend. It sends each request through the backend's
+* API proxy with the session cookie instead of attaching a token, and refreshes the session once
+* when the backend reports
+* it expired. Requests under `bypass` go straight there with the cookies and, unless turned off, the
+* access token the backend issued.
+*/
+const hasBackendError = (error, code$1) => error?.response?.status === 401 && error.response.data?.error === code$1;
+const isSessionExpired = (error) => hasBackendError(error, "session_expired");
+var BackendHttpClient = class extends FetchHttpClient_default {
+	/**
+	* @param backend - The backend client.
+	* @param getAccessToken - Returns the access token for bypassed requests; `renew` asks for a new one.
+	*/
+	constructor(backend, getAccessToken) {
+		super(true);
+		this.backend = backend;
+		this.getAccessToken = getAccessToken;
+	}
+	async transport(config) {
+		if (this.backend.isBypassed(config.url ?? "")) return this.sendBypassed(config);
+		const proxyUrl = this.backend.toProxyUrl(config.url ?? "");
+		if (!proxyUrl) throw Object.assign(/* @__PURE__ */ new Error(`"${config.url}" is not under the backend API base, so it cannot be sent.`), {
+			code: "BACKEND_UNSUPPORTED_URL",
+			config
+		});
+		const send = () => super.transport({
+			...config,
+			...BackendClient_default.requestInit(config.headers),
+			url: proxyUrl
+		});
+		try {
+			return await send();
+		} catch (error) {
+			if (isSessionExpired(error) && await this.backend.refresh()) return send();
+			if (hasBackendError(error, "login_required")) this.backend.markSignedOut();
+			throw error;
+		}
+	}
+	/**
+	* Sends a request straight to its URL, skipping the proxy, with the cookies and the access token.
+	* When the API rejects the token, it gets a new one and retries once.
+	*/
+	async sendBypassed(config) {
+		if (!this.backend.attachesTokenOnBypass()) return super.transport({
+			...config,
+			credentials: "include"
+		});
+		const send = async (renew) => super.transport({
+			...config,
+			credentials: "include",
+			headers: {
+				...config.headers,
+				Authorization: `Bearer ${await this.getAccessToken(renew)}`
+			}
+		});
+		try {
+			return await send(false);
+		} catch (error) {
+			if (error.response?.status === 401) return send(true);
+			throw error;
+		}
+	}
+};
+var BackendHttpClient_default = BackendHttpClient;
+
+//#endregion
+//#region src/constants/Hooks.ts
+/**
+* Event hook names for attaching callbacks via `ThunderIDBrowserClient.on()`.
+*/
+let Hooks = /* @__PURE__ */ function(Hooks$1) {
+	Hooks$1["SignIn"] = "sign-in";
+	Hooks$1["SignOut"] = "sign-out";
+	Hooks$1["Initialize"] = "initialize";
+	Hooks$1["HttpRequestStart"] = "http-request-start";
+	Hooks$1["HttpRequestFinish"] = "http-request-finish";
+	Hooks$1["HttpRequestError"] = "http-request-error";
+	Hooks$1["HttpRequestSuccess"] = "http-request-success";
+	Hooks$1["RevokeAccessToken"] = "revoke-access-token";
+	Hooks$1["CustomGrant"] = "custom-grant";
+	Hooks$1["SignOutFailed"] = "sign-out-failed";
+	return Hooks$1;
+}({});
+var Hooks_default = Hooks;
+
+//#endregion
+//#region src/constants/SPAConstants.ts
+const ERROR = "error";
+const ERROR_DESCRIPTION = "error_description";
+const CUSTOM_GRANT_CONFIG = "custom_grant_config";
+const STATE_QUERY = "state";
+const SILENT_SIGN_IN_STATE = "sign-in-silently";
+const SILENT_SIGN_IN_TIMEOUT = 1e4;
+const ACCESS_TOKEN_INVALID = "Access token is invalid";
+const REFRESH_ACCESS_TOKEN_ERR0R = "refresh-access-token-error";
+const TOKEN_REQUEST_CONFIG_KEY = "token_request_config";
+const SILENT_SIGN_IN_SIGNED_IN = "silent_sign_in_signed_in";
+const SILENT_SIGN_IN_SIGNED_OUT = "silent_sign_in_signed_out";
+
 //#endregion
 //#region src/models/BrowserStorage.ts
 /**
@@ -2513,6 +2806,9 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	_hookCallbacks = /* @__PURE__ */ new Map();
 	_initialized = false;
 	_startedInitialize = false;
+	_backend;
+	_stopBackendWatch;
+	_backendTokenRequest;
 	constructor(instanceId = 0) {
 		super(void 0, new SPACryptoUtils_default());
 		this._browserInstanceId = instanceId;
@@ -2536,7 +2832,29 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		const attachToken = async (request) => {
 			await this._authHelper?.attachTokenToRequestConfig(request);
 		};
-		this._httpClient = FetchHttpClient_default.getInstance(this._browserInstanceId, true, attachToken);
+		const backendEndpoints = resolveBackendEndpoints(merged, window.location.origin);
+		if (backendEndpoints) {
+			if (!this._backend?.hasEndpoints(backendEndpoints)) {
+				this._backend = new BackendClient_default(backendEndpoints);
+				this._backend.onSignedOut(() => {
+					this.getStorageManager().removeSessionData();
+					this._emitHook(Hooks_default.SignOut);
+				});
+			}
+			this._stopBackendWatch?.();
+			const { session } = merged;
+			this._stopBackendWatch = this._backend.watch(Number(session?.checkInterval ?? 0));
+			this._httpClient = new BackendHttpClient_default(this._backend, (renew) => this._getBackendAccessToken(renew));
+			FetchHttpClient_default.setInstance(this._browserInstanceId, this._httpClient);
+			this._backend.getSession().catch((error) => {
+				logger$2.debug("Could not read the backend session.", error);
+			});
+		} else {
+			this._stopBackendWatch?.();
+			this._stopBackendWatch = void 0;
+			this._backend = void 0;
+			this._httpClient = FetchHttpClient_default.getInstance(this._browserInstanceId, true, attachToken);
+		}
 		this._httpClient.setHttpRequestStartCallback((request) => {
 			this._emitHook(Hooks_default.HttpRequestStart, request);
 		});
@@ -2581,10 +2899,25 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		return true;
 	}
 	isLoading() {
-		return false;
+		return this._backend?.isLoading() ?? false;
+	}
+	/**
+	* Whether sign-in runs on the app's backend, which holds the tokens so the browser never does.
+	*/
+	isBackendMode() {
+		return this._backend !== void 0;
+	}
+	_rejectInBackendMode(operation) {
+		return Promise.reject(new ThunderIDAuthException("SPA-AUTH_CLIENT-BACKEND-NS01", "Not supported when sign-in runs on the backend.", `${operation} is not available when sign-in runs on the backend, because the browser holds no tokens.`));
 	}
 	async signIn(config, authorizationCode, state, tokenRequestConfig) {
 		await this.isInitialized();
+		if (this._backend) {
+			if (config?.callOnlyOnRedirect) return;
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`);
+			await SPAUtils_default.waitTillPageRedirect();
+			return;
+		}
 		if (!SPAUtils_default.canContinueSignIn(Boolean(config?.callOnlyOnRedirect), authorizationCode)) return;
 		delete config?.callOnlyOnRedirect;
 		const user = await this._signInInternal(config, authorizationCode, state, tokenRequestConfig);
@@ -2655,6 +2988,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async signInSilently(additionalParams, tokenRequestConfig) {
 		await this.isInitialized();
+		if (this._backend) return await this.isSignedIn() ? this.getUser() : false;
 		if (SPAUtils_default.wasSignInCalled()) return;
 		const response = await this._signInSilentlyInternal(additionalParams, tokenRequestConfig);
 		if (response) this._emitHook(Hooks_default.SignIn, response);
@@ -2672,6 +3006,14 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 			sessionId = sessionIdOrAfterSignOut;
 			afterSignOut = afterSignOutParam;
 		}
+		if (this._backend) {
+			await this.getStorageManager().removeSessionData();
+			const backendSignOutUrl = await this._backend.signOut();
+			afterSignOut?.(backendSignOutUrl);
+			location.href = backendSignOutUrl;
+			await SPAUtils_default.waitTillPageRedirect();
+			return backendSignOutUrl;
+		}
 		const config = await this.getStorageManager().getConfigData();
 		let signOutUrl = "";
 		if (config?.rpInitiatedLogout !== false) {
@@ -2703,18 +3045,31 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async httpRequest(requestConfig) {
 		await this._validateMethod(false);
+		if (this._backend) return this._backendRequest(requestConfig);
 		const response = await this._authHelper.httpRequest(this._httpClient, requestConfig, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
 		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
 		return response;
 	}
 	async httpRequestAll(configs) {
 		await this._validateMethod(false);
+		if (this._backend) return Promise.all(configs.map((requestConfig) => this._backendRequest(requestConfig)));
 		const responses = await this._authHelper.httpRequestAll(configs, this._httpClient, this._isHttpHandlerEnabled, this._emitHttpError, this._emitHttpFinish);
 		if (this._isHttpHandlerEnabled) this._emitHttpFinish();
 		return responses;
 	}
+	async _backendRequest(requestConfig) {
+		try {
+			return await this._httpClient.request(requestConfig);
+		} catch (error) {
+			if (this._isHttpHandlerEnabled) await this._emitHttpError(error);
+			throw error;
+		} finally {
+			if (this._isHttpHandlerEnabled) this._emitHttpFinish();
+		}
+	}
 	async getUser(userId) {
 		await this._validateMethod();
+		if (this._backend) return (await this._backend.getSession()).user ?? {};
 		return super.getUser(userId);
 	}
 	/**
@@ -2738,13 +3093,38 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		};
 	}
 	async getAccessToken(sessionId) {
+		if (this._backend) return this._getBackendAccessToken();
 		return super.getAccessToken(sessionId);
 	}
+	/**
+	* The access token for requests under `endpoints.backend.bypass`. Like a client credentials token it
+	* has no refresh token: it is kept in the session storage until it nears expiry, then requested again.
+	*
+	* @param renew - Request a new token even when the stored one is still valid.
+	*/
+	async _getBackendAccessToken(renew = false) {
+		const storageManager = this.getStorageManager();
+		const session = await storageManager.getSessionData();
+		const expiresAt = (session?.created_at ?? 0) + Number(session?.expires_in ?? 0) * 1e3;
+		if (!renew && session?.access_token && expiresAt - TokenConstants.Lifecycle.CLIENT_CREDENTIALS_REFRESH_MARGIN_MS > Date.now()) return session.access_token;
+		this._backendTokenRequest ??= this._backend.requestAccessToken().then(async (response) => {
+			await storageManager.setSessionData({
+				...response,
+				created_at: Date.now()
+			});
+			return response.access_token ?? "";
+		}).finally(() => {
+			this._backendTokenRequest = void 0;
+		});
+		return this._backendTokenRequest;
+	}
 	async getDecodedIdToken(userId, idToken) {
 		await this._validateMethod();
+		if (this._backend) return (await this._backend.getSession()).user ?? {};
 		return super.getDecodedIdToken(userId, idToken);
 	}
 	async getIdToken(userId) {
+		if (this._backend) return this._rejectInBackendMode("getIdToken");
 		await this._validateMethod();
 		return super.getIdToken(userId);
 	}
@@ -2762,6 +3142,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async isSignedIn(userId) {
 		await this.isInitialized();
+		if (this._backend) return (await this._backend.getSession()).isSignedIn;
 		return super.isSignedIn(userId);
 	}
 	notifySignIn(user) {
@@ -2769,10 +3150,15 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async isSessionActive() {
 		await this.isInitialized();
+		if (this._backend) return this.isSignedIn();
 		return await this.getStorageManager().getSessionStatus() === "true";
 	}
 	async refreshAccessToken(userId) {
 		await this._validateMethod(false);
+		if (this._backend) {
+			if (!await this._backend.refresh()) return Promise.reject(new ThunderIDAuthException("SPA-AUTH_CLIENT-BACKEND-RF01", "Refresh failed.", "The backend could not refresh the session."));
+			return this.getUser();
+		}
 		try {
 			return await this._authHelper.refreshAccessToken((cfg) => this._enableRetrievingSignOutURLFromSession(cfg));
 		} catch (error) {
@@ -2780,6 +3166,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		}
 	}
 	async revokeAccessToken(userId) {
+		if (this._backend) return this._rejectInBackendMode("revokeAccessToken");
 		await this._validateMethod();
 		const timer = await this._spaHelper.getRefreshTimeoutTimer();
 		await super.revokeAccessToken(userId);
@@ -2788,6 +3175,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		return true;
 	}
 	async exchangeToken(config) {
+		if (this._backend) return this._rejectInBackendMode("exchangeToken");
 		if (config.signInRequired) await this._validateMethod();
 		if (!config.id) return Promise.reject(new ThunderIDAuthException("SPA-AUTH_CLIENT-RCG-NF01", "The custom grant request id not found.", "Set the `id` attribute on the token exchange config."));
 		const response = await this._authHelper.exchangeToken(config, (cfg) => this._enableRetrievingSignOutURLFromSession(cfg));
@@ -2800,6 +3188,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	}
 	async startAutoRefreshToken() {
 		await this.isInitialized();
+		if (this._backend) return;
 		await this._spaHelper.clearRefreshTokenTimeout();
 		await this._spaHelper.refreshAccessTokenAutomatically(() => this.refreshAccessToken());
 	}
@@ -2841,6 +3230,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 				this._addHookCallback(hook, callback);
 				break;
 			case Hooks_default.SignOut:
+				this._addHookCallback(hook, callback);
 				if (await SPAUtils_default.isSignOutSuccessful(ThunderIDBrowserClient.isSignOutSuccessful.bind(ThunderIDBrowserClient), () => ThunderIDBrowserClient.clearSession())) callback();
 				break;
 			case Hooks_default.CustomGrant:
@@ -3817,5 +4207,5 @@ const normalizeBorderRadius = (raw) => {
 var normalizeBorderRadius_default = normalizeBorderRadius;
 
 //#endregion
-export { ACCESS_TOKEN_INVALID, ANONYMOUS_ANIMAL_ICONS, ANONYMOUS_ENTITY_ICONS, AVATAR_GRADIENT_COUNT, AVATAR_URI_SCHEME, AuthenticationHelper_default as AuthenticationHelper, Hooks as BrowserHooks, BrowserStorage_default as BrowserStorage, CUSTOM_GRANT_CONFIG, ERROR, ERROR_DESCRIPTION, FetchHttpClient_default as FetchHttpClient, Hooks_default as Hooks, LocalStore_default as LocalStore, MemoryStore_default as MemoryStore, REFRESH_ACCESS_TOKEN_ERR0R, SILENT_SIGN_IN_SIGNED_IN, SILENT_SIGN_IN_SIGNED_OUT, SILENT_SIGN_IN_STATE, SILENT_SIGN_IN_TIMEOUT, SPACryptoUtils_default as SPACryptoUtils, SPAHelper_default as SPAHelper, SPAUtils_default as SPAUtils, STATE_QUERY, SessionStore_default as SessionStore, TOKEN_REQUEST_CONFIG_KEY, ThunderIDBrowserClient_default as ThunderIDBrowserClient, buildAvatarSpec_default as buildAvatarSpec, copyTextToClipboard_default as copyTextToClipboard, createClassObserver, createHttpClientFetcher_default as createHttpClientFetcher, createMediaQueryListener, deriveAvatarContent, detectThemeMode, extractAvatarParamsFromUri_default as extractAvatarParamsFromUri, generateAvatarDataUri_default as generateAvatarDataUri, getActiveTheme_default as getActiveTheme, handleWebAuthnAuthentication_default as handleWebAuthnAuthentication, hasAuthParamsInUrl_default as hasAuthParamsInUrl, hasCalledForThisInstanceInUrl_default as hasCalledForThisInstanceInUrl, http_default as http, isAvatarUri_default as isAvatarUri, navigate_default as navigate, normalizeBorderRadius_default as normalizeBorderRadius, pickAnonymousAvatarName_default as pickAnonymousAvatarName, pickAnonymousEntityName_default as pickAnonymousEntityName, resolveEmojiUrisInHtml_default as resolveEmojiUrisInHtml, resolveLogoUri_default as resolveLogoUri };
+export { ACCESS_TOKEN_INVALID, ANONYMOUS_ANIMAL_ICONS, ANONYMOUS_ENTITY_ICONS, AVATAR_GRADIENT_COUNT, AVATAR_URI_SCHEME, AuthenticationHelper_default as AuthenticationHelper, BACKEND_REQUEST_HEADER, BackendClient_default as BackendClient, BackendHttpClient_default as BackendHttpClient, Hooks as BrowserHooks, BrowserStorage_default as BrowserStorage, CUSTOM_GRANT_CONFIG, ERROR, ERROR_DESCRIPTION, FetchHttpClient_default as FetchHttpClient, Hooks_default as Hooks, LocalStore_default as LocalStore, MemoryStore_default as MemoryStore, REFRESH_ACCESS_TOKEN_ERR0R, SILENT_SIGN_IN_SIGNED_IN, SILENT_SIGN_IN_SIGNED_OUT, SILENT_SIGN_IN_STATE, SILENT_SIGN_IN_TIMEOUT, SPACryptoUtils_default as SPACryptoUtils, SPAHelper_default as SPAHelper, SPAUtils_default as SPAUtils, STATE_QUERY, SessionStore_default as SessionStore, TOKEN_REQUEST_CONFIG_KEY, ThunderIDBrowserClient_default as ThunderIDBrowserClient, buildAvatarSpec_default as buildAvatarSpec, copyTextToClipboard_default as copyTextToClipboard, createClassObserver, createHttpClientFetcher_default as createHttpClientFetcher, createMediaQueryListener, deriveAvatarContent, detectThemeMode, extractAvatarParamsFromUri_default as extractAvatarParamsFromUri, generateAvatarDataUri_default as generateAvatarDataUri, getActiveTheme_default as getActiveTheme, handleWebAuthnAuthentication_default as handleWebAuthnAuthentication, hasAuthParamsInUrl_default as hasAuthParamsInUrl, hasCalledForThisInstanceInUrl_default as hasCalledForThisInstanceInUrl, http_default as http, isAvatarUri_default as isAvatarUri, navigate_default as navigate, normalizeBorderRadius_default as normalizeBorderRadius, pickAnonymousAvatarName_default as pickAnonymousAvatarName, pickAnonymousEntityName_default as pickAnonymousEntityName, resolveEmojiUrisInHtml_default as resolveEmojiUrisInHtml, resolveLogoUri_default as resolveLogoUri };
 //# sourceMappingURL=index.js.map