@thunderid/browser 1.9.0 → 1.9.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveApiBaseUrl, resolveBackendEndpoints, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -220,11 +220,12 @@ var BackendClient = class BackendClient {
 		return await response.json();
 	}
 	/**
-	* The headers and credentials mode every backend request is sent with.
+	* The headers and credentials mode every backend request is sent with. The cookies go with every
+	* request, so a backend on another origin works too when its CORS allows credentials.
 	*/
 	static requestInit(headers = {}) {
 		return {
-			credentials: "same-origin",
+			credentials: "include",
 			headers: {
 				...headers,
 				[BACKEND_REQUEST_HEADER]: BACKEND_REQUEST_HEADER_VALUE
@@ -3083,7 +3084,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await this._validateMethod();
 		const configData = await this.getStorageManager().getConfigData();
 		const profile = await getUsersMe({
-			baseUrl: options?.baseUrl ?? configData?.baseUrl,
+			baseUrl: options?.baseUrl ?? resolveApiBaseUrl(configData),
 			fetcher: createHttpClientFetcher_default(this._browserInstanceId),
 			url: resolveResourceEndpoint("usersMe", configData, options?.url)
 		});
@@ -3097,6 +3098,23 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		return super.getAccessToken(sessionId);
 	}
 	/**
+	* The permissions the signed-in user's access token grants, for example to hide a page the user
+	* cannot use. The server still checks every request.
+	*
+	* In backend mode they come only from the backend's session (`scope`): the token stays on the backend,
+	* so a session without `scope` grants nothing. Otherwise they are read from the access token's `scope`
+	* or `scopes` claim.
+	*
+	* @returns The granted permissions, or an empty list when none can be read.
+	*/
+	async getGrantedPermissions() {
+		if (this._backend) {
+			const { scope } = await this._backend.getSession();
+			return typeof scope === "string" ? scope.split(" ").filter((entry) => entry.length > 0) : [];
+		}
+		return getTokenPermissions(await this.getAccessToken());
+	}
+	/**
 	* The access token for requests under `endpoints.backend.bypass`. Like a client credentials token it
 	* has no refresh token: it is kept in the session storage until it nears expiry, then requested again.
 	*