@thunderid/express 0.0.3 → 0.0.5

package/dist/index.js

@@ -1,12 +1,11 @@
-import { LegacyThunderIDNodeClient, Logger, ThunderIDAuthException } from "@thunderid/node";
+import { ThunderIDAuthException, ThunderIDNodeClient, ThunderIDRuntimeError, executeEmbeddedSignInFlowV2, logger } from "@thunderid/node";
 import { v4 } from "uuid";
-import express from "express";
 
 export * from "@thunderid/node"
 
-//#region src/__legacy__/constants/default-options.ts
+//#region src/constants/CookieConfig.ts
 /**
-* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
 *
 * WSO2 LLC. licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file except
@@ -22,206 +21,335 @@ export * from "@thunderid/node"
 * specific language governing permissions and limitations
 * under the License.
 */
-let CookieConfig = /* @__PURE__ */ function(CookieConfig$1) {
-	CookieConfig$1[CookieConfig$1["defaultMaxAge"] = 9e4] = "defaultMaxAge";
-	CookieConfig$1["defaultHttpOnly"] = "true";
-	CookieConfig$1["defaultSameSite"] = "lax";
-	CookieConfig$1["defaultSecure"] = "false";
-	return CookieConfig$1;
-}({});
-const DEFAULT_LOGIN_PATH = "/login";
-const DEFAULT_LOGOUT_PATH = "/logout";
+/** Session cookie name used across the Express SDK. */
+const SESSION_COOKIE_NAME = "THUNDERID_SESSION_ID";
+/** Default cookie configuration values. */
+const CookieConfig = {
+	defaultExpirySeconds: 86400,
+	defaultHttpOnly: true,
+	defaultSameSite: "lax",
+	defaultSecure: false
+};
+var CookieConfig_default = CookieConfig;
 
 //#endregion
-//#region src/__legacy__/middleware/protect-route.ts
-const protectRoute = (thunderIDExpressClient, callback) => {
-	return async (req, res, next) => {
-		if (req.cookies.THUNDERID_SESSION_ID === void 0) {
-			Logger.error("No session ID found in the request cookies");
-			if (callback(res, "Unauthenticated")) return;
-			return next();
-		} else if (await thunderIDExpressClient.isSignedIn(req.cookies.THUNDERID_SESSION_ID)) return next();
-		else {
-			Logger.error("Invalid session ID found in the request cookies");
-			if (callback(res, "Invalid session cookie")) return;
-			return next();
-		}
-	};
+//#region src/utils/expressUtils.ts
+/**
+* Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+*
+* WSO2 LLC. licenses this file to you under the Apache License,
+* Version 2.0 (the "License"); you may not use this file except
+* in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing,
+* software distributed under the License is distributed on an
+* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+* KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations
+* under the License.
+*/
+const AUTH_ERROR_REGEXP = /[?&]error=[^&]+/;
+/**
+* Returns `true` if the given URL contains an OAuth error query parameter.
+*
+* @param url - The URL to inspect.
+*/
+const hasErrorInURL = (url) => AUTH_ERROR_REGEXP.test(url);
+var expressUtils_default = hasErrorInURL;
+
+//#endregion
+//#region src/ThunderIDExpressClient.ts
+var ThunderIDExpressClient = class extends ThunderIDNodeClient {
+	_expressConfig;
+	constructor() {
+		super();
+	}
+	async initialize(config, storage) {
+		this._expressConfig = config;
+		return super.initialize(config, storage);
+	}
+	get expressConfig() {
+		return this._expressConfig;
+	}
+	async getUserFromRequest(req) {
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		return this.getUser(sessionId);
+	}
+	async signIn(req, res, next, signInConfig) {
+		if (expressUtils_default(req.originalUrl)) return Promise.reject(new ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
+		let userId = req.cookies?.[SESSION_COOKIE_NAME];
+		if (!userId) userId = v4();
+		const sc = this._expressConfig?.sessionCookie;
+		const authRedirectCallback = (url) => {
+			if (!url) return;
+			res.cookie(SESSION_COOKIE_NAME, userId, {
+				httpOnly: sc?.httpOnly ?? CookieConfig_default.defaultHttpOnly,
+				maxAge: (sc?.expiryTime ?? CookieConfig_default.defaultExpirySeconds) * 1e3,
+				sameSite: sc?.sameSite ?? CookieConfig_default.defaultSameSite,
+				secure: sc?.secure ?? CookieConfig_default.defaultSecure
+			});
+			res.redirect(url);
+			if (typeof next === "function") next();
+		};
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query.code, req.query.session_state, req.query.state, signInConfig);
+		if (authResponse.accessToken || authResponse.idToken) return authResponse;
+		return {
+			accessToken: "",
+			createdAt: 0,
+			expiresIn: "",
+			idToken: "",
+			refreshToken: "",
+			scope: "",
+			tokenType: ""
+		};
+	}
+	async signOut(userId) {
+		return super.signOut(userId);
+	}
 };
+var ThunderIDExpressClient_default = ThunderIDExpressClient;
 
 //#endregion
-//#region src/__legacy__/middleware/authentication.ts
-const thunderIDExpressAuth = (thunderIDExpressClient, config, onSignIn, onSignOut, onError) => {
-	const router = new express.Router();
-	router.use(async (req, res, next) => {
-		req.thunderIDAuth = thunderIDExpressClient;
-		res.thunderIDAuth = thunderIDExpressClient;
+//#region src/middleware/authentication.ts
+/**
+* Returns Express middleware that initialises the ThunderID client and attaches
+* it to `req.thunderIDAuth` for use in route handlers and `protect()`.
+*
+* Unlike the old `thunderID()` router, this function does **not** mount any
+* routes automatically. Register sign-in and sign-out handlers explicitly:
+*
+* ```ts
+* app.use(thunderID(config));
+* app.get('/login',  handleSignIn());
+* app.get('/logout', handleSignOut());
+* ```
+*
+* @param config - ThunderID Express configuration.
+*/
+const thunderID = (config) => {
+	const client = new ThunderIDExpressClient_default();
+	let initPromise;
+	const getInitPromise = (req) => {
+		if (initPromise === void 0) {
+			const origin = `${req.protocol}://${req.get("host")}`;
+			initPromise = client.initialize({
+				...config,
+				afterSignInUrl: config.afterSignInUrl ?? `${origin}/login`,
+				afterSignOutUrl: config.afterSignOutUrl ?? `${origin}/logout`
+			});
+		}
+		return initPromise;
+	};
+	return async (req, res, next) => {
+		await getInitPromise(req);
+		req.thunderIDAuth = client;
+		res.thunderIDAuth = client;
 		next();
-	});
-	router.get(config.loginPath || DEFAULT_LOGIN_PATH, async (req, res, next) => {
+	};
+};
+/**
+* Returns an Express route handler for the sign-in path.
+*
+* - If the request has no `?code` query param, initiates the OAuth 2.0 redirect.
+* - If the request has `?code`, exchanges the authorization code for tokens,
+*   sets the session cookie, and calls `onSignIn`.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+*
+* ```ts
+* app.get('/login', handleSignIn());
+* ```
+*/
+const handleSignIn = () => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before handleSignIn()");
+			res.status(500).end();
+			return;
+		}
+		const config = client.expressConfig;
+		const onSignIn = config?.onSignIn ?? ((r) => r.end());
+		const onError = config?.onError ?? ((r, e) => {
+			logger.error(e.message);
+			r.status(500).end();
+		});
 		try {
-			const response = await thunderIDExpressClient.signIn(req, res, next, config.signInConfig);
+			const response = await client.signIn(req, res, next, config?.signInOptions);
 			if (response.accessToken || response.idToken) onSignIn(res, response);
 		} catch (e) {
-			Logger.error(e.message);
+			logger.error(e.message);
 			onError(res, e);
 		}
-	});
-	router.get(config.logoutPath || DEFAULT_LOGOUT_PATH, async (req, res, next) => {
+	};
+};
+/**
+* Returns an Express route handler for the sign-out path.
+*
+* - Clears the session cookie and redirects to the identity provider's
+*   end-session endpoint.
+* - When the identity provider redirects back with `?state=sign_out_success`,
+*   calls `onSignOut`.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+*
+* ```ts
+* app.get('/logout', handleSignOut());
+* ```
+*/
+const handleSignOut = () => {
+	return async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before handleSignOut()");
+			res.status(500).end();
+			return;
+		}
+		const config = client.expressConfig;
+		const onSignOut = config?.onSignOut ?? ((r) => r.end());
+		const onError = config?.onError ?? ((r, e) => {
+			logger.error(e.message);
+			r.status(500).end();
+		});
 		if (req.query.state === "sign_out_success") {
 			onSignOut(res);
 			return;
 		}
-		if (req.cookies.THUNDERID_SESSION_ID === void 0) {
-			onError(res, new ThunderIDAuthException("EXPRESS-AUTH_MW-LOGOUT-NF01", "No cookie found in the request", "No cookie was sent with the request. The user may not have signed in yet."));
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		if (!sessionId) {
+			onError(res, new ThunderIDRuntimeError("No cookie found in the request", "EXPRESS-AUTH_MW-LOGOUT-NF01", "express"));
 			return;
-		} else try {
-			const signOutURL = await req.thunderIDAuth.signOut(req.cookies.THUNDERID_SESSION_ID);
+		}
+		try {
+			const signOutURL = await client.signOut(sessionId);
 			if (signOutURL) {
-				res.cookie("THUNDERID_SESSION_ID", null, { maxAge: 0 });
+				res.cookie(SESSION_COOKIE_NAME, null, { maxAge: 0 });
 				res.redirect(signOutURL);
-				return;
 			}
 		} catch (e) {
 			onError(res, e);
-			return;
 		}
-	});
-	return router;
+	};
 };
 
 //#endregion
-//#region src/__legacy__/utils/express-utils.ts
-var ExpressUtils = class {
-	static AUTH_CODE_REGEXP = /[?&]error=[^&]+/;
-	/**
-	* Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
-	*
-	* WSO2 LLC. licenses this file to you under the Apache License,
-	* Version 2.0 (the "License"); you may not use this file except
-	* in compliance with the License.
-	* You may obtain a copy of the License at
-	*
-	*     http://www.apache.org/licenses/LICENSE-2.0
-	*
-	* Unless required by applicable law or agreed to in writing,
-	* software distributed under the License is distributed on an
-	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-	* KIND, either express or implied. See the License for the
-	* specific language governing permissions and limitations
-	* under the License.
-	*/
-	static hasErrorInURL(url) {
-		return this.AUTH_CODE_REGEXP.test(url);
-	}
+//#region src/middleware/protect.ts
+/**
+* Returns Express middleware that blocks unauthenticated requests.
+* Requires `thunderID()` to be mounted before this middleware so that
+* `req.thunderIDAuth` is populated.
+*
+* @param onUnauthenticated - Called when the session is missing or invalid.
+*   Defaults to sending a 401 response.
+*/
+const protect = (onUnauthenticated) => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		const sessionId = req.cookies?.[SESSION_COOKIE_NAME];
+		const reject = () => {
+			if (onUnauthenticated) onUnauthenticated(res);
+			else res.status(401).end();
+		};
+		if (!client || !sessionId) {
+			logger.error("No session ID found in the request cookies");
+			reject();
+			return;
+		}
+		if (await client.isSignedIn(sessionId)) return next();
+		logger.error("Invalid session ID found in the request cookies");
+		reject();
+	};
 };
+var protect_default = protect;
 
 //#endregion
-//#region src/__legacy__/client.ts
-var ThunderIDExpressClient = class ThunderIDExpressClient {
-	_authClient;
-	_storage;
-	static _clientConfig;
-	static _instance;
-	constructor(config, storage) {
-		ThunderIDExpressClient._clientConfig = { ...config };
-		const nodeClientConfig = {
-			...config,
-			afterSignInUrl: config.appURL + (config.loginPath || DEFAULT_LOGIN_PATH),
-			afterSignOutUrl: config.appURL + (config.logoutPath || DEFAULT_LOGOUT_PATH)
-		};
-		if (storage) {
-			Logger.debug("Initializing user provided storage");
-			this._storage = storage;
+//#region src/middleware/flow.ts
+/**
+* Returns an Express route handler that drives the embedded sign-in flow loop.
+*
+* Requires `thunderID()` middleware with `mode: 'embedded'` to be mounted first.
+* On each POST, the handler advances the flow one step and returns JSON.
+*
+* **First call** — no `executionId`:
+* ```json
+* { "applicationId": "app-id", "flowType": "SIGN_IN" }
+* ```
+* Response includes `executionId`, `challengeToken`, `authId`, and `components`
+* (the UI elements to render).
+*
+* **Subsequent calls** — continue the flow:
+* ```json
+* { "executionId": "...", "challengeToken": "...", "authId": "...", "inputs": { ... } }
+* ```
+*
+* **On completion** — flow returns `{ "done": true, "redirectUrl": "/login?code=..." }`.
+* The client navigates to `redirectUrl`, which is handled by `handleSignIn()` to
+* exchange the code and set the session cookie.
+*
+* ```ts
+* app.use(thunderID({ ..., mode: 'embedded' }));
+* app.get('/login',          handleSignIn());
+* app.post('/flow/sign-in',  handleFlow());
+* app.get('/logout',         handleSignOut());
+* ```
+*/
+const handleFlow = () => {
+	return async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before handleFlow()");
+			res.status(500).json({ error: "SDK not initialised" });
+			return;
 		}
-		this._authClient = new LegacyThunderIDNodeClient();
-		this._authClient.initialize(nodeClientConfig, this._storage);
-	}
-	static getInstance(config, storage) {
-		if (!ThunderIDExpressClient._instance && config) {
-			ThunderIDExpressClient._instance = new ThunderIDExpressClient(config, storage);
-			Logger.debug("Initialized ThunderIDExpressClient successfully");
+		const baseUrl = client.expressConfig?.baseUrl;
+		if (!baseUrl) {
+			res.status(500).json({ error: "baseUrl is not configured" });
+			return;
 		}
-		if (!ThunderIDExpressClient._instance && !config) throw Error(new ThunderIDAuthException("EXPRESS-CLIENT-GI1-NF01", "User configuration  is not found", "User config has not been passed to initialize ThunderIDExpressClient").toString());
-		return ThunderIDExpressClient._instance;
-	}
-	async signIn(req, res, next, signInConfig) {
-		if (ExpressUtils.hasErrorInURL(req.originalUrl)) return Promise.reject(new ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
-		let userId = req.cookies.THUNDERID_SESSION_ID;
-		if (!userId) userId = v4();
-		const authRedirectCallback = (url) => {
-			if (url) {
-				Logger.debug("Redirecting to: " + url);
-				res.cookie("THUNDERID_SESSION_ID", userId, {
-					maxAge: ThunderIDExpressClient._clientConfig.cookieConfig?.maxAge ? ThunderIDExpressClient._clientConfig.cookieConfig.maxAge : CookieConfig.defaultMaxAge,
-					httpOnly: ThunderIDExpressClient._clientConfig.cookieConfig?.httpOnly ?? CookieConfig.defaultHttpOnly,
-					sameSite: ThunderIDExpressClient._clientConfig.cookieConfig?.sameSite ?? CookieConfig.defaultSameSite,
-					secure: ThunderIDExpressClient._clientConfig.cookieConfig?.secure ?? CookieConfig.defaultSecure
+		const { applicationId, flowType, executionId, challengeToken, authId, inputs } = req.body ?? {};
+		try {
+			let resolvedAuthId = authId;
+			if (!executionId && !resolvedAuthId) {
+				const authUrl = await client.getSignInUrl();
+				resolvedAuthId = new URL(authUrl).searchParams.get("authId") ?? void 0;
+			}
+			const flowResponse = await executeEmbeddedSignInFlowV2({
+				authId: resolvedAuthId,
+				baseUrl,
+				payload: executionId ? {
+					action: "submit",
+					challengeToken,
+					executionId,
+					inputs
+				} : {
+					applicationId,
+					flowType: flowType ?? "SIGN_IN"
+				}
+			});
+			if (flowResponse.redirectUrl) {
+				res.json({
+					done: true,
+					redirectUrl: flowResponse.redirectUrl
 				});
-				res.redirect(url);
-				next && typeof next === "function" && next();
+				return;
 			}
-		};
-		const authResponse = await this._authClient.signIn(authRedirectCallback, userId, req.query.code, req.query.session_state, req.query.state, signInConfig);
-		if (authResponse.accessToken || authResponse.idToken) return authResponse;
-		else return {
-			accessToken: "",
-			createdAt: 0,
-			expiresIn: "",
-			idToken: "",
-			refreshToken: "",
-			scope: "",
-			tokenType: ""
-		};
-	}
-	async signOut(userId) {
-		return this._authClient.signOut(userId);
-	}
-	async isSignedIn(userId) {
-		return this._authClient.isSignedIn(userId);
-	}
-	async getIdToken(userId) {
-		return this._authClient.getIdToken(userId);
-	}
-	async getUser(userId) {
-		return this._authClient.getUser(userId);
-	}
-	async getOpenIDProviderEndpoints() {
-		return this._authClient.getOpenIDProviderEndpoints();
-	}
-	async getDecodedIdToken(userId) {
-		return this._authClient.getDecodedIdToken(userId);
-	}
-	async getAccessToken(userId) {
-		return this._authClient.getAccessToken(userId);
-	}
-	async exchangeToken(config, userId) {
-		return this._authClient.exchangeToken(config, userId);
-	}
-	async reInitialize(config) {
-		return this._authClient.reInitialize(config);
-	}
-	async revokeAccessToken(userId) {
-		return this._authClient.revokeAccessToken(userId);
-	}
-	static didSignOutFail(afterSignOutUrl) {
-		return LegacyThunderIDNodeClient.didSignOutFail(afterSignOutUrl);
-	}
-	static isSignOutSuccessful(afterSignOutUrl) {
-		return LegacyThunderIDNodeClient.isSignOutSuccessful(afterSignOutUrl);
-	}
-	static protectRoute(callback) {
-		if (!this._instance) throw new ThunderIDAuthException("EXPRESS-CLIENT-PR-NF01", "ThunderIDExpressClient is not instantiated", "Create an instance of ThunderIDExpressClient before using calling this method.");
-		return protectRoute(this._instance, callback);
-	}
-	static thunderIDExpressAuth(onSignIn, onSignOut, onError) {
-		if (!this._instance) throw new ThunderIDAuthException("EXPRESS-CLIENT-AEA-NF01", "ThunderIDExpressClient is not instantiated", "Create an instance of ThunderIDExpressClient before using calling this method.");
-		return thunderIDExpressAuth(this._instance, ThunderIDExpressClient._clientConfig, onSignIn, onSignOut, onError);
-	}
-	async getStorageManager() {
-		return this._authClient.getStorageManager();
-	}
+			res.json({
+				authId: resolvedAuthId,
+				challengeToken: flowResponse.challengeToken,
+				components: flowResponse.data?.meta?.components ?? [],
+				executionId: flowResponse.executionId,
+				flowStatus: flowResponse.flowStatus
+			});
+		} catch (e) {
+			logger.error(e.message);
+			res.status(500).json({ error: e.message ?? "Flow execution failed" });
+		}
+	};
 };
+var flow_default = handleFlow;
 
 //#endregion
-export { ThunderIDExpressClient };
+export { CookieConfig_default as CookieConfig, SESSION_COOKIE_NAME, ThunderIDExpressClient_default as ThunderIDExpressClient, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };

package/dist/middleware/authentication.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import express from 'express';
+import { ThunderIDExpressConfig } from '../models/config';
+/**
+ * Returns Express middleware that initialises the ThunderID client and attaches
+ * it to `req.thunderIDAuth` for use in route handlers and `protect()`.
+ *
+ * Unlike the old `thunderID()` router, this function does **not** mount any
+ * routes automatically. Register sign-in and sign-out handlers explicitly:
+ *
+ * ```ts
+ * app.use(thunderID(config));
+ * app.get('/login',  handleSignIn());
+ * app.get('/logout', handleSignOut());
+ * ```
+ *
+ * @param config - ThunderID Express configuration.
+ */
+declare const thunderID: (config: ThunderIDExpressConfig) => express.RequestHandler;
+/**
+ * Returns an Express route handler for the sign-in path.
+ *
+ * - If the request has no `?code` query param, initiates the OAuth 2.0 redirect.
+ * - If the request has `?code`, exchanges the authorization code for tokens,
+ *   sets the session cookie, and calls `onSignIn`.
+ *
+ * Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+ *
+ * ```ts
+ * app.get('/login', handleSignIn());
+ * ```
+ */
+declare const handleSignIn: () => express.RequestHandler;
+/**
+ * Returns an Express route handler for the sign-out path.
+ *
+ * - Clears the session cookie and redirects to the identity provider's
+ *   end-session endpoint.
+ * - When the identity provider redirects back with `?state=sign_out_success`,
+ *   calls `onSignOut`.
+ *
+ * Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set.
+ *
+ * ```ts
+ * app.get('/logout', handleSignOut());
+ * ```
+ */
+declare const handleSignOut: () => express.RequestHandler;
+export { thunderID, handleSignIn, handleSignOut };
+//# sourceMappingURL=authentication.d.ts.map

package/dist/middleware/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../src/middleware/authentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,sBAAsB,EAAC,MAAM,kBAAkB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,SAAS,GAAI,QAAQ,sBAAsB,KAAG,OAAO,CAAC,cAsB3D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,YAAY,QAAO,OAAO,CAAC,cA6BhC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,QAAA,MAAM,aAAa,QAAO,OAAO,CAAC,cAgDjC,CAAC;AAEF,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAC,CAAC"}

package/dist/middleware/flow.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) 2025, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import express from 'express';
+/**
+ * Returns an Express route handler that drives the embedded sign-in flow loop.
+ *
+ * Requires `thunderID()` middleware with `mode: 'embedded'` to be mounted first.
+ * On each POST, the handler advances the flow one step and returns JSON.
+ *
+ * **First call** — no `executionId`:
+ * ```json
+ * { "applicationId": "app-id", "flowType": "SIGN_IN" }
+ * ```
+ * Response includes `executionId`, `challengeToken`, `authId`, and `components`
+ * (the UI elements to render).
+ *
+ * **Subsequent calls** — continue the flow:
+ * ```json
+ * { "executionId": "...", "challengeToken": "...", "authId": "...", "inputs": { ... } }
+ * ```
+ *
+ * **On completion** — flow returns `{ "done": true, "redirectUrl": "/login?code=..." }`.
+ * The client navigates to `redirectUrl`, which is handled by `handleSignIn()` to
+ * exchange the code and set the session cookie.
+ *
+ * ```ts
+ * app.use(thunderID({ ..., mode: 'embedded' }));
+ * app.get('/login',          handleSignIn());
+ * app.post('/flow/sign-in',  handleFlow());
+ * app.get('/logout',         handleSignOut());
+ * ```
+ */
+declare const handleFlow: () => express.RequestHandler;
+export default handleFlow;
+//# sourceMappingURL=flow.d.ts.map

package/dist/middleware/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/middleware/flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,QAAA,MAAM,UAAU,QAAO,OAAO,CAAC,cAwD9B,CAAC;AAEF,eAAe,UAAU,CAAC"}