@thunderid/react 0.4.0 → 0.6.0

package/dist/utils/composeAffixedInputs.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Returns the sentinel key used to store the selected prefix `value` for the affixed
+ * field addressed by `identifier`. The vendor namespace controls the runtime string
+ * so consumers overriding `vendor` do not conflict with the SDK default.
+ */
+export declare const affixPrefixKey: (identifier: string, vendor?: string) => string;
+/**
+ * Returns the sentinel key used to store the postfix `value` for the affixed field
+ * addressed by `identifier`. See {@link affixPrefixKey}.
+ */
+export declare const affixPostfixKey: (identifier: string, vendor?: string) => string;
+/**
+ * Rewrites `formData` (returns a new object) so that any affixed-input identifier
+ * tracked by matching sentinel prefix/postfix keys is replaced with its composed
+ * form `${prefix}${typed}${postfix}`. Sentinel keys are stripped from the result.
+ *
+ * Behaviour:
+ *  - Prefix present, postfix present  → `prefix + typed + postfix`.
+ *  - Only prefix present               → `prefix + typed`.
+ *  - Only postfix present              → `typed + postfix`.
+ *  - Both empty / typed empty          → the identifier is left untouched.
+ *  - No sentinel keys                  → returns a shallow copy of `formData` unchanged.
+ *
+ * The input object is not mutated. This is component-type agnostic: any field carrying
+ * matching sentinel keys is composed, regardless of whether it originated from a
+ * TEXT_INPUT, EMAIL_INPUT, PASSWORD_INPUT, or PHONE_INPUT.
+ *
+ * @param formData - The current form values map (values indexed by field identifier).
+ * @param vendor - The vendor namespace configured on the SDK client, if any. Sentinel
+ *   keys are resolved through this namespace so composition ignores unrelated keys
+ *   written by other vendors when multiple SDK instances share a form.
+ */
+declare const composeAffixedInputs: (formData: Record<string, string>, vendor?: string) => Record<string, string>;
+export default composeAffixedInputs;
+//# sourceMappingURL=composeAffixedInputs.d.ts.map

package/dist/utils/composeAffixedInputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composeAffixedInputs.d.ts","sourceRoot":"","sources":["../../src/utils/composeAffixedInputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAiBH;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,YAAY,MAAM,EAAE,SAAS,MAAM,KAAG,MAAkD,CAAC;AAExH;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,YAAY,MAAM,EAAE,SAAS,MAAM,KAAG,MAC3B,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,QAAA,MAAM,oBAAoB,GAAI,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CA6BtG,CAAC;AAEF,eAAe,oBAAoB,CAAC"}

package/dist/utils/composeAffixedInputs.js

@@ -0,0 +1,70 @@
+import { getVendorPrefix } from "@thunderid/browser";
+
+//#region src/utils/composeAffixedInputs.ts
+/**
+* Returns the runtime sentinel prefix used to tag "selected prefix" entries in the
+* form-state map. Resolved through the vendor namespace so white-labeled deployments
+* do not collide with each other or with a real field identifier.
+*/
+const prefixSentinel = (vendor) => `__${getVendorPrefix(vendor)}_prefix__`;
+/**
+* Returns the runtime sentinel prefix used to tag "postfix" entries in the form-state
+* map. See {@link prefixSentinel}.
+*/
+const postfixSentinel = (vendor) => `__${getVendorPrefix(vendor)}_postfix__`;
+/**
+* Returns the sentinel key used to store the selected prefix `value` for the affixed
+* field addressed by `identifier`. The vendor namespace controls the runtime string
+* so consumers overriding `vendor` do not conflict with the SDK default.
+*/
+const affixPrefixKey = (identifier, vendor) => `${prefixSentinel(vendor)}${identifier}`;
+/**
+* Returns the sentinel key used to store the postfix `value` for the affixed field
+* addressed by `identifier`. See {@link affixPrefixKey}.
+*/
+const affixPostfixKey = (identifier, vendor) => `${postfixSentinel(vendor)}${identifier}`;
+/**
+* Rewrites `formData` (returns a new object) so that any affixed-input identifier
+* tracked by matching sentinel prefix/postfix keys is replaced with its composed
+* form `${prefix}${typed}${postfix}`. Sentinel keys are stripped from the result.
+*
+* Behaviour:
+*  - Prefix present, postfix present  → `prefix + typed + postfix`.
+*  - Only prefix present               → `prefix + typed`.
+*  - Only postfix present              → `typed + postfix`.
+*  - Both empty / typed empty          → the identifier is left untouched.
+*  - No sentinel keys                  → returns a shallow copy of `formData` unchanged.
+*
+* The input object is not mutated. This is component-type agnostic: any field carrying
+* matching sentinel keys is composed, regardless of whether it originated from a
+* TEXT_INPUT, EMAIL_INPUT, PASSWORD_INPUT, or PHONE_INPUT.
+*
+* @param formData - The current form values map (values indexed by field identifier).
+* @param vendor - The vendor namespace configured on the SDK client, if any. Sentinel
+*   keys are resolved through this namespace so composition ignores unrelated keys
+*   written by other vendors when multiple SDK instances share a form.
+*/
+const composeAffixedInputs = (formData, vendor) => {
+	const composed = { ...formData };
+	const prefixTag = prefixSentinel(vendor);
+	const postfixTag = postfixSentinel(vendor);
+	for (const key of Object.keys(formData)) {
+		if (!key.startsWith(prefixTag) && !key.startsWith(postfixTag)) continue;
+		const identifier = key.startsWith(prefixTag) ? key.slice(prefixTag.length) : key.slice(postfixTag.length);
+		const typed = composed[identifier] ?? "";
+		if (typed === "") {
+			delete composed[affixPrefixKey(identifier, vendor)];
+			delete composed[affixPostfixKey(identifier, vendor)];
+			continue;
+		}
+		composed[identifier] = `${composed[affixPrefixKey(identifier, vendor)] ?? ""}${typed}${composed[affixPostfixKey(identifier, vendor)] ?? ""}`;
+		delete composed[affixPrefixKey(identifier, vendor)];
+		delete composed[affixPostfixKey(identifier, vendor)];
+	}
+	return composed;
+};
+var composeAffixedInputs_default = composeAffixedInputs;
+
+//#endregion
+export { affixPostfixKey, affixPrefixKey, composeAffixedInputs_default as default };
+//# sourceMappingURL=composeAffixedInputs.js.map

package/dist/utils/composeAffixedInputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composeAffixedInputs.js","names":["composed: Record<string, string>","prefixTag: string","postfixTag: string","identifier: string","typed: string"],"sources":["../../src/utils/composeAffixedInputs.ts"],"sourcesContent":["/**\n * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {getVendorPrefix} from '@thunderid/browser';\n\n/**\n * Returns the runtime sentinel prefix used to tag \"selected prefix\" entries in the\n * form-state map. Resolved through the vendor namespace so white-labeled deployments\n * do not collide with each other or with a real field identifier.\n */\nconst prefixSentinel = (vendor?: string): string => `__${getVendorPrefix(vendor)}_prefix__`;\n\n/**\n * Returns the runtime sentinel prefix used to tag \"postfix\" entries in the form-state\n * map. See {@link prefixSentinel}.\n */\nconst postfixSentinel = (vendor?: string): string => `__${getVendorPrefix(vendor)}_postfix__`;\n\n/**\n * Returns the sentinel key used to store the selected prefix `value` for the affixed\n * field addressed by `identifier`. The vendor namespace controls the runtime string\n * so consumers overriding `vendor` do not conflict with the SDK default.\n */\nexport const affixPrefixKey = (identifier: string, vendor?: string): string => `${prefixSentinel(vendor)}${identifier}`;\n\n/**\n * Returns the sentinel key used to store the postfix `value` for the affixed field\n * addressed by `identifier`. See {@link affixPrefixKey}.\n */\nexport const affixPostfixKey = (identifier: string, vendor?: string): string =>\n  `${postfixSentinel(vendor)}${identifier}`;\n\n/**\n * Rewrites `formData` (returns a new object) so that any affixed-input identifier\n * tracked by matching sentinel prefix/postfix keys is replaced with its composed\n * form `${prefix}${typed}${postfix}`. Sentinel keys are stripped from the result.\n *\n * Behaviour:\n *  - Prefix present, postfix present  → `prefix + typed + postfix`.\n *  - Only prefix present               → `prefix + typed`.\n *  - Only postfix present              → `typed + postfix`.\n *  - Both empty / typed empty          → the identifier is left untouched.\n *  - No sentinel keys                  → returns a shallow copy of `formData` unchanged.\n *\n * The input object is not mutated. This is component-type agnostic: any field carrying\n * matching sentinel keys is composed, regardless of whether it originated from a\n * TEXT_INPUT, EMAIL_INPUT, PASSWORD_INPUT, or PHONE_INPUT.\n *\n * @param formData - The current form values map (values indexed by field identifier).\n * @param vendor - The vendor namespace configured on the SDK client, if any. Sentinel\n *   keys are resolved through this namespace so composition ignores unrelated keys\n *   written by other vendors when multiple SDK instances share a form.\n */\nconst composeAffixedInputs = (formData: Record<string, string>, vendor?: string): Record<string, string> => {\n  const composed: Record<string, string> = {...formData};\n  const prefixTag: string = prefixSentinel(vendor);\n  const postfixTag: string = postfixSentinel(vendor);\n\n  for (const key of Object.keys(formData)) {\n    if (!key.startsWith(prefixTag) && !key.startsWith(postfixTag)) {\n      continue;\n    }\n\n    const identifier: string = key.startsWith(prefixTag) ? key.slice(prefixTag.length) : key.slice(postfixTag.length);\n\n    const typed: string = composed[identifier] ?? '';\n    if (typed === '') {\n      // Preserve emptiness — required-field checks are the caller's responsibility.\n      delete composed[affixPrefixKey(identifier, vendor)];\n      delete composed[affixPostfixKey(identifier, vendor)];\n      continue;\n    }\n\n    const prefix: string = composed[affixPrefixKey(identifier, vendor)] ?? '';\n    const postfix: string = composed[affixPostfixKey(identifier, vendor)] ?? '';\n\n    composed[identifier] = `${prefix}${typed}${postfix}`;\n    delete composed[affixPrefixKey(identifier, vendor)];\n    delete composed[affixPostfixKey(identifier, vendor)];\n  }\n\n  return composed;\n};\n\nexport default composeAffixedInputs;\n"],"mappings":";;;;;;;;AAyBA,MAAM,kBAAkB,WAA4B,KAAK,gBAAgB,OAAO,CAAC;;;;;AAMjF,MAAM,mBAAmB,WAA4B,KAAK,gBAAgB,OAAO,CAAC;;;;;;AAOlF,MAAa,kBAAkB,YAAoB,WAA4B,GAAG,eAAe,OAAO,GAAG;;;;;AAM3G,MAAa,mBAAmB,YAAoB,WAClD,GAAG,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;AAuB/B,MAAM,wBAAwB,UAAkC,WAA4C;CAC1G,MAAMA,WAAmC,EAAC,GAAG,UAAS;CACtD,MAAMC,YAAoB,eAAe,OAAO;CAChD,MAAMC,aAAqB,gBAAgB,OAAO;AAElD,MAAK,MAAM,OAAO,OAAO,KAAK,SAAS,EAAE;AACvC,MAAI,CAAC,IAAI,WAAW,UAAU,IAAI,CAAC,IAAI,WAAW,WAAW,CAC3D;EAGF,MAAMC,aAAqB,IAAI,WAAW,UAAU,GAAG,IAAI,MAAM,UAAU,OAAO,GAAG,IAAI,MAAM,WAAW,OAAO;EAEjH,MAAMC,QAAgB,SAAS,eAAe;AAC9C,MAAI,UAAU,IAAI;AAEhB,UAAO,SAAS,eAAe,YAAY,OAAO;AAClD,UAAO,SAAS,gBAAgB,YAAY,OAAO;AACnD;;AAMF,WAAS,cAAc,GAHA,SAAS,eAAe,YAAY,OAAO,KAAK,KAGpC,QAFX,SAAS,gBAAgB,YAAY,OAAO,KAAK;AAGzE,SAAO,SAAS,eAAe,YAAY,OAAO;AAClD,SAAO,SAAS,gBAAgB,YAAY,OAAO;;AAGrD,QAAO;;AAGT,mCAAe"}

package/dist/utils/oauth.d.ts

@@ -20,6 +20,7 @@
  * Generates random state, stores return path in sessionStorage, and redirects to OAuth provider.
  *
  * @param redirectURL - OAuth authorization URL from the server
+ * @param vendor - Vendor/brand namespace used to prefix the sessionStorage key. Defaults to `'thunderid'`.
  */
-export declare function initiateOAuthRedirect(redirectURL: string): void;
+export declare function initiateOAuthRedirect(redirectURL: string, vendor?: string): void;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/utils/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/utils/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAsB/D"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/utils/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBhF"}

package/dist/utils/oauth.js

@@ -1,4 +1,4 @@
-import { navigate } from "@thunderid/browser";
+import { getVendorPrefix, navigate } from "@thunderid/browser";
 
 //#region src/utils/oauth.ts
 /**
@@ -6,13 +6,14 @@ import { navigate } from "@thunderid/browser";
 * Generates random state, stores return path in sessionStorage, and redirects to OAuth provider.
 *
 * @param redirectURL - OAuth authorization URL from the server
+* @param vendor - Vendor/brand namespace used to prefix the sessionStorage key. Defaults to `'thunderid'`.
 */
-function initiateOAuthRedirect(redirectURL) {
+function initiateOAuthRedirect(redirectURL, vendor) {
 	const basePath = document.querySelector("base")?.getAttribute("href") || "";
 	let returnPath = window.location.pathname;
 	if (basePath && returnPath.startsWith(basePath)) returnPath = returnPath.slice(basePath.length) || "/";
 	const state = crypto.randomUUID();
-	sessionStorage.setItem(`thunderid_oauth_${state}`, JSON.stringify({
+	sessionStorage.setItem(`${getVendorPrefix(vendor)}_oauth_${state}`, JSON.stringify({
 		path: returnPath,
 		timestamp: Date.now()
 	}));

package/dist/utils/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":["basePath: string","returnPath: string","state: string","redirectUrlObj: URL"],"sources":["../../src/utils/oauth.ts"],"sourcesContent":["/**\n * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {navigate} from '@thunderid/browser';\n\n/**\n * Initiates OAuth redirect with CSRF protection.\n * Generates random state, stores return path in sessionStorage, and redirects to OAuth provider.\n *\n * @param redirectURL - OAuth authorization URL from the server\n */\nexport function initiateOAuthRedirect(redirectURL: string): void {\n  const basePath: string = document.querySelector('base')?.getAttribute('href') || '';\n  let returnPath: string = window.location.pathname;\n\n  if (basePath && returnPath.startsWith(basePath)) {\n    returnPath = returnPath.slice(basePath.length) || '/';\n  }\n\n  const state: string = crypto.randomUUID();\n\n  sessionStorage.setItem(\n    `thunderid_oauth_${state}`,\n    JSON.stringify({\n      path: returnPath,\n      timestamp: Date.now(),\n    }),\n  );\n\n  const redirectUrlObj: URL = new URL(redirectURL);\n  redirectUrlObj.searchParams.set('state', state);\n\n  navigate(redirectUrlObj.toString());\n}\n"],"mappings":";;;;;;;;;AA0BA,SAAgB,sBAAsB,aAA2B;CAC/D,MAAMA,WAAmB,SAAS,cAAc,OAAO,EAAE,aAAa,OAAO,IAAI;CACjF,IAAIC,aAAqB,OAAO,SAAS;AAEzC,KAAI,YAAY,WAAW,WAAW,SAAS,CAC7C,cAAa,WAAW,MAAM,SAAS,OAAO,IAAI;CAGpD,MAAMC,QAAgB,OAAO,YAAY;AAEzC,gBAAe,QACb,mBAAmB,SACnB,KAAK,UAAU;EACb,MAAM;EACN,WAAW,KAAK,KAAK;EACtB,CAAC,CACH;CAED,MAAMC,iBAAsB,IAAI,IAAI,YAAY;AAChD,gBAAe,aAAa,IAAI,SAAS,MAAM;AAE/C,UAAS,eAAe,UAAU,CAAC"}
+{"version":3,"file":"oauth.js","names":["basePath: string","returnPath: string","state: string","redirectUrlObj: URL"],"sources":["../../src/utils/oauth.ts"],"sourcesContent":["/**\n * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).\n *\n * WSO2 LLC. licenses this file to you under the Apache License,\n * Version 2.0 (the \"License\"); you may not use this file except\n * in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing,\n * software distributed under the License is distributed on an\n * \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY\n * KIND, either express or implied. See the License for the\n * specific language governing permissions and limitations\n * under the License.\n */\n\nimport {navigate, getVendorPrefix} from '@thunderid/browser';\n\n/**\n * Initiates OAuth redirect with CSRF protection.\n * Generates random state, stores return path in sessionStorage, and redirects to OAuth provider.\n *\n * @param redirectURL - OAuth authorization URL from the server\n * @param vendor - Vendor/brand namespace used to prefix the sessionStorage key. Defaults to `'thunderid'`.\n */\nexport function initiateOAuthRedirect(redirectURL: string, vendor?: string): void {\n  const basePath: string = document.querySelector('base')?.getAttribute('href') || '';\n  let returnPath: string = window.location.pathname;\n\n  if (basePath && returnPath.startsWith(basePath)) {\n    returnPath = returnPath.slice(basePath.length) || '/';\n  }\n\n  const state: string = crypto.randomUUID();\n\n  sessionStorage.setItem(\n    `${getVendorPrefix(vendor)}_oauth_${state}`,\n    JSON.stringify({\n      path: returnPath,\n      timestamp: Date.now(),\n    }),\n  );\n\n  const redirectUrlObj: URL = new URL(redirectURL);\n  redirectUrlObj.searchParams.set('state', state);\n\n  navigate(redirectUrlObj.toString());\n}\n"],"mappings":";;;;;;;;;;AA2BA,SAAgB,sBAAsB,aAAqB,QAAuB;CAChF,MAAMA,WAAmB,SAAS,cAAc,OAAO,EAAE,aAAa,OAAO,IAAI;CACjF,IAAIC,aAAqB,OAAO,SAAS;AAEzC,KAAI,YAAY,WAAW,WAAW,SAAS,CAC7C,cAAa,WAAW,MAAM,SAAS,OAAO,IAAI;CAGpD,MAAMC,QAAgB,OAAO,YAAY;AAEzC,gBAAe,QACb,GAAG,gBAAgB,OAAO,CAAC,SAAS,SACpC,KAAK,UAAU;EACb,MAAM;EACN,WAAW,KAAK,KAAK;EACtB,CAAC,CACH;CAED,MAAMC,iBAAsB,IAAI,IAAI,YAAY;AAChD,gBAAe,aAAa,IAAI,SAAS,MAAM;AAE/C,UAAS,eAAe,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/react",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "React SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -61,7 +61,7 @@
     "@floating-ui/react": "0.27.12",
     "dompurify": "3.4.11",
     "tslib": "2.8.1",
-    "@thunderid/browser": "^0.4.0"
+    "@thunderid/browser": "^0.6.0"
   },
   "publishConfig": {
     "access": "public"