@tidecloak/js 0.14.41-staging → 0.14.42-staging

package/dist/types/index.d.ts

@@ -1,15 +1,5 @@
-export { default as IAMService } from './IAMService.js';
+export { IAMService } from './IAMService.js';
 export { default as TideCloak } from "../lib/tidecloak.js";
 export { RequestEnclave, ApprovalEnclaveNew } from "../lib/tidecloak.js";
 export { Tools, Models } from "@tideorg/js";
-export type NativeAdapter = import('./types.js').NativeAdapter;
-export type NativeTokenData = import('./types.js').NativeTokenData;
-export type NativeAuthCallbackResult = import('./types.js').NativeAuthCallbackResult;
-export type NativeEncryptionCallbackResult = import('./types.js').NativeEncryptionCallbackResult;
-export type NativeConfig = import('./types.js').NativeConfig;
-/** @typedef {import('./types.js').NativeAdapter} NativeAdapter */
-/** @typedef {import('./types.js').NativeTokenData} NativeTokenData */
-/** @typedef {import('./types.js').NativeAuthCallbackResult} NativeAuthCallbackResult */
-/** @typedef {import('./types.js').NativeEncryptionCallbackResult} NativeEncryptionCallbackResult */
-/** @typedef {import('./types.js').NativeConfig} NativeConfig */
 export { default as AdminAPI, AdminAPI as AdminAPIClass } from './AdminAPI.js';

package/dist/types/lib/tidecloak-dpop.d.ts

@@ -1,3 +1,7 @@
+/**
+ * @import { DPoPState, DPoPSignatureProviderOptions } from "./tidecloak-dpop.js"
+ */
+import type { DPoPSignatureProviderOptions } from "./tidecloak-dpop.js";
 /** @enum {string} */
 export declare const BrowserSignatureAlgs: {
     ES256: string;
@@ -51,8 +55,20 @@ export declare class DPoPSignatureProvider {
      */
     generateDPoPProof(url: string, httpMethod: string, accessToken?: string, nonce?: string): Promise<string>;
     /**
-     * Compute the SHA256 thumbprint of the DPoP Public Key
-     * @returns {string} Base64 URL Encoding of the thumbprint
+     * Compute the RFC 7638 JWK thumbprint of the DPoP public key.
+     * @returns {Promise<string>} Base64url-encoded SHA-256 thumbprint
      */
-    generateJWKThumbprint(): string;
+    generateJWKThumbprint(): Promise<string>;
+    /**
+     * Sign a delegation request as a JWT using the DPoP private key.
+     * The resulting JWT proves the user authorizes the delegation described by the claims.
+     *
+     * @param {string} resourcePublicKeyInfo Base64 URL encoded Ed25519 SubjectPublicKeyInfo
+     * @param {string} challengeMessage UTF8 text
+     * @param {string} resourceChallengeSignature Base64 URL encoded signature
+     * @param {string} accessToken Access token if calling resource server
+     * @returns {Promise<string>} Compact JWT string (header.payload.signature)
+     * @throws {Error} If the resource's challenge signature cannot be verified
+     */
+    generateResourceDelegation(resourcePublicKeyInfo: string, challengeMessage: string, resourceChallengeSignature: string, accessToken: string): Promise<string>;
 }

package/dist/types/lib/tidecloak.d.ts

@@ -18,7 +18,24 @@ export type LoginIframe = {
     iframe?: HTMLIFrameElement | undefined;
     iframeOrigin?: string | undefined;
 };
-export { shouldAttachDpopProof } from './secureFetchPolicy.js';
+/**
+ * @typedef {Object} Endpoints
+ * @property {() => string} authorize
+ * @property {() => string} token
+ * @property {() => string} logout
+ * @property {() => string} checkSessionIframe
+ * @property {() => string=} thirdPartyCookiesIframe
+ * @property {() => string} register
+ * @property {() => string} userinfo
+ */
+/**
+ * @typedef {Object} LoginIframe
+ * @property {boolean} enable
+ * @property {((error: Error | null, value?: boolean) => void)[]} callbackList
+ * @property {number} interval
+ * @property {HTMLIFrameElement=} iframe
+ * @property {string=} iframeOrigin
+ */
 export { RequestEnclave, ApprovalEnclave, ApprovalEnclaveNew, PolicySignRequest } from "heimdall-tide";
 export { Tools, Models } from "@tideorg/js";
 export type ParsedCallbackParams = {
@@ -57,7 +74,7 @@ export type AccessTokenResponse = {
 };
 export default class TideCloak {
     #private;
-    useDPoP: import("./tidecloak.js").DPoPConfig | undefined;
+    dpopConfig: import("./tidecloak.js").DPoPConfig | undefined;
     dpopSigningAlgValuesSupported: string[] | undefined;
     issuer: string | undefined;
     didInitialize: boolean;
@@ -77,15 +94,6 @@ export default class TideCloak {
     silentCheckSsoRedirectUri: string | undefined;
     /** @type {boolean} */
     silentCheckSsoFallback: boolean;
-    /**
-     * Max time (ms) to wait for the hidden silent-check-sso iframe to post back
-     * before treating the attempt as "not authenticated". Guards against the
-     * post-logout wedge where the check-sso (or the Tide enclave it spins up)
-     * never responds and init() would otherwise hang forever. Overridable via
-     * initOptions.silentCheckSsoTimeout.
-     * @type {number}
-     */
-    silentCheckSsoTimeout: number;
     /** @type {TideCloakPkceMethod} */
     pkceMethod: TideCloakPkceMethod;
     enableLogging: boolean;
@@ -106,9 +114,9 @@ export default class TideCloak {
     refreshToken: string | undefined;
     /** @type {TideCloakTokenParsed=} */
     refreshTokenParsed: TideCloakTokenParsed | undefined;
-    /** @type {string | undefined} */
+    /** @type {string=} */
     doken: string | undefined;
-    /** @type {TideCloakTokenParsed | undefined} */
+    /** @type {TideCloakTokenParsed=} */
     dokenParsed: TideCloakTokenParsed | undefined;
     /** @type {any} */
     requestEnclave: any;
@@ -166,11 +174,6 @@ export default class TideCloak {
      * @returns {Promise<void>}
      */
     login: (options?: TideCloakLoginOptions) => Promise<void>;
-    /**
-     * Ensure the access token is valid, refreshing if needed.
-     * @returns {Promise<void>}
-     */
-    ensureTokenReady(): Promise<void>;
     /**
      * @param {TideCloakLoginOptions} [options]
      * @returns {Promise<string>}
@@ -234,8 +237,13 @@ export default class TideCloak {
      * @returns {Promise<boolean>}
      */
     updateToken: (minValidity: number) => Promise<boolean>;
-    clearToken: () => void;
-    secureFetch: (url: any, init?: {}) => Promise<Response>;
+    clearToken: () => Promise<void>;
+    fetch: (url: any, init?: {}) => Promise<Response>;
+    /**
+     * Ensure the access token is valid, refreshing if needed.
+     * @returns {Promise<void>}
+     */
+    ensureTokenReady(): Promise<void>;
     /**
      * Register a callback for when the browser blocks the Tide enclave popup.
      * It replaces the default "pop-ups are blocked" header.
@@ -253,40 +261,40 @@ export default class TideCloak {
     /**
      * Role-based encryption via Tide RequestEnclave.
      * @param {{ data: string | Uint8Array, tags: string[] }[]} toEncrypt
-     * @param {Uint8Array} decryption_policy If you'd like the data to be protected by a decryption policy
+     * @param {Uint8Array | null} [decryption_policy] If you'd like the data to be protected by a decryption policy
      * @returns {Promise<(string | Uint8Array)[]>}
      */
     encrypt(toEncrypt: {
         data: string | Uint8Array;
         tags: string[];
-    }[], decryption_policy?: Uint8Array): Promise<(string | Uint8Array)[]>;
+    }[], decryption_policy?: Uint8Array | null): Promise<(string | Uint8Array)[]>;
     /**
-     * Begin the process of drafting a encryption request
-     * @param {{ data: string | Uint8Array, tags: string[] }[]} toEncrypt
-     * @returns
+     * Begin drafting an encryption request.
+     * @param {{ data: Uint8Array, tags: string[] }[]} toEncrypt
+     * @returns {Promise<Uint8Array>}
      */
     draftEncryption(toEncrypt: {
-        data: string | Uint8Array;
+        data: Uint8Array;
         tags: string[];
-    }[]): Promise<any>;
+    }[]): Promise<Uint8Array>;
     /**
-     * Commit a encryption request with a specified policy
+     * Commit an encryption request with a specified policy.
      * @param {Uint8Array} request
      * @param {Uint8Array} decryption_policy
      * @returns {Promise<Uint8Array[]>}
      */
     commitEncryption(request: Uint8Array, decryption_policy: Uint8Array): Promise<Uint8Array[]>;
     /**
-     * Begin the process of drafting a encryption request
-     * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} toDecrypt
-     * @returns {Uint8Array}
+     * Begin drafting a decryption request.
+     * @param {{ encrypted: Uint8Array, tags: string[] }[]} toDecrypt
+     * @returns {Promise<Uint8Array>}
      */
     draftDecryption(toDecrypt: {
-        encrypted: string | Uint8Array;
+        encrypted: Uint8Array;
         tags: string[];
-    }[]): Uint8Array;
+    }[]): Promise<Uint8Array>;
     /**
-     * Commit a decryption request with a specified policy
+     * Commit a decryption request with a specified policy.
      * @param {Uint8Array} request
      * @param {Uint8Array} decryption_policy
      * @returns {Promise<Uint8Array[]>}
@@ -312,22 +320,22 @@ export default class TideCloak {
         status: "approved" | "denied" | "pending";
     }[]>;
     /**
-     * Execute a Tide Sign Request
+     * Execute a Tide Sign Request.
      * @param {Uint8Array} request
      * @param {boolean} [waitForAll=false]
-     * @returns {Promise<Array>} Array of signatures
+     * @returns {Promise<any[]>} Array of signatures
      */
     executeSignRequest(request: Uint8Array, waitForAll?: boolean): Promise<any[]>;
     /**
      * Role-based decryption via Tide RequestEnclave.
      * @param {{ encrypted: string | Uint8Array, tags: string[] }[]} toDecrypt
-     * @param {Uint8Array} decryption_policy If the data is protected by a decryption policy
+     * @param {Uint8Array | null} [decryption_policy] If the data is protected by a decryption policy
      * @returns {Promise<(string | Uint8Array)[]>}
      */
     decrypt(toDecrypt: {
         encrypted: string | Uint8Array;
         tags: string[];
-    }[], decryption_policy?: Uint8Array): Promise<(string | Uint8Array)[]>;
+    }[], decryption_policy?: Uint8Array | null): Promise<(string | Uint8Array)[]>;
 }
 export type CallbackState = {
     state: string;

package/dist/types/src/AdminAPI.d.ts

@@ -21,7 +21,7 @@ declare class AdminAPI {
      * When DPoP is enabled the issued token is sender-constrained (`typ: DPoP`,
      * `cnf.jkt`), and RFC 9449 says a bound token presented as a plain `Bearer` is
      * invalid - the server answers a bare `401` explaining nothing. So every admin
-     * call goes through `IAMService.secureFetch`, which:
+     * call goes through `IAMService.fetch`, which:
      *
      *   - with a DPoP provider: upgrades `Authorization: Bearer <our token>` to
      *     `Authorization: DPoP <our token>` + a `DPoP:` proof (and handles nonces);