@tidecloak/js 0.14.41 → 0.14.43-staging

package/dist/cjs/src/utils/dpopAuthPage.js

@@ -1,69 +0,0 @@
-"use strict";
-// With DPoP on, the enclave loads tide_dpop_auth.html from this app's origin
-// during login. If it is missing, login stalls ~4s and falls back to a popup
-// with nothing logged. This check says which URL is missing. It never throws.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.utf8ToHex = utf8ToHex;
-exports.buildDpopAuthUrl = buildDpopAuthUrl;
-exports.probeDpopAuthPage = probeDpopAuthPage;
-exports.preflightDpopAuthPage = preflightDpopAuthPage;
-function utf8ToHex(value) {
-    let out = '';
-    for (const b of new TextEncoder().encode(value))
-        out += b.toString(16).padStart(2, '0');
-    return out;
-}
-function buildDpopAuthUrl({ origin, authServerUrl, realm, clientId }) {
-    if (!origin || !authServerUrl || !realm || !clientId)
-        return null;
-    const issuer = `${String(authServerUrl).replace(/\/+$/, '')}/realms/${realm}`;
-    return `${String(origin).replace(/\/+$/, '')}/tide_dpop/iss/${utf8ToHex(issuer)}/aud/${utf8ToHex(clientId)}/tide_dpop_auth.html`;
-}
-// Returns served | missing-headers | mismatch | not-served | inconclusive.
-async function probeDpopAuthPage({ url, fetchImpl = globalThis.fetch, timeoutMs = 2000 }) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    let res;
-    try {
-        res = await fetchImpl(url, { method: 'HEAD', cache: 'no-store', credentials: 'omit', signal: controller.signal });
-    }
-    catch {
-        return { outcome: 'inconclusive' };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    // 405/501: a GET-only route is still a working route.
-    if (res.status === 403)
-        return { outcome: 'mismatch' };
-    if (res.status === 404 || res.status === 410)
-        return { outcome: 'not-served' };
-    if (res.status < 200 || res.status >= 300)
-        return { outcome: 'inconclusive' };
-    const missing = ['Content-Security-Policy', 'Allow-CSP-From'].filter((h) => !res.headers.get(h));
-    return missing.length ? { outcome: 'missing-headers', missing } : { outcome: 'served' };
-}
-async function preflightDpopAuthPage({ logger = console, ...params }) {
-    try {
-        const url = buildDpopAuthUrl(params);
-        if (!url)
-            return 'inconclusive';
-        const { outcome, missing } = await probeDpopAuthPage({ url, ...params });
-        if (outcome === 'not-served') {
-            logger.error(`[IAMService] DPoP is on but nothing is served at ${url}. Serve tide_dpop_auth.html there ` +
-                'with Content-Security-Policy and Allow-CSP-From: * headers, or logins will stall and fall back to a popup.');
-        }
-        else if (outcome === 'missing-headers') {
-            logger.warn(`[IAMService] ${url} is served without ${missing.join(' and ')}. The enclave cannot embed it.`);
-        }
-        else if (outcome === 'mismatch') {
-            // Behind a proxy, TideCloak may see a different base URL than the one in our config.
-            logger.warn(`[IAMService] ${url} answered 403. Check the realm and client id match your TideCloak config.`);
-        }
-        return outcome;
-    }
-    catch {
-        return 'inconclusive';
-    }
-}
-//# sourceMappingURL=dpopAuthPage.js.map

package/dist/cjs/src/utils/dpopAuthPage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopAuthPage.js","sourceRoot":"","sources":["../../../../src/utils/dpopAuthPage.js"],"names":[],"mappings":";AAAA,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;;;;;;AAE9E,mBAA0B,KAAK;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0BAAiC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE;IACzE,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,KAAK,EAAE,CAAC;IAC9E,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,SAAS,CAAC,MAAM,CAAC,QAAQ,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AACnI,CAAC;AAED,2EAA2E;AACpE,KAAK,4BAA4B,EAAE,GAAG,EAAE,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE;IAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,sDAAsD;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC/E,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAE9E,MAAM,OAAO,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAEM,KAAK,gCAAgC,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,cAAc,CAAC;QAChC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAEzE,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,oDAAoD,GAAG,oCAAoC;gBACzF,4GAA4G,CAC/G,CAAC;QACJ,CAAC;aAAM,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,sBAAsB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC9G,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,qFAAqF;YACrF,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,2EAA2E,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/cjs/src/utils/fetch.js

@@ -1,39 +0,0 @@
-"use strict";
-/**
- * Fetch utilities for HTTP requests.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchJson = fetchJson;
-/**
- * Fetch JSON with credentials included.
- * @param {string} url - URL to fetch
- * @param {RequestInit} [options={}] - Fetch options
- * @returns {Promise<any>} Parsed JSON response
- * @throws {Error} If request fails (with status and body properties)
- */
-async function fetchJson(url, options = {}) {
-    const res = await fetch(url, {
-        credentials: "include",
-        ...options,
-        headers: {
-            "Content-Type": "application/json",
-            ...(options.headers || {}),
-        },
-    });
-    const text = await res.text();
-    let json = null;
-    try {
-        json = text ? JSON.parse(text) : null;
-    }
-    catch {
-        // ignore parse errors
-    }
-    if (!res.ok) {
-        const err = new Error((json === null || json === void 0 ? void 0 : json.message) || `Request failed (${res.status})`);
-        err.status = res.status;
-        err.body = json !== null && json !== void 0 ? json : text;
-        throw err;
-    }
-    return json;
-}
-//# sourceMappingURL=fetch.js.map

package/dist/cjs/src/utils/fetch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../../src/utils/fetch.js"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH;;;;;;GAMG;AACI,KAAK,oBAAoB,GAAG,EAAE,OAAO,GAAG,EAAE;IAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,WAAW,EAAE,SAAS;QACtB,GAAG,OAAO;QACV,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;SAC3B;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,KAAI,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,IAAI,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC;QACxB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cjs/src/utils/index.js

@@ -1,17 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.preflightDpopAuthPage = exports.buildInitOptions = exports.SILENT_CHECK_SSO_FILENAME = exports.resolveSilentCheckSsoRedirectUri = exports.fetchJson = exports.base64UrlEncode = exports.randomPkceVerifier = exports.makePkce = void 0;
-var pkce_js_1 = require("./pkce.js");
-Object.defineProperty(exports, "makePkce", { enumerable: true, get: function () { return pkce_js_1.makePkce; } });
-Object.defineProperty(exports, "randomPkceVerifier", { enumerable: true, get: function () { return pkce_js_1.randomPkceVerifier; } });
-Object.defineProperty(exports, "base64UrlEncode", { enumerable: true, get: function () { return pkce_js_1.base64UrlEncode; } });
-var fetch_js_1 = require("./fetch.js");
-Object.defineProperty(exports, "fetchJson", { enumerable: true, get: function () { return fetch_js_1.fetchJson; } });
-var silentCheckSso_js_1 = require("./silentCheckSso.js");
-Object.defineProperty(exports, "resolveSilentCheckSsoRedirectUri", { enumerable: true, get: function () { return silentCheckSso_js_1.resolveSilentCheckSsoRedirectUri; } });
-Object.defineProperty(exports, "SILENT_CHECK_SSO_FILENAME", { enumerable: true, get: function () { return silentCheckSso_js_1.SILENT_CHECK_SSO_FILENAME; } });
-var initOptions_js_1 = require("./initOptions.js");
-Object.defineProperty(exports, "buildInitOptions", { enumerable: true, get: function () { return initOptions_js_1.buildInitOptions; } });
-var dpopAuthPage_js_1 = require("./dpopAuthPage.js");
-Object.defineProperty(exports, "preflightDpopAuthPage", { enumerable: true, get: function () { return dpopAuthPage_js_1.preflightDpopAuthPage; } });
-//# sourceMappingURL=index.js.map

package/dist/cjs/src/utils/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/utils/index.js"],"names":[],"mappings":";;;AAAA,qCAA0E;AAAjE,mGAAA,QAAQ,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,0GAAA,eAAe,OAAA;AACtD,uCAAuC;AAA9B,qGAAA,SAAS,OAAA;AAClB,yDAAkG;AAAzF,qIAAA,gCAAgC,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AACpE,mDAAoD;AAA3C,kHAAA,gBAAgB,OAAA;AACzB,qDAA0D;AAAjD,wHAAA,qBAAqB,OAAA"}

package/dist/cjs/src/utils/initOptions.js

@@ -1,78 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildInitOptions = buildInitOptions;
-/**
- * Builds the options object handed to `TideCloak.init()` from a caller's
- * resolved TideCloak config.
- *
- * ## Why this is an ALLOWLIST, deliberately
- *
- * `IAMService.initIAM` has always built these options as an allowlist: it reads
- * a handful of keys off the config and drops everything else on the floor. The
- * config object is NOT a `KeycloakInitOptions` bag - it is an adapter/config
- * snapshot (`tidecloak.json` + Tide fields + app-level OIDC hints), and callers
- * legitimately put keys in it that are meaningful to `IAMService` (or to their
- * own code) but that must NOT be handed to `init()`.
- *
- * PR #91 widened this allowlist to also forward `redirectUri`,
- * `silentCheckSsoFallback`, `silentCheckSsoTimeout`, `scope` and a
- * caller-supplied `pkceMethod`, on the reasoning that "each is inert unless the
- * caller sets it". That reasoning is wrong in one important direction: consumers
- * had been shipping configs with these keys set for as long as the keys were
- * being SWALLOWED, so their behaviour was pinned to the SDK's defaults, not to
- * the value in their config. Forwarding them is therefore a silent behaviour
- * change for every existing consumer - the exact opposite of inert.
- *
- * `scope` is the sharpest edge: forwarding it rewrites the authorization
- * request's scope, which changes the audience/roles on the issued access token
- * and can strip a consumer's admin-API access.
- *
- * So: forward ONLY what the SDK genuinely needs, and keep the previously
- * defaulted behaviour byte-for-byte. Any option that a consumer should be able
- * to set must be added here CONSCIOUSLY, with its prior default preserved.
- *
- * ### Forwarded
- * - `setupRequestEnclave` - passed through from the `initIAM` argument.
- * - `onLoad` - always `"check-sso"`. NOT taken from config: callers (e.g. the
- *   admin console) set `onLoad: "login-required"`, and honouring it would send
- *   `#processInit` down the full-redirect branch and never run silent check-sso
- *   at all. That is a separate product decision.
- * - `silentCheckSsoRedirectUri` - the resolved URI (see ./silentCheckSso.js).
- *   This is the ONE option PR #91 needed to make caller-supplied, and it stays.
- *   `undefined` => TideCloak skips silent check-sso and falls back to an
- *   interactive login rather than emitting a URI that would 400.
- * - `pkceMethod` - always `"S256"`, as it was before PR #91.
- * - `useDPoP` / `checkLoginIframe` - the two options `initIAM` has always
- *   forwarded. `useDPoP` is forwarded ONLY when the caller actually set it, and
- *   VERBATIM. DPoP is opt-in: nothing upstream may default it on, because
- *   enabling it appends `dpop_jkt` to the authorization request and the realm
- *   then issues a `cnf.jkt`-BOUND token, which a plain-Bearer consumer cannot
- *   use (RFC 9449) - a bare `401` with no explanation. Pinned in
- *   test/bootstrapDpop.test.js.
- *
- * ### Deliberately NOT forwarded (regression-tested in test/initOptions.test.js)
- * `scope`, `redirectUri`, `silentCheckSsoFallback`, `silentCheckSsoTimeout`.
- * Consumers depend on the SDK's defaults for these. `redirectUri` in particular
- * is still READ from config by `IAMService.doLogin` / `doLogout` and is used as
- * a derivation source for `silentCheckSsoRedirectUri`, so a sub-path-hosted app
- * still gets a correct login redirect - it just does not have `kc.redirectUri`
- * overridden at init time.
- *
- * @param {Object} args
- * @param {Object|null|undefined} args.config Resolved TideCloak config.
- * @param {boolean} args.setupRequestEnclave
- * @param {string|undefined} args.silentCheckSsoRedirectUri Resolved URI, or
- *   `undefined` when no correct URI could be derived.
- * @returns {Object} Options for `TideCloak.init()`.
- */
-function buildInitOptions({ config, setupRequestEnclave, silentCheckSsoRedirectUri, }) {
-    return {
-        setupRequestEnclave,
-        onLoad: "check-sso",
-        silentCheckSsoRedirectUri,
-        pkceMethod: "S256",
-        ...((config === null || config === void 0 ? void 0 : config.useDPoP) && { useDPoP: config.useDPoP }),
-        ...((config === null || config === void 0 ? void 0 : config.checkLoginIframe) === false && { checkLoginIframe: false }),
-    };
-}
-//# sourceMappingURL=initOptions.js.map

package/dist/cjs/src/utils/initOptions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"initOptions.js","sourceRoot":"","sources":["../../../../src/utils/initOptions.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,0BAAiC,EAC/B,MAAM,EACN,mBAAmB,EACnB,yBAAyB,GAC1B;IACC,OAAO;QACL,mBAAmB;QACnB,MAAM,EAAE,WAAW;QACnB,yBAAyB;QACzB,UAAU,EAAE,MAAM;QAClB,GAAG,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,KAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACnD,GAAG,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,gBAAgB,MAAK,KAAK,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/cjs/src/utils/pkce.js

@@ -1,48 +0,0 @@
-"use strict";
-/**
- * PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0 authorization code flow.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.randomPkceVerifier = randomPkceVerifier;
-exports.base64UrlEncode = base64UrlEncode;
-exports.makePkce = makePkce;
-/**
- * Generate random PKCE verifier string.
- * @param {number} len - Length of the verifier (default 96)
- * @returns {string} Random verifier string
- */
-function randomPkceVerifier(len = 96) {
-    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
-    const bytes = new Uint8Array(len);
-    crypto.getRandomValues(bytes);
-    let out = "";
-    for (let i = 0; i < len; i++) {
-        out += charset[bytes[i] % charset.length];
-    }
-    return out;
-}
-/**
- * Base64 URL encode an ArrayBuffer.
- * @param {ArrayBuffer} arrayBuffer - Buffer to encode
- * @returns {string} Base64 URL encoded string
- */
-function base64UrlEncode(arrayBuffer) {
-    const bytes = new Uint8Array(arrayBuffer);
-    let binary = "";
-    for (let i = 0; i < bytes.byteLength; i++) {
-        binary += String.fromCharCode(bytes[i]);
-    }
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-/**
- * Generate PKCE verifier and challenge.
- * @returns {Promise<{verifier: string, challenge: string, method: string}>}
- */
-async function makePkce() {
-    const verifier = randomPkceVerifier(96);
-    const encoder = new TextEncoder();
-    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
-    const challenge = base64UrlEncode(digest);
-    return { verifier, challenge, method: "S256" };
-}
-//# sourceMappingURL=pkce.js.map

package/dist/cjs/src/utils/pkce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../../src/utils/pkce.js"],"names":[],"mappings":";AAAA;;GAEG;;;;;AAEH;;;;GAIG;AACH,4BAAmC,GAAG,GAAG,EAAE;IACzC,MAAM,OAAO,GAAG,oEAAoE,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,yBAAgC,WAAW;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACI,KAAK;IACV,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC"}

package/dist/cjs/src/utils/silentCheckSso.js

@@ -1,138 +0,0 @@
-"use strict";
-/**
- * Resolution of the silent-check-SSO redirect URI.
- *
- * ## Why this exists
- *
- * `IAMService.initIAM` used to hardcode:
- *
- * ```js
- * silentCheckSsoRedirectUri: `${window.location.origin}/silent-check-sso.html`
- * ```
- *
- * That is only correct for an app served from the ORIGIN ROOT. For any app
- * hosted under a sub-path (e.g. a console served at
- * `https://host/realms/<realm>/tide-console/`) the origin-root URI is:
- *
- *   - NOT served (there is no file at `/silent-check-sso.html`), and
- *   - NOT a registered `redirectUri` on the OIDC client,
- *
- * so the authorization request fails with `400 Invalid parameter: redirect_uri`.
- * The silent iframe then never posts back and the app hangs on its bootstrap
- * spinner. A silently-wrong URI is the worst possible outcome, so this module
- * either derives a CORRECT base-aware URI or reports that it cannot, letting
- * the caller fail loud and fall back to a redirect-based login.
- *
- * ## Resolution order
- *
- * 1. **Caller-supplied `silentCheckSsoRedirectUri`** - always wins, verbatim.
- * 2. **`<base href>`** - the standard way a sub-path-hosted SPA declares where
- *    it lives. Resolved via the browser's own `document.baseURI`.
- * 3. **The app's configured OIDC `redirectUri`** - the SDK already requires this
- *    to be base-aware and registered, so it is a sound source of truth for the
- *    app's base. The SDK's own convention is `<base>auth/redirect`, which is
- *    stripped to recover `<base>` exactly; any other redirect path is resolved
- *    relative to its own directory.
- * 4. **Origin root** - only when the app declares NEITHER a base NOR a
- *    redirectUri. Such an app is relying on the SDK's origin-root default
- *    redirectUri (`${origin}/auth/redirect`) and is therefore root-hosted by
- *    construction. This preserves the historical behaviour for every existing
- *    root-hosted consumer.
- *
- * Anything that cannot be resolved (cross-origin or malformed redirectUri)
- * returns `uri: undefined` plus a `reason`, so the caller can log an error and
- * SKIP the silent check rather than emit a URI that will 400.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SILENT_CHECK_SSO_FILENAME = void 0;
-exports.resolveSilentCheckSsoRedirectUri = resolveSilentCheckSsoRedirectUri;
-/** Filename the SDK ships and that hosting providers are expected to serve. */
-exports.SILENT_CHECK_SSO_FILENAME = 'silent-check-sso.html';
-/** The redirect path convention IAMService itself defaults to (`<base>auth/redirect`). */
-const AUTH_REDIRECT_SUFFIX = 'auth/redirect';
-/**
- * @typedef {object} SilentCheckSsoResolution
- * @property {string|undefined} uri    The resolved URI, or undefined if none could be derived.
- * @property {'config'|'base-href'|'redirect-uri-convention'|'redirect-uri'|'origin-root'|'none'} source
- * @property {string} [reason]         Why resolution failed (only when `uri` is undefined).
- */
-/**
- * Resolve the silent-check-SSO redirect URI.
- *
- * Pure: every environment input is passed in explicitly, so this is unit-testable
- * with no DOM. See the module docblock for the resolution order.
- *
- * @param {object} params
- * @param {string} params.origin        The app's origin (`window.location.origin`).
- * @param {string} [params.configured]  Caller-supplied `silentCheckSsoRedirectUri`.
- * @param {string} [params.baseHref]    `document.baseURI`, but ONLY when a `<base href>` element exists.
- * @param {string} [params.redirectUri] Caller-supplied OIDC `redirectUri`.
- * @returns {SilentCheckSsoResolution}
- */
-function resolveSilentCheckSsoRedirectUri({ origin, configured, baseHref, redirectUri } = {}) {
-    // 1. An explicit value ALWAYS wins, on every init path. Dropping it is the bug
-    //    that took the sub-path-hosted console down.
-    if (isNonEmptyString(configured)) {
-        return { uri: configured.trim(), source: 'config' };
-    }
-    if (!isNonEmptyString(origin)) {
-        return { uri: undefined, source: 'none', reason: 'no origin available (non-browser context)' };
-    }
-    // 2. A declared <base href> is the app telling us exactly where it is hosted.
-    if (isNonEmptyString(baseHref)) {
-        try {
-            const base = new URL(baseHref, origin);
-            return { uri: new URL(exports.SILENT_CHECK_SSO_FILENAME, base).href, source: 'base-href' };
-        }
-        catch {
-            // Malformed <base href> - fall through to the redirectUri, which is more
-            // load-bearing anyway (login is already broken if it is wrong).
-        }
-    }
-    // 3. Derive the base from the app's own configured OIDC redirectUri.
-    if (isNonEmptyString(redirectUri)) {
-        let parsed;
-        try {
-            parsed = new URL(redirectUri, origin);
-        }
-        catch {
-            return {
-                uri: undefined,
-                source: 'none',
-                reason: `configured redirectUri (${redirectUri}) is not a valid URL, so the app base cannot be derived`
-            };
-        }
-        if (parsed.origin !== origin) {
-            return {
-                uri: undefined,
-                source: 'none',
-                reason: `configured redirectUri (${redirectUri}) is on a different origin than the app (${origin}), so the app base cannot be derived`
-            };
-        }
-        // The SDK's own convention: `<base>auth/redirect`. Strip the suffix to
-        // recover `<base>` (keeping its trailing slash) rather than resolving
-        // relative to `<base>auth/`, which would be one directory too deep.
-        if (parsed.pathname.endsWith(`/${AUTH_REDIRECT_SUFFIX}`)) {
-            const basePath = parsed.pathname.slice(0, parsed.pathname.length - AUTH_REDIRECT_SUFFIX.length);
-            return {
-                uri: new URL(exports.SILENT_CHECK_SSO_FILENAME, new URL(basePath, origin)).href,
-                source: 'redirect-uri-convention'
-            };
-        }
-        // Any other redirect path: resolve the filename against the redirect URI's
-        // own directory (`/app/callback` -> `/app/silent-check-sso.html`).
-        return { uri: new URL(exports.SILENT_CHECK_SSO_FILENAME, parsed).href, source: 'redirect-uri' };
-    }
-    // 4. Neither a base nor a redirectUri was declared. The app is therefore
-    //    relying on the SDK's origin-root default redirectUri, i.e. it is
-    //    root-hosted, and origin-root is the right answer.
-    return { uri: `${origin}/${exports.SILENT_CHECK_SSO_FILENAME}`, source: 'origin-root' };
-}
-/**
- * @param {unknown} value
- * @returns {value is string}
- */
-function isNonEmptyString(value) {
-    return typeof value === 'string' && value.trim() !== '';
-}
-//# sourceMappingURL=silentCheckSso.js.map

package/dist/cjs/src/utils/silentCheckSso.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"silentCheckSso.js","sourceRoot":"","sources":["../../../../src/utils/silentCheckSso.js"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;;;;AAEH,+EAA+E;AAClE,QAAA,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;;GAKG;AAEH;;;;;;;;;;;;GAYG;AACH,0CAAkD,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;IAClG,+EAA+E;IAC/E,iDAAiD;IACjD,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACjG,CAAC;IAED,8EAA8E;IAC9E,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,QAAA,yBAAyB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,WAAW,yDAAyD;aACxG,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,SAAS;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,WAAW,4CAA4C,MAAM,sCAAsC;aACvI,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAChG,OAAO;gBACL,GAAG,EAAE,IAAI,GAAG,CAAC,QAAA,yBAAyB,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI;gBACvE,MAAM,EAAE,yBAAyB;aAClC,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,mEAAmE;QACnE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,QAAA,yBAAyB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1F,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,uDAAuD;IACvD,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,QAAA,yBAAyB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAE,KAAK;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC"}

package/dist/cjs/src/vite.js

@@ -1,43 +0,0 @@
-"use strict";
-// Serves tide_dpop_auth.html from `vite dev` and `vite preview`:
-//
-//   import { tideDpopPlugin } from '@tidecloak/js/vite';
-//   export default { plugins: [tideDpopPlugin({ config: tidecloak })] };
-//
-// A static production build still needs the two headers set on the host.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.tideDpopPlugin = tideDpopPlugin;
-const dpopServer_js_1 = require("./dpopServer.js");
-/**
- * @param {Object} [options]
- * @param {Object} [options.config] TideCloak adapter config (tidecloak.json). Used to
- *   reject requests for another realm or client.
- */
-function tideDpopPlugin({ config } = {}) {
-    const { issuer, client } = (0, dpopServer_js_1.expectationsFromConfig)(config);
-    const middleware = (req, res, next) => {
-        var _a, _b;
-        const result = (0, dpopServer_js_1.resolveDpopAuthRequest)({
-            pathname: (_a = req.url) !== null && _a !== void 0 ? _a : '',
-            expectedIssuer: issuer,
-            expectedClient: client,
-            method: req.method,
-        });
-        if (!result)
-            return next();
-        res.statusCode = result.status;
-        for (const [name, value] of Object.entries(result.headers))
-            res.setHeader(name, value);
-        res.end((_b = result.body) !== null && _b !== void 0 ? _b : '');
-    };
-    const install = (server) => {
-        if (!issuer || !client) {
-            console.warn('[tidecloak] Serving the DPoP page without an issuer/client check. Pass `config` to enable it.');
-        }
-        // Registered here, before Vite's own middleware, so the SPA fallback cannot answer first.
-        server.middlewares.use(middleware);
-    };
-    return { name: 'tidecloak-dpop-auth-page', configureServer: install, configurePreviewServer: install };
-}
-exports.default = tideDpopPlugin;
-//# sourceMappingURL=vite.js.map

package/dist/cjs/src/vite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"vite.js","sourceRoot":"","sources":["../../../src/vite.js"],"names":[],"mappings":";AAAA,iEAAiE;AACjE,EAAE;AACF,yDAAyD;AACzD,yEAAyE;AACzE,EAAE;AACF,yEAAyE;;;AAEzE,mDAAiF;AAEjF;;;;GAIG;AACH,wBAA+B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;;QACpC,MAAM,MAAM,GAAG,IAAA,sCAAsB,EAAC;YACpC,QAAQ,QAAE,GAAG,CAAC,GAAG,mCAAI,EAAE;YACvB,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,MAAM;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,EAAE,CAAC;QAE3B,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvF,GAAG,CAAC,GAAG,OAAC,MAAM,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE;QACzB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,+FAA+F,CAAC,CAAC;QAChH,CAAC;QACD,0FAA0F;QAC1F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,eAAe,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC;AACzG,CAAC;kBAEc,cAAc"}

package/dist/esm/lib/secureFetchPolicy.js

@@ -1,42 +0,0 @@
-/**
- * The decision seam of `TideCloak.secureFetch`: given the caller's `Authorization`
- * header (if any) and the access token this client currently holds, should we sign
- * the request as our own - `Authorization: DPoP <token>` plus a `DPoP:` proof?
- *
- * Kept in its own dependency-free module so it can be unit-tested directly.
- * `lib/tidecloak.js` pulls in `heimdall-tide`, which cannot be loaded under plain
- * node ESM, so the predicate is unreachable from a test if it lives there - and
- * this is precisely the seam where a mistake becomes an unexplainable `401`.
- */
-/**
- * @param {string|null|undefined} existingAuth - the caller's `Authorization` header.
- * @param {string} ourToken - the access token this client currently holds.
- * @returns {boolean} true -> attach `Authorization: DPoP <ourToken>` + a DPoP proof.
- *
- * Three cases:
- *
- *  - NO `Authorization` header: YES, attach. "I set no Authorization, use your
- *    token" is the entire point of calling `secureFetch` rather than `fetch`, and
- *    it is exactly what `secureFetch`'s own stale-token warning tells callers to do
- *    ("omit the Authorization header entirely and let secureFetch attach it").
- *
- *    This case used to be false, which sent the request as a plain, UNAUTHENTICATED
- *    fetch: no token, no proof, no credentials of any kind. A consumer that reads
- *    its token from an async state container and calls before that state has
- *    settled (React state that has not yet committed, say) would silently ship a
- *    credential-less admin request and get back a bare `401` naming none of this.
- *    That is the admin-API 401 this closes.
- *
- *  - OUR bearer token: YES, attach - upgrade `Bearer` to `DPoP` + proof. Unchanged.
- *
- *  - SOMEONE ELSE'S bearer token: NO. A third-party API call is a legitimate
- *    pass-through: it goes out verbatim and must never be handed one of our proofs.
- *    Unchanged. (A stale copy of one of ours lands here too, and is warned about
- *    once by the caller.)
- */
-export function shouldAttachDpopProof(existingAuth, ourToken) {
-    if (existingAuth === null || existingAuth === undefined)
-        return true;
-    return existingAuth === `Bearer ${ourToken}`;
-}
-//# sourceMappingURL=secureFetchPolicy.js.map

package/dist/esm/lib/secureFetchPolicy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secureFetchPolicy.js","sourceRoot":"","sources":["../../../lib/secureFetchPolicy.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CAAE,YAAY,EAAE,QAAQ;IAC3D,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpE,OAAO,YAAY,KAAK,UAAU,QAAQ,EAAE,CAAA;AAC9C,CAAC"}

package/dist/esm/src/dpopRoute.js

@@ -1,27 +0,0 @@
-// Serves tide_dpop_auth.html at /tide_dpop/iss/<hex>/aud/<hex>/tide_dpop_auth.html.
-// Uses web Request/Response, so it drops into a Next.js route handler:
-//
-//   // app/tide_dpop/[...path]/route.js
-//   export const { GET, HEAD } = createDpopRoute({ config });
-import { resolveDpopAuthRequest, expectationsFromConfig } from './dpopServer.js';
-/**
- * @param {Object} [options]
- * @param {Object} [options.config] TideCloak adapter config (tidecloak.json). Used to
- *   reject requests for another realm or client. Omitted or empty, it serves any.
- */
-export function createDpopRoute({ config = {} } = {}) {
-    const { issuer, client } = expectationsFromConfig(config);
-    const handle = (request) => {
-        const result = resolveDpopAuthRequest({
-            pathname: new URL(request.url).pathname,
-            expectedIssuer: issuer,
-            expectedClient: client,
-            method: request.method,
-        });
-        if (!result)
-            return new Response('Not Found', { status: 404, headers: { 'Content-Type': 'text/plain' } });
-        return new Response(result.body, { status: result.status, headers: result.headers });
-    };
-    return { GET: handle, HEAD: handle };
-}
-//# sourceMappingURL=dpopRoute.js.map

package/dist/esm/src/dpopRoute.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopRoute.js","sourceRoot":"","sources":["../../../src/dpopRoute.js"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uEAAuE;AACvE,EAAE;AACF,wCAAwC;AACxC,8DAA8D;AAE9D,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,sBAAsB,CAAC;YACpC,QAAQ,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;YACvC,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/esm/src/dpopServer.js

@@ -1,68 +0,0 @@
-// Framework-neutral core for serving tide_dpop_auth.html. No fs, crypto or
-// Buffer, so it also runs on Edge. Adapters: ./dpopRoute.js and ./vite.js.
-import { DPOP_AUTH_HTML, DPOP_AUTH_CSP } from './generated/dpopAuthAsset.js';
-export { DPOP_AUTH_HTML, DPOP_AUTH_CSP };
-const PATH_RE = /^\/tide_dpop\/iss\/([0-9a-fA-F]+)\/aud\/([0-9a-fA-F]+)\/tide_dpop_auth\.html$/;
-// X-Frame-Options or frame-ancestors would block the enclave's embed.
-export function dpopAuthHeaders() {
-    return {
-        'Content-Type': 'text/html; charset=utf-8',
-        'Content-Security-Policy': DPOP_AUTH_CSP,
-        'Allow-CSP-From': '*',
-        'Cache-Control': 'no-store',
-    };
-}
-export function hexToUtf8(hex) {
-    if (!hex || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex))
-        return null;
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < bytes.length; i++)
-        bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
-    try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-    }
-    catch {
-        return null;
-    }
-}
-export function dpopAuthPathFor(issuer, clientId) {
-    const hex = (s) => [...new TextEncoder().encode(s)].map((b) => b.toString(16).padStart(2, '0')).join('');
-    return `/tide_dpop/iss/${hex(issuer)}/aud/${hex(clientId)}/tide_dpop_auth.html`;
-}
-/**
- * Issuer and client id to accept, from a TideCloak adapter config.
- * Either is undefined when the config does not carry it (e.g. the `{}` placeholder).
- */
-export function expectationsFromConfig(config = {}) {
-    const url = config['auth-server-url'];
-    return {
-        issuer: url && config.realm ? `${String(url).replace(/\/+$/, '')}/realms/${config.realm}` : undefined,
-        client: config.resource || undefined,
-    };
-}
-/**
- * The response for a request path, as `{ status, headers, body }`, or null when
- * the path is not the DPoP page. Omitted expectations are not checked.
- */
-export function resolveDpopAuthRequest({ pathname, expectedIssuer, expectedClient, method = 'GET' }) {
-    const match = String(pathname !== null && pathname !== void 0 ? pathname : '').split('?')[0].match(PATH_RE);
-    if (!match)
-        return null;
-    const text = (status, body, extra = {}) => ({
-        status,
-        headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', ...extra },
-        body,
-    });
-    const verb = String(method).toUpperCase();
-    if (verb !== 'GET' && verb !== 'HEAD')
-        return text(405, 'Method Not Allowed', { Allow: 'GET, HEAD' });
-    const issuer = hexToUtf8(match[1]);
-    const client = hexToUtf8(match[2]);
-    if (issuer === null || client === null)
-        return text(400, 'Invalid hex encoding in URL');
-    if ((expectedIssuer && issuer !== expectedIssuer) || (expectedClient && client !== expectedClient)) {
-        return text(403, 'Issuer or client mismatch');
-    }
-    return { status: 200, headers: dpopAuthHeaders(), body: verb === 'HEAD' ? null : DPOP_AUTH_HTML };
-}
-//# sourceMappingURL=dpopServer.js.map

package/dist/esm/src/dpopServer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dpopServer.js","sourceRoot":"","sources":["../../../src/dpopServer.js"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2EAA2E;AAE3E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAEzC,MAAM,OAAO,GAAG,+EAA+E,CAAC;AAEhG,sEAAsE;AACtE,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,cAAc,EAAE,0BAA0B;QAC1C,yBAAyB,EAAE,aAAa;QACxC,gBAAgB,EAAE,GAAG;QACrB,eAAe,EAAE,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAG;IAC3B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAM,EAAE,QAAQ;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,OAAO,kBAAkB,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAM,GAAG,EAAE;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtC,OAAO;QACL,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;QACrG,MAAM,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,GAAG,KAAK,EAAE;IACjG,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE;QAC/F,IAAI;KACL,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEtG,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IACxF,IAAI,CAAC,cAAc,IAAI,MAAM,KAAK,cAAc,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,KAAK,cAAc,CAAC,EAAE,CAAC;QACnG,OAAO,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACpG,CAAC"}