@turnkey/react-wallet-kit 1.7.2 → 1.8.0

package/dist/utils/oauth.mjs

@@ -0,0 +1,670 @@
+import { defineProperty as _defineProperty, createForOfIteratorHelper as _createForOfIteratorHelper, slicedToArray as _slicedToArray, asyncToGenerator as _asyncToGenerator, regenerator as _regenerator, toConsumableArray as _toConsumableArray, objectSpread2 as _objectSpread2 } from '../_virtual/_rollupPluginBabelHelpers.mjs';
+import { OAuthProviders, TurnkeyError, TurnkeyErrorCodes } from '@turnkey/sdk-types';
+import { faGoogle, faApple, faXTwitter, faDiscord, faFacebook } from '@fortawesome/free-brands-svg-icons';
+
+// ============================================================================
+// OAuth URL Constants
+// ============================================================================
+var DISCORD_AUTH_URL = "https://discord.com/oauth2/authorize";
+var X_AUTH_URL = "https://x.com/i/oauth2/authorize";
+var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
+var APPLE_AUTH_URL = "https://account.apple.com/auth/authorize";
+var FACEBOOK_AUTH_URL = "https://www.facebook.com/v11.0/dialog/oauth";
+var FACEBOOK_GRAPH_URL = "https://graph.facebook.com/v11.0/oauth/access_token";
+// ============================================================================
+// OAuth Popup Constants
+// ============================================================================
+var popupWidth = 500;
+var popupHeight = 600;
+// ============================================================================
+// OAuth Intent Constants
+// ============================================================================
+var OAUTH_INTENT_ADD_PROVIDER = "addProvider";
+var OAUTH_ADD_PROVIDER_METADATA_KEY = "oauth_add_provider_metadata";
+/**
+ * Stores OAuth add provider metadata in session storage
+ * Used for addOauthProvider flow if opening in-page
+ */
+function storeOAuthAddProviderMetadata(metadata) {
+  try {
+    sessionStorage.setItem(OAUTH_ADD_PROVIDER_METADATA_KEY, JSON.stringify(metadata));
+  } catch (error) {
+    throw new TurnkeyError("Failed to store OAuth add provider metadata: ".concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+/**
+ * Retrieves OAuth add provider metadata from session storage
+ */
+function getOAuthAddProviderMetadata() {
+  try {
+    var stored = sessionStorage.getItem(OAUTH_ADD_PROVIDER_METADATA_KEY);
+    if (!stored) return null;
+    try {
+      return JSON.parse(stored);
+    } catch (_unused) {
+      return null;
+    }
+  } catch (error) {
+    throw new TurnkeyError("Failed to retrieve OAuth add provider metadata: ".concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+/**
+ * Clears OAuth add provider metadata from session storage
+ */
+function clearOAuthAddProviderMetadata() {
+  try {
+    sessionStorage.removeItem(OAUTH_ADD_PROVIDER_METADATA_KEY);
+  } catch (error) {
+    throw new TurnkeyError("Failed to clear OAuth add provider metadata: ".concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+// ============================================================================
+// OAuth State Building
+// ============================================================================
+/**
+ * Builds the OAuth state parameter string
+ */
+function buildOAuthState(params) {
+  var provider = params.provider,
+    flow = params.flow,
+    publicKey = params.publicKey,
+    nonce = params.nonce,
+    additionalState = params.additionalState;
+  var state = "provider=".concat(provider, "&flow=").concat(flow, "&publicKey=").concat(encodeURIComponent(publicKey));
+  if (nonce) {
+    state += "&nonce=".concat(nonce);
+  }
+  if (additionalState) {
+    var extra = Object.entries(additionalState).map(function (_ref) {
+      var _ref2 = _slicedToArray(_ref, 2),
+        k = _ref2[0],
+        v = _ref2[1];
+      return "".concat(encodeURIComponent(k), "=").concat(encodeURIComponent(v));
+    }).join("&");
+    if (extra) {
+      state += "&".concat(extra);
+    }
+  }
+  return state;
+}
+// ============================================================================
+// OAuth Provider Opening Utilities
+// ============================================================================
+/**
+ * Opens a centered OAuth popup window
+ */
+function openOAuthPopup() {
+  var width = popupWidth;
+  var height = popupHeight;
+  var left = window.screenX + (window.innerWidth - width) / 2;
+  var top = window.screenY + (window.innerHeight - height) / 2;
+  return window.open("about:blank", "_blank", "width=".concat(width, ",height=").concat(height, ",top=").concat(top, ",left=").concat(left, ",scrollbars=yes,resizable=yes"));
+}
+/**
+ * Redirects to OAuth provider URL
+ */
+function redirectToOAuthProvider(url) {
+  window.location.href = url;
+  var timeLimit = 5 * 60 * 1000; // 5 minutes
+  return new Promise(function (_, reject) {
+    var timeout = setTimeout(function () {
+      reject(new Error("Authentication timed out."));
+    }, timeLimit);
+    window.addEventListener("beforeunload", function () {
+      return clearTimeout(timeout);
+    });
+  });
+}
+// ============================================================================
+// OAuth URL Cleanup
+// ============================================================================
+/**
+ * Cleans up OAuth parameters from URL (removes hash and search)
+ */
+function cleanupOAuthUrl() {
+  window.history.replaceState(null, document.title, window.location.pathname);
+}
+/**
+ * Cleans up OAuth hash from URL but preserves search parameters
+ */
+function cleanupOAuthUrlPreserveSearch() {
+  window.history.replaceState(null, document.title, window.location.pathname + window.location.search);
+}
+// ============================================================================
+// OAuth State Parsing
+// ============================================================================
+/**
+ * Parses the OAuth state parameter string into an object
+ */
+function parseStateParam(stateParam) {
+  if (!stateParam) return {};
+  var result = {};
+  var pairs = stateParam.split("&");
+  var _iterator = _createForOfIteratorHelper(pairs),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var pair = _step.value;
+      var _pair$split = pair.split("="),
+        _pair$split2 = _slicedToArray(_pair$split, 2),
+        key = _pair$split2[0],
+        value = _pair$split2[1];
+      if (key && value !== undefined) {
+        result[key] = decodeURIComponent(value);
+      }
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return result;
+}
+/**
+ * Unified OAuth response parser for both popup and redirect flows.
+ * Handles both:
+ * - PKCE flows (Facebook, Discord, X): code in search parameters
+ * - Non-PKCE flows (Google, Apple): id_token in hash parameters
+ * - Apple's non-standard hash format where state parameters are directly embedded
+ *
+ * @param url - The full URL to parse (from popup or redirect)
+ * @param expectedProvider - Optional provider if already known (for popup flows)
+ * @returns Parsed OAuth response data including tokens, codes, and state parameters, or null if invalid
+ */
+function parseOAuthResponse(url, expectedProvider) {
+  var idToken = null;
+  var authCode = null;
+  var stateString = null;
+  var parsedUrl = new URL(url);
+  var search = parsedUrl.search.substring(1); // Remove leading '?'
+  var hash = parsedUrl.hash.substring(1); // Remove leading '#'
+  // Handle PKCE flows (code in search parameters)
+  if (search && search.includes("code=")) {
+    var searchParams = new URLSearchParams(search);
+    authCode = searchParams.get("code");
+    stateString = searchParams.get("state");
+  }
+  // Handle non-PKCE flows (id_token in hash)
+  else if (hash) {
+    // Handle Apple's non-standard format: state=provider=apple&flow=redirect&...&code=...&id_token=...
+    if (hash.startsWith("state=provider=apple")) {
+      // Extract id_token from the end
+      var idTokenMatch = hash.match(/id_token=([^&]+)$/);
+      idToken = idTokenMatch ? idTokenMatch[1] : null;
+      // Extract state content between "state=" and "&code="
+      var stateEndIndex = hash.indexOf("&code=");
+      if (stateEndIndex !== -1) {
+        stateString = hash.substring(6, stateEndIndex); // Remove "state=" prefix
+      }
+    } else {
+      // Standard OAuth format - parse as URLSearchParams
+      var hashParams = new URLSearchParams(hash);
+      idToken = hashParams.get("id_token");
+      stateString = hashParams.get("state");
+    }
+  }
+  // Parse state parameters
+  var _parseStateParam = parseStateParam(stateString),
+    provider = _parseStateParam.provider,
+    flow = _parseStateParam.flow,
+    publicKey = _parseStateParam.publicKey,
+    openModal = _parseStateParam.openModal,
+    sessionKey = _parseStateParam.sessionKey,
+    oauthIntent = _parseStateParam.oauthIntent,
+    nonce = _parseStateParam.nonce;
+  // If we have an expected provider (popup flow), validate it matches
+  if (expectedProvider) {
+    var config = OAUTH_PROVIDER_CONFIGS[expectedProvider];
+    if (config.usesPKCE) {
+      // PKCE providers must have authCode and matching provider in state
+      if (!authCode || !stateString || provider !== expectedProvider) {
+        return null;
+      }
+    } else {
+      // Non-PKCE providers must have idToken
+      if (!idToken) {
+        return null;
+      }
+    }
+  }
+  return {
+    idToken: idToken,
+    authCode: authCode,
+    provider: provider !== null && provider !== void 0 ? provider : null,
+    flow: flow !== null && flow !== void 0 ? flow : null,
+    publicKey: publicKey !== null && publicKey !== void 0 ? publicKey : null,
+    openModal: openModal !== null && openModal !== void 0 ? openModal : null,
+    sessionKey: sessionKey !== null && sessionKey !== void 0 ? sessionKey : undefined,
+    oauthIntent: oauthIntent !== null && oauthIntent !== void 0 ? oauthIntent : null,
+    nonce: nonce !== null && nonce !== void 0 ? nonce : null
+  };
+}
+// ============================================================================
+// PKCE Utilities
+// ============================================================================
+/**
+ * Generates a PKCE challenge pair (verifier and code challenge)
+ */
+function generateChallengePair() {
+  return _generateChallengePair.apply(this, arguments);
+}
+/**
+ * Exchanges Facebook authorization code for token
+ */
+function _generateChallengePair() {
+  _generateChallengePair = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
+    var randomBytes, verifier, encoder, data, digest, base64Challenge;
+    return _regenerator().w(function (_context) {
+      while (1) switch (_context.n) {
+        case 0:
+          randomBytes = new Uint8Array(32);
+          window.crypto.getRandomValues(randomBytes);
+          verifier = btoa(String.fromCharCode.apply(String, _toConsumableArray(randomBytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+          encoder = new TextEncoder();
+          data = encoder.encode(verifier);
+          _context.n = 1;
+          return window.crypto.subtle.digest("SHA-256", data);
+        case 1:
+          digest = _context.v;
+          base64Challenge = btoa(String.fromCharCode.apply(String, _toConsumableArray(new Uint8Array(digest)))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+          return _context.a(2, {
+            verifier: verifier,
+            codeChallenge: base64Challenge
+          });
+      }
+    }, _callee);
+  }));
+  return _generateChallengePair.apply(this, arguments);
+}
+function exchangeFacebookCodeForToken(_x, _x2, _x3, _x4) {
+  return _exchangeFacebookCodeForToken.apply(this, arguments);
+}
+/**
+ * Unified OAuth completion handler.
+ * Routes to the appropriate completion handler based on params:
+ * Priority: onAddProvider > onOauthSuccess > callbacks.onOauthRedirect > completeOauth
+ *
+ * This is the core completion logic used by both popup and redirect flows.
+ */
+function _exchangeFacebookCodeForToken() {
+  _exchangeFacebookCodeForToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(clientId, redirectUri, code, codeVerifier) {
+    var params, response, errorData;
+    return _regenerator().w(function (_context2) {
+      while (1) switch (_context2.n) {
+        case 0:
+          params = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+            code: code,
+            grant_type: "authorization_code"
+          });
+          _context2.n = 1;
+          return fetch(FACEBOOK_GRAPH_URL, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/x-www-form-urlencoded"
+            },
+            body: params.toString()
+          });
+        case 1:
+          response = _context2.v;
+          if (response.ok) {
+            _context2.n = 3;
+            break;
+          }
+          _context2.n = 2;
+          return response.json();
+        case 2:
+          errorData = _context2.v;
+          throw new Error("Facebook token exchange failed: ".concat(JSON.stringify(errorData)));
+        case 3:
+          _context2.n = 4;
+          return response.json();
+        case 4:
+          return _context2.a(2, _context2.v);
+      }
+    }, _callee2);
+  }));
+  return _exchangeFacebookCodeForToken.apply(this, arguments);
+}
+function completeOAuthFlow(_x5) {
+  return _completeOAuthFlow.apply(this, arguments);
+}
+/**
+ * Gets the verifier key name for a PKCE provider
+ */
+function _completeOAuthFlow() {
+  _completeOAuthFlow = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(params) {
+    var provider, publicKey, oidcToken, sessionKey, callbacks, completeOauth, onOauthSuccess, onAddProvider;
+    return _regenerator().w(function (_context3) {
+      while (1) switch (_context3.n) {
+        case 0:
+          provider = params.provider, publicKey = params.publicKey, oidcToken = params.oidcToken, sessionKey = params.sessionKey, callbacks = params.callbacks, completeOauth = params.completeOauth, onOauthSuccess = params.onOauthSuccess, onAddProvider = params.onAddProvider;
+          if (!onAddProvider) {
+            _context3.n = 2;
+            break;
+          }
+          _context3.n = 1;
+          return onAddProvider(oidcToken);
+        case 1:
+          _context3.n = 5;
+          break;
+        case 2:
+          if (!onOauthSuccess) {
+            _context3.n = 3;
+            break;
+          }
+          onOauthSuccess(_objectSpread2({
+            publicKey: publicKey,
+            oidcToken: oidcToken,
+            providerName: provider
+          }, sessionKey && {
+            sessionKey: sessionKey
+          }));
+          _context3.n = 5;
+          break;
+        case 3:
+          if (!(callbacks !== null && callbacks !== void 0 && callbacks.onOauthRedirect)) {
+            _context3.n = 4;
+            break;
+          }
+          callbacks.onOauthRedirect(_objectSpread2({
+            idToken: oidcToken,
+            publicKey: publicKey
+          }, sessionKey && {
+            sessionKey: sessionKey
+          }));
+          _context3.n = 5;
+          break;
+        case 4:
+          _context3.n = 5;
+          return completeOauth(_objectSpread2({
+            oidcToken: oidcToken,
+            publicKey: publicKey,
+            providerName: provider
+          }, sessionKey && {
+            sessionKey: sessionKey
+          }));
+        case 5:
+          return _context3.a(2);
+      }
+    }, _callee3);
+  }));
+  return _completeOAuthFlow.apply(this, arguments);
+}
+function getPKCEVerifierKey(provider) {
+  return "".concat(provider, "_verifier");
+}
+/**
+ * Retrieves and removes the PKCE verifier from session storage
+ * @param provider - The OAuth provider
+ * @returns The verifier string
+ * @throws TurnkeyError if verifier is not found
+ */
+function consumePKCEVerifier(provider) {
+  try {
+    var key = getPKCEVerifierKey(provider);
+    var verifier = sessionStorage.getItem(key);
+    if (!verifier) {
+      throw new TurnkeyError("Missing PKCE verifier for ".concat(provider, " authentication"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+    }
+    sessionStorage.removeItem(key);
+    return verifier;
+  } catch (error) {
+    if (error instanceof TurnkeyError) {
+      throw error;
+    }
+    throw new TurnkeyError("Failed to access PKCE verifier for ".concat(provider, ": ").concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+/**
+ * Stores the PKCE verifier in session storage
+ * @param provider - The OAuth provider
+ * @param verifier - The verifier string to store
+ */
+function storePKCEVerifier(provider, verifier) {
+  try {
+    sessionStorage.setItem(getPKCEVerifierKey(provider), verifier);
+  } catch (error) {
+    throw new TurnkeyError("Failed to store PKCE verifier for ".concat(provider, ": ").concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+/**
+ * Checks if a PKCE verifier exists for a provider (without consuming it)
+ * @param provider - The OAuth provider
+ * @returns true if verifier exists
+ */
+function hasPKCEVerifier(provider) {
+  try {
+    return sessionStorage.getItem(getPKCEVerifierKey(provider)) !== null;
+  } catch (error) {
+    throw new TurnkeyError("Failed to check PKCE verifier for ".concat(provider, ": ").concat(error instanceof Error ? error.message : "Unknown error"), TurnkeyErrorCodes.OAUTH_SIGNUP_ERROR);
+  }
+}
+/**
+ * Unified PKCE flow handler for all PKCE-based OAuth providers.
+ * Handles the complete PKCE flow: verifier retrieval, token exchange, and completion routing.
+ *
+ * This function abstracts the common logic shared between popup and redirect flows
+ * for Facebook, Discord, and Twitter/X.
+ *
+ * @param params - The PKCE flow parameters
+ * @returns A promise that resolves when the flow is complete
+ */
+function handlePKCEFlow(_x6) {
+  return _handlePKCEFlow.apply(this, arguments);
+}
+/**
+ * Pre-configured OAuth provider settings
+ */
+function _handlePKCEFlow() {
+  _handlePKCEFlow = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(_ref3) {
+    var publicKey, providerName, sessionKey, callbacks, completeOauth, onOauthSuccess, onAddProvider, exchangeCodeForToken, verifier, oidcToken;
+    return _regenerator().w(function (_context4) {
+      while (1) switch (_context4.n) {
+        case 0:
+          publicKey = _ref3.publicKey, providerName = _ref3.providerName, sessionKey = _ref3.sessionKey, callbacks = _ref3.callbacks, completeOauth = _ref3.completeOauth, onOauthSuccess = _ref3.onOauthSuccess, onAddProvider = _ref3.onAddProvider, exchangeCodeForToken = _ref3.exchangeCodeForToken;
+          // Consume the verifier (retrieves and removes from storage)
+          verifier = consumePKCEVerifier(providerName); // Exchange the code for an OIDC token using the provider-specific function
+          _context4.n = 1;
+          return exchangeCodeForToken(verifier);
+        case 1:
+          oidcToken = _context4.v;
+          _context4.n = 2;
+          return completeOAuthFlow({
+            provider: providerName,
+            publicKey: publicKey,
+            oidcToken: oidcToken,
+            sessionKey: sessionKey,
+            callbacks: callbacks,
+            completeOauth: completeOauth,
+            onOauthSuccess: onOauthSuccess,
+            onAddProvider: onAddProvider
+          });
+        case 2:
+          return _context4.a(2);
+      }
+    }, _callee4);
+  }));
+  return _handlePKCEFlow.apply(this, arguments);
+}
+var OAUTH_PROVIDER_CONFIGS = _defineProperty(_defineProperty(_defineProperty(_defineProperty(_defineProperty({}, OAuthProviders.GOOGLE, {
+  provider: OAuthProviders.GOOGLE,
+  authUrl: GOOGLE_AUTH_URL,
+  scopes: "openid email profile",
+  usesPKCE: false,
+  responseType: "id_token",
+  nonceInParams: true
+}), OAuthProviders.APPLE, {
+  provider: OAuthProviders.APPLE,
+  authUrl: APPLE_AUTH_URL,
+  scopes: "",
+  usesPKCE: false,
+  responseType: "code id_token",
+  responseMode: "fragment",
+  nonceInParams: true
+}), OAuthProviders.FACEBOOK, {
+  provider: OAuthProviders.FACEBOOK,
+  authUrl: FACEBOOK_AUTH_URL,
+  scopes: "openid",
+  usesPKCE: true,
+  responseType: "code",
+  nonceInParams: true
+}), OAuthProviders.DISCORD, {
+  provider: OAuthProviders.DISCORD,
+  authUrl: DISCORD_AUTH_URL,
+  scopes: "identify email",
+  usesPKCE: true,
+  responseType: "code",
+  nonceInParams: false
+}), OAuthProviders.X, {
+  provider: OAuthProviders.X,
+  authUrl: X_AUTH_URL,
+  scopes: "tweet.read users.read",
+  usesPKCE: true,
+  responseType: "code",
+  nonceInParams: false
+});
+/**
+ * Builds the complete OAuth authorization URL for a provider
+ */
+function buildOAuthUrl(params) {
+  var provider = params.provider,
+    clientId = params.clientId,
+    redirectUri = params.redirectUri,
+    publicKey = params.publicKey,
+    nonce = params.nonce,
+    flow = params.flow,
+    codeChallenge = params.codeChallenge,
+    additionalState = params.additionalState;
+  var config = OAUTH_PROVIDER_CONFIGS[provider];
+  var authUrl = new URL(config.authUrl);
+  authUrl.searchParams.set("client_id", clientId);
+  authUrl.searchParams.set("redirect_uri", redirectUri);
+  authUrl.searchParams.set("response_type", config.responseType);
+  if (config.scopes) {
+    authUrl.searchParams.set("scope", config.scopes);
+  }
+  if (config.responseMode) {
+    authUrl.searchParams.set("response_mode", config.responseMode);
+  }
+  // PKCE parameters
+  if (config.usesPKCE && codeChallenge) {
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+  }
+  // Nonce handling - some providers want it in URL params, others in state
+  if (config.nonceInParams) {
+    authUrl.searchParams.set("nonce", nonce);
+  }
+  // Google-specific: prompt for account selection
+  if (provider === OAuthProviders.GOOGLE) {
+    authUrl.searchParams.set("prompt", "select_account");
+  }
+  // Build state parameter
+  var stateParams = {
+    provider: provider,
+    flow: flow,
+    publicKey: publicKey
+  };
+  // Include nonce in state for providers that need it there (not in URL params)
+  if (!config.nonceInParams) {
+    stateParams.nonce = nonce;
+  }
+  if (additionalState) {
+    stateParams.additionalState = additionalState;
+  }
+  authUrl.searchParams.set("state", buildOAuthState(stateParams));
+  return authUrl.toString();
+}
+/**
+ * Completes OAuth flow in popup - handles both PKCE and non-PKCE providers
+ */
+function completeOAuthPopup(_x7) {
+  return _completeOAuthPopup.apply(this, arguments);
+}
+// ============================================================================
+// OAuth Helper Utilities
+// ============================================================================
+/**
+ * Capitalizes the first letter of a provider name
+ * @param provider - The provider name (e.g., "facebook", "discord")
+ * @returns The capitalized provider name (e.g., "Facebook", "Discord")
+ */
+function _completeOAuthPopup() {
+  _completeOAuthPopup = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee5(params) {
+    var provider, publicKey, result, callbacks, completeOauth, onOauthSuccess, exchangeCodeForToken, config;
+    return _regenerator().w(function (_context5) {
+      while (1) switch (_context5.n) {
+        case 0:
+          provider = params.provider, publicKey = params.publicKey, result = params.result, callbacks = params.callbacks, completeOauth = params.completeOauth, onOauthSuccess = params.onOauthSuccess, exchangeCodeForToken = params.exchangeCodeForToken;
+          config = OAUTH_PROVIDER_CONFIGS[provider];
+          if (!config.usesPKCE) {
+            _context5.n = 3;
+            break;
+          }
+          if (exchangeCodeForToken) {
+            _context5.n = 1;
+            break;
+          }
+          throw new TurnkeyError("exchangeCodeForToken is required for PKCE providers", TurnkeyErrorCodes.INTERNAL_ERROR);
+        case 1:
+          _context5.n = 2;
+          return handlePKCEFlow({
+            publicKey: publicKey,
+            providerName: provider,
+            sessionKey: result.sessionKey,
+            callbacks: callbacks,
+            completeOauth: completeOauth,
+            onOauthSuccess: onOauthSuccess,
+            exchangeCodeForToken: exchangeCodeForToken
+          });
+        case 2:
+          _context5.n = 4;
+          break;
+        case 3:
+          _context5.n = 4;
+          return completeOAuthFlow({
+            provider: provider,
+            publicKey: publicKey,
+            oidcToken: result.idToken,
+            sessionKey: result.sessionKey,
+            callbacks: callbacks,
+            completeOauth: completeOauth,
+            onOauthSuccess: onOauthSuccess
+          });
+        case 4:
+          return _context5.a(2);
+      }
+    }, _callee5);
+  }));
+  return _completeOAuthPopup.apply(this, arguments);
+}
+function capitalizeProviderName(provider) {
+  if (!provider) return "Provider";
+  return provider.charAt(0).toUpperCase() + provider.slice(1);
+}
+/**
+ * Gets the FontAwesome icon for an OAuth provider
+ * @param provider - The provider name
+ * @returns The FontAwesome icon definition
+ */
+function getProviderIcon(provider) {
+  switch (provider) {
+    case OAuthProviders.FACEBOOK:
+      return faFacebook;
+    case OAuthProviders.DISCORD:
+      return faDiscord;
+    case OAuthProviders.X:
+      return faXTwitter;
+    case OAuthProviders.APPLE:
+      return faApple;
+    case OAuthProviders.GOOGLE:
+    default:
+      return faGoogle;
+  }
+}
+
+export { APPLE_AUTH_URL, DISCORD_AUTH_URL, FACEBOOK_AUTH_URL, FACEBOOK_GRAPH_URL, GOOGLE_AUTH_URL, OAUTH_ADD_PROVIDER_METADATA_KEY, OAUTH_INTENT_ADD_PROVIDER, OAUTH_PROVIDER_CONFIGS, X_AUTH_URL, buildOAuthState, buildOAuthUrl, capitalizeProviderName, cleanupOAuthUrl, cleanupOAuthUrlPreserveSearch, clearOAuthAddProviderMetadata, completeOAuthFlow, completeOAuthPopup, consumePKCEVerifier, exchangeFacebookCodeForToken, generateChallengePair, getOAuthAddProviderMetadata, getPKCEVerifierKey, getProviderIcon, handlePKCEFlow, hasPKCEVerifier, openOAuthPopup, parseOAuthResponse, parseStateParam, popupHeight, popupWidth, redirectToOAuthProvider, storeOAuthAddProviderMetadata, storePKCEVerifier };
+//# sourceMappingURL=oauth.mjs.map