@uveysservetoglu/kobil-auth 1.0.0

package/README.md

@@ -0,0 +1,37 @@
+# @uveysservetoglu/kobil-auth
+
+KOBIL OIDC (OpenID Connect) authentication helper for Node.js / TypeScript.
+
+- Build authorization redirect URLs with a secure random nonce
+- Exchange authorization codes for tokens
+
+```bash
+npm install @uveysservetoglu/kobil-auth
+```
+
+```ts
+import { AuthClient } from "@uveysservetoglu/kobil-auth";
+
+const auth = new AuthClient({
+  authorizationEndpoint: process.env.OAUTH_URL!,
+  tokenEndpoint: process.env.OTOKEN_URL!,
+  clientId: process.env.OAUTH_CLIENT_ID!,
+  clientSecret: process.env.OAUTH_CLIENT_SECRET!,
+  scope: "openid profile email",
+});
+
+// 1. Redirect the user to log in
+const url = auth.buildAuthorizationUrl("https://app.example.com/callback");
+
+// 2. On the callback, exchange the code
+const tokens = await auth.exchangeCodeForToken(code, "https://app.example.com/callback");
+```
+
+JavaScript usage is identical (`const { AuthClient } = require("@uveysservetoglu/kobil-auth")`).
+
+Failures throw `KobilAuthError` (extends `KobilError` from `@uveysservetoglu/kobil-core`), carrying
+`statusCode` and `responseBody` when available.
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,24 @@
+export interface AuthClientOptions {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret: string;
+    /** Space-separated scopes. Default: "openid". */
+    scope?: string;
+    /** OAuth2 response type. Default: "code". */
+    responseType?: string;
+    /** OAuth2 response mode. Default: "query". */
+    responseMode?: string;
+    /** Length of the generated nonce. Default: 32. */
+    nonceLength?: number;
+}
+/** OIDC authentication helper: build the login redirect URL and exchange the code for tokens. */
+export declare class AuthClient {
+    private readonly options;
+    constructor(options: AuthClientOptions);
+    /** Builds the authorization redirect URL, embedding a fresh secure nonce. */
+    buildAuthorizationUrl(redirectUri: string): string;
+    /** Exchanges an authorization code for tokens. Returns the parsed token response. */
+    exchangeCodeForToken(code: string, redirectUri: string, signal?: AbortSignal): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iGAAiG;AACjG,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAE1C,OAAO,EAAE,iBAAiB;IAetC,6EAA6E;IAC7E,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAclD,qFAAqF;IAC/E,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAsCpC"}

package/dist/client.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthClient = void 0;
+const crypto_1 = require("crypto");
+const error_1 = require("./error");
+const NONCE_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_-";
+/** OIDC authentication helper: build the login redirect URL and exchange the code for tokens. */
+class AuthClient {
+    options;
+    constructor(options) {
+        if (!options.authorizationEndpoint)
+            throw new error_1.KobilAuthError("authorizationEndpoint is required.");
+        if (!options.tokenEndpoint)
+            throw new error_1.KobilAuthError("tokenEndpoint is required.");
+        if (!options.clientId)
+            throw new error_1.KobilAuthError("clientId is required.");
+        if (!options.clientSecret)
+            throw new error_1.KobilAuthError("clientSecret is required.");
+        this.options = {
+            scope: "openid",
+            responseType: "code",
+            responseMode: "query",
+            nonceLength: 32,
+            ...options,
+        };
+    }
+    /** Builds the authorization redirect URL, embedding a fresh secure nonce. */
+    buildAuthorizationUrl(redirectUri) {
+        if (!redirectUri)
+            throw new error_1.KobilAuthError("redirectUri cannot be empty.");
+        const o = this.options;
+        const params = new URLSearchParams({
+            client_id: o.clientId,
+            redirect_uri: redirectUri,
+            scope: o.scope,
+            response_type: o.responseType,
+            response_mode: o.responseMode,
+            nonce: generateNonce(o.nonceLength),
+        });
+        return `${o.authorizationEndpoint}?${params.toString()}`;
+    }
+    /** Exchanges an authorization code for tokens. Returns the parsed token response. */
+    async exchangeCodeForToken(code, redirectUri, signal) {
+        if (!code)
+            throw new error_1.KobilAuthError("code cannot be empty.");
+        if (!redirectUri)
+            throw new error_1.KobilAuthError("redirectUri cannot be empty.");
+        const body = new URLSearchParams({
+            client_id: this.options.clientId,
+            client_secret: this.options.clientSecret,
+            code,
+            redirect_uri: redirectUri,
+            grant_type: "authorization_code",
+        });
+        let response;
+        try {
+            response = await fetch(this.options.tokenEndpoint, {
+                method: "POST",
+                headers: { "content-type": "application/x-www-form-urlencoded" },
+                body,
+                signal,
+            });
+        }
+        catch (cause) {
+            throw new error_1.KobilAuthError("An error occurred while exchanging code for token.", { cause });
+        }
+        const text = await response.text();
+        if (!response.ok) {
+            throw new error_1.KobilAuthError(`Token endpoint returned ${response.status}.`, {
+                statusCode: response.status,
+                responseBody: text,
+            });
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch (cause) {
+            throw new error_1.KobilAuthError("Token endpoint returned invalid JSON.", { cause, responseBody: text });
+        }
+    }
+}
+exports.AuthClient = AuthClient;
+function generateNonce(length) {
+    if (length <= 0)
+        throw new error_1.KobilAuthError("Nonce length must be greater than zero.");
+    const bytes = (0, crypto_1.randomBytes)(length);
+    let result = "";
+    for (let i = 0; i < length; i++) {
+        result += NONCE_CHARS[bytes[i] % NONCE_CHARS.length];
+    }
+    return result;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,mCAAyC;AAEzC,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAiBvF,iGAAiG;AACjG,MAAa,UAAU;IACJ,OAAO,CAA8B;IAEtD,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,CAAC,qBAAqB;YAAE,MAAM,IAAI,sBAAc,CAAC,oCAAoC,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,sBAAc,CAAC,4BAA4B,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAc,CAAC,uBAAuB,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,IAAI,sBAAc,CAAC,2BAA2B,CAAC,CAAC;QAEjF,IAAI,CAAC,OAAO,GAAG;YACb,KAAK,EAAE,QAAQ;YACf,YAAY,EAAE,MAAM;YACpB,YAAY,EAAE,OAAO;YACrB,WAAW,EAAE,EAAE;YACf,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,qBAAqB,CAAC,WAAmB;QACvC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,oBAAoB,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,sBAAc,CAAC,uBAAuB,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACxC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAc,CAAC,2BAA2B,QAAQ,CAAC,MAAM,GAAG,EAAE;gBACtE,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;CACF;AA5ED,gCA4EC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAc,CAAC,yCAAyC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/error.d.ts

@@ -0,0 +1,5 @@
+import { KobilError } from "@uveysservetoglu/kobil-core";
+/** Thrown when an auth operation (token exchange) fails. */
+export declare class KobilAuthError extends KobilError {
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,4DAA4D;AAC5D,qBAAa,cAAe,SAAQ,UAAU;CAAG"}

package/dist/error.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KobilAuthError = void 0;
+const kobil_core_1 = require("@uveysservetoglu/kobil-core");
+/** Thrown when an auth operation (token exchange) fails. */
+class KobilAuthError extends kobil_core_1.KobilError {
+}
+exports.KobilAuthError = KobilAuthError;
+//# sourceMappingURL=error.js.map

package/dist/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":";;;AAAA,4DAAyD;AAEzD,4DAA4D;AAC5D,MAAa,cAAe,SAAQ,uBAAU;CAAG;AAAjD,wCAAiD"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { AuthClient } from "./client";
+export type { AuthClientOptions } from "./client";
+export { KobilAuthError } from "./error";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KobilAuthError = exports.AuthClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "AuthClient", { enumerable: true, get: function () { return client_1.AuthClient; } });
+var error_1 = require("./error");
+Object.defineProperty(exports, "KobilAuthError", { enumerable: true, get: function () { return error_1.KobilAuthError; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAAsC;AAA7B,oGAAA,UAAU,OAAA;AAEnB,iCAAyC;AAAhC,uGAAA,cAAc,OAAA"}

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@uveysservetoglu/kobil-auth",
+  "version": "1.0.0",
+  "description": "KOBIL OIDC (OpenID Connect) authentication helper for Node.js: build authorization URLs and exchange authorization codes for tokens.",
+  "license": "MIT",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "kobil",
+    "oidc",
+    "oauth2",
+    "authentication",
+    "openid-connect"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/uveysservetoglu/kobil-sdks"
+  },
+  "dependencies": {
+    "@uveysservetoglu/kobil-core": "^1.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  }
+}