@vantageos/cloud-identity 0.7.0 → 0.8.0

package/dist/token-exchange.js

@@ -0,0 +1,60 @@
+import { isWellFormedVerifier, pkceChallengeFromVerifier, refusal, utf8, } from "./authorize-shared.js";
+import { sha256Hex, timingSafeEqual } from "./crypto.js";
+const fail = (reason) => ({
+    ok: false,
+    refusal: refusal(reason),
+});
+/**
+ * Redeems an authorization code. The code is CONSUMED first (atomically, by
+ * the store) so that every attempt, successful or not, burns it: a wrong
+ * verifier cannot be retried against the same code. A code presented twice is
+ * `code-reused`, distinct from `code-unknown`, so the consumer can revoke what
+ * the first redemption issued.
+ *
+ * Checks, in order: expiry, client, redirect_uri, resource, PKCE.
+ */
+export async function exchangeAuthorizationCode(input, deps) {
+    if (typeof input.code !== "string" || input.code.length === 0) {
+        return fail("code-unknown");
+    }
+    let consumed;
+    try {
+        consumed = await deps.codeStore.consume(await sha256Hex(input.code));
+    }
+    catch {
+        return fail("code-store-unavailable");
+    }
+    if (consumed.status === "unknown")
+        return fail("code-unknown");
+    if (consumed.status === "already-used")
+        return fail("code-reused");
+    const rec = consumed.record;
+    if (rec.expiresAt <= (deps.now ?? Date.now)())
+        return fail("code-expired");
+    if (rec.clientId !== input.clientId)
+        return fail("client-mismatch");
+    if (rec.redirectUri !== input.redirectUri)
+        return fail("redirect-uri-changed");
+    if (input.resource !== undefined && input.resource !== rec.resource) {
+        return fail("resource-mismatch");
+    }
+    if (!isWellFormedVerifier(input.codeVerifier))
+        return fail("verifier-malformed");
+    const derived = await pkceChallengeFromVerifier(input.codeVerifier);
+    if (!(await timingSafeEqual(utf8(derived), utf8(rec.codeChallenge)))) {
+        return fail("pkce-mismatch");
+    }
+    return {
+        ok: true,
+        claims: {
+            sub: rec.clerkUserId,
+            org_id: rec.orgId,
+            org_slug: rec.orgSlug,
+            org_role: rec.orgRole,
+            aud: rec.resource,
+            client_id: rec.clientId,
+            scope: rec.scope,
+        },
+    };
+}
+//# sourceMappingURL=token-exchange.js.map

package/dist/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../src/token-exchange.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,EACzB,OAAO,EACP,IAAI,GACL,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA0CzD,MAAM,IAAI,GAAG,CAAC,MAAqC,EAAkB,EAAE,CAAC,CAAC;IACvE,EAAE,EAAE,KAAK;IACT,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAoB,EACpB,IAAkB;IAElB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE5B,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,MAAM,EAAE,GAAG,CAAC,KAAK;YACjB,QAAQ,EAAE,GAAG,CAAC,OAAO;YACrB,QAAQ,EAAE,GAAG,CAAC,OAAO;YACrB,GAAG,EAAE,GAAG,CAAC,QAAQ;YACjB,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -37,6 +37,22 @@
     "./presented-bearer": {
       "types": "./dist/presented-bearer.d.ts",
       "import": "./dist/presented-bearer.js"
+    },
+    "./authorize": {
+      "types": "./dist/authorize-flow.d.ts",
+      "import": "./dist/authorize-flow.js"
+    },
+    "./token-exchange": {
+      "types": "./dist/token-exchange.d.ts",
+      "import": "./dist/token-exchange.js"
+    },
+    "./clerk-session": {
+      "types": "./dist/clerk-session.d.ts",
+      "import": "./dist/clerk-session.js"
+    },
+    "./oidc": {
+      "types": "./dist/oidc.d.ts",
+      "import": "./dist/oidc.js"
     }
   },
   "files": [