@vymalo/opencode-oauth2 0.14.0 → 0.15.0

package/dist/oauth/client.js

@@ -1,424 +0,0 @@
-import { DEFAULT_TOKEN_EXPIRY_SKEW_MS } from "../config.js";
-import { openExternalUrl } from "./browser.js";
-import { acquireTokenViaDeviceCode } from "./device-code.js";
-import { discoverOidcMetadata } from "./discovery.js";
-import { readResponseBodyPreview, redactUrl, scrubSecrets } from "./http-utils.js";
-import { startLocalCallbackServer } from "./local-callback.js";
-import { generatePkcePair, generateStateToken } from "./pkce.js";
-import { resolveSubjectToken } from "./subject-token.js";
-export function toTokenSet(payload, options) {
-	const accessToken = payload.access_token;
-	if (typeof accessToken !== "string" || accessToken.length === 0) {
-		throw new Error("OAuth token response is missing access_token");
-	}
-	const tokenType = typeof payload.token_type === "string" && payload.token_type.length > 0 ? payload.token_type : "Bearer";
-	const expiresIn = typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? payload.expires_in : undefined;
-	const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.length > 0 ? payload.refresh_token : options?.fallbackRefreshToken;
-	if (options?.requireRefreshToken !== false && !refreshToken) {
-		throw new Error("OAuth token response is missing refresh_token");
-	}
-	return {
-		accessToken,
-		tokenType,
-		refreshToken,
-		scope: typeof payload.scope === "string" ? payload.scope : undefined,
-		expiresAt: expiresIn ? Date.now() + expiresIn * 1e3 : undefined
-	};
-}
-export class OAuthClient {
-	server;
-	fetchImpl;
-	logger;
-	timeoutMs;
-	onAuthorizationUrl;
-	tokenExpirySkewMs;
-	constructor(server, options) {
-		this.server = server;
-		this.fetchImpl = options.fetchImpl ?? fetch;
-		this.logger = options.logger;
-		this.timeoutMs = options.timeoutMs;
-		this.onAuthorizationUrl = options.onAuthorizationUrl;
-		this.tokenExpirySkewMs = typeof options.tokenExpirySkewMs === "number" && Number.isFinite(options.tokenExpirySkewMs) && options.tokenExpirySkewMs > 0 ? options.tokenExpirySkewMs : DEFAULT_TOKEN_EXPIRY_SKEW_MS;
-	}
-	isTokenValid(token) {
-		if (!token?.accessToken) {
-			return false;
-		}
-		if (!token.expiresAt) {
-			// For machine-to-machine flows (client_credentials, jwt_bearer,
-			// token_exchange), re-authentication is cheap (one POST + maybe a
-			// subject-token fetch) and the spec allows but does not require
-			// `expires_in`. Without a declared lifetime we cannot tell if the
-			// server-side token has been revoked, so we re-acquire each time to
-			// avoid persistent 401s after the server's idea of the token has
-			// expired. User-interactive flows (authorization_code, device_code)
-			// keep the old behavior — assume non-expiring when expires_in is
-			// missing — because the cost of forcing an unnecessary browser dance
-			// is high.
-			const machineFlows = [
-				"client_credentials",
-				"jwt_bearer",
-				"token_exchange"
-			];
-			return !machineFlows.includes(this.server.authFlow);
-		}
-		return Date.now() + this.tokenExpirySkewMs < token.expiresAt;
-	}
-	/**
-	* POST to a token endpoint with an AbortController-backed timeout. Without
-	* this, a stalled IdP would block the warmup path indefinitely (the plugin
-	* runs token requests at config-hook time for cached/client_credentials
-	* paths).
-	*/
-	async postWithTimeout(url, body) {
-		const controller = new AbortController();
-		const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-		try {
-			return await this.fetchImpl(url, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/x-www-form-urlencoded",
-					Accept: "application/json"
-				},
-				body,
-				signal: controller.signal
-			});
-		} finally {
-			clearTimeout(timer);
-		}
-	}
-	async ensureToken(current, options = {}) {
-		if (this.isTokenValid(current)) {
-			return current;
-		}
-		// Machine-to-machine flows never need a refresh token (they re-acquire
-		// by re-presenting the platform identity / client secret) and are safe
-		// to run during non-interactive warmup. Dispatch before the refresh
-		// branch so we don't try to use a stale refresh token that the IdP may
-		// not even have issued.
-		if (this.server.authFlow === "client_credentials") {
-			return this.loginClientCredentials();
-		}
-		if (this.server.authFlow === "jwt_bearer") {
-			return this.loginJwtBearer();
-		}
-		if (this.server.authFlow === "token_exchange") {
-			return this.loginTokenExchange();
-		}
-		if (current?.refreshToken) {
-			try {
-				const refreshed = await this.refreshToken(current.refreshToken);
-				this.logger.debug("oauth_refresh_success", { serverId: this.server.id });
-				return refreshed;
-			} catch (error) {
-				this.logger.warn("oauth_refresh_failed", {
-					serverId: this.server.id,
-					error: error instanceof Error ? error.message : String(error)
-				});
-			}
-		}
-		// When called non-interactively (e.g. plugin warmup at config-hook time),
-		// refuse to open a browser or block on device-code polling. Callers like
-		// syncServer catch this and preserve cached state; the provider's models
-		// stay empty in OpenCode until the user actually attempts a chat (which
-		// calls ensureToken with the default interactive=true).
-		if (options.interactive === false) {
-			throw new Error(`interactive authentication required for server "${this.server.id}" (authFlow=${this.server.authFlow}) but called non-interactively`);
-		}
-		if (this.server.authFlow === "device_code") {
-			return this.loginDeviceCode();
-		}
-		return this.loginInteractive();
-	}
-	async loginClientCredentials() {
-		if (!this.server.clientSecret) {
-			throw new Error("client_credentials flow requires clientSecret");
-		}
-		const endpoints = await this.resolveEndpoints();
-		const body = new URLSearchParams({
-			grant_type: "client_credentials",
-			client_id: this.server.clientId,
-			client_secret: this.server.clientSecret
-		});
-		if (this.server.scopes.length > 0) {
-			body.set("scope", this.server.scopes.join(" "));
-		}
-		this.logger.info("oauth_client_credentials_started", {
-			serverId: this.server.id,
-			// tokenEndpoint comes from user-supplied config (or OIDC discovery off
-			// a user-supplied issuer); strip userinfo + query before logging so
-			// configs like `https://user:pass@.../token` don't leak credentials.
-			tokenEndpoint: redactUrl(endpoints.tokenEndpoint)
-		});
-		const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
-		if (!response.ok) {
-			const bodyPreview = await readResponseBodyPreview(response, 500);
-			// Log the body separately so the logger's redaction can scrub matching
-			// keys, and run it through scrubSecrets to also mask token-shaped
-			// substrings that IdPs sometimes echo back inside arbitrary error text
-			// (where field-name-based redaction wouldn't help). Never embed the
-			// body in throw new Error(...) — callers log error.message verbatim.
-			this.logger.error("oauth_client_credentials_failed", {
-				serverId: this.server.id,
-				status: response.status,
-				bodyPreview: bodyPreview ? scrubSecrets(bodyPreview) : undefined
-			});
-			throw new Error(`client_credentials token request failed (${response.status})`);
-		}
-		const payload = await response.json();
-		const token = toTokenSet(payload, { requireRefreshToken: false });
-		this.logger.info("oauth_client_credentials_success", {
-			serverId: this.server.id,
-			hasExpiry: token.expiresAt !== undefined
-		});
-		return token;
-	}
-	async loginJwtBearer() {
-		if (!this.server.subjectTokenSource) {
-			throw new Error("jwt_bearer flow requires subjectTokenSource");
-		}
-		return this.postFederatedGrant({
-			grantType: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-			extraFields: (assertion) => ({ assertion }),
-			eventPrefix: "oauth_jwt_bearer"
-		});
-	}
-	async loginTokenExchange() {
-		if (!this.server.subjectTokenSource) {
-			throw new Error("token_exchange flow requires subjectTokenSource");
-		}
-		return this.postFederatedGrant({
-			grantType: "urn:ietf:params:oauth:grant-type:token-exchange",
-			extraFields: (subjectToken) => {
-				const fields = {
-					subject_token: subjectToken,
-					subject_token_type: "urn:ietf:params:oauth:token-type:jwt"
-				};
-				if (this.server.tokenExchangeAudience) {
-					fields.audience = this.server.tokenExchangeAudience;
-				}
-				return fields;
-			},
-			eventPrefix: "oauth_token_exchange"
-		});
-	}
-	/**
-	* Shared driver for jwt_bearer and token_exchange. Both grants:
-	*   - resolve a platform-supplied JWT from `subjectTokenSource`
-	*   - POST it to the token endpoint with grant-specific form fields
-	*   - get back an access token (refresh token is NOT expected for either)
-	*/
-	async postFederatedGrant(spec) {
-		const subjectTokenSource = this.server.subjectTokenSource;
-		if (!subjectTokenSource) {
-			// Caller already guards this; belt-and-braces for the type narrowing.
-			throw new Error("federated flow requires subjectTokenSource");
-		}
-		const subjectToken = await resolveSubjectToken(subjectTokenSource, {
-			fetchImpl: this.fetchImpl,
-			timeoutMs: this.timeoutMs
-		});
-		const endpoints = await this.resolveEndpoints();
-		const body = new URLSearchParams({
-			grant_type: spec.grantType,
-			client_id: this.server.clientId,
-			...spec.extraFields(subjectToken)
-		});
-		if (this.server.scopes.length > 0) {
-			body.set("scope", this.server.scopes.join(" "));
-		}
-		if (this.server.clientSecret) {
-			// Confidential federated clients are permitted by Keycloak and many
-			// others; some IdPs require both the assertion AND the client secret.
-			body.set("client_secret", this.server.clientSecret);
-		}
-		this.logger.info(`${spec.eventPrefix}_started`, {
-			serverId: this.server.id,
-			tokenEndpoint: redactUrl(endpoints.tokenEndpoint),
-			subjectTokenSource: subjectTokenSource.type
-		});
-		const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
-		if (!response.ok) {
-			const preview = await readResponseBodyPreview(response, 500);
-			this.logger.error(`${spec.eventPrefix}_failed`, {
-				serverId: this.server.id,
-				status: response.status,
-				bodyPreview: preview ? scrubSecrets(preview) : undefined
-			});
-			throw new Error(`${spec.grantType} request failed (${response.status})`);
-		}
-		const payload = await response.json();
-		const token = toTokenSet(payload, { requireRefreshToken: false });
-		this.logger.info(`${spec.eventPrefix}_success`, {
-			serverId: this.server.id,
-			hasExpiry: token.expiresAt !== undefined
-		});
-		return token;
-	}
-	/**
-	* Resolve endpoints for the configured flow. Skips OIDC discovery entirely
-	* when the explicit endpoints needed for the flow are all present in config
-	* — discovery is unavailable on RFC 8414-only servers and on Keycloak
-	* realms where the well-known doc is locked down.
-	*/
-	async resolveEndpoints() {
-		const haveAllExplicit = this.hasExplicitEndpointsForFlow();
-		if (haveAllExplicit) {
-			return {
-				authorizationEndpoint: this.server.authorizationEndpoint,
-				tokenEndpoint: this.server.tokenEndpoint,
-				deviceAuthorizationEndpoint: this.server.deviceAuthorizationEndpoint
-			};
-		}
-		const metadata = await discoverOidcMetadata(this.server.issuer, this.fetchImpl, this.timeoutMs);
-		const tokenEndpoint = this.server.tokenEndpoint ?? metadata.token_endpoint;
-		const authorizationEndpoint = this.server.authorizationEndpoint ?? metadata.authorization_endpoint;
-		const deviceAuthorizationEndpoint = this.server.deviceAuthorizationEndpoint ?? metadata.device_authorization_endpoint;
-		if (this.server.authFlow === "authorization_code" && !authorizationEndpoint) {
-			throw new Error("authorization_code flow requires an authorization_endpoint (either configured or discovered)");
-		}
-		if (this.server.authFlow === "device_code" && !deviceAuthorizationEndpoint) {
-			throw new Error("device_code flow requires a device_authorization_endpoint (either configured or discovered)");
-		}
-		return {
-			authorizationEndpoint,
-			tokenEndpoint,
-			deviceAuthorizationEndpoint
-		};
-	}
-	hasExplicitEndpointsForFlow() {
-		if (!this.server.tokenEndpoint) {
-			return false;
-		}
-		switch (this.server.authFlow) {
-			case "client_credentials":
-			case "jwt_bearer":
-			case "token_exchange": return true;
-			case "device_code": return Boolean(this.server.deviceAuthorizationEndpoint);
-			default: return Boolean(this.server.authorizationEndpoint);
-		}
-	}
-	async refreshToken(refreshToken) {
-		const endpoints = await this.resolveEndpoints();
-		const body = new URLSearchParams({
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: this.server.clientId
-		});
-		if (this.server.clientSecret) {
-			body.set("client_secret", this.server.clientSecret);
-		}
-		const response = await this.postWithTimeout(endpoints.tokenEndpoint, body);
-		if (!response.ok) {
-			throw new Error(`refresh token exchange failed (${response.status})`);
-		}
-		const payload = await response.json();
-		const nextToken = toTokenSet(payload, {
-			fallbackRefreshToken: refreshToken,
-			requireRefreshToken: true
-		});
-		return nextToken;
-	}
-	async loginDeviceCode() {
-		const endpoints = await this.resolveEndpoints();
-		if (!endpoints.deviceAuthorizationEndpoint) {
-			throw new Error("device_code flow requires a device_authorization_endpoint (either configured or discovered)");
-		}
-		return acquireTokenViaDeviceCode({
-			deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
-			tokenEndpoint: endpoints.tokenEndpoint,
-			clientId: this.server.clientId,
-			clientSecret: this.server.clientSecret,
-			scopes: this.server.scopes,
-			serverId: this.server.id,
-			logger: this.logger,
-			fetchImpl: this.fetchImpl,
-			timeoutMs: this.timeoutMs,
-			pkce: this.server.pkce
-		});
-	}
-	async loginInteractive() {
-		const endpoints = await this.resolveEndpoints();
-		if (!endpoints.authorizationEndpoint) {
-			// resolveEndpoints already guards this for authorization_code, but TS
-			// sees the type as optional. Belt-and-braces.
-			throw new Error("authorization_code flow requires an authorization_endpoint (either configured or discovered)");
-		}
-		const callbackServer = await startLocalCallbackServer("/oauth2/callback", this.server.redirectPort);
-		try {
-			// PKCE on by default; opt out via the `pkce` server option for
-			// non-compliant IdPs. Compliant servers ignore the extra parameters.
-			const pkce = this.server.pkce !== false ? generatePkcePair() : undefined;
-			const state = generateStateToken();
-			const authorizeUrl = new URL(endpoints.authorizationEndpoint);
-			authorizeUrl.searchParams.set("response_type", "code");
-			authorizeUrl.searchParams.set("client_id", this.server.clientId);
-			authorizeUrl.searchParams.set("redirect_uri", callbackServer.redirectUri);
-			authorizeUrl.searchParams.set("scope", this.server.scopes.join(" "));
-			if (pkce) {
-				authorizeUrl.searchParams.set("code_challenge", pkce.challenge);
-				authorizeUrl.searchParams.set("code_challenge_method", "S256");
-			}
-			authorizeUrl.searchParams.set("state", state);
-			this.logger.info("oauth_login_started", {
-				serverId: this.server.id,
-				issuer: this.server.issuer,
-				authorizationEndpoint: `${authorizeUrl.origin}${authorizeUrl.pathname}`
-			});
-			if (this.onAuthorizationUrl) {
-				await this.onAuthorizationUrl(authorizeUrl.toString());
-			} else {
-				try {
-					await openExternalUrl(authorizeUrl.toString());
-				} catch (error) {
-					this.logger.warn("oauth_open_browser_failed", {
-						serverId: this.server.id,
-						error: error instanceof Error ? error.message : String(error)
-					});
-					// Write the URL to stderr directly so the terminal user can copy-paste
-					// it. Bypasses the structured logger to avoid leaking the `state`
-					// nonce (and other query params) into centralized log aggregation,
-					// which would enable login-CSRF via a forged localhost callback.
-					process.stderr.write(`\n[opencode-oauth2] open this URL to authenticate (${this.server.id}):\n${authorizeUrl.toString()}\n\n`);
-				}
-			}
-			const callback = await callbackServer.waitForCode();
-			if (callback.state !== state) {
-				throw new Error("OAuth callback state mismatch");
-			}
-			const tokenBody = new URLSearchParams({
-				grant_type: "authorization_code",
-				code: callback.code,
-				client_id: this.server.clientId,
-				redirect_uri: callbackServer.redirectUri
-			});
-			if (pkce) {
-				tokenBody.set("code_verifier", pkce.verifier);
-			}
-			if (this.server.clientSecret) {
-				tokenBody.set("client_secret", this.server.clientSecret);
-			}
-			const tokenResponse = await this.postWithTimeout(endpoints.tokenEndpoint, tokenBody);
-			if (!tokenResponse.ok) {
-				throw new Error(`authorization code exchange failed (${tokenResponse.status})`);
-			}
-			const payload = await tokenResponse.json();
-			const token = toTokenSet(payload, { requireRefreshToken: true });
-			this.logger.info("oauth_login_success", {
-				serverId: this.server.id,
-				hasRefreshToken: true
-			});
-			return token;
-		} catch (error) {
-			this.logger.error("oauth_login_failed", {
-				serverId: this.server.id,
-				error: error instanceof Error ? error.message : String(error)
-			});
-			throw error;
-		} finally {
-			await callbackServer.close();
-		}
-	}
-}
-
-//# sourceMappingURL=client.js.map

package/dist/oauth/client.js.map

@@ -1 +0,0 @@
-{"mappings":"AACA,SAAS,oCAAoC;AAG7C,SAAS,uBAAuB;AAChC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,WAAW,oBAAoB;AACjE,SAAS,gCAAgC;AACzC,SAAS,kBAAkB,0BAA0B;AACrD,SAAS,2BAA2B;AAgBpC,OAAO,SAAS,WACd,SACA,SAIU;CACV,MAAM,cAAc,QAAQ;CAC5B,IAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG;EAC/D,MAAM,IAAI,MAAM,8CAA8C;CAChE;CAEA,MAAM,YACJ,OAAO,QAAQ,eAAe,YAAY,QAAQ,WAAW,SAAS,IAClE,QAAQ,aACR;CAEN,MAAM,YACJ,OAAO,QAAQ,eAAe,YAAY,OAAO,SAAS,QAAQ,UAAU,IACxE,QAAQ,aACR;CACN,MAAM,eACJ,OAAO,QAAQ,kBAAkB,YAAY,QAAQ,cAAc,SAAS,IACxE,QAAQ,gBACR,SAAS;CAEf,IAAI,SAAS,wBAAwB,SAAS,CAAC,cAAc;EAC3D,MAAM,IAAI,MAAM,+CAA+C;CACjE;CAEA,OAAO;EACL;EACA;EACc;EACd,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;EAC3D,WAAW,YAAY,KAAK,IAAI,IAAI,YAAY,MAAO;CACzD;AACF;AAEA,OAAO,MAAM,YAAY;CAQJ;CAPnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YACE,AAAiB,QACjB,SACA;EAFiB;EAGjB,KAAK,YAAY,QAAQ,aAAa;EACtC,KAAK,SAAS,QAAQ;EACtB,KAAK,YAAY,QAAQ;EACzB,KAAK,qBAAqB,QAAQ;EAClC,KAAK,oBACH,OAAO,QAAQ,sBAAsB,YACrC,OAAO,SAAS,QAAQ,iBAAiB,KACzC,QAAQ,oBAAoB,IACxB,QAAQ,oBACR;CACR;CAEA,AAAQ,aAAa,OAA2B;EAC9C,IAAI,CAAC,OAAO,aAAa;GACvB,OAAO;EACT;EAEA,IAAI,CAAC,MAAM,WAAW;;;;;;;;;;;GAWpB,MAAM,eAA6C;IACjD;IACA;IACA;GACF;GACA,OAAO,CAAC,aAAa,SAAS,KAAK,OAAO,QAAQ;EACpD;EAEA,OAAO,KAAK,IAAI,IAAI,KAAK,oBAAoB,MAAM;CACrD;;;;;;;CAQA,MAAc,gBAAgB,KAAa,MAA0C;EACnF,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,GAAG,KAAK,SAAS;EACjE,IAAI;GACF,OAAO,MAAM,KAAK,UAAU,KAAK;IAC/B,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;IACV;IACA;IACA,QAAQ,WAAW;GACrB,CAAC;EACH,UAAU;GACR,aAAa,KAAK;EACpB;CACF;CAEA,MAAM,YACJ,SACA,UAAqC,CAAC,GACnB;EACnB,IAAI,KAAK,aAAa,OAAO,GAAG;GAC9B,OAAO;EACT;;;;;;EAOA,IAAI,KAAK,OAAO,aAAa,sBAAsB;GACjD,OAAO,KAAK,uBAAuB;EACrC;EACA,IAAI,KAAK,OAAO,aAAa,cAAc;GACzC,OAAO,KAAK,eAAe;EAC7B;EACA,IAAI,KAAK,OAAO,aAAa,kBAAkB;GAC7C,OAAO,KAAK,mBAAmB;EACjC;EAEA,IAAI,SAAS,cAAc;GACzB,IAAI;IACF,MAAM,YAAY,MAAM,KAAK,aAAa,QAAQ,YAAY;IAC9D,KAAK,OAAO,MAAM,yBAAyB,EAAE,UAAU,KAAK,OAAO,GAAG,CAAC;IACvE,OAAO;GACT,SAAS,OAAO;IACd,KAAK,OAAO,KAAK,wBAAwB;KACvC,UAAU,KAAK,OAAO;KACtB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC9D,CAAC;GACH;EACF;;;;;;EAOA,IAAI,QAAQ,gBAAgB,OAAO;GACjC,MAAM,IAAI,MACR,mDAAmD,KAAK,OAAO,GAAG,cAAc,KAAK,OAAO,SAAS,+BACvG;EACF;EAEA,IAAI,KAAK,OAAO,aAAa,eAAe;GAC1C,OAAO,KAAK,gBAAgB;EAC9B;EAEA,OAAO,KAAK,iBAAiB;CAC/B;CAEA,MAAc,yBAA4C;EACxD,IAAI,CAAC,KAAK,OAAO,cAAc;GAC7B,MAAM,IAAI,MAAM,+CAA+C;EACjE;EAEA,MAAM,YAAY,MAAM,KAAK,iBAAiB;EAC9C,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK,OAAO;GACvB,eAAe,KAAK,OAAO;EAC7B,CAAC;EAED,IAAI,KAAK,OAAO,OAAO,SAAS,GAAG;GACjC,KAAK,IAAI,SAAS,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC;EAChD;EAEA,KAAK,OAAO,KAAK,oCAAoC;GACnD,UAAU,KAAK,OAAO;;;;GAItB,eAAe,UAAU,UAAU,aAAa;EAClD,CAAC;EAED,MAAM,WAAW,MAAM,KAAK,gBAAgB,UAAU,eAAe,IAAI;EAEzE,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,cAAc,MAAM,wBAAwB,UAAU,GAAG;;;;;;GAM/D,KAAK,OAAO,MAAM,mCAAmC;IACnD,UAAU,KAAK,OAAO;IACtB,QAAQ,SAAS;IACjB,aAAa,cAAc,aAAa,WAAW,IAAI;GACzD,CAAC;GACD,MAAM,IAAI,MAAM,4CAA4C,SAAS,OAAO,EAAE;EAChF;EAEA,MAAM,UAAW,MAAM,SAAS,KAAK;EACrC,MAAM,QAAQ,WAAW,SAAS,EAAE,qBAAqB,MAAM,CAAC;EAEhE,KAAK,OAAO,KAAK,oCAAoC;GACnD,UAAU,KAAK,OAAO;GACtB,WAAW,MAAM,cAAc;EACjC,CAAC;EAED,OAAO;CACT;CAEA,MAAc,iBAAoC;EAChD,IAAI,CAAC,KAAK,OAAO,oBAAoB;GACnC,MAAM,IAAI,MAAM,6CAA6C;EAC/D;EACA,OAAO,KAAK,mBAAmB;GAC7B,WAAW;GACX,cAAc,eAAe,EAAE,UAAU;GACzC,aAAa;EACf,CAAC;CACH;CAEA,MAAc,qBAAwC;EACpD,IAAI,CAAC,KAAK,OAAO,oBAAoB;GACnC,MAAM,IAAI,MAAM,iDAAiD;EACnE;EACA,OAAO,KAAK,mBAAmB;GAC7B,WAAW;GACX,cAAc,iBAAiB;IAC7B,MAAM,SAAiC;KACrC,eAAe;KACf,oBAAoB;IACtB;IACA,IAAI,KAAK,OAAO,uBAAuB;KACrC,OAAO,WAAW,KAAK,OAAO;IAChC;IACA,OAAO;GACT;GACA,aAAa;EACf,CAAC;CACH;;;;;;;CAQA,MAAc,mBAAmB,MAIX;EACpB,MAAM,qBAAqB,KAAK,OAAO;EACvC,IAAI,CAAC,oBAAoB;;GAEvB,MAAM,IAAI,MAAM,4CAA4C;EAC9D;EAEA,MAAM,eAAe,MAAM,oBAAoB,oBAAoB;GACjE,WAAW,KAAK;GAChB,WAAW,KAAK;EAClB,CAAC;EAED,MAAM,YAAY,MAAM,KAAK,iBAAiB;EAC9C,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY,KAAK;GACjB,WAAW,KAAK,OAAO;GACvB,GAAG,KAAK,YAAY,YAAY;EAClC,CAAC;EACD,IAAI,KAAK,OAAO,OAAO,SAAS,GAAG;GACjC,KAAK,IAAI,SAAS,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC;EAChD;EACA,IAAI,KAAK,OAAO,cAAc;;;GAG5B,KAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;EACpD;EAEA,KAAK,OAAO,KAAK,GAAG,KAAK,YAAY,WAAW;GAC9C,UAAU,KAAK,OAAO;GACtB,eAAe,UAAU,UAAU,aAAa;GAChD,oBAAoB,mBAAmB;EACzC,CAAC;EAED,MAAM,WAAW,MAAM,KAAK,gBAAgB,UAAU,eAAe,IAAI;EAEzE,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,UAAU,MAAM,wBAAwB,UAAU,GAAG;GAC3D,KAAK,OAAO,MAAM,GAAG,KAAK,YAAY,UAAU;IAC9C,UAAU,KAAK,OAAO;IACtB,QAAQ,SAAS;IACjB,aAAa,UAAU,aAAa,OAAO,IAAI;GACjD,CAAC;GACD,MAAM,IAAI,MAAM,GAAG,KAAK,UAAU,mBAAmB,SAAS,OAAO,EAAE;EACzE;EAEA,MAAM,UAAW,MAAM,SAAS,KAAK;EACrC,MAAM,QAAQ,WAAW,SAAS,EAAE,qBAAqB,MAAM,CAAC;EAEhE,KAAK,OAAO,KAAK,GAAG,KAAK,YAAY,WAAW;GAC9C,UAAU,KAAK,OAAO;GACtB,WAAW,MAAM,cAAc;EACjC,CAAC;EAED,OAAO;CACT;;;;;;;CAQA,MAAc,mBAA+C;EAC3D,MAAM,kBAAkB,KAAK,4BAA4B;EACzD,IAAI,iBAAiB;GACnB,OAAO;IACL,uBAAuB,KAAK,OAAO;IACnC,eAAe,KAAK,OAAO;IAC3B,6BAA6B,KAAK,OAAO;GAC3C;EACF;EAEA,MAAM,WAAW,MAAM,qBAAqB,KAAK,OAAO,QAAQ,KAAK,WAAW,KAAK,SAAS;EAE9F,MAAM,gBAAgB,KAAK,OAAO,iBAAiB,SAAS;EAC5D,MAAM,wBACJ,KAAK,OAAO,yBAAyB,SAAS;EAChD,MAAM,8BACJ,KAAK,OAAO,+BAA+B,SAAS;EAEtD,IAAI,KAAK,OAAO,aAAa,wBAAwB,CAAC,uBAAuB;GAC3E,MAAM,IAAI,MACR,8FACF;EACF;EACA,IAAI,KAAK,OAAO,aAAa,iBAAiB,CAAC,6BAA6B;GAC1E,MAAM,IAAI,MACR,6FACF;EACF;EAEA,OAAO;GACL;GACA;GACA;EACF;CACF;CAEA,AAAQ,8BAAuC;EAC7C,IAAI,CAAC,KAAK,OAAO,eAAe;GAC9B,OAAO;EACT;EACA,QAAQ,KAAK,OAAO,UAApB;GACE,KAAK;GACL,KAAK;GACL,KAAK,kBACH,OAAO;GACT,KAAK,eACH,OAAO,QAAQ,KAAK,OAAO,2BAA2B;GACxD,SACE,OAAO,QAAQ,KAAK,OAAO,qBAAqB;EACpD;CACF;CAEA,MAAc,aAAa,cAAyC;EAClE,MAAM,YAAY,MAAM,KAAK,iBAAiB;EAC9C,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,eAAe;GACf,WAAW,KAAK,OAAO;EACzB,CAAC;EAED,IAAI,KAAK,OAAO,cAAc;GAC5B,KAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;EACpD;EAEA,MAAM,WAAW,MAAM,KAAK,gBAAgB,UAAU,eAAe,IAAI;EAEzE,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,IAAI,MAAM,kCAAkC,SAAS,OAAO,EAAE;EACtE;EAEA,MAAM,UAAW,MAAM,SAAS,KAAK;EACrC,MAAM,YAAY,WAAW,SAAS;GACpC,sBAAsB;GACtB,qBAAqB;EACvB,CAAC;EAED,OAAO;CACT;CAEA,MAAc,kBAAqC;EACjD,MAAM,YAAY,MAAM,KAAK,iBAAiB;EAC9C,IAAI,CAAC,UAAU,6BAA6B;GAC1C,MAAM,IAAI,MACR,6FACF;EACF;EAEA,OAAO,0BAA0B;GAC/B,6BAA6B,UAAU;GACvC,eAAe,UAAU;GACzB,UAAU,KAAK,OAAO;GACtB,cAAc,KAAK,OAAO;GAC1B,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;GACtB,QAAQ,KAAK;GACb,WAAW,KAAK;GAChB,WAAW,KAAK;GAChB,MAAM,KAAK,OAAO;EACpB,CAAC;CACH;CAEA,MAAc,mBAAsC;EAClD,MAAM,YAAY,MAAM,KAAK,iBAAiB;EAC9C,IAAI,CAAC,UAAU,uBAAuB;;;GAGpC,MAAM,IAAI,MACR,8FACF;EACF;EACA,MAAM,iBAAiB,MAAM,yBAC3B,oBACA,KAAK,OAAO,YACd;EAEA,IAAI;;;GAGF,MAAM,OAAO,KAAK,OAAO,SAAS,QAAQ,iBAAiB,IAAI;GAC/D,MAAM,QAAQ,mBAAmB;GACjC,MAAM,eAAe,IAAI,IAAI,UAAU,qBAAqB;GAE5D,aAAa,aAAa,IAAI,iBAAiB,MAAM;GACrD,aAAa,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;GAC/D,aAAa,aAAa,IAAI,gBAAgB,eAAe,WAAW;GACxE,aAAa,aAAa,IAAI,SAAS,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC;GACnE,IAAI,MAAM;IACR,aAAa,aAAa,IAAI,kBAAkB,KAAK,SAAS;IAC9D,aAAa,aAAa,IAAI,yBAAyB,MAAM;GAC/D;GACA,aAAa,aAAa,IAAI,SAAS,KAAK;GAE5C,KAAK,OAAO,KAAK,uBAAuB;IACtC,UAAU,KAAK,OAAO;IACtB,QAAQ,KAAK,OAAO;IACpB,uBAAuB,GAAG,aAAa,SAAS,aAAa;GAC/D,CAAC;GAED,IAAI,KAAK,oBAAoB;IAC3B,MAAM,KAAK,mBAAmB,aAAa,SAAS,CAAC;GACvD,OAAO;IACL,IAAI;KACF,MAAM,gBAAgB,aAAa,SAAS,CAAC;IAC/C,SAAS,OAAO;KACd,KAAK,OAAO,KAAK,6BAA6B;MAC5C,UAAU,KAAK,OAAO;MACtB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAC9D,CAAC;;;;;KAKD,QAAQ,OAAO,MACb,sDAAsD,KAAK,OAAO,GAAG,MAAM,aAAa,SAAS,EAAE,KACrG;IACF;GACF;GAEA,MAAM,WAAW,MAAM,eAAe,YAAY;GAClD,IAAI,SAAS,UAAU,OAAO;IAC5B,MAAM,IAAI,MAAM,+BAA+B;GACjD;GAEA,MAAM,YAAY,IAAI,gBAAgB;IACpC,YAAY;IACZ,MAAM,SAAS;IACf,WAAW,KAAK,OAAO;IACvB,cAAc,eAAe;GAC/B,CAAC;GAED,IAAI,MAAM;IACR,UAAU,IAAI,iBAAiB,KAAK,QAAQ;GAC9C;GAEA,IAAI,KAAK,OAAO,cAAc;IAC5B,UAAU,IAAI,iBAAiB,KAAK,OAAO,YAAY;GACzD;GAEA,MAAM,gBAAgB,MAAM,KAAK,gBAAgB,UAAU,eAAe,SAAS;GAEnF,IAAI,CAAC,cAAc,IAAI;IACrB,MAAM,IAAI,MAAM,uCAAuC,cAAc,OAAO,EAAE;GAChF;GAEA,MAAM,UAAW,MAAM,cAAc,KAAK;GAC1C,MAAM,QAAQ,WAAW,SAAS,EAAE,qBAAqB,KAAK,CAAC;GAE/D,KAAK,OAAO,KAAK,uBAAuB;IACtC,UAAU,KAAK,OAAO;IACtB,iBAAiB;GACnB,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,KAAK,OAAO,MAAM,sBAAsB;IACtC,UAAU,KAAK,OAAO;IACtB,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC9D,CAAC;GACD,MAAM;EACR,UAAU;GACR,MAAM,eAAe,MAAM;EAC7B;CACF;AACF","names":[],"sources":["../../src/oauth/client.ts"],"version":3,"file":"client.js","sourceRoot":""}

package/dist/oauth/device-code.d.ts

@@ -1,28 +0,0 @@
-import type { Logger } from "../logging.js";
-import type { TokenSet } from "../types.js";
-export interface AcquireTokenViaDeviceCodeOptions {
-	deviceAuthorizationEndpoint: string;
-	tokenEndpoint: string;
-	clientId: string;
-	clientSecret?: string;
-	scopes: string[];
-	serverId: string;
-	logger: Logger;
-	fetchImpl?: typeof fetch;
-	timeoutMs: number;
-	/**
-	* Send PKCE (`code_challenge` on the device-authorization request,
-	* `code_verifier` on the token poll). Defaults to `true`. Set `false` only
-	* for non-compliant IdPs that reject the extra parameters.
-	*/
-	pkce?: boolean;
-	/**
-	* Sleep function used between polls. Overridable for tests.
-	*/
-	sleep?: (ms: number) => Promise<void>;
-	/**
-	* Clock used to measure elapsed time. Overridable for tests.
-	*/
-	now?: () => number;
-}
-export declare function acquireTokenViaDeviceCode(options: AcquireTokenViaDeviceCodeOptions): Promise<TokenSet>;