@witsauth/react-client 1.3.6 → 1.3.9

package/dist/core/AuthClient.d.ts

@@ -1,15 +1,20 @@
-import { OAuth2Config, TokenInfo } from '../models/types';
+import { AuthorizeOptions, OAuth2Config, TokenInfo, UserInfo } from '../models/types';
 import { TokenStorage } from './storage';
 export declare class AuthClient {
     private config;
     private storage;
+    private refreshPromise;
     constructor(config: OAuth2Config, storage?: TokenStorage);
     log(level: 'error' | 'warn' | 'info' | 'debug', ...args: any[]): void;
-    startAuthorization(): Promise<void>;
+    startAuthorization(options?: AuthorizeOptions): Promise<void>;
     exchangeCodeForTokens(code: string, state: string): Promise<TokenInfo>;
     refreshAccessToken(): Promise<TokenInfo>;
     private saveTokenInfo;
     getAccessToken(): string | null;
+    getIdToken(): string | null;
+    getRefreshToken(): string | null;
+    getUserProfile<T extends UserInfo = UserInfo>(): T | null;
+    getToken(): Promise<string | null>;
     getExpiresAt(): number | null;
     isAuthenticated(): boolean;
     navigateToAccountManagement(): Promise<void>;

package/dist/core/pkce.d.ts

@@ -11,3 +11,4 @@ export declare function generateState(): string;
  * Creates a SHA-256 code challenge from the code verifier
  */
 export declare function createCodeChallenge(verifier: string): Promise<string>;
+export declare function decodeJwtPayload<T = Record<string, any>>(token: string | null | undefined): T | null;

package/dist/core/storage.d.ts

@@ -3,7 +3,7 @@ export declare class TokenStorage {
     private storageType?;
     private customStorage?;
     private memoryStorage;
-    constructor(storageType?: "localStorage" | "sessionStorage" | "custom" | undefined, customStorage?: OAuth2Storage | undefined);
+    constructor(storageType?: 'localStorage' | 'sessionStorage' | 'custom' | undefined, customStorage?: OAuth2Storage | undefined);
     private getStorage;
     setItem(key: string, value: string): void;
     getItem(key: string): string | null;

package/dist/index.es.js

@@ -1,33 +1,59 @@
-import { createContext as e, useContext as t, useEffect as n, useMemo as r, useRef as i, useState as a } from "react";
-import { Fragment as o, jsx as s } from "react/jsx-runtime";
+import { createContext as e, useCallback as t, useContext as n, useEffect as r, useMemo as i, useRef as a, useState as o } from "react";
+import { Fragment as s, jsx as c } from "react/jsx-runtime";
 //#region src/models/types.ts
-var c = {
+var l = {
 	ACCESS_TOKEN: "witsauth_access_token",
 	REFRESH_TOKEN: "witsauth_refresh_token",
 	TOKEN_EXPIRES_AT: "witsauth_expires_at",
 	TOKEN_TYPE: "witsauth_token_type",
 	SCOPE: "witsauth_scope",
+	ID_TOKEN: "witsauth_id_token",
 	CODE_VERIFIER: "witsauth_code_verifier",
 	STATE: "witsauth_state",
 	NONCE: "witsauth_nonce"
 };
 //#endregion
 //#region src/core/pkce.ts
-function l() {
+function u() {
 	let e = /* @__PURE__ */ new Uint8Array(32);
 	return crypto.getRandomValues(e), btoa(String.fromCharCode(...e)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function u() {
+function d() {
 	let e = /* @__PURE__ */ new Uint8Array(32);
 	return crypto.getRandomValues(e), btoa(String.fromCharCode(...e)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-async function d(e) {
+async function f(e) {
 	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t), r = new Uint8Array(n);
 	return btoa(String.fromCharCode(...r)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
+function p(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t + "=".repeat((4 - t.length % 4) % 4);
+	if (typeof atob == "function") {
+		let e = atob(n), t = new Uint8Array(e.length);
+		for (let n = 0; n < e.length; n++) t[n] = e.charCodeAt(n);
+		if (typeof TextDecoder < "u") return new TextDecoder().decode(t);
+		let r = "";
+		for (let e = 0; e < t.length; e++) r += String.fromCharCode(t[e]);
+		return decodeURIComponent(escape(r));
+	}
+	let r = typeof globalThis < "u" ? globalThis : void 0;
+	if (r?.Buffer) return r.Buffer.from(n, "base64").toString("utf8");
+	throw Error("Unable to decode base64url string.");
+}
+function m(e) {
+	if (!e || typeof e != "string") return null;
+	let t = e.split(".");
+	if (t.length < 2) return null;
+	try {
+		let e = p(t[1]);
+		return JSON.parse(e);
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/core/storage.ts
-var f = class {
+var h = class {
 	storageType;
 	customStorage;
 	memoryStorage = /* @__PURE__ */ new Map();
@@ -36,10 +62,10 @@ var f = class {
 	}
 	getStorage() {
 		if (this.storageType === "custom" && this.customStorage) return this.customStorage;
-		if (typeof window < "u") {
+		if (typeof window < "u") try {
 			if (this.storageType === "sessionStorage" && window.sessionStorage) return window.sessionStorage;
 			if ((!this.storageType || this.storageType === "localStorage") && window.localStorage) return window.localStorage;
-		}
+		} catch {}
 		let e = this.memoryStorage;
 		return {
 			getItem: (t) => e.has(t) ? e.get(t) : null,
@@ -65,17 +91,18 @@ var f = class {
 	}
 	clearTokens() {
 		let e = this.getStorage();
-		e.removeItem(c.ACCESS_TOKEN), e.removeItem(c.REFRESH_TOKEN), e.removeItem(c.TOKEN_EXPIRES_AT), e.removeItem(c.TOKEN_TYPE), e.removeItem(c.SCOPE);
+		e.removeItem(l.ACCESS_TOKEN), e.removeItem(l.REFRESH_TOKEN), e.removeItem(l.TOKEN_EXPIRES_AT), e.removeItem(l.TOKEN_TYPE), e.removeItem(l.SCOPE), e.removeItem(l.ID_TOKEN);
 	}
 	clearTemporary() {
 		let e = this.getStorage();
-		e.removeItem(c.CODE_VERIFIER), e.removeItem(c.STATE), e.removeItem(c.NONCE);
+		e.removeItem(l.CODE_VERIFIER), e.removeItem(l.STATE), e.removeItem(l.NONCE);
 	}
-}, p = class {
+}, g = class {
 	config;
 	storage;
+	refreshPromise = null;
 	constructor(e, t) {
-		this.config = e, this.storage = t || new f(e.storage, e.customStorage);
+		this.config = e, this.storage = t || new h(e.storage, e.customStorage);
 	}
 	log(e, ...t) {
 		let n = {
@@ -87,29 +114,30 @@ var f = class {
 		}, r = n[this.config.logLevel || "warn"] || 0, i = n[e] || 0;
 		i > 0 && r >= i && console[e](...t);
 	}
-	async startAuthorization() {
-		let e = l(), t = await d(e), n = u(), r = this.config.nonce || u();
-		this.storage.setItem(c.CODE_VERIFIER, e), this.storage.setItem(c.STATE, n), this.storage.setItem(c.NONCE, r);
-		let i = new URLSearchParams({
+	async startAuthorization(e) {
+		let t = u(), n = await f(t), r = d(), i = this.config.nonce || d();
+		this.storage.setItem(l.CODE_VERIFIER, t), this.storage.setItem(l.STATE, r), this.storage.setItem(l.NONCE, i);
+		let a = new URLSearchParams({
 			client_id: this.config.clientId,
 			redirect_uri: this.config.redirectUri,
 			response_type: this.config.responseType || "code",
 			code_challenge_method: this.config.codeChallengeMethod || "S256",
-			code_challenge: t,
-			state: n,
-			nonce: r
+			code_challenge: n,
+			state: r,
+			nonce: i
 		});
 		if (this.config.theme) {
 			let e = typeof this.config.theme == "function" ? this.config.theme() : this.config.theme;
-			e && i.append("theme", e);
+			e && a.append("theme", e);
 		}
-		this.config.scope && i.append("scope", this.config.scope), this.config.audience && i.append("audience", this.config.audience);
-		let a = `${this.config.authorizationEndpoint}?${i.toString()}`;
+		let o = e?.scope ?? this.config.scope, s = e?.audience ?? this.config.audience;
+		o && a.append("scope", o), s && a.append("audience", s), e?.prompt && a.append("prompt", e.prompt);
+		let c = `${this.config.authorizationEndpoint}?${a.toString()}`;
 		if (typeof window > "u" || !window.location) throw Error("startAuthorization requires a browser environment to redirect the user.");
-		window.location.href = a;
+		window.location.href = c;
 	}
 	async exchangeCodeForTokens(e, t) {
-		let n = this.storage.getItem(c.STATE), r = this.storage.getItem(c.CODE_VERIFIER);
+		let n = this.storage.getItem(l.STATE), r = this.storage.getItem(l.CODE_VERIFIER);
 		if (t !== n) throw Error("Invalid state parameter. Possible CSRF attack.");
 		if (!r) throw Error("Code verifier missing from storage.");
 		let i = new URLSearchParams({
@@ -135,36 +163,76 @@ var f = class {
 		return this.saveTokenInfo(s), this.storage.clearTemporary(), s;
 	}
 	async refreshAccessToken() {
-		let e = this.storage.getItem(c.REFRESH_TOKEN);
-		if (!e) throw Error("No refresh token available");
-		let t = new URLSearchParams({
-			grant_type: "refresh_token",
-			client_id: this.config.clientId,
-			refresh_token: e
-		}), n = await fetch(this.config.tokenEndpoint, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: t.toString()
-		});
-		if (!n.ok) throw this.storage.clearTokens(), Error("Failed to refresh token");
-		let r = await n.json(), i = {
-			accessToken: r.access_token,
-			refreshToken: r.refresh_token || e,
-			tokenType: r.token_type || "Bearer",
-			expiresAt: Date.now() + r.expires_in * 1e3,
-			scope: r.scope,
-			idToken: r.id_token
-		};
-		return this.saveTokenInfo(i), i;
+		return this.refreshPromise ||= (async () => {
+			let e = this.storage.getItem(l.REFRESH_TOKEN);
+			if (!e) throw Error("No refresh token available");
+			let t = new URLSearchParams({
+				grant_type: "refresh_token",
+				client_id: this.config.clientId,
+				refresh_token: e
+			}), n;
+			try {
+				n = await fetch(this.config.tokenEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: t.toString()
+				});
+			} catch (e) {
+				throw this.log("error", "Token refresh network request failed:", e), e;
+			}
+			if (!n.ok) {
+				let e = {};
+				try {
+					e = await n.json();
+				} catch {
+					try {
+						e = { error: await n.text() };
+					} catch {
+						e = {};
+					}
+				}
+				this.log("error", "Token refresh failed with status:", n.status, e), (n.status === 400 || n.status === 401) && this.storage.clearTokens();
+				let t = e.error_description || e.error || n.statusText || "Failed to refresh token";
+				throw Error(`Failed to refresh token (${n.status}): ${t}`);
+			}
+			let r = await n.json(), i = {
+				accessToken: r.access_token,
+				refreshToken: r.refresh_token || e,
+				tokenType: r.token_type || "Bearer",
+				expiresAt: Date.now() + r.expires_in * 1e3,
+				scope: r.scope,
+				idToken: r.id_token
+			};
+			return this.saveTokenInfo(i), i;
+		})().finally(() => {
+			this.refreshPromise = null;
+		}), this.refreshPromise;
 	}
 	saveTokenInfo(e) {
-		this.storage.setItem(c.ACCESS_TOKEN, e.accessToken), this.storage.setItem(c.TOKEN_EXPIRES_AT, e.expiresAt.toString()), this.storage.setItem(c.TOKEN_TYPE, e.tokenType), e.refreshToken && this.storage.setItem(c.REFRESH_TOKEN, e.refreshToken), e.scope && this.storage.setItem(c.SCOPE, e.scope);
+		this.storage.setItem(l.ACCESS_TOKEN, e.accessToken), this.storage.setItem(l.TOKEN_EXPIRES_AT, e.expiresAt.toString()), this.storage.setItem(l.TOKEN_TYPE, e.tokenType), e.refreshToken && this.storage.setItem(l.REFRESH_TOKEN, e.refreshToken), e.scope && this.storage.setItem(l.SCOPE, e.scope), e.idToken && this.storage.setItem(l.ID_TOKEN, e.idToken);
 	}
 	getAccessToken() {
-		return this.storage.getItem(c.ACCESS_TOKEN);
+		return this.storage.getItem(l.ACCESS_TOKEN);
+	}
+	getIdToken() {
+		return this.storage.getItem(l.ID_TOKEN);
+	}
+	getRefreshToken() {
+		return this.storage.getItem(l.REFRESH_TOKEN);
+	}
+	getUserProfile() {
+		return m(this.getIdToken() || this.getAccessToken());
+	}
+	async getToken() {
+		if (this.isAuthenticated()) return this.getAccessToken();
+		try {
+			return (await this.refreshAccessToken()).accessToken;
+		} catch {
+			return null;
+		}
 	}
 	getExpiresAt() {
-		let e = this.storage.getItem(c.TOKEN_EXPIRES_AT);
+		let e = this.storage.getItem(l.TOKEN_EXPIRES_AT);
 		if (!e) return null;
 		let t = Number(e);
 		return Number.isFinite(t) ? t : null;
@@ -174,9 +242,9 @@ var f = class {
 		return e !== null && Date.now() < e - 3e4 && !!this.getAccessToken();
 	}
 	async navigateToAccountManagement() {
-		let e = this.storage.getItem(c.REFRESH_TOKEN);
+		let e = this.storage.getItem(l.REFRESH_TOKEN);
 		if (!e) throw Error("No refresh token available to access account management.");
-		if (typeof window > "u" || !document) throw Error("navigateToAccountManagement requires a browser environment.");
+		if (typeof window > "u" || typeof document > "u" || !document) throw Error("navigateToAccountManagement requires a browser environment.");
 		let t = document.createElement("form");
 		t.method = "POST";
 		let n = this.config.authorizationEndpoint.replace(/\/authorize\/?$/, "");
@@ -194,96 +262,109 @@ var f = class {
 		r("refreshToken", e), r("clientId", this.config.clientId), r("redirectUri", this.config.redirectUri), document.body.appendChild(t), t.submit();
 	}
 	async logout() {
-		let e = this.getAccessToken();
-		if (this.storage.clearTokens(), this.storage.clearTemporary(), this.config.revokeEndpoint && e) try {
-			await fetch(this.config.revokeEndpoint, {
-				method: "POST",
-				headers: { "Content-Type": "application/x-www-form-urlencoded" },
-				body: new URLSearchParams({ token: e }).toString()
-			});
-		} catch (e) {
-			this.log("error", "Failed to revoke token during logout", e);
+		let e = this.getAccessToken(), t = this.storage.getItem(l.REFRESH_TOKEN);
+		if (this.storage.clearTokens(), this.storage.clearTemporary(), this.config.revokeEndpoint) {
+			let n = [...t ? [{
+				token: t,
+				token_type_hint: "refresh_token"
+			}] : [], ...e ? [{
+				token: e,
+				token_type_hint: "access_token"
+			}] : []];
+			for (let e of n) try {
+				await fetch(this.config.revokeEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						token: e.token,
+						token_type_hint: e.token_type_hint,
+						client_id: this.config.clientId
+					}).toString()
+				});
+			} catch (e) {
+				this.log("error", "Failed to revoke token during logout", e);
+			}
 		}
 	}
-}, m = e(null), h = ({ config: e, children: t }) => {
-	let [i, o] = a({
+}, _ = e(null), v = ({ config: e, children: n }) => {
+	let [a, s] = o({
 		isAuthenticated: !1,
 		isLoading: !0
-	}), c = r(() => new p(e), [e]);
-	n(() => {
+	}), l = i(() => new g(e), [e]);
+	r(() => {
 		(async () => {
 			try {
-				if (c.isAuthenticated()) o({
+				if (l.isAuthenticated()) s({
 					isAuthenticated: !0,
 					isLoading: !1
 				});
 				else try {
-					await c.refreshAccessToken(), o({
+					await l.refreshAccessToken(), s({
 						isAuthenticated: !0,
 						isLoading: !1
 					});
 				} catch {
-					o({
+					s({
 						isAuthenticated: !1,
 						isLoading: !1
 					});
 				}
 			} catch (e) {
-				o({
+				s({
 					isAuthenticated: !1,
 					isLoading: !1,
 					error: e instanceof Error ? e.message : String(e)
 				});
 			}
 		})();
-	}, [c]), n(() => {
-		if (e.autoRefresh === !1 || !i.isAuthenticated) return;
+	}, [l]), r(() => {
+		if (e.autoRefresh === !1 || !a.isAuthenticated) return;
 		let t = !1, n = setInterval(async () => {
 			if (!t) try {
-				let n = c.getExpiresAt();
+				let n = l.getExpiresAt();
 				if (!n) return;
 				let r = (e.refreshThreshold ?? 60) * 1e3;
 				if (Date.now() >= n - r) {
 					t = !0;
 					try {
-						let e = await c.refreshAccessToken();
-						o((t) => ({
+						let e = await l.refreshAccessToken();
+						s((t) => ({
 							...t,
 							tokenInfo: e
 						}));
 					} catch {
-						u();
+						d();
 					} finally {
 						t = !1;
 					}
 				}
 			} catch (e) {
-				c.log("error", "Auto-refresh error:", e);
+				l.log("error", "Auto-refresh error:", e);
 			}
 		}, 1e4);
 		return () => clearInterval(n);
 	}, [
 		e.autoRefresh,
 		e.refreshThreshold,
-		i.isAuthenticated,
-		c
+		a.isAuthenticated,
+		l
 	]);
-	let l = async () => {
-		o((e) => ({
+	let u = t(async (e) => {
+		s((e) => ({
 			...e,
 			isLoading: !0
-		})), await c.startAuthorization();
-	}, u = async () => {
-		o((e) => ({
+		})), await l.startAuthorization(e);
+	}, [l]), d = async () => {
+		s((e) => ({
 			...e,
 			isLoading: !0
 		}));
 		try {
-			await c.logout();
+			await l.logout();
 		} catch (e) {
-			c.log("error", "Logout error:", e);
+			l.log("error", "Logout error:", e);
 		} finally {
-			if (o({
+			if (s({
 				isAuthenticated: !1,
 				isLoading: !1
 			}), e.logoutEndpoint && typeof window < "u") {
@@ -296,14 +377,14 @@ var f = class {
 				window.location.assign(t.toString());
 			}
 		}
-	}, d = async (t, n) => {
-		o((e) => ({
+	}, f = async (t, n) => {
+		s((e) => ({
 			...e,
 			isLoading: !0
 		}));
 		try {
-			let r = await c.exchangeCodeForTokens(t, n);
-			return o({
+			let r = await l.exchangeCodeForTokens(t, n);
+			return s({
 				isAuthenticated: !0,
 				isLoading: !1,
 				tokenInfo: r
@@ -311,58 +392,63 @@ var f = class {
 				window.location.assign(e.redirectRoute);
 			}, 0), r;
 		} catch (e) {
-			throw o({
+			throw s({
 				isAuthenticated: !1,
 				isLoading: !1,
 				error: e instanceof Error ? e.message : String(e)
 			}), e;
 		}
-	}, f = {
-		...i,
-		login: l,
-		logout: u,
-		navigateToAccountManagement: () => c.navigateToAccountManagement(),
-		handleCallback: d,
-		client: c
+	}, p = t(async () => l.getToken(), [l]), m = a.isAuthenticated ? l.getAccessToken() : null, h = a.isAuthenticated ? l.getIdToken() : null, v = a.isAuthenticated ? l.getUserProfile() : null, y = {
+		...a,
+		accessToken: m,
+		idToken: h,
+		user: v,
+		login: u,
+		logout: d,
+		getToken: p,
+		navigateToAccountManagement: () => l.navigateToAccountManagement(),
+		handleCallback: f,
+		client: l
 	};
-	return /* @__PURE__ */ s(m.Provider, {
-		value: f,
-		children: t
+	return /* @__PURE__ */ c(_.Provider, {
+		value: y,
+		children: n
 	});
-}, g = () => {
-	let e = t(m);
+}, y = () => {
+	let e = n(_);
 	if (!e) throw Error("useAuth must be used within an AuthProvider");
 	return e;
-}, _ = ({ onSuccess: e, onError: t, loadingComponent: r = /* @__PURE__ */ s("div", { children: "Processing authentication..." }) }) => {
-	let { handleCallback: a, client: c } = g(), l = i(!1);
-	return n(() => {
+}, b = ({ onSuccess: e, onError: t, loadingComponent: n = /* @__PURE__ */ c("div", { children: "Processing authentication..." }) }) => {
+	let { handleCallback: i, client: o } = y(), l = a(!1);
+	return r(() => {
 		l.current || (l.current = !0, (async () => {
-			let n = new URLSearchParams(window.location.search), r = new URLSearchParams(window.location.hash.substring(1)), i = n.get("code") || r.get("code"), o = n.get("state") || r.get("state"), s = n.get("error") || r.get("error");
-			if (s) {
-				let e = /* @__PURE__ */ Error(`OAuth Error: ${s}`);
+			if (typeof window > "u" || !window.location) return;
+			let n = new URLSearchParams(window.location.search), r = new URLSearchParams(window.location.hash.substring(1)), a = n.get("code") || r.get("code"), s = n.get("state") || r.get("state"), c = n.get("error") || r.get("error");
+			if (c) {
+				let e = /* @__PURE__ */ Error(`OAuth Error: ${c}`);
 				t && t(e);
 				return;
 			}
-			if (i && o) try {
-				await a(i, o), e && e();
+			if (a && s) try {
+				await i(a, s), e && e();
 			} catch (e) {
 				t && t(e instanceof Error ? e : Error(String(e)));
 			}
-			else if (!i) {
-				let e = c.config;
+			else if (!a) {
+				let e = o.config;
 				window.location.assign(e.redirectRoute || "/");
 			}
 		})());
 	}, [
-		a,
-		c,
+		i,
+		o,
 		e,
 		t
-	]), /* @__PURE__ */ s(o, { children: r });
+	]), /* @__PURE__ */ c(s, { children: n });
 };
 //#endregion
 //#region src/axios/interceptor.ts
-function v(e, t) {
+function x(e, t) {
 	e.interceptors.request.use((e) => {
 		let n = t.getAccessToken();
 		return n && e.headers && (e.headers.Authorization = `Bearer ${n}`), e;
@@ -381,4 +467,4 @@ function v(e, t) {
 	});
 }
 //#endregion
-export { _ as AuthCallback, p as AuthClient, h as AuthProvider, c as STORAGE_KEYS, f as TokenStorage, d as createCodeChallenge, l as generateCodeVerifier, u as generateState, v as setupAxiosInterceptors, g as useAuth };
+export { b as AuthCallback, g as AuthClient, v as AuthProvider, l as STORAGE_KEYS, h as TokenStorage, f as createCodeChallenge, m as decodeJwtPayload, u as generateCodeVerifier, d as generateState, x as setupAxiosInterceptors, y as useAuth };

package/dist/index.umd.js

@@ -1 +1 @@
-(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("react"),require("react/jsx-runtime")):typeof define==`function`&&define.amd?define([`exports`,`react`,`react/jsx-runtime`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.WitsAuthReactClient={},e.React,e.jsxRuntime))})(this,function(e,t,n){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var r=Object.create,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=Object.getOwnPropertyNames,s=Object.getPrototypeOf,c=Object.prototype.hasOwnProperty,l=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var s=o(t),l=0,u=s.length,d;l<u;l++)d=s[l],!c.call(e,d)&&d!==n&&i(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(r=a(t,d))||r.enumerable});return e};t=((e,t,n)=>(n=e==null?{}:r(s(e)),l(t||!e||!e.__esModule?i(n,`default`,{value:e,enumerable:!0}):n,e)))(t,1);var u={ACCESS_TOKEN:`witsauth_access_token`,REFRESH_TOKEN:`witsauth_refresh_token`,TOKEN_EXPIRES_AT:`witsauth_expires_at`,TOKEN_TYPE:`witsauth_token_type`,SCOPE:`witsauth_scope`,CODE_VERIFIER:`witsauth_code_verifier`,STATE:`witsauth_state`,NONCE:`witsauth_nonce`};function d(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function f(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}async function p(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n);return btoa(String.fromCharCode(...r)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}var m=class{storageType;customStorage;memoryStorage=new Map;constructor(e,t){this.storageType=e,this.customStorage=t}getStorage(){if(this.storageType===`custom`&&this.customStorage)return this.customStorage;if(typeof window<`u`){if(this.storageType===`sessionStorage`&&window.sessionStorage)return window.sessionStorage;if((!this.storageType||this.storageType===`localStorage`)&&window.localStorage)return window.localStorage}let e=this.memoryStorage;return{getItem:t=>e.has(t)?e.get(t):null,setItem:(t,n)=>{e.set(t,n)},removeItem:t=>{e.delete(t)},clear:()=>{e.clear()}}}setItem(e,t){this.getStorage().setItem(e,t)}getItem(e){return this.getStorage().getItem(e)}removeItem(e){this.getStorage().removeItem(e)}clearTokens(){let e=this.getStorage();e.removeItem(u.ACCESS_TOKEN),e.removeItem(u.REFRESH_TOKEN),e.removeItem(u.TOKEN_EXPIRES_AT),e.removeItem(u.TOKEN_TYPE),e.removeItem(u.SCOPE)}clearTemporary(){let e=this.getStorage();e.removeItem(u.CODE_VERIFIER),e.removeItem(u.STATE),e.removeItem(u.NONCE)}},h=class{config;storage;constructor(e,t){this.config=e,this.storage=t||new m(e.storage,e.customStorage)}log(e,...t){let n={none:0,error:1,warn:2,info:3,debug:4},r=n[this.config.logLevel||`warn`]||0,i=n[e]||0;i>0&&r>=i&&console[e](...t)}async startAuthorization(){let e=d(),t=await p(e),n=f(),r=this.config.nonce||f();this.storage.setItem(u.CODE_VERIFIER,e),this.storage.setItem(u.STATE,n),this.storage.setItem(u.NONCE,r);let i=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri,response_type:this.config.responseType||`code`,code_challenge_method:this.config.codeChallengeMethod||`S256`,code_challenge:t,state:n,nonce:r});if(this.config.theme){let e=typeof this.config.theme==`function`?this.config.theme():this.config.theme;e&&i.append(`theme`,e)}this.config.scope&&i.append(`scope`,this.config.scope),this.config.audience&&i.append(`audience`,this.config.audience);let a=`${this.config.authorizationEndpoint}?${i.toString()}`;if(typeof window>`u`||!window.location)throw Error(`startAuthorization requires a browser environment to redirect the user.`);window.location.href=a}async exchangeCodeForTokens(e,t){let n=this.storage.getItem(u.STATE),r=this.storage.getItem(u.CODE_VERIFIER);if(t!==n)throw Error(`Invalid state parameter. Possible CSRF attack.`);if(!r)throw Error(`Code verifier missing from storage.`);let i=new URLSearchParams({grant_type:`authorization_code`,client_id:this.config.clientId,redirect_uri:this.config.redirectUri,code:e,code_verifier:r}),a=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i.toString()});if(!a.ok)throw Error(`Failed to exchange code for tokens`);let o=await a.json(),s={accessToken:o.access_token,refreshToken:o.refresh_token,tokenType:o.token_type||`Bearer`,expiresAt:Date.now()+o.expires_in*1e3,scope:o.scope,idToken:o.id_token};return this.saveTokenInfo(s),this.storage.clearTemporary(),s}async refreshAccessToken(){let e=this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available`);let t=new URLSearchParams({grant_type:`refresh_token`,client_id:this.config.clientId,refresh_token:e}),n=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t.toString()});if(!n.ok)throw this.storage.clearTokens(),Error(`Failed to refresh token`);let r=await n.json(),i={accessToken:r.access_token,refreshToken:r.refresh_token||e,tokenType:r.token_type||`Bearer`,expiresAt:Date.now()+r.expires_in*1e3,scope:r.scope,idToken:r.id_token};return this.saveTokenInfo(i),i}saveTokenInfo(e){this.storage.setItem(u.ACCESS_TOKEN,e.accessToken),this.storage.setItem(u.TOKEN_EXPIRES_AT,e.expiresAt.toString()),this.storage.setItem(u.TOKEN_TYPE,e.tokenType),e.refreshToken&&this.storage.setItem(u.REFRESH_TOKEN,e.refreshToken),e.scope&&this.storage.setItem(u.SCOPE,e.scope)}getAccessToken(){return this.storage.getItem(u.ACCESS_TOKEN)}getExpiresAt(){let e=this.storage.getItem(u.TOKEN_EXPIRES_AT);if(!e)return null;let t=Number(e);return Number.isFinite(t)?t:null}isAuthenticated(){let e=this.getExpiresAt();return e!==null&&Date.now()<e-3e4&&!!this.getAccessToken()}async navigateToAccountManagement(){let e=this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available to access account management.`);if(typeof window>`u`||!document)throw Error(`navigateToAccountManagement requires a browser environment.`);let t=document.createElement(`form`);t.method=`POST`;let n=this.config.authorizationEndpoint.replace(/\/authorize\/?$/,``);t.action=`${n}/account/session`;let r=(e,n)=>{let r=document.createElement(`input`);r.type=`hidden`,r.name=e,r.value=n,t.appendChild(r)};try{let e=await(await fetch(`${n}/csrf-token`,{credentials:`include`})).json();e.csrfToken&&r(`_csrf`,e.csrfToken)}catch(e){this.log(`warn`,`Failed to fetch CSRF token for Account Management navigation`,e)}r(`refreshToken`,e),r(`clientId`,this.config.clientId),r(`redirectUri`,this.config.redirectUri),document.body.appendChild(t),t.submit()}async logout(){let e=this.getAccessToken();if(this.storage.clearTokens(),this.storage.clearTemporary(),this.config.revokeEndpoint&&e)try{await fetch(this.config.revokeEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:e}).toString()})}catch(e){this.log(`error`,`Failed to revoke token during logout`,e)}}},g=(0,t.createContext)(null),_=({config:e,children:r})=>{let[i,a]=(0,t.useState)({isAuthenticated:!1,isLoading:!0}),o=(0,t.useMemo)(()=>new h(e),[e]);(0,t.useEffect)(()=>{(async()=>{try{if(o.isAuthenticated())a({isAuthenticated:!0,isLoading:!1});else try{await o.refreshAccessToken(),a({isAuthenticated:!0,isLoading:!1})}catch{a({isAuthenticated:!1,isLoading:!1})}}catch(e){a({isAuthenticated:!1,isLoading:!1,error:e instanceof Error?e.message:String(e)})}})()},[o]),(0,t.useEffect)(()=>{if(e.autoRefresh===!1||!i.isAuthenticated)return;let t=!1,n=setInterval(async()=>{if(!t)try{let n=o.getExpiresAt();if(!n)return;let r=(e.refreshThreshold??60)*1e3;if(Date.now()>=n-r){t=!0;try{let e=await o.refreshAccessToken();a(t=>({...t,tokenInfo:e}))}catch{c()}finally{t=!1}}}catch(e){o.log(`error`,`Auto-refresh error:`,e)}},1e4);return()=>clearInterval(n)},[e.autoRefresh,e.refreshThreshold,i.isAuthenticated,o]);let s=async()=>{a(e=>({...e,isLoading:!0})),await o.startAuthorization()},c=async()=>{a(e=>({...e,isLoading:!0}));try{await o.logout()}catch(e){o.log(`error`,`Logout error:`,e)}finally{if(a({isAuthenticated:!1,isLoading:!1}),e.logoutEndpoint&&typeof window<`u`){let t=new URL(e.logoutEndpoint);t.searchParams.set(`client_id`,e.clientId);let n=e.redirectUri;e.logoutRedirectRoute&&(n=new URL(e.logoutRedirectRoute,window.location.origin).toString()),t.searchParams.set(`redirect_uri`,n),window.location.assign(t.toString())}else if(e.logoutRedirectRoute&&typeof window<`u`){let t=new URL(e.logoutRedirectRoute,window.location.origin);window.location.assign(t.toString())}}},l=async(t,n)=>{a(e=>({...e,isLoading:!0}));try{let r=await o.exchangeCodeForTokens(t,n);return a({isAuthenticated:!0,isLoading:!1,tokenInfo:r}),e.redirectRoute&&typeof window<`u`&&setTimeout(()=>{window.location.assign(e.redirectRoute)},0),r}catch(e){throw a({isAuthenticated:!1,isLoading:!1,error:e instanceof Error?e.message:String(e)}),e}},u={...i,login:s,logout:c,navigateToAccountManagement:()=>o.navigateToAccountManagement(),handleCallback:l,client:o};return(0,n.jsx)(g.Provider,{value:u,children:r})},v=()=>{let e=(0,t.useContext)(g);if(!e)throw Error(`useAuth must be used within an AuthProvider`);return e},y=({onSuccess:e,onError:r,loadingComponent:i=(0,n.jsx)(`div`,{children:`Processing authentication...`})})=>{let{handleCallback:a,client:o}=v(),s=(0,t.useRef)(!1);return(0,t.useEffect)(()=>{s.current||(s.current=!0,(async()=>{let t=new URLSearchParams(window.location.search),n=new URLSearchParams(window.location.hash.substring(1)),i=t.get(`code`)||n.get(`code`),s=t.get(`state`)||n.get(`state`),c=t.get(`error`)||n.get(`error`);if(c){let e=Error(`OAuth Error: ${c}`);r&&r(e);return}if(i&&s)try{await a(i,s),e&&e()}catch(e){r&&r(e instanceof Error?e:Error(String(e)))}else if(!i){let e=o.config;window.location.assign(e.redirectRoute||`/`)}})())},[a,o,e,r]),(0,n.jsx)(n.Fragment,{children:i})};function b(e,t){e.interceptors.request.use(e=>{let n=t.getAccessToken();return n&&e.headers&&(e.headers.Authorization=`Bearer ${n}`),e},e=>Promise.reject(e)),e.interceptors.response.use(e=>e,async n=>{let r=n.config;if(n.response?.status===401&&r&&!r._retry){r._retry=!0;try{let n=await t.refreshAccessToken();return r.headers&&(r.headers.Authorization=`Bearer ${n.accessToken}`),e(r)}catch(e){return t.logout(),Promise.reject(e)}}return Promise.reject(n)})}e.AuthCallback=y,e.AuthClient=h,e.AuthProvider=_,e.STORAGE_KEYS=u,e.TokenStorage=m,e.createCodeChallenge=p,e.generateCodeVerifier=d,e.generateState=f,e.setupAxiosInterceptors=b,e.useAuth=v});
+(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("react"),require("react/jsx-runtime")):typeof define==`function`&&define.amd?define([`exports`,`react`,`react/jsx-runtime`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.WitsAuthReactClient={},e.React,e.jsxRuntime))})(this,function(e,t,n){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var r=Object.create,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=Object.getOwnPropertyNames,s=Object.getPrototypeOf,c=Object.prototype.hasOwnProperty,l=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var s=o(t),l=0,u=s.length,d;l<u;l++)d=s[l],!c.call(e,d)&&d!==n&&i(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(r=a(t,d))||r.enumerable});return e};t=((e,t,n)=>(n=e==null?{}:r(s(e)),l(t||!e||!e.__esModule?i(n,`default`,{value:e,enumerable:!0}):n,e)))(t,1);var u={ACCESS_TOKEN:`witsauth_access_token`,REFRESH_TOKEN:`witsauth_refresh_token`,TOKEN_EXPIRES_AT:`witsauth_expires_at`,TOKEN_TYPE:`witsauth_token_type`,SCOPE:`witsauth_scope`,ID_TOKEN:`witsauth_id_token`,CODE_VERIFIER:`witsauth_code_verifier`,STATE:`witsauth_state`,NONCE:`witsauth_nonce`};function d(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function f(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}async function p(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n);return btoa(String.fromCharCode(...r)).replace(/\+/g,`-`).replace(/\//g,`_`).replace(/=/g,``)}function m(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4);if(typeof atob==`function`){let e=atob(n),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);if(typeof TextDecoder<`u`)return new TextDecoder().decode(t);let r=``;for(let e=0;e<t.length;e++)r+=String.fromCharCode(t[e]);return decodeURIComponent(escape(r))}let r=typeof globalThis<`u`?globalThis:void 0;if(r?.Buffer)return r.Buffer.from(n,`base64`).toString(`utf8`);throw Error(`Unable to decode base64url string.`)}function h(e){if(!e||typeof e!=`string`)return null;let t=e.split(`.`);if(t.length<2)return null;try{let e=m(t[1]);return JSON.parse(e)}catch{return null}}var g=class{storageType;customStorage;memoryStorage=new Map;constructor(e,t){this.storageType=e,this.customStorage=t}getStorage(){if(this.storageType===`custom`&&this.customStorage)return this.customStorage;if(typeof window<`u`)try{if(this.storageType===`sessionStorage`&&window.sessionStorage)return window.sessionStorage;if((!this.storageType||this.storageType===`localStorage`)&&window.localStorage)return window.localStorage}catch{}let e=this.memoryStorage;return{getItem:t=>e.has(t)?e.get(t):null,setItem:(t,n)=>{e.set(t,n)},removeItem:t=>{e.delete(t)},clear:()=>{e.clear()}}}setItem(e,t){this.getStorage().setItem(e,t)}getItem(e){return this.getStorage().getItem(e)}removeItem(e){this.getStorage().removeItem(e)}clearTokens(){let e=this.getStorage();e.removeItem(u.ACCESS_TOKEN),e.removeItem(u.REFRESH_TOKEN),e.removeItem(u.TOKEN_EXPIRES_AT),e.removeItem(u.TOKEN_TYPE),e.removeItem(u.SCOPE),e.removeItem(u.ID_TOKEN)}clearTemporary(){let e=this.getStorage();e.removeItem(u.CODE_VERIFIER),e.removeItem(u.STATE),e.removeItem(u.NONCE)}},_=class{config;storage;refreshPromise=null;constructor(e,t){this.config=e,this.storage=t||new g(e.storage,e.customStorage)}log(e,...t){let n={none:0,error:1,warn:2,info:3,debug:4},r=n[this.config.logLevel||`warn`]||0,i=n[e]||0;i>0&&r>=i&&console[e](...t)}async startAuthorization(e){let t=d(),n=await p(t),r=f(),i=this.config.nonce||f();this.storage.setItem(u.CODE_VERIFIER,t),this.storage.setItem(u.STATE,r),this.storage.setItem(u.NONCE,i);let a=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri,response_type:this.config.responseType||`code`,code_challenge_method:this.config.codeChallengeMethod||`S256`,code_challenge:n,state:r,nonce:i});if(this.config.theme){let e=typeof this.config.theme==`function`?this.config.theme():this.config.theme;e&&a.append(`theme`,e)}let o=e?.scope??this.config.scope,s=e?.audience??this.config.audience;o&&a.append(`scope`,o),s&&a.append(`audience`,s),e?.prompt&&a.append(`prompt`,e.prompt);let c=`${this.config.authorizationEndpoint}?${a.toString()}`;if(typeof window>`u`||!window.location)throw Error(`startAuthorization requires a browser environment to redirect the user.`);window.location.href=c}async exchangeCodeForTokens(e,t){let n=this.storage.getItem(u.STATE),r=this.storage.getItem(u.CODE_VERIFIER);if(t!==n)throw Error(`Invalid state parameter. Possible CSRF attack.`);if(!r)throw Error(`Code verifier missing from storage.`);let i=new URLSearchParams({grant_type:`authorization_code`,client_id:this.config.clientId,redirect_uri:this.config.redirectUri,code:e,code_verifier:r}),a=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i.toString()});if(!a.ok)throw Error(`Failed to exchange code for tokens`);let o=await a.json(),s={accessToken:o.access_token,refreshToken:o.refresh_token,tokenType:o.token_type||`Bearer`,expiresAt:Date.now()+o.expires_in*1e3,scope:o.scope,idToken:o.id_token};return this.saveTokenInfo(s),this.storage.clearTemporary(),s}async refreshAccessToken(){return this.refreshPromise||=(async()=>{let e=this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available`);let t=new URLSearchParams({grant_type:`refresh_token`,client_id:this.config.clientId,refresh_token:e}),n;try{n=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t.toString()})}catch(e){throw this.log(`error`,`Token refresh network request failed:`,e),e}if(!n.ok){let e={};try{e=await n.json()}catch{try{e={error:await n.text()}}catch{e={}}}this.log(`error`,`Token refresh failed with status:`,n.status,e),(n.status===400||n.status===401)&&this.storage.clearTokens();let t=e.error_description||e.error||n.statusText||`Failed to refresh token`;throw Error(`Failed to refresh token (${n.status}): ${t}`)}let r=await n.json(),i={accessToken:r.access_token,refreshToken:r.refresh_token||e,tokenType:r.token_type||`Bearer`,expiresAt:Date.now()+r.expires_in*1e3,scope:r.scope,idToken:r.id_token};return this.saveTokenInfo(i),i})().finally(()=>{this.refreshPromise=null}),this.refreshPromise}saveTokenInfo(e){this.storage.setItem(u.ACCESS_TOKEN,e.accessToken),this.storage.setItem(u.TOKEN_EXPIRES_AT,e.expiresAt.toString()),this.storage.setItem(u.TOKEN_TYPE,e.tokenType),e.refreshToken&&this.storage.setItem(u.REFRESH_TOKEN,e.refreshToken),e.scope&&this.storage.setItem(u.SCOPE,e.scope),e.idToken&&this.storage.setItem(u.ID_TOKEN,e.idToken)}getAccessToken(){return this.storage.getItem(u.ACCESS_TOKEN)}getIdToken(){return this.storage.getItem(u.ID_TOKEN)}getRefreshToken(){return this.storage.getItem(u.REFRESH_TOKEN)}getUserProfile(){return h(this.getIdToken()||this.getAccessToken())}async getToken(){if(this.isAuthenticated())return this.getAccessToken();try{return(await this.refreshAccessToken()).accessToken}catch{return null}}getExpiresAt(){let e=this.storage.getItem(u.TOKEN_EXPIRES_AT);if(!e)return null;let t=Number(e);return Number.isFinite(t)?t:null}isAuthenticated(){let e=this.getExpiresAt();return e!==null&&Date.now()<e-3e4&&!!this.getAccessToken()}async navigateToAccountManagement(){let e=this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available to access account management.`);if(typeof window>`u`||typeof document>`u`||!document)throw Error(`navigateToAccountManagement requires a browser environment.`);let t=document.createElement(`form`);t.method=`POST`;let n=this.config.authorizationEndpoint.replace(/\/authorize\/?$/,``);t.action=`${n}/account/session`;let r=(e,n)=>{let r=document.createElement(`input`);r.type=`hidden`,r.name=e,r.value=n,t.appendChild(r)};try{let e=await(await fetch(`${n}/csrf-token`,{credentials:`include`})).json();e.csrfToken&&r(`_csrf`,e.csrfToken)}catch(e){this.log(`warn`,`Failed to fetch CSRF token for Account Management navigation`,e)}r(`refreshToken`,e),r(`clientId`,this.config.clientId),r(`redirectUri`,this.config.redirectUri),document.body.appendChild(t),t.submit()}async logout(){let e=this.getAccessToken(),t=this.storage.getItem(u.REFRESH_TOKEN);if(this.storage.clearTokens(),this.storage.clearTemporary(),this.config.revokeEndpoint){let n=[...t?[{token:t,token_type_hint:`refresh_token`}]:[],...e?[{token:e,token_type_hint:`access_token`}]:[]];for(let e of n)try{await fetch(this.config.revokeEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:e.token,token_type_hint:e.token_type_hint,client_id:this.config.clientId}).toString()})}catch(e){this.log(`error`,`Failed to revoke token during logout`,e)}}}},v=(0,t.createContext)(null),y=({config:e,children:r})=>{let[i,a]=(0,t.useState)({isAuthenticated:!1,isLoading:!0}),o=(0,t.useMemo)(()=>new _(e),[e]);(0,t.useEffect)(()=>{(async()=>{try{if(o.isAuthenticated())a({isAuthenticated:!0,isLoading:!1});else try{await o.refreshAccessToken(),a({isAuthenticated:!0,isLoading:!1})}catch{a({isAuthenticated:!1,isLoading:!1})}}catch(e){a({isAuthenticated:!1,isLoading:!1,error:e instanceof Error?e.message:String(e)})}})()},[o]),(0,t.useEffect)(()=>{if(e.autoRefresh===!1||!i.isAuthenticated)return;let t=!1,n=setInterval(async()=>{if(!t)try{let n=o.getExpiresAt();if(!n)return;let r=(e.refreshThreshold??60)*1e3;if(Date.now()>=n-r){t=!0;try{let e=await o.refreshAccessToken();a(t=>({...t,tokenInfo:e}))}catch{c()}finally{t=!1}}}catch(e){o.log(`error`,`Auto-refresh error:`,e)}},1e4);return()=>clearInterval(n)},[e.autoRefresh,e.refreshThreshold,i.isAuthenticated,o]);let s=(0,t.useCallback)(async e=>{a(e=>({...e,isLoading:!0})),await o.startAuthorization(e)},[o]),c=async()=>{a(e=>({...e,isLoading:!0}));try{await o.logout()}catch(e){o.log(`error`,`Logout error:`,e)}finally{if(a({isAuthenticated:!1,isLoading:!1}),e.logoutEndpoint&&typeof window<`u`){let t=new URL(e.logoutEndpoint);t.searchParams.set(`client_id`,e.clientId);let n=e.redirectUri;e.logoutRedirectRoute&&(n=new URL(e.logoutRedirectRoute,window.location.origin).toString()),t.searchParams.set(`redirect_uri`,n),window.location.assign(t.toString())}else if(e.logoutRedirectRoute&&typeof window<`u`){let t=new URL(e.logoutRedirectRoute,window.location.origin);window.location.assign(t.toString())}}},l=async(t,n)=>{a(e=>({...e,isLoading:!0}));try{let r=await o.exchangeCodeForTokens(t,n);return a({isAuthenticated:!0,isLoading:!1,tokenInfo:r}),e.redirectRoute&&typeof window<`u`&&setTimeout(()=>{window.location.assign(e.redirectRoute)},0),r}catch(e){throw a({isAuthenticated:!1,isLoading:!1,error:e instanceof Error?e.message:String(e)}),e}},u=(0,t.useCallback)(async()=>o.getToken(),[o]),d=i.isAuthenticated?o.getAccessToken():null,f=i.isAuthenticated?o.getIdToken():null,p=i.isAuthenticated?o.getUserProfile():null,m={...i,accessToken:d,idToken:f,user:p,login:s,logout:c,getToken:u,navigateToAccountManagement:()=>o.navigateToAccountManagement(),handleCallback:l,client:o};return(0,n.jsx)(v.Provider,{value:m,children:r})},b=()=>{let e=(0,t.useContext)(v);if(!e)throw Error(`useAuth must be used within an AuthProvider`);return e},x=({onSuccess:e,onError:r,loadingComponent:i=(0,n.jsx)(`div`,{children:`Processing authentication...`})})=>{let{handleCallback:a,client:o}=b(),s=(0,t.useRef)(!1);return(0,t.useEffect)(()=>{s.current||(s.current=!0,(async()=>{if(typeof window>`u`||!window.location)return;let t=new URLSearchParams(window.location.search),n=new URLSearchParams(window.location.hash.substring(1)),i=t.get(`code`)||n.get(`code`),s=t.get(`state`)||n.get(`state`),c=t.get(`error`)||n.get(`error`);if(c){let e=Error(`OAuth Error: ${c}`);r&&r(e);return}if(i&&s)try{await a(i,s),e&&e()}catch(e){r&&r(e instanceof Error?e:Error(String(e)))}else if(!i){let e=o.config;window.location.assign(e.redirectRoute||`/`)}})())},[a,o,e,r]),(0,n.jsx)(n.Fragment,{children:i})};function S(e,t){e.interceptors.request.use(e=>{let n=t.getAccessToken();return n&&e.headers&&(e.headers.Authorization=`Bearer ${n}`),e},e=>Promise.reject(e)),e.interceptors.response.use(e=>e,async n=>{let r=n.config;if(n.response?.status===401&&r&&!r._retry){r._retry=!0;try{let n=await t.refreshAccessToken();return r.headers&&(r.headers.Authorization=`Bearer ${n.accessToken}`),e(r)}catch(e){return t.logout(),Promise.reject(e)}}return Promise.reject(n)})}e.AuthCallback=x,e.AuthClient=_,e.AuthProvider=y,e.STORAGE_KEYS=u,e.TokenStorage=g,e.createCodeChallenge=p,e.decodeJwtPayload=h,e.generateCodeVerifier=d,e.generateState=f,e.setupAxiosInterceptors=S,e.useAuth=b});

package/dist/models/types.d.ts

@@ -44,15 +44,35 @@ export interface AuthState {
 export interface UserInfo {
     sub?: string;
     name?: string;
+    given_name?: string;
+    family_name?: string;
     email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    roles?: string[];
+    permissions?: string[];
+    amr?: string[];
+    act?: {
+        sub: string;
+        ticket_ref?: string;
+        [key: string]: any;
+    };
     [key: string]: any;
 }
+export type UserProfile = UserInfo;
+export interface AuthorizeOptions {
+    prompt?: 'login' | 'consent' | 'select_account';
+    scope?: string;
+    audience?: string;
+}
 export declare const STORAGE_KEYS: {
     ACCESS_TOKEN: string;
     REFRESH_TOKEN: string;
     TOKEN_EXPIRES_AT: string;
     TOKEN_TYPE: string;
     SCOPE: string;
+    ID_TOKEN: string;
     CODE_VERIFIER: string;
     STATE: string;
     NONCE: string;

package/dist/react/AuthCallback.d.ts

@@ -1,4 +1,4 @@
-import { default as React } from 'react';
+import React from 'react';
 interface AuthCallbackProps {
     onSuccess?: () => void;
     onError?: (error: Error) => void;

package/dist/react/AuthContext.d.ts

@@ -1,9 +1,13 @@
-import { default as React } from 'react';
-import { OAuth2Config, AuthState, TokenInfo } from '../models/types';
+import React from 'react';
+import { AuthorizeOptions, OAuth2Config, AuthState, TokenInfo, UserInfo } from '../models/types';
 import { AuthClient } from '../core/AuthClient';
-interface AuthContextValue extends AuthState {
-    login: () => Promise<void>;
+export interface AuthContextValue extends AuthState {
+    accessToken: string | null;
+    idToken: string | null;
+    user: UserInfo | null;
+    login: (options?: AuthorizeOptions) => Promise<void>;
     logout: () => Promise<void>;
+    getToken: () => Promise<string | null>;
     navigateToAccountManagement: () => Promise<void>;
     client: AuthClient;
     handleCallback: (code: string, state: string) => Promise<TokenInfo>;
@@ -13,4 +17,3 @@ export declare const AuthProvider: React.FC<{
     children: React.ReactNode;
 }>;
 export declare const useAuth: () => AuthContextValue;
-export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@witsauth/react-client",
-  "version": "1.3.6",
+  "version": "1.3.9",
   "description": "Official React client library for integrating Witsauth Single Sign-On (SSO) authentication or similar services into your React applications.",
   "main": "./dist/index.umd.js",
   "module": "./dist/index.es.js",
@@ -42,16 +42,14 @@
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@typescript/typescript6": "^6.0.2",
     "jsdom": "^29.1.1",
     "typescript": "^7.0.2",
     "vite": "^8.1.5",
-    "vite-plugin-dts": "^5.0.3",
     "vitest": "^4.1.10"
   },
   "scripts": {
     "dev": "vite",
-    "build": "tsc && vite build",
+    "build": "tsc && vite build && tsc -p tsconfig.build.json",
     "test": "vitest run"
   }
 }