npm - @witsauth/react-native-client - Versions diffs - 0.0.0-stage → 1.0.0 - Mend

@witsauth/react-native-client 0.0.0-stage → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md +194 -2
package/dist/axios/interceptor.d.ts +13 -0
package/dist/core/AuthClient.d.ts +44 -0
package/dist/core/browser.d.ts +29 -0
package/dist/core/pkce.d.ts +15 -0
package/dist/core/storage.d.ts +49 -0
package/dist/index.d.ts +9 -0
package/dist/index.es.js +619 -0
package/dist/index.umd.js +1 -0
package/dist/models/types.d.ts +104 -0
package/dist/react/AuthContext.d.ts +28 -0
package/package.json +63 -4

package/README.md CHANGED Viewed

@@ -1,3 +1,195 @@
-# Temporary Holding Version
+# @witsauth/react-native-client
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Official React Native SDK for **WitsAuth** OAuth 2.0 + PKCE authentication, token lifecycle management, Axios interceptor integration, and hosted Account Management on **Android** and **iOS** (supporting both **Expo** and **Bare React Native CLI**).
+---
+## Features
+- **RFC 8252 System Browser OAuth 2.0 + PKCE (`S256`)**: Uses `ASWebAuthenticationSession` on iOS and Chrome Custom Tabs on Android.
+- **Hermes-Ready Pure-TS SHA-256 PKCE**: Works out-of-the-box on React Native Hermes without requiring native Web Crypto polyfills.
+- **Hardware-Backed Secure Token Storage**: Built-in adapters for `expo-secure-store` (Expo) and `react-native-keychain` (Bare React Native CLI), backed by iOS Keychain and Android Keystore.
+- **Automatic Token Refresh**: Proactively refreshes expiring tokens and refreshes automatically when the app returns to the foreground (`AppState`).
+- **Hosted Account Management (`/auth/account`)**: Allows users to change their password, update their profile, and verify their mobile phone number via OTP using a single-use handoff ticket (`navigateToAccountManagement()`).
+- **Axios Interceptor**: Automatically attaches `Authorization: Bearer <token>` and queues/retries concurrent `401 Unauthorized` requests.
+---
+## 1. WitsAuth Console Configuration
+1. Open the **WitsAuth Console** and create or edit a **Regular Web / Mobile Application**.
+2. Set **Framework** to **React Native (Mobile)**.
+3. Add your mobile deep-link callback URI under **Allowed Callback URLs**, for example:
+   ```text
+   myapp://auth/callback
+   ```
+---
+## 2. Installation & Setup
+### Option A: Expo (Managed or Prebuild Workflow)
+```bash
+npx expo install @witsauth/react-native-client expo-web-browser expo-secure-store
+```
+Configure your custom scheme in `app.json`:
+```json
+{
+  "expo": {
+    "name": "My App",
+    "slug": "my-app",
+    "scheme": "myapp"
+  }
+}
+```
+Initialize `AuthProvider` in your app root:
+```tsx
+import React from 'react';
+import { AppState } from 'react-native';
+import * as WebBrowser from 'expo-web-browser';
+import * as SecureStore from 'expo-secure-store';
+import {
+  AuthProvider,
+  createExpoSecureStoreAdapter,
+  createExpoWebBrowserLauncher,
+  OAuth2NativeConfig
+} from '@witsauth/react-native-client';
+WebBrowser.maybeCompleteAuthSession();
+const authConfig: OAuth2NativeConfig = {
+  clientId: 'YOUR_CLIENT_ID',
+  authorizationEndpoint: 'https://your-tenant.witsauth.com/auth/authorize',
+  tokenEndpoint: 'https://your-tenant.witsauth.com/oauth/token',
+  revokeEndpoint: 'https://your-tenant.witsauth.com/oauth/revoke',
+  redirectUri: 'myapp://auth/callback',
+  scope: 'openid profile email offline_access',
+  storage: createExpoSecureStoreAdapter(SecureStore),
+  openAuthSession: createExpoWebBrowserLauncher(WebBrowser)
+};
+export default function App() {
+  return (
+    <AuthProvider
+      config={authConfig}
+      subscribeAppState={(listener) => {
+        const sub = AppState.addEventListener('change', listener);
+        return () => sub.remove();
+      }}
+    >
+      {/* Your App Navigation */}
+    </AuthProvider>
+  );
+}
+```
+---
+### Option B: Bare React Native CLI (Android & iOS)
+```bash
+npm install @witsauth/react-native-client react-native-inappbrowser-reborn react-native-keychain
+cd ios && pod install
+```
+#### Android Deep-Link Configuration (`android/app/src/main/AndroidManifest.xml`)
+Add an `<intent-filter>` inside your main `<activity>`:
+```xml
+<intent-filter>
+  <action android:name="android.intent.action.VIEW" />
+  <category android:name="android.intent.category.DEFAULT" />
+  <category android:name="android.intent.category.BROWSABLE" />
+  <data android:scheme="myapp" android:host="auth" android:pathPrefix="/callback" />
+</intent-filter>
+```
+#### iOS Deep-Link Configuration (`ios/<YourApp>/Info.plist`)
+Register `CFBundleURLTypes`:
+```xml
+<key>CFBundleURLTypes</key>
+<array>
+  <dict>
+    <key>CFBundleTypeRole</key>
+    <string>Editor</string>
+    <key>CFBundleURLName</key>
+    <string>com.yourcompany.myapp</string>
+    <key>CFBundleURLSchemes</key>
+    <array>
+      <string>myapp</string>
+    </array>
+  </dict>
+</array>
+```
+Initialize `AuthProvider` with `react-native-keychain` and `react-native-inappbrowser-reborn`:
+```tsx
+import React from 'react';
+import { AppState } from 'react-native';
+import InAppBrowser from 'react-native-inappbrowser-reborn';
+import * as Keychain from 'react-native-keychain';
+import {
+  AuthProvider,
+  createKeychainStorageAdapter,
+  createInAppBrowserLauncher,
+  OAuth2NativeConfig
+} from '@witsauth/react-native-client';
+const authConfig: OAuth2NativeConfig = {
+  clientId: 'YOUR_CLIENT_ID',
+  authorizationEndpoint: 'https://your-tenant.witsauth.com/auth/authorize',
+  tokenEndpoint: 'https://your-tenant.witsauth.com/oauth/token',
+  revokeEndpoint: 'https://your-tenant.witsauth.com/oauth/revoke',
+  redirectUri: 'myapp://auth/callback',
+  scope: 'openid profile email offline_access',
+  storage: createKeychainStorageAdapter(Keychain),
+  openAuthSession: createInAppBrowserLauncher(InAppBrowser)
+};
+```
+---
+## 3. Using `useAuth()` for Login, Logout & Account Management
+```tsx
+import React from 'react';
+import { View, Button, Text } from 'react-native';
+import { useAuth } from '@witsauth/react-native-client';
+export function ProfileScreen() {
+  const {
+    isAuthenticated,
+    isLoading,
+    login,
+    logout,
+    navigateToAccountManagement
+  } = useAuth();
+  if (isLoading) {
+    return <Text>Loading...</Text>;
+  }
+  if (!isAuthenticated) {
+    return <Button title="Sign In with WitsAuth" onPress={login} />;
+  }
+  return (
+    <View>
+      <Button
+        title="Manage Account (Password & Phone)"
+        onPress={navigateToAccountManagement}
+      />
+      <Button title="Sign Out" onPress={logout} />
+    </View>
+  );
+}
+```

package/dist/axios/interceptor.d.ts ADDED Viewed

@@ -0,0 +1,13 @@
+import { AxiosInstance } from 'axios';
+import { AuthClient } from '../core/AuthClient';
+export interface InterceptorOptions {
+    /**
+     * Optional callback triggered when token refresh fails completely (e.g., refresh token expired).
+     */
+    onUnauthorized?: () => void;
+    /**
+     * Specify URLs that should NOT have the Authorization header injected.
+     */
+    excludeUrls?: (string | RegExp)[];
+}
+export declare function setupAxiosInterceptors(axiosInstance: AxiosInstance, authClient: AuthClient, options?: InterceptorOptions): () => void;

package/dist/core/AuthClient.d.ts ADDED Viewed

@@ -0,0 +1,44 @@
+import { OAuth2NativeConfig, TokenInfo } from '../models/types';
+import { NativeTokenStorage } from './storage';
+export declare class AuthClient {
+    private config;
+    private storage;
+    private refreshPromise;
+    constructor(config: OAuth2NativeConfig, storage?: NativeTokenStorage);
+    /**
+     * Hydrates the in-memory token cache from the underlying async secure storage.
+     * Called automatically by `AuthProvider` on mount.
+     */
+    initialize(): Promise<void>;
+    log(level: 'error' | 'warn' | 'info' | 'debug', ...args: unknown[]): void;
+    /**
+     * Builds the OAuth 2.0 + PKCE authorization URL and persists `code_verifier`, `state`, and `nonce`.
+     */
+    buildAuthorizationUrl(): Promise<string>;
+    /**
+     * Launches the system authentication browser (`ASWebAuthenticationSession` on iOS / Chrome Custom Tabs on Android),
+     * intercepts the deep-link callback (`redirectUri`), validates `state`, and exchanges `code` + `code_verifier` for tokens.
+     */
+    authorize(): Promise<TokenInfo>;
+    /**
+     * Parses a redirect callback URL (`myapp://auth/callback?code=...&state=...`) and exchanges the code for tokens.
+     */
+    handleCallbackUrl(callbackUrl: string): Promise<TokenInfo>;
+    exchangeCodeForTokens(code: string, state: string): Promise<TokenInfo>;
+    refreshAccessToken(): Promise<TokenInfo>;
+    private saveTokenInfo;
+    getAccessToken(): string | null;
+    getRefreshToken(): string | null;
+    getExpiresAt(): number | null;
+    isAuthenticated(): boolean;
+    /**
+     * Opens the hosted WitsAuth Account Management portal (`/auth/account`) in the native secure browser
+     * using a short-lived single-use ticket (`POST /auth/account/ticket`), allowing the user to change
+     * their password, update their profile, or verify their mobile phone number via OTP.
+     */
+    navigateToAccountManagement(): Promise<void>;
+    /**
+     * Clears tokens from secure storage and revokes both refresh_token and access_token at `revokeEndpoint`.
+     */
+    logout(): Promise<void>;
+}

package/dist/core/browser.d.ts ADDED Viewed

@@ -0,0 +1,29 @@
+import { BrowserSessionLauncher } from '../models/types';
+/**
+ * Creates a `BrowserSessionLauncher` using Expo's `expo-web-browser` module.
+ */
+export declare function createExpoWebBrowserLauncher(webBrowserModule: {
+    openAuthSessionAsync: (url: string, redirectUrl?: string) => Promise<{
+        type: string;
+        url?: string;
+    }>;
+}): BrowserSessionLauncher;
+/**
+ * Creates a `BrowserSessionLauncher` using `react-native-inappbrowser-reborn` for Bare React Native CLI apps.
+ */
+export declare function createInAppBrowserLauncher(inAppBrowserModule: {
+    isAvailable: () => Promise<boolean>;
+    openAuth: (url: string, redirectUrl: string, options?: Record<string, unknown>) => Promise<{
+        type: string;
+        url?: string;
+    }>;
+}): BrowserSessionLauncher;
+/**
+ * Parses `code`, `state`, `error`, and `error_description` from a custom-scheme or HTTPS callback URL.
+ */
+export declare function parseCallbackUrl(callbackUrl: string): {
+    code: string | null;
+    state: string | null;
+    error: string | null;
+    errorDescription: string | null;
+};

package/dist/core/pkce.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+/**
+ * Hermes-compatible PKCE (RFC 7636) utilities.
+ * Uses Web Crypto API when available, and falls back to a pure-TypeScript
+ * FIPS 180-4 SHA-256 implementation so S256 works out-of-the-box on React Native
+ * Hermes without requiring native crypto polyfills.
+ */
+/**
+ * Pure-TypeScript FIPS 180-4 SHA-256 digest.
+ */
+export declare function sha256Bytes(asciiOrUtf8: string): Uint8Array;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function generateRandomString(length?: number): string;
+export declare function generateCodeVerifier(): string;
+export declare function generateState(): string;
+export declare function createCodeChallenge(verifier: string): Promise<string>;

package/dist/core/storage.d.ts ADDED Viewed

@@ -0,0 +1,49 @@
+import { OAuth2AsyncStorage } from '../models/types';
+/**
+ * Wraps an asynchronous native secure store (e.g., Expo SecureStore or React Native Keychain)
+ * with a synchronous in-memory read cache. Once `hydrate()` resolves on startup,
+ * `getAccessToken()` and `isAuthenticated()` are synchronous while all mutations
+ * persist asynchronously to the native keychain/keystore.
+ */
+export declare class NativeTokenStorage {
+    private backend;
+    private cache;
+    private hydrated;
+    private hydratePromise;
+    constructor(customStorage?: OAuth2AsyncStorage);
+    hydrate(): Promise<void>;
+    getItemSync(key: string): string | null;
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+    clearTemporary(): Promise<void>;
+    clearTokens(): Promise<void>;
+}
+export declare function createMemoryStorageAdapter(): OAuth2AsyncStorage;
+/**
+ * Helper to create a storage adapter backed by `expo-secure-store`.
+ * Pass the imported `SecureStore` module from `expo-secure-store`.
+ */
+export declare function createExpoSecureStoreAdapter(secureStoreModule: {
+    getItemAsync: (key: string) => Promise<string | null>;
+    setItemAsync: (key: string, value: string) => Promise<void>;
+    deleteItemAsync: (key: string) => Promise<void>;
+}): OAuth2AsyncStorage;
+/**
+ * Helper to create a storage adapter backed by `react-native-keychain` for Bare React Native CLI apps.
+ * Pass the imported `Keychain` module from `react-native-keychain`.
+ */
+export declare function createKeychainStorageAdapter(keychainModule: {
+    getGenericPassword: (options?: {
+        service?: string;
+    }) => Promise<false | {
+        username: string;
+        password: string;
+    }>;
+    setGenericPassword: (username: string, password: string, options?: {
+        service?: string;
+    }) => Promise<unknown>;
+    resetGenericPassword: (options?: {
+        service?: string;
+    }) => Promise<unknown>;
+}, servicePrefix?: string): OAuth2AsyncStorage;

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+export * from './models/types';
+export { AuthClient } from './core/AuthClient';
+export { NativeTokenStorage, createMemoryStorageAdapter, createExpoSecureStoreAdapter, createKeychainStorageAdapter } from './core/storage';
+export { createExpoWebBrowserLauncher, createInAppBrowserLauncher, parseCallbackUrl } from './core/browser';
+export * from './core/pkce';
+export { AuthProvider, useAuth } from './react/AuthContext';
+export type { AuthContextType, AuthProviderProps } from './react/AuthContext';
+export { setupAxiosInterceptors } from './axios/interceptor';
+export type { InterceptorOptions } from './axios/interceptor';

package/dist/index.es.js ADDED Viewed

@@ -0,0 +1,619 @@
+import { createContext as e, useCallback as t, useContext as n, useEffect as r, useState as i } from "react";
+import { jsx as a } from "react/jsx-runtime";
+// src/models/types.ts
+var o = {
+	ACCESS_TOKEN: "witsauth_access_token",
+	REFRESH_TOKEN: "witsauth_refresh_token",
+	TOKEN_EXPIRES_AT: "witsauth_expires_at",
+	TOKEN_TYPE: "witsauth_token_type",
+	SCOPE: "witsauth_scope",
+	ID_TOKEN: "witsauth_id_token",
+	CODE_VERIFIER: "witsauth_code_verifier",
+	STATE: "witsauth_state",
+	NONCE: "witsauth_nonce"
+}, s = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", c = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+function l(e, t) {
+	return t >>> e | t << 32 - e;
+}
+function u(e) {
+	if (typeof TextEncoder < "u") return new TextEncoder().encode(e);
+	let t = [];
+	for (let n = 0; n < e.length; n++) {
+		let r = e.charCodeAt(n);
+		r < 128 ? t.push(r) : r < 2048 ? t.push(192 | r >> 6, 128 | r & 63) : r < 55296 || r >= 57344 ? t.push(224 | r >> 12, 128 | r >> 6 & 63, 128 | r & 63) : (n++, r = 65536 + ((r & 1023) << 10 | e.charCodeAt(n) & 1023), t.push(240 | r >> 18, 128 | r >> 12 & 63, 128 | r >> 6 & 63, 128 | r & 63));
+	}
+	return new Uint8Array(t);
+}
+function d(e) {
+	let t = u(e), n = t.length * 8, r = t.length + 9 + 63 >> 6 << 6, i = new Uint8Array(r);
+	i.set(t), i[t.length] = 128;
+	let a = new DataView(i.buffer);
+	a.setUint32(r - 8, Math.floor(n / 4294967296), !1), a.setUint32(r - 4, n >>> 0, !1);
+	let o = 1779033703, s = 3144134277, d = 1013904242, f = 2773480762, p = 1359893119, m = 2600822924, h = 528734635, g = 1541459225, _ = /* @__PURE__ */ new Uint32Array(64);
+	for (let e = 0; e < r; e += 64) {
+		for (let t = 0; t < 16; t++) _[t] = a.getUint32(e + t * 4, !1);
+		for (let e = 16; e < 64; e++) {
+			let t = l(7, _[e - 15]) ^ l(18, _[e - 15]) ^ _[e - 15] >>> 3, n = l(17, _[e - 2]) ^ l(19, _[e - 2]) ^ _[e - 2] >>> 10;
+			_[e] = _[e - 16] + t + _[e - 7] + n >>> 0;
+		}
+		let t = o, n = s, r = d, i = f, u = p, v = m, y = h, b = g;
+		for (let e = 0; e < 64; e++) {
+			let a = l(6, u) ^ l(11, u) ^ l(25, u), o = u & v ^ ~u & y, s = b + a + o + c[e] + _[e] >>> 0, d = (l(2, t) ^ l(13, t) ^ l(22, t)) + (t & n ^ t & r ^ n & r) >>> 0;
+			b = y, y = v, v = u, u = i + s >>> 0, i = r, r = n, n = t, t = s + d >>> 0;
+		}
+		o = o + t >>> 0, s = s + n >>> 0, d = d + r >>> 0, f = f + i >>> 0, p = p + u >>> 0, m = m + v >>> 0, h = h + y >>> 0, g = g + b >>> 0;
+	}
+	let v = /* @__PURE__ */ new Uint8Array(32), y = new DataView(v.buffer);
+	return y.setUint32(0, o, !1), y.setUint32(4, s, !1), y.setUint32(8, d, !1), y.setUint32(12, f, !1), y.setUint32(16, p, !1), y.setUint32(20, m, !1), y.setUint32(24, h, !1), y.setUint32(28, g, !1), v;
+}
+function f(e) {
+	let t = "", n = e.length;
+	for (let r = 0; r < n; r += 3) {
+		let i = e[r], a = r + 1 < n ? e[r + 1] : 0, o = r + 2 < n ? e[r + 2] : 0;
+		t += s[i >> 2], t += s[(i & 3) << 4 | a >> 4], r + 1 < n && (t += s[(a & 15) << 2 | o >> 6]), r + 2 < n && (t += s[o & 63]);
+	}
+	return t;
+}
+function p(e) {
+	let t = new Uint8Array(e), n = typeof globalThis < "u" ? globalThis : void 0;
+	if (n?.crypto && typeof n.crypto.getRandomValues == "function") return n.crypto.getRandomValues(t), t;
+	for (let n = 0; n < e; n++) t[n] = Math.floor(Math.random() * 256);
+	return t;
+}
+function m(e = 64) {
+	let t = p(e), n = "";
+	for (let r = 0; r < e; r++) n += "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[t[r] % 66];
+	return n;
+}
+function h() {
+	return m(64);
+}
+function g() {
+	return m(32);
+}
+async function _(e) {
+	let t = typeof globalThis < "u" ? globalThis : void 0;
+	if (t?.crypto?.subtle && typeof t.crypto.subtle.digest == "function") try {
+		let n = u(e), r = await t.crypto.subtle.digest("SHA-256", n);
+		return f(new Uint8Array(r));
+	} catch {}
+	return f(d(e));
+}
+// src/core/storage.ts
+var v = Object.values(o), y = class {
+	backend;
+	cache = /* @__PURE__ */ new Map();
+	hydrated = !1;
+	hydratePromise = null;
+	constructor(e) {
+		this.backend = e || b();
+	}
+	async hydrate() {
+		if (!this.hydrated) return this.hydratePromise ||= (async () => {
+			await Promise.all(v.map(async (e) => {
+				try {
+					let t = await this.backend.getItem(e);
+					t != null && this.cache.set(e, t);
+				} catch {}
+			})), this.hydrated = !0;
+		})().finally(() => {
+			this.hydratePromise = null;
+		}), this.hydratePromise;
+	}
+	getItemSync(e) {
+		return this.cache.get(e) ?? null;
+	}
+	async getItem(e) {
+		if (this.cache.has(e)) return this.cache.get(e);
+		let t = await this.backend.getItem(e);
+		return t == null ? null : (this.cache.set(e, t), t);
+	}
+	async setItem(e, t) {
+		this.cache.set(e, t), await this.backend.setItem(e, t);
+	}
+	async removeItem(e) {
+		this.cache.delete(e), await this.backend.removeItem(e);
+	}
+	async clearTemporary() {
+		await Promise.all([
+			this.removeItem(o.CODE_VERIFIER),
+			this.removeItem(o.STATE),
+			this.removeItem(o.NONCE)
+		]);
+	}
+	async clearTokens() {
+		await Promise.all([
+			this.removeItem(o.ACCESS_TOKEN),
+			this.removeItem(o.REFRESH_TOKEN),
+			this.removeItem(o.TOKEN_EXPIRES_AT),
+			this.removeItem(o.TOKEN_TYPE),
+			this.removeItem(o.SCOPE),
+			this.removeItem(o.ID_TOKEN)
+		]);
+	}
+};
+function b() {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		getItem: async (t) => e.get(t) ?? null,
+		setItem: async (t, n) => {
+			e.set(t, n);
+		},
+		removeItem: async (t) => {
+			e.delete(t);
+		}
+	};
+}
+function x(e) {
+	return {
+		getItem: (t) => e.getItemAsync(t),
+		setItem: (t, n) => e.setItemAsync(t, n),
+		removeItem: (t) => e.deleteItemAsync(t)
+	};
+}
+function S(e, t = "com.witsauth.tokens") {
+	return {
+		getItem: async (n) => {
+			let r = await e.getGenericPassword({ service: `${t}.${n}` });
+			return r ? r.password : null;
+		},
+		setItem: async (n, r) => {
+			await e.setGenericPassword(n, r, { service: `${t}.${n}` });
+		},
+		removeItem: async (n) => {
+			await e.resetGenericPassword({ service: `${t}.${n}` });
+		}
+	};
+}
+// src/core/browser.ts
+function C(e) {
+	return async (t, n) => {
+		let r = await e.openAuthSessionAsync(t, n);
+		return r.type === "success" && r.url ? {
+			type: "success",
+			url: r.url
+		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
+	};
+}
+function w(e) {
+	return async (t, n) => {
+		if (!await e.isAvailable()) throw Error("InAppBrowser is not available on this device.");
+		let r = await e.openAuth(t, n, {
+			ephemeralWebSession: !1,
+			showTitle: !1,
+			enableUrlBarHiding: !0,
+			enableDefaultShare: !1
+		});
+		return r.type === "success" && r.url ? {
+			type: "success",
+			url: r.url
+		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
+	};
+}
+function T(e) {
+	let t = e.indexOf("?");
+	if (t === -1) return {
+		code: null,
+		state: null,
+		error: null,
+		errorDescription: null
+	};
+	let n = e.indexOf("#", t), r = n === -1 ? e.slice(t + 1) : e.slice(t + 1, n), i = new URLSearchParams(r);
+	return {
+		code: i.get("code"),
+		state: i.get("state"),
+		error: i.get("error"),
+		errorDescription: i.get("error_description")
+	};
+}
+// src/core/AuthClient.ts
+var E = class {
+	config;
+	storage;
+	refreshPromise = null;
+	constructor(e, t) {
+		this.config = e, this.storage = t || new y(e.storage);
+	}
+	async initialize() {
+		await this.storage.hydrate();
+	}
+	log(e, ...t) {
+		let n = {
+			none: 0,
+			error: 1,
+			warn: 2,
+			info: 3,
+			debug: 4
+		}, r = n[this.config.logLevel || "warn"] || 0, i = n[e] || 0;
+		i > 0 && r >= i && console[e](...t);
+	}
+	async buildAuthorizationUrl() {
+		await this.storage.hydrate();
+		let e = h(), t = await _(e), n = g(), r = this.config.nonce || g();
+		await this.storage.setItem(o.CODE_VERIFIER, e), await this.storage.setItem(o.STATE, n), await this.storage.setItem(o.NONCE, r);
+		let i = new URLSearchParams({
+			client_id: this.config.clientId,
+			redirect_uri: this.config.redirectUri,
+			response_type: this.config.responseType || "code",
+			code_challenge_method: this.config.codeChallengeMethod || "S256",
+			code_challenge: t,
+			state: n,
+			nonce: r
+		});
+		if (this.config.theme) {
+			let e = typeof this.config.theme == "function" ? this.config.theme() : this.config.theme;
+			e && i.append("theme", e);
+		}
+		return this.config.scope && i.append("scope", this.config.scope), this.config.audience && i.append("audience", this.config.audience), `${this.config.authorizationEndpoint}?${i.toString()}`;
+	}
+	async authorize() {
+		if (!this.config.openAuthSession) throw Error("No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.");
+		let e = await this.buildAuthorizationUrl(), t = await this.config.openAuthSession(e, this.config.redirectUri);
+		if (t.type !== "success" || !t.url) throw await this.storage.clearTemporary(), Error(`Authentication ${t.type}`);
+		return this.handleCallbackUrl(t.url);
+	}
+	async handleCallbackUrl(e) {
+		let { code: t, state: n, error: r, errorDescription: i } = T(e);
+		if (r) throw await this.storage.clearTemporary(), Error(i ? `${r}: ${i}` : r);
+		if (!t || !n) throw await this.storage.clearTemporary(), Error("Callback URL is missing required code or state parameters.");
+		return this.exchangeCodeForTokens(t, n);
+	}
+	async exchangeCodeForTokens(e, t) {
+		await this.storage.hydrate();
+		let n = await this.storage.getItem(o.STATE), r = await this.storage.getItem(o.CODE_VERIFIER);
+		if (!n || t !== n) throw await this.storage.clearTemporary(), Error("Invalid state parameter. Possible CSRF attack.");
+		if (!r) throw await this.storage.clearTemporary(), Error("Code verifier missing from storage.");
+		let i = new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: this.config.clientId,
+			redirect_uri: this.config.redirectUri,
+			code: e,
+			code_verifier: r
+		}), a = await fetch(this.config.tokenEndpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: i.toString()
+		});
+		if (!a.ok) throw Error("Failed to exchange code for tokens");
+		let s = await a.json(), c = {
+			accessToken: s.access_token,
+			refreshToken: s.refresh_token,
+			tokenType: s.token_type || "Bearer",
+			expiresAt: Date.now() + s.expires_in * 1e3,
+			scope: s.scope,
+			idToken: s.id_token
+		};
+		return await this.saveTokenInfo(c), await this.storage.clearTemporary(), c;
+	}
+	async refreshAccessToken() {
+		return this.refreshPromise ||= (async () => {
+			await this.storage.hydrate();
+			let e = await this.storage.getItem(o.REFRESH_TOKEN);
+			if (!e) throw Error("No refresh token available");
+			let t = new URLSearchParams({
+				grant_type: "refresh_token",
+				client_id: this.config.clientId,
+				refresh_token: e
+			}), n;
+			try {
+				n = await fetch(this.config.tokenEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: t.toString()
+				});
+			} catch (e) {
+				throw this.log("error", "Token refresh network request failed:", e), e;
+			}
+			if (!n.ok) {
+				let e = {};
+				try {
+					e = await n.json();
+				} catch {
+					try {
+						e = { error: await n.text() };
+					} catch {
+						e = {};
+					}
+				}
+				this.log("error", "Token refresh failed with status:", n.status, e), (n.status === 400 || n.status === 401) && await this.storage.clearTokens();
+				let t = e.error_description || e.error || n.statusText || "Failed to refresh token";
+				throw Error(`Failed to refresh token (${n.status}): ${t}`);
+			}
+			let r = await n.json(), i = {
+				accessToken: r.access_token,
+				refreshToken: r.refresh_token || e,
+				tokenType: r.token_type || "Bearer",
+				expiresAt: Date.now() + r.expires_in * 1e3,
+				scope: r.scope,
+				idToken: r.id_token
+			};
+			return await this.saveTokenInfo(i), i;
+		})().finally(() => {
+			this.refreshPromise = null;
+		}), this.refreshPromise;
+	}
+	async saveTokenInfo(e) {
+		await this.storage.setItem(o.ACCESS_TOKEN, e.accessToken), await this.storage.setItem(o.TOKEN_EXPIRES_AT, e.expiresAt.toString()), await this.storage.setItem(o.TOKEN_TYPE, e.tokenType), e.refreshToken && await this.storage.setItem(o.REFRESH_TOKEN, e.refreshToken), e.scope && await this.storage.setItem(o.SCOPE, e.scope), e.idToken && await this.storage.setItem(o.ID_TOKEN, e.idToken);
+	}
+	getAccessToken() {
+		return this.storage.getItemSync(o.ACCESS_TOKEN);
+	}
+	getRefreshToken() {
+		return this.storage.getItemSync(o.REFRESH_TOKEN);
+	}
+	getExpiresAt() {
+		let e = this.storage.getItemSync(o.TOKEN_EXPIRES_AT);
+		if (!e) return null;
+		let t = Number(e);
+		return Number.isFinite(t) ? t : null;
+	}
+	isAuthenticated() {
+		let e = this.getExpiresAt();
+		return e !== null && Date.now() < e - 3e4 && !!this.getAccessToken();
+	}
+	async navigateToAccountManagement() {
+		await this.storage.hydrate();
+		let e = await this.storage.getItem(o.REFRESH_TOKEN);
+		if (!e) throw Error("No refresh token available to access account management.");
+		if (!this.config.openAuthSession) throw Error("No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.");
+		let t = this.config.authorizationEndpoint.replace(/\/authorize\/?$/, ""), n = await fetch(`${t}/account/ticket`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				refreshToken: e,
+				clientId: this.config.clientId,
+				redirectUri: this.config.redirectUri
+			})
+		});
+		if (!n.ok) throw Error(`Failed to request account management ticket (${n.status})`);
+		let { ticket: r } = await n.json();
+		if (!r) throw Error("Account management ticket missing from server response.");
+		let i = `${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;
+		await this.config.openAuthSession(i, this.config.redirectUri);
+	}
+	async logout() {
+		await this.storage.hydrate();
+		let e = this.getAccessToken(), t = await this.storage.getItem(o.REFRESH_TOKEN);
+		if (await this.storage.clearTokens(), await this.storage.clearTemporary(), this.config.revokeEndpoint) {
+			let n = [...t ? [{
+				token: t,
+				token_type_hint: "refresh_token"
+			}] : [], ...e ? [{
+				token: e,
+				token_type_hint: "access_token"
+			}] : []];
+			for (let e of n) try {
+				await fetch(this.config.revokeEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						token: e.token,
+						token_type_hint: e.token_type_hint,
+						client_id: this.config.clientId
+					}).toString()
+				});
+			} catch (e) {
+				this.log("error", "Failed to revoke token during logout", e);
+			}
+		}
+	}
+}, D = e(null), O = ({ config: e, client: n, children: o, onLoginSuccess: s, onLoginError: c, subscribeAppState: l }) => {
+	let [u] = i(() => {
+		if (n) return n;
+		if (e) return new E(e);
+		throw Error("AuthProvider requires either a `client` or `config` prop.");
+	}), [d, f] = i(!1), [p, m] = i(null), [h, g] = i(!0), [_, v] = i(null), y = t(async () => {
+		if (await u.initialize(), u.isAuthenticated()) f(!0), m(u.getAccessToken());
+		else {
+			if (u.getRefreshToken()) try {
+				let e = await u.refreshAccessToken();
+				f(!0), m(e.accessToken);
+				return;
+			} catch {
+				f(!1), m(null);
+				return;
+			}
+			f(!1), m(null);
+		}
+	}, [u]);
+	r(() => {
+		let e = !0;
+		return (async () => {
+			try {
+				await y();
+			} finally {
+				e && g(!1);
+			}
+		})(), () => {
+			e = !1;
+		};
+	}, [y]), r(() => {
+		if (!d) return;
+		let e, t = () => {
+			let n = u.getExpiresAt();
+			if (!n) return;
+			let r = n - Date.now() - 6e4;
+			e = setTimeout(async () => {
+				try {
+					let e = await u.refreshAccessToken();
+					m(e.accessToken), f(!0), t();
+				} catch (n) {
+					u.log("error", "Background token refresh failed:", n), u.getAccessToken() ? e = setTimeout(t, 3e4) : (f(!1), m(null));
+				}
+			}, Math.max(0, r));
+		};
+		t();
+		let n = l ? l((e) => {
+			e === "active" && y().catch(() => {});
+		}) : void 0;
+		return () => {
+			e && clearTimeout(e), n && n();
+		};
+	}, [
+		d,
+		u,
+		l,
+		y
+	]);
+	let b = t(async () => {
+		g(!0), v(null);
+		try {
+			let e = await u.authorize();
+			m(e.accessToken), f(!0), s?.();
+		} catch (e) {
+			let t = e instanceof Error ? e : /* @__PURE__ */ Error("Authentication failed");
+			v(t), c?.(t);
+		} finally {
+			g(!1);
+		}
+	}, [
+		u,
+		s,
+		c
+	]), x = t(async () => {
+		g(!0);
+		try {
+			await u.logout(), f(!1), m(null);
+		} catch (e) {
+			v(e instanceof Error ? e : /* @__PURE__ */ Error("Logout failed"));
+		} finally {
+			g(!1);
+		}
+	}, [u]), S = t(async () => {
+		if (await u.initialize(), u.isAuthenticated()) return u.getAccessToken();
+		try {
+			let e = await u.refreshAccessToken();
+			return m(e.accessToken), f(!0), e.accessToken;
+		} catch {
+			return f(!1), m(null), null;
+		}
+	}, [u]), C = t(async () => {
+		await u.navigateToAccountManagement(), await y();
+	}, [u, y]);
+	return /* @__PURE__ */ a(D.Provider, {
+		value: {
+			isAuthenticated: d,
+			isLoading: h,
+			accessToken: p,
+			error: _,
+			login: b,
+			logout: x,
+			getToken: S,
+			navigateToAccountManagement: C,
+			authClient: u
+		},
+		children: o
+	});
+}, k = () => {
+	let e = n(D);
+	if (!e) throw Error("useAuth must be used within an AuthProvider");
+	return e;
+};
+// src/axios/interceptor.ts
+function A(e, t, n = {}) {
+	let r = !1, i = [], a = (e, t = null) => {
+		i.forEach((n) => {
+			e ? n.reject(e) : n.resolve(t);
+		}), i = [];
+	}, o = (e) => !e || !n.excludeUrls ? !1 : n.excludeUrls.some((t) => typeof t == "string" ? e.includes(t) : t.test(e)), s = e.interceptors.request.use(async (e) => {
+		if (o(e.url)) return e;
+		await t.initialize();
+		let n = t.getAccessToken();
+		if (!t.isAuthenticated() && n) try {
+			n = (await t.refreshAccessToken()).accessToken;
+		} catch {
+			n = null;
+		}
+		return n && e.headers.set("Authorization", `Bearer ${n}`), e;
+	}, (e) => Promise.reject(e)), c = e.interceptors.response.use((e) => e, async (s) => {
+		let c = s.config;
+		if (!c || o(c.url)) return Promise.reject(s);
+		if (s.response?.status === 401 && !c._retry) {
+			if (r) return new Promise((e, t) => {
+				i.push({
+					resolve: e,
+					reject: t
+				});
+			}).then((t) => (t && c.headers.set("Authorization", `Bearer ${t}`), e(c))).catch((e) => Promise.reject(e));
+			c._retry = !0, r = !0;
+			try {
+				let n = (await t.refreshAccessToken()).accessToken;
+				return a(null, n), c.headers.set("Authorization", `Bearer ${n}`), e(c);
+			} catch (e) {
+				return a(e, null), await t.logout(), n.onUnauthorized && n.onUnauthorized(), Promise.reject(e);
+			} finally {
+				r = !1;
+			}
+		}
+		return Promise.reject(s);
+	});
+	return () => {
+		e.interceptors.request.eject(s), e.interceptors.response.eject(c);
+	};
+}
+export { E as AuthClient, O as AuthProvider, y as NativeTokenStorage, o as STORAGE_KEYS, f as base64UrlEncode, _ as createCodeChallenge, x as createExpoSecureStoreAdapter, C as createExpoWebBrowserLauncher, w as createInAppBrowserLauncher, S as createKeychainStorageAdapter, b as createMemoryStorageAdapter, h as generateCodeVerifier, m as generateRandomString, g as generateState, T as parseCallbackUrl, A as setupAxiosInterceptors, d as sha256Bytes, k as useAuth };

package/dist/index.umd.js ADDED Viewed

@@ -0,0 +1 @@

package/dist/models/types.d.ts ADDED Viewed

@@ -0,0 +1,104 @@
+export interface OAuth2AsyncStorage {
+    getItem(key: string): Promise<string | null> | string | null;
+    setItem(key: string, value: string): Promise<void> | void;
+    removeItem(key: string): Promise<void> | void;
+}
+export interface BrowserSessionResult {
+    type: 'success' | 'cancel' | 'dismiss';
+    url?: string;
+}
+export type BrowserSessionLauncher = (authUrl: string, redirectUri: string) => Promise<BrowserSessionResult>;
+export interface OAuth2NativeConfig {
+    /**
+     * The Client ID obtained from the WitsAuth console.
+     */
+    clientId: string;
+    /**
+     * The authorization endpoint URL.
+     * E.g., https://auth.example.com/auth/authorize
+     */
+    authorizationEndpoint: string;
+    /**
+     * The token endpoint URL.
+     * E.g., https://auth.example.com/oauth/token
+     */
+    tokenEndpoint: string;
+    /**
+     * The callback URI configured for your mobile application.
+     * Supports custom schemes (e.g., myapp://auth/callback) and Universal/App Links.
+     */
+    redirectUri: string;
+    /**
+     * Optional userInfo endpoint URL.
+     * E.g., https://auth.example.com/oauth/userinfo
+     */
+    userInfoEndpoint?: string;
+    /**
+     * Optional token revocation endpoint URL.
+     * E.g., https://auth.example.com/oauth/revoke
+     */
+    revokeEndpoint?: string;
+    /**
+     * Optional logout endpoint URL.
+     * E.g., https://auth.example.com/auth/logout
+     */
+    logoutEndpoint?: string;
+    /**
+     * Scopes to request, separated by spaces.
+     * E.g., "openid profile email offline_access"
+     */
+    scope?: string;
+    /**
+     * Audience parameter to request (if required by WitsAuth).
+     */
+    audience?: string;
+    /**
+     * Optional static nonce value. If omitted, a random cryptographic nonce is generated per authorization request.
+     */
+    nonce?: string;
+    /**
+     * Optional theme hint ("light" | "dark") or a callback returning the current theme.
+     */
+    theme?: 'light' | 'dark' | (() => 'light' | 'dark' | undefined);
+    /**
+     * Response type. Defaults to "code".
+     */
+    responseType?: string;
+    /**
+     * PKCE code challenge method. Defaults to "S256".
+     */
+    codeChallengeMethod?: 'S256' | 'plain';
+    /**
+     * Secure async storage adapter (e.g., Expo SecureStore or React Native Keychain).
+     * If omitted, falls back to an in-memory store.
+     */
+    storage?: OAuth2AsyncStorage;
+    /**
+     * Custom system browser session launcher (ASWebAuthenticationSession on iOS / Chrome Custom Tabs on Android).
+     * If omitted, auto-detects `expo-web-browser` or `react-native-inappbrowser-reborn`.
+     */
+    openAuthSession?: BrowserSessionLauncher;
+    /**
+     * Log level for internal client messages. Defaults to 'warn'.
+     */
+    logLevel?: 'none' | 'error' | 'warn' | 'info' | 'debug';
+}
+export interface TokenInfo {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    tokenType: string;
+    scope?: string;
+    idToken?: string;
+}
+export declare const STORAGE_KEYS: {
+    readonly ACCESS_TOKEN: 'witsauth_access_token';
+    readonly REFRESH_TOKEN: 'witsauth_refresh_token';
+    readonly TOKEN_EXPIRES_AT: 'witsauth_expires_at';
+    readonly TOKEN_TYPE: 'witsauth_token_type';
+    readonly SCOPE: 'witsauth_scope';
+    readonly ID_TOKEN: 'witsauth_id_token';
+    readonly CODE_VERIFIER: 'witsauth_code_verifier';
+    readonly STATE: 'witsauth_state';
+    readonly NONCE: 'witsauth_nonce';
+};

package/dist/react/AuthContext.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+import React from 'react';
+import { AuthClient } from '../core/AuthClient';
+import { OAuth2NativeConfig } from '../models/types';
+export interface AuthContextType {
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    accessToken: string | null;
+    error: Error | null;
+    login: () => Promise<void>;
+    logout: () => Promise<void>;
+    getToken: () => Promise<string | null>;
+    navigateToAccountManagement: () => Promise<void>;
+    authClient: AuthClient;
+}
+export interface AuthProviderProps {
+    config?: OAuth2NativeConfig;
+    client?: AuthClient;
+    children: React.ReactNode;
+    onLoginSuccess?: () => void;
+    onLoginError?: (error: Error) => void;
+    /**
+     * Optional subscription to React Native's `AppState.addEventListener('change', listener)`
+     * so tokens automatically refresh when the app returns to the foreground (`active`).
+     */
+    subscribeAppState?: (listener: (state: string) => void) => () => void;
+}
+export declare const AuthProvider: React.FC<AuthProviderProps>;
+export declare const useAuth: () => AuthContextType;

package/package.json CHANGED Viewed

@@ -1,6 +1,65 @@
 {
   "name": "@witsauth/react-native-client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Official React Native client library (Expo and Bare React Native CLI) for integrating WitsAuth OAuth 2.0 + PKCE authentication on Android and iOS.",
+  "main": "./dist/index.umd.js",
+  "module": "./dist/index.es.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.es.js",
+      "require": "./dist/index.umd.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build && tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm test && pnpm build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "react-native",
+    "expo",
+    "android",
+    "ios",
+    "witsauth",
+    "auth",
+    "oauth2",
+    "pkce"
+  ],
+  "author": "",
+  "license": "ISC",
+  "type": "module",
+  "peerDependencies": {
+    "axios": "^1.0.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-native": ">=0.72.0"
+  },
+  "peerDependenciesMeta": {
+    "axios": {
+      "optional": true
+    },
+    "react-native": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@testing-library/jest-dom": "^7.0.0",
+    "@testing-library/react": "^16.3.2",
+    "@types/node": "^24.13.2",
+    "@types/react": "^19.2.17",
+    "axios": "^1.18.1",
+    "jsdom": "^29.1.1",
+    "react": "^19.2.7",
+    "typescript": "^7.0.2",
+    "vite": "^8.1.5",
+    "vitest": "^4.1.10"
+  }
+}