@witsauth/react-native-client 1.0.0 → 1.0.1

package/dist/core/AuthClient.d.ts

@@ -1,4 +1,4 @@
-import { OAuth2NativeConfig, TokenInfo } from '../models/types';
+import { AuthorizeOptions, LogoutOptions, OAuth2NativeConfig, TokenInfo, UserProfile } from '../models/types';
 import { NativeTokenStorage } from './storage';
 export declare class AuthClient {
     private config;
@@ -14,12 +14,12 @@ export declare class AuthClient {
     /**
      * Builds the OAuth 2.0 + PKCE authorization URL and persists `code_verifier`, `state`, and `nonce`.
      */
-    buildAuthorizationUrl(): Promise<string>;
+    buildAuthorizationUrl(options?: AuthorizeOptions): Promise<string>;
     /**
      * Launches the system authentication browser (`ASWebAuthenticationSession` on iOS / Chrome Custom Tabs on Android),
      * intercepts the deep-link callback (`redirectUri`), validates `state`, and exchanges `code` + `code_verifier` for tokens.
      */
-    authorize(): Promise<TokenInfo>;
+    authorize(options?: AuthorizeOptions): Promise<TokenInfo>;
     /**
      * Parses a redirect callback URL (`myapp://auth/callback?code=...&state=...`) and exchanges the code for tokens.
      */
@@ -28,6 +28,8 @@ export declare class AuthClient {
     refreshAccessToken(): Promise<TokenInfo>;
     private saveTokenInfo;
     getAccessToken(): string | null;
+    getIdToken(): string | null;
+    getUserProfile<T extends UserProfile = UserProfile>(): T | null;
     getRefreshToken(): string | null;
     getExpiresAt(): number | null;
     isAuthenticated(): boolean;
@@ -39,6 +41,8 @@ export declare class AuthClient {
     navigateToAccountManagement(): Promise<void>;
     /**
      * Clears tokens from secure storage and revokes both refresh_token and access_token at `revokeEndpoint`.
+     * If `options.clearBrowserSession` is true and `logoutEndpoint` + `openAuthSession` are configured,
+     * launches the system browser to terminate the WitsAuth web session cookie.
      */
-    logout(): Promise<void>;
+    logout(options?: LogoutOptions): Promise<void>;
 }

package/dist/core/pkce.d.ts

@@ -9,6 +9,8 @@
  */
 export declare function sha256Bytes(asciiOrUtf8: string): Uint8Array;
 export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function getRandomBytes(length: number): Uint8Array;
+export declare function decodeJwtPayload<T = Record<string, unknown>>(token: string | null | undefined): T | null;
 export declare function generateRandomString(length?: number): string;
 export declare function generateCodeVerifier(): string;
 export declare function generateState(): string;

package/dist/core/storage.d.ts

@@ -22,6 +22,8 @@ export declare class NativeTokenStorage {
 export declare function createMemoryStorageAdapter(): OAuth2AsyncStorage;
 /**
  * Helper to create a storage adapter backed by `expo-secure-store`.
+ * Automatically splits values exceeding 2000 bytes across indexed chunk keys
+ * to prevent Expo SecureStore's 2048-byte limit errors on large JWTs.
  * Pass the imported `SecureStore` module from `expo-secure-store`.
  */
 export declare function createExpoSecureStoreAdapter(secureStoreModule: {

package/dist/index.es.js

@@ -122,21 +122,56 @@ function f(e) {
 function p(e) {
 	let t = new Uint8Array(e), n = typeof globalThis < "u" ? globalThis : void 0;
 	if (n?.crypto && typeof n.crypto.getRandomValues == "function") return n.crypto.getRandomValues(t), t;
-	for (let n = 0; n < e; n++) t[n] = Math.floor(Math.random() * 256);
-	return t;
+	try {
+		let r = typeof n?.require == "function" ? n.require : void 0;
+		if (r) {
+			let n = r("expo-crypto");
+			if (n && typeof n.getRandomValues == "function") return n.getRandomValues(t), t;
+			if (n && typeof n.getRandomBytes == "function") {
+				let r = n.getRandomBytes(e);
+				return t.set(r.subarray(0, e)), t;
+			}
+		}
+	} catch {}
+	throw Error("Cryptographically secure random number generator (CSPRNG) is unavailable. Please install and import \"react-native-get-random-values\" or \"expo-crypto\".");
+}
+function m(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t + "=".repeat((4 - t.length % 4) % 4);
+	if (typeof atob == "function") {
+		let e = atob(n), t = new Uint8Array(e.length);
+		for (let n = 0; n < e.length; n++) t[n] = e.charCodeAt(n);
+		if (typeof TextDecoder < "u") return new TextDecoder().decode(t);
+		let r = "";
+		for (let e = 0; e < t.length; e++) r += String.fromCharCode(t[e]);
+		return decodeURIComponent(escape(r));
+	}
+	let r = typeof globalThis < "u" ? globalThis : void 0;
+	if (r?.Buffer) return r.Buffer.from(n, "base64").toString("utf8");
+	throw Error("Unable to decode base64url string.");
+}
+function h(e) {
+	if (!e || typeof e != "string") return null;
+	let t = e.split(".");
+	if (t.length < 2) return null;
+	try {
+		let e = m(t[1]);
+		return JSON.parse(e);
+	} catch {
+		return null;
+	}
 }
-function m(e = 64) {
+function g(e = 64) {
 	let t = p(e), n = "";
 	for (let r = 0; r < e; r++) n += "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[t[r] % 66];
 	return n;
 }
-function h() {
-	return m(64);
+function _() {
+	return g(64);
 }
-function g() {
-	return m(32);
+function v() {
+	return g(32);
 }
-async function _(e) {
+async function y(e) {
 	let t = typeof globalThis < "u" ? globalThis : void 0;
 	if (t?.crypto?.subtle && typeof t.crypto.subtle.digest == "function") try {
 		let n = u(e), r = await t.crypto.subtle.digest("SHA-256", n);
@@ -145,17 +180,17 @@ async function _(e) {
 	return f(d(e));
 }
 // src/core/storage.ts
-var v = Object.values(o), y = class {
+var b = Object.values(o), x = class {
 	backend;
 	cache = /* @__PURE__ */ new Map();
 	hydrated = !1;
 	hydratePromise = null;
 	constructor(e) {
-		this.backend = e || b();
+		this.backend = e || S();
 	}
 	async hydrate() {
 		if (!this.hydrated) return this.hydratePromise ||= (async () => {
-			await Promise.all(v.map(async (e) => {
+			await Promise.all(b.map(async (e) => {
 				try {
 					let t = await this.backend.getItem(e);
 					t != null && this.cache.set(e, t);
@@ -197,7 +232,7 @@ var v = Object.values(o), y = class {
 		]);
 	}
 };
-function b() {
+function S() {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		getItem: async (t) => e.get(t) ?? null,
@@ -209,14 +244,51 @@ function b() {
 		}
 	};
 }
-function x(e) {
+var C = 2e3, w = "__witsauth_chunked__:";
+function T(e) {
+	let t = async (t) => {
+		try {
+			let n = await e.getItemAsync(t);
+			if (n && n.startsWith(w)) {
+				let r = parseInt(n.slice(21), 10);
+				if (Number.isFinite(r) && r > 0) {
+					let n = [];
+					for (let i = 0; i < r; i++) n.push(e.deleteItemAsync(`${t}__chunk_${i}`));
+					await Promise.all(n);
+				}
+			}
+		} catch {}
+	};
 	return {
-		getItem: (t) => e.getItemAsync(t),
-		setItem: (t, n) => e.setItemAsync(t, n),
-		removeItem: (t) => e.deleteItemAsync(t)
+		getItem: async (t) => {
+			let n = await e.getItemAsync(t);
+			if (!n) return null;
+			if (n.startsWith(w)) {
+				let r = parseInt(n.slice(21), 10);
+				if (!Number.isFinite(r) || r <= 0) return null;
+				let i = [];
+				for (let n = 0; n < r; n++) i.push(e.getItemAsync(`${t}__chunk_${n}`));
+				let a = await Promise.all(i);
+				return a.some((e) => e == null) ? null : a.join("");
+			}
+			return n;
+		},
+		setItem: async (n, r) => {
+			if (r.length <= C) {
+				await t(n), await e.setItemAsync(n, r);
+				return;
+			}
+			await t(n);
+			let i = [];
+			for (let e = 0; e < r.length; e += C) i.push(r.slice(e, e + C));
+			await Promise.all(i.map((t, r) => e.setItemAsync(`${n}__chunk_${r}`, t))), await e.setItemAsync(n, `${w}${i.length}`);
+		},
+		removeItem: async (n) => {
+			await t(n), await e.deleteItemAsync(n);
+		}
 	};
 }
-function S(e, t = "com.witsauth.tokens") {
+function E(e, t = "com.witsauth.tokens") {
 	return {
 		getItem: async (n) => {
 			let r = await e.getGenericPassword({ service: `${t}.${n}` });
@@ -231,7 +303,7 @@ function S(e, t = "com.witsauth.tokens") {
 	};
 }
 // src/core/browser.ts
-function C(e) {
+function D(e) {
 	return async (t, n) => {
 		let r = await e.openAuthSessionAsync(t, n);
 		return r.type === "success" && r.url ? {
@@ -240,7 +312,7 @@ function C(e) {
 		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
 	};
 }
-function w(e) {
+function O(e) {
 	return async (t, n) => {
 		if (!await e.isAvailable()) throw Error("InAppBrowser is not available on this device.");
 		let r = await e.openAuth(t, n, {
@@ -255,7 +327,7 @@ function w(e) {
 		} : r.type === "cancel" ? { type: "cancel" } : { type: "dismiss" };
 	};
 }
-function T(e) {
+function k(e) {
 	let t = e.indexOf("?");
 	if (t === -1) return {
 		code: null,
@@ -272,12 +344,12 @@ function T(e) {
 	};
 }
 // src/core/AuthClient.ts
-var E = class {
+var A = class {
 	config;
 	storage;
 	refreshPromise = null;
 	constructor(e, t) {
-		this.config = e, this.storage = t || new y(e.storage);
+		this.config = e, this.storage = t || new x(e.storage);
 	}
 	async initialize() {
 		await this.storage.hydrate();
@@ -292,33 +364,34 @@ var E = class {
 		}, r = n[this.config.logLevel || "warn"] || 0, i = n[e] || 0;
 		i > 0 && r >= i && console[e](...t);
 	}
-	async buildAuthorizationUrl() {
+	async buildAuthorizationUrl(e) {
 		await this.storage.hydrate();
-		let e = h(), t = await _(e), n = g(), r = this.config.nonce || g();
-		await this.storage.setItem(o.CODE_VERIFIER, e), await this.storage.setItem(o.STATE, n), await this.storage.setItem(o.NONCE, r);
-		let i = new URLSearchParams({
+		let t = _(), n = await y(t), r = v(), i = this.config.nonce || v();
+		await this.storage.setItem(o.CODE_VERIFIER, t), await this.storage.setItem(o.STATE, r), await this.storage.setItem(o.NONCE, i);
+		let a = new URLSearchParams({
 			client_id: this.config.clientId,
 			redirect_uri: this.config.redirectUri,
 			response_type: this.config.responseType || "code",
 			code_challenge_method: this.config.codeChallengeMethod || "S256",
-			code_challenge: t,
-			state: n,
-			nonce: r
+			code_challenge: n,
+			state: r,
+			nonce: i
 		});
 		if (this.config.theme) {
 			let e = typeof this.config.theme == "function" ? this.config.theme() : this.config.theme;
-			e && i.append("theme", e);
+			e && a.append("theme", e);
 		}
-		return this.config.scope && i.append("scope", this.config.scope), this.config.audience && i.append("audience", this.config.audience), `${this.config.authorizationEndpoint}?${i.toString()}`;
+		let s = e?.scope ?? this.config.scope, c = e?.audience ?? this.config.audience;
+		return s && a.append("scope", s), c && a.append("audience", c), e?.prompt && a.append("prompt", e.prompt), `${this.config.authorizationEndpoint}?${a.toString()}`;
 	}
-	async authorize() {
+	async authorize(e) {
 		if (!this.config.openAuthSession) throw Error("No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.");
-		let e = await this.buildAuthorizationUrl(), t = await this.config.openAuthSession(e, this.config.redirectUri);
-		if (t.type !== "success" || !t.url) throw await this.storage.clearTemporary(), Error(`Authentication ${t.type}`);
-		return this.handleCallbackUrl(t.url);
+		let t = await this.buildAuthorizationUrl(e), n = await this.config.openAuthSession(t, this.config.redirectUri);
+		if (n.type !== "success" || !n.url) throw await this.storage.clearTemporary(), Error(`Authentication ${n.type}`);
+		return this.handleCallbackUrl(n.url);
 	}
 	async handleCallbackUrl(e) {
-		let { code: t, state: n, error: r, errorDescription: i } = T(e);
+		let { code: t, state: n, error: r, errorDescription: i } = k(e);
 		if (r) throw await this.storage.clearTemporary(), Error(i ? `${r}: ${i}` : r);
 		if (!t || !n) throw await this.storage.clearTemporary(), Error("Callback URL is missing required code or state parameters.");
 		return this.exchangeCodeForTokens(t, n);
@@ -403,6 +476,12 @@ var E = class {
 	getAccessToken() {
 		return this.storage.getItemSync(o.ACCESS_TOKEN);
 	}
+	getIdToken() {
+		return this.storage.getItemSync(o.ID_TOKEN);
+	}
+	getUserProfile() {
+		return h(this.getIdToken() || this.getAccessToken());
+	}
 	getRefreshToken() {
 		return this.storage.getItemSync(o.REFRESH_TOKEN);
 	}
@@ -436,24 +515,24 @@ var E = class {
 		let i = `${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;
 		await this.config.openAuthSession(i, this.config.redirectUri);
 	}
-	async logout() {
+	async logout(e) {
 		await this.storage.hydrate();
-		let e = this.getAccessToken(), t = await this.storage.getItem(o.REFRESH_TOKEN);
+		let t = this.getAccessToken(), n = await this.storage.getItem(o.REFRESH_TOKEN);
 		if (await this.storage.clearTokens(), await this.storage.clearTemporary(), this.config.revokeEndpoint) {
-			let n = [...t ? [{
-				token: t,
+			let e = [...n ? [{
+				token: n,
 				token_type_hint: "refresh_token"
-			}] : [], ...e ? [{
-				token: e,
+			}] : [], ...t ? [{
+				token: t,
 				token_type_hint: "access_token"
 			}] : []];
-			for (let e of n) try {
+			for (let t of e) try {
 				await fetch(this.config.revokeEndpoint, {
 					method: "POST",
 					headers: { "Content-Type": "application/x-www-form-urlencoded" },
 					body: new URLSearchParams({
-						token: e.token,
-						token_type_hint: e.token_type_hint,
+						token: t.token,
+						token_type_hint: t.token_type_hint,
 						client_id: this.config.clientId
 					}).toString()
 				});
@@ -461,38 +540,49 @@ var E = class {
 				this.log("error", "Failed to revoke token during logout", e);
 			}
 		}
+		if (e?.clearBrowserSession && this.config.logoutEndpoint && this.config.openAuthSession) {
+			let e = new URLSearchParams({
+				client_id: this.config.clientId,
+				redirect_uri: this.config.redirectUri
+			}), t = this.config.logoutEndpoint.includes("?") ? "&" : "?", n = `${this.config.logoutEndpoint}${t}${e.toString()}`;
+			try {
+				await this.config.openAuthSession(n, this.config.redirectUri);
+			} catch (e) {
+				this.log("warn", "Browser logout session dismissed or failed", e);
+			}
+		}
 	}
-}, D = e(null), O = ({ config: e, client: n, children: o, onLoginSuccess: s, onLoginError: c, subscribeAppState: l }) => {
+}, j = e(null), M = ({ config: e, client: n, children: o, onLoginSuccess: s, onLoginError: c, subscribeAppState: l }) => {
 	let [u] = i(() => {
 		if (n) return n;
-		if (e) return new E(e);
+		if (e) return new A(e);
 		throw Error("AuthProvider requires either a `client` or `config` prop.");
-	}), [d, f] = i(!1), [p, m] = i(null), [h, g] = i(!0), [_, v] = i(null), y = t(async () => {
-		if (await u.initialize(), u.isAuthenticated()) f(!0), m(u.getAccessToken());
+	}), [d, f] = i(!1), [p, m] = i(null), [h, g] = i(null), [_, v] = i(null), [y, b] = i(!0), [x, S] = i(null), C = t(async () => {
+		if (await u.initialize(), u.isAuthenticated()) f(!0), m(u.getAccessToken()), g(u.getIdToken()), v(u.getUserProfile());
 		else {
 			if (u.getRefreshToken()) try {
 				let e = await u.refreshAccessToken();
-				f(!0), m(e.accessToken);
+				f(!0), m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile());
 				return;
 			} catch {
-				f(!1), m(null);
+				f(!1), m(null), g(null), v(null);
 				return;
 			}
-			f(!1), m(null);
+			f(!1), m(null), g(null), v(null);
 		}
 	}, [u]);
 	r(() => {
 		let e = !0;
 		return (async () => {
 			try {
-				await y();
+				await C();
 			} finally {
-				e && g(!1);
+				e && b(!1);
 			}
 		})(), () => {
 			e = !1;
 		};
-	}, [y]), r(() => {
+	}, [C]), r(() => {
 		if (!d) return;
 		let e, t = () => {
 			let n = u.getExpiresAt();
@@ -501,15 +591,15 @@ var E = class {
 			e = setTimeout(async () => {
 				try {
 					let e = await u.refreshAccessToken();
-					m(e.accessToken), f(!0), t();
+					m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), t();
 				} catch (n) {
-					u.log("error", "Background token refresh failed:", n), u.getAccessToken() ? e = setTimeout(t, 3e4) : (f(!1), m(null));
+					u.log("error", "Background token refresh failed:", n), u.getAccessToken() ? e = setTimeout(t, 3e4) : (f(!1), m(null), g(null), v(null));
 				}
 			}, Math.max(0, r));
 		};
 		t();
 		let n = l ? l((e) => {
-			e === "active" && y().catch(() => {});
+			e === "active" && C().catch(() => {});
 		}) : void 0;
 		return () => {
 			e && clearTimeout(e), n && n();
@@ -518,64 +608,66 @@ var E = class {
 		d,
 		u,
 		l,
-		y
+		C
 	]);
-	let b = t(async () => {
-		g(!0), v(null);
+	let w = t(async (e) => {
+		b(!0), S(null);
 		try {
-			let e = await u.authorize();
-			m(e.accessToken), f(!0), s?.();
+			let t = await u.authorize(e);
+			m(t.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), s?.();
 		} catch (e) {
 			let t = e instanceof Error ? e : /* @__PURE__ */ Error("Authentication failed");
-			v(t), c?.(t);
+			S(t), c?.(t);
 		} finally {
-			g(!1);
+			b(!1);
 		}
 	}, [
 		u,
 		s,
 		c
-	]), x = t(async () => {
-		g(!0);
+	]), T = t(async (e) => {
+		b(!0);
 		try {
-			await u.logout(), f(!1), m(null);
+			await u.logout(e), f(!1), m(null), g(null), v(null);
 		} catch (e) {
-			v(e instanceof Error ? e : /* @__PURE__ */ Error("Logout failed"));
+			S(e instanceof Error ? e : /* @__PURE__ */ Error("Logout failed"));
 		} finally {
-			g(!1);
+			b(!1);
 		}
-	}, [u]), S = t(async () => {
+	}, [u]), E = t(async () => {
 		if (await u.initialize(), u.isAuthenticated()) return u.getAccessToken();
 		try {
 			let e = await u.refreshAccessToken();
-			return m(e.accessToken), f(!0), e.accessToken;
+			return m(e.accessToken), g(u.getIdToken()), v(u.getUserProfile()), f(!0), e.accessToken;
 		} catch {
-			return f(!1), m(null), null;
+			return f(!1), m(null), g(null), v(null), null;
 		}
-	}, [u]), C = t(async () => {
-		await u.navigateToAccountManagement(), await y();
-	}, [u, y]);
-	return /* @__PURE__ */ a(D.Provider, {
+	}, [u]), D = t(async () => {
+		await u.navigateToAccountManagement(), await C();
+	}, [u, C]);
+	return /* @__PURE__ */ a(j.Provider, {
 		value: {
 			isAuthenticated: d,
-			isLoading: h,
+			isLoading: y,
 			accessToken: p,
-			error: _,
-			login: b,
-			logout: x,
-			getToken: S,
-			navigateToAccountManagement: C,
+			idToken: h,
+			user: _,
+			error: x,
+			login: w,
+			logout: T,
+			getToken: E,
+			navigateToAccountManagement: D,
 			authClient: u
 		},
 		children: o
 	});
-}, k = () => {
-	let e = n(D);
+}, N = () => {
+	let e = n(j);
 	if (!e) throw Error("useAuth must be used within an AuthProvider");
 	return e;
 };
 // src/axios/interceptor.ts
-function A(e, t, n = {}) {
+function P(e, t, n = {}) {
 	let r = !1, i = [], a = (e, t = null) => {
 		i.forEach((n) => {
 			e ? n.reject(e) : n.resolve(t);
@@ -616,4 +708,4 @@ function A(e, t, n = {}) {
 		e.interceptors.request.eject(s), e.interceptors.response.eject(c);
 	};
 }
-export { E as AuthClient, O as AuthProvider, y as NativeTokenStorage, o as STORAGE_KEYS, f as base64UrlEncode, _ as createCodeChallenge, x as createExpoSecureStoreAdapter, C as createExpoWebBrowserLauncher, w as createInAppBrowserLauncher, S as createKeychainStorageAdapter, b as createMemoryStorageAdapter, h as generateCodeVerifier, m as generateRandomString, g as generateState, T as parseCallbackUrl, A as setupAxiosInterceptors, d as sha256Bytes, k as useAuth };
+export { A as AuthClient, M as AuthProvider, x as NativeTokenStorage, o as STORAGE_KEYS, f as base64UrlEncode, y as createCodeChallenge, T as createExpoSecureStoreAdapter, D as createExpoWebBrowserLauncher, O as createInAppBrowserLauncher, E as createKeychainStorageAdapter, S as createMemoryStorageAdapter, h as decodeJwtPayload, _ as generateCodeVerifier, g as generateRandomString, v as generateState, p as getRandomBytes, k as parseCallbackUrl, P as setupAxiosInterceptors, d as sha256Bytes, N as useAuth };

package/dist/index.umd.js

@@ -1 +1 @@
-(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("react"),require("react/jsx-runtime")):typeof define==`function`&&define.amd?define([`exports`,`react`,`react/jsx-runtime`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.WitsAuthReactNativeClient={},e.React,e.jsxRuntime))})(this,function(e,t,n){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var r=Object.create,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=Object.getOwnPropertyNames,s=Object.getPrototypeOf,c=Object.prototype.hasOwnProperty,l=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var s=o(t),l=0,u=s.length,d;l<u;l++)d=s[l],!c.call(e,d)&&d!==n&&i(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(r=a(t,d))||r.enumerable});return e};t=((e,t,n)=>(n=e==null?{}:r(s(e)),l(i(n,`default`,{value:e,enumerable:!0}),e)))(t,1);var u={ACCESS_TOKEN:`witsauth_access_token`,REFRESH_TOKEN:`witsauth_refresh_token`,TOKEN_EXPIRES_AT:`witsauth_expires_at`,TOKEN_TYPE:`witsauth_token_type`,SCOPE:`witsauth_scope`,ID_TOKEN:`witsauth_id_token`,CODE_VERIFIER:`witsauth_code_verifier`,STATE:`witsauth_state`,NONCE:`witsauth_nonce`},d=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_`,f=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]);function p(e,t){return t>>>e|t<<32-e}function m(e){if(typeof TextEncoder<`u`)return new TextEncoder().encode(e);let t=[];for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192|r>>6,128|r&63):r<55296||r>=57344?t.push(224|r>>12,128|r>>6&63,128|r&63):(n++,r=65536+((r&1023)<<10|e.charCodeAt(n)&1023),t.push(240|r>>18,128|r>>12&63,128|r>>6&63,128|r&63))}return new Uint8Array(t)}function h(e){let t=m(e),n=t.length*8,r=t.length+9+63>>6<<6,i=new Uint8Array(r);i.set(t),i[t.length]=128;let a=new DataView(i.buffer);a.setUint32(r-8,Math.floor(n/4294967296),!1),a.setUint32(r-4,n>>>0,!1);let o=1779033703,s=3144134277,c=1013904242,l=2773480762,u=1359893119,d=2600822924,h=528734635,g=1541459225,_=new Uint32Array(64);for(let e=0;e<r;e+=64){for(let t=0;t<16;t++)_[t]=a.getUint32(e+t*4,!1);for(let e=16;e<64;e++){let t=p(7,_[e-15])^p(18,_[e-15])^_[e-15]>>>3,n=p(17,_[e-2])^p(19,_[e-2])^_[e-2]>>>10;_[e]=_[e-16]+t+_[e-7]+n>>>0}let t=o,n=s,r=c,i=l,m=u,v=d,y=h,b=g;for(let e=0;e<64;e++){let a=p(6,m)^p(11,m)^p(25,m),o=m&v^~m&y,s=b+a+o+f[e]+_[e]>>>0,c=(p(2,t)^p(13,t)^p(22,t))+(t&n^t&r^n&r)>>>0;b=y,y=v,v=m,m=i+s>>>0,i=r,r=n,n=t,t=s+c>>>0}o=o+t>>>0,s=s+n>>>0,c=c+r>>>0,l=l+i>>>0,u=u+m>>>0,d=d+v>>>0,h=h+y>>>0,g=g+b>>>0}let v=new Uint8Array(32),y=new DataView(v.buffer);return y.setUint32(0,o,!1),y.setUint32(4,s,!1),y.setUint32(8,c,!1),y.setUint32(12,l,!1),y.setUint32(16,u,!1),y.setUint32(20,d,!1),y.setUint32(24,h,!1),y.setUint32(28,g,!1),v}function g(e){let t=``,n=e.length;for(let r=0;r<n;r+=3){let i=e[r],a=r+1<n?e[r+1]:0,o=r+2<n?e[r+2]:0;t+=d[i>>2],t+=d[(i&3)<<4|a>>4],r+1<n&&(t+=d[(a&15)<<2|o>>6]),r+2<n&&(t+=d[o&63])}return t}function _(e){let t=new Uint8Array(e),n=typeof globalThis<`u`?globalThis:void 0;if(n?.crypto&&typeof n.crypto.getRandomValues==`function`)return n.crypto.getRandomValues(t),t;for(let n=0;n<e;n++)t[n]=Math.floor(Math.random()*256);return t}function v(e=64){let t=_(e),n=``;for(let r=0;r<e;r++)n+=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`[t[r]%66];return n}function y(){return v(64)}function b(){return v(32)}async function x(e){let t=typeof globalThis<`u`?globalThis:void 0;if(t?.crypto?.subtle&&typeof t.crypto.subtle.digest==`function`)try{let n=m(e),r=await t.crypto.subtle.digest(`SHA-256`,n);return g(new Uint8Array(r))}catch{}return g(h(e))}var S=Object.values(u),C=class{backend;cache=new Map;hydrated=!1;hydratePromise=null;constructor(e){this.backend=e||w()}async hydrate(){if(!this.hydrated)return this.hydratePromise||=(async()=>{await Promise.all(S.map(async e=>{try{let t=await this.backend.getItem(e);t!=null&&this.cache.set(e,t)}catch{}})),this.hydrated=!0})().finally(()=>{this.hydratePromise=null}),this.hydratePromise}getItemSync(e){return this.cache.get(e)??null}async getItem(e){if(this.cache.has(e))return this.cache.get(e);let t=await this.backend.getItem(e);return t==null?null:(this.cache.set(e,t),t)}async setItem(e,t){this.cache.set(e,t),await this.backend.setItem(e,t)}async removeItem(e){this.cache.delete(e),await this.backend.removeItem(e)}async clearTemporary(){await Promise.all([this.removeItem(u.CODE_VERIFIER),this.removeItem(u.STATE),this.removeItem(u.NONCE)])}async clearTokens(){await Promise.all([this.removeItem(u.ACCESS_TOKEN),this.removeItem(u.REFRESH_TOKEN),this.removeItem(u.TOKEN_EXPIRES_AT),this.removeItem(u.TOKEN_TYPE),this.removeItem(u.SCOPE),this.removeItem(u.ID_TOKEN)])}};function w(){let e=new Map;return{getItem:async t=>e.get(t)??null,setItem:async(t,n)=>{e.set(t,n)},removeItem:async t=>{e.delete(t)}}}function T(e){return{getItem:t=>e.getItemAsync(t),setItem:(t,n)=>e.setItemAsync(t,n),removeItem:t=>e.deleteItemAsync(t)}}function E(e,t=`com.witsauth.tokens`){return{getItem:async n=>{let r=await e.getGenericPassword({service:`${t}.${n}`});return r?r.password:null},setItem:async(n,r)=>{await e.setGenericPassword(n,r,{service:`${t}.${n}`})},removeItem:async n=>{await e.resetGenericPassword({service:`${t}.${n}`})}}}function D(e){return async(t,n)=>{let r=await e.openAuthSessionAsync(t,n);return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function O(e){return async(t,n)=>{if(!await e.isAvailable())throw Error(`InAppBrowser is not available on this device.`);let r=await e.openAuth(t,n,{ephemeralWebSession:!1,showTitle:!1,enableUrlBarHiding:!0,enableDefaultShare:!1});return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function k(e){let t=e.indexOf(`?`);if(t===-1)return{code:null,state:null,error:null,errorDescription:null};let n=e.indexOf(`#`,t),r=n===-1?e.slice(t+1):e.slice(t+1,n),i=new URLSearchParams(r);return{code:i.get(`code`),state:i.get(`state`),error:i.get(`error`),errorDescription:i.get(`error_description`)}}var A=class{config;storage;refreshPromise=null;constructor(e,t){this.config=e,this.storage=t||new C(e.storage)}async initialize(){await this.storage.hydrate()}log(e,...t){let n={none:0,error:1,warn:2,info:3,debug:4},r=n[this.config.logLevel||`warn`]||0,i=n[e]||0;i>0&&r>=i&&console[e](...t)}async buildAuthorizationUrl(){await this.storage.hydrate();let e=y(),t=await x(e),n=b(),r=this.config.nonce||b();await this.storage.setItem(u.CODE_VERIFIER,e),await this.storage.setItem(u.STATE,n),await this.storage.setItem(u.NONCE,r);let i=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri,response_type:this.config.responseType||`code`,code_challenge_method:this.config.codeChallengeMethod||`S256`,code_challenge:t,state:n,nonce:r});if(this.config.theme){let e=typeof this.config.theme==`function`?this.config.theme():this.config.theme;e&&i.append(`theme`,e)}return this.config.scope&&i.append(`scope`,this.config.scope),this.config.audience&&i.append(`audience`,this.config.audience),`${this.config.authorizationEndpoint}?${i.toString()}`}async authorize(){if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let e=await this.buildAuthorizationUrl(),t=await this.config.openAuthSession(e,this.config.redirectUri);if(t.type!==`success`||!t.url)throw await this.storage.clearTemporary(),Error(`Authentication ${t.type}`);return this.handleCallbackUrl(t.url)}async handleCallbackUrl(e){let{code:t,state:n,error:r,errorDescription:i}=k(e);if(r)throw await this.storage.clearTemporary(),Error(i?`${r}: ${i}`:r);if(!t||!n)throw await this.storage.clearTemporary(),Error(`Callback URL is missing required code or state parameters.`);return this.exchangeCodeForTokens(t,n)}async exchangeCodeForTokens(e,t){await this.storage.hydrate();let n=await this.storage.getItem(u.STATE),r=await this.storage.getItem(u.CODE_VERIFIER);if(!n||t!==n)throw await this.storage.clearTemporary(),Error(`Invalid state parameter. Possible CSRF attack.`);if(!r)throw await this.storage.clearTemporary(),Error(`Code verifier missing from storage.`);let i=new URLSearchParams({grant_type:`authorization_code`,client_id:this.config.clientId,redirect_uri:this.config.redirectUri,code:e,code_verifier:r}),a=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i.toString()});if(!a.ok)throw Error(`Failed to exchange code for tokens`);let o=await a.json(),s={accessToken:o.access_token,refreshToken:o.refresh_token,tokenType:o.token_type||`Bearer`,expiresAt:Date.now()+o.expires_in*1e3,scope:o.scope,idToken:o.id_token};return await this.saveTokenInfo(s),await this.storage.clearTemporary(),s}async refreshAccessToken(){return this.refreshPromise||=(async()=>{await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available`);let t=new URLSearchParams({grant_type:`refresh_token`,client_id:this.config.clientId,refresh_token:e}),n;try{n=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t.toString()})}catch(e){throw this.log(`error`,`Token refresh network request failed:`,e),e}if(!n.ok){let e={};try{e=await n.json()}catch{try{e={error:await n.text()}}catch{e={}}}this.log(`error`,`Token refresh failed with status:`,n.status,e),(n.status===400||n.status===401)&&await this.storage.clearTokens();let t=e.error_description||e.error||n.statusText||`Failed to refresh token`;throw Error(`Failed to refresh token (${n.status}): ${t}`)}let r=await n.json(),i={accessToken:r.access_token,refreshToken:r.refresh_token||e,tokenType:r.token_type||`Bearer`,expiresAt:Date.now()+r.expires_in*1e3,scope:r.scope,idToken:r.id_token};return await this.saveTokenInfo(i),i})().finally(()=>{this.refreshPromise=null}),this.refreshPromise}async saveTokenInfo(e){await this.storage.setItem(u.ACCESS_TOKEN,e.accessToken),await this.storage.setItem(u.TOKEN_EXPIRES_AT,e.expiresAt.toString()),await this.storage.setItem(u.TOKEN_TYPE,e.tokenType),e.refreshToken&&await this.storage.setItem(u.REFRESH_TOKEN,e.refreshToken),e.scope&&await this.storage.setItem(u.SCOPE,e.scope),e.idToken&&await this.storage.setItem(u.ID_TOKEN,e.idToken)}getAccessToken(){return this.storage.getItemSync(u.ACCESS_TOKEN)}getRefreshToken(){return this.storage.getItemSync(u.REFRESH_TOKEN)}getExpiresAt(){let e=this.storage.getItemSync(u.TOKEN_EXPIRES_AT);if(!e)return null;let t=Number(e);return Number.isFinite(t)?t:null}isAuthenticated(){let e=this.getExpiresAt();return e!==null&&Date.now()<e-3e4&&!!this.getAccessToken()}async navigateToAccountManagement(){await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available to access account management.`);if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let t=this.config.authorizationEndpoint.replace(/\/authorize\/?$/,``),n=await fetch(`${t}/account/ticket`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({refreshToken:e,clientId:this.config.clientId,redirectUri:this.config.redirectUri})});if(!n.ok)throw Error(`Failed to request account management ticket (${n.status})`);let{ticket:r}=await n.json();if(!r)throw Error(`Account management ticket missing from server response.`);let i=`${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;await this.config.openAuthSession(i,this.config.redirectUri)}async logout(){await this.storage.hydrate();let e=this.getAccessToken(),t=await this.storage.getItem(u.REFRESH_TOKEN);if(await this.storage.clearTokens(),await this.storage.clearTemporary(),this.config.revokeEndpoint){let n=[...t?[{token:t,token_type_hint:`refresh_token`}]:[],...e?[{token:e,token_type_hint:`access_token`}]:[]];for(let e of n)try{await fetch(this.config.revokeEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:e.token,token_type_hint:e.token_type_hint,client_id:this.config.clientId}).toString()})}catch(e){this.log(`error`,`Failed to revoke token during logout`,e)}}}},j=(0,t.createContext)(null),M=({config:e,client:r,children:i,onLoginSuccess:a,onLoginError:o,subscribeAppState:s})=>{let[c]=(0,t.useState)(()=>{if(r)return r;if(e)return new A(e);throw Error("AuthProvider requires either a `client` or `config` prop.")}),[l,u]=(0,t.useState)(!1),[d,f]=(0,t.useState)(null),[p,m]=(0,t.useState)(!0),[h,g]=(0,t.useState)(null),_=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())u(!0),f(c.getAccessToken());else{if(c.getRefreshToken())try{let e=await c.refreshAccessToken();u(!0),f(e.accessToken);return}catch{u(!1),f(null);return}u(!1),f(null)}},[c]);(0,t.useEffect)(()=>{let e=!0;return(async()=>{try{await _()}finally{e&&m(!1)}})(),()=>{e=!1}},[_]),(0,t.useEffect)(()=>{if(!l)return;let e,t=()=>{let n=c.getExpiresAt();if(!n)return;let r=n-Date.now()-6e4;e=setTimeout(async()=>{try{let e=await c.refreshAccessToken();f(e.accessToken),u(!0),t()}catch(n){c.log(`error`,`Background token refresh failed:`,n),c.getAccessToken()?e=setTimeout(t,3e4):(u(!1),f(null))}},Math.max(0,r))};t();let n=s?s(e=>{e===`active`&&_().catch(()=>{})}):void 0;return()=>{e&&clearTimeout(e),n&&n()}},[l,c,s,_]);let v=(0,t.useCallback)(async()=>{m(!0),g(null);try{let e=await c.authorize();f(e.accessToken),u(!0),a?.()}catch(e){let t=e instanceof Error?e:Error(`Authentication failed`);g(t),o?.(t)}finally{m(!1)}},[c,a,o]),y=(0,t.useCallback)(async()=>{m(!0);try{await c.logout(),u(!1),f(null)}catch(e){g(e instanceof Error?e:Error(`Logout failed`))}finally{m(!1)}},[c]),b=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())return c.getAccessToken();try{let e=await c.refreshAccessToken();return f(e.accessToken),u(!0),e.accessToken}catch{return u(!1),f(null),null}},[c]),x=(0,t.useCallback)(async()=>{await c.navigateToAccountManagement(),await _()},[c,_]);return(0,n.jsx)(j.Provider,{value:{isAuthenticated:l,isLoading:p,accessToken:d,error:h,login:v,logout:y,getToken:b,navigateToAccountManagement:x,authClient:c},children:i})},N=()=>{let e=(0,t.useContext)(j);if(!e)throw Error(`useAuth must be used within an AuthProvider`);return e};function P(e,t,n={}){let r=!1,i=[],a=(e,t=null)=>{i.forEach(n=>{e?n.reject(e):n.resolve(t)}),i=[]},o=e=>!e||!n.excludeUrls?!1:n.excludeUrls.some(t=>typeof t==`string`?e.includes(t):t.test(e)),s=e.interceptors.request.use(async e=>{if(o(e.url))return e;await t.initialize();let n=t.getAccessToken();if(!t.isAuthenticated()&&n)try{n=(await t.refreshAccessToken()).accessToken}catch{n=null}return n&&e.headers.set(`Authorization`,`Bearer ${n}`),e},e=>Promise.reject(e)),c=e.interceptors.response.use(e=>e,async s=>{let c=s.config;if(!c||o(c.url))return Promise.reject(s);if(s.response?.status===401&&!c._retry){if(r)return new Promise((e,t)=>{i.push({resolve:e,reject:t})}).then(t=>(t&&c.headers.set(`Authorization`,`Bearer ${t}`),e(c))).catch(e=>Promise.reject(e));c._retry=!0,r=!0;try{let n=(await t.refreshAccessToken()).accessToken;return a(null,n),c.headers.set(`Authorization`,`Bearer ${n}`),e(c)}catch(e){return a(e,null),await t.logout(),n.onUnauthorized&&n.onUnauthorized(),Promise.reject(e)}finally{r=!1}}return Promise.reject(s)});return()=>{e.interceptors.request.eject(s),e.interceptors.response.eject(c)}}e.AuthClient=A,e.AuthProvider=M,e.NativeTokenStorage=C,e.STORAGE_KEYS=u,e.base64UrlEncode=g,e.createCodeChallenge=x,e.createExpoSecureStoreAdapter=T,e.createExpoWebBrowserLauncher=D,e.createInAppBrowserLauncher=O,e.createKeychainStorageAdapter=E,e.createMemoryStorageAdapter=w,e.generateCodeVerifier=y,e.generateRandomString=v,e.generateState=b,e.parseCallbackUrl=k,e.setupAxiosInterceptors=P,e.sha256Bytes=h,e.useAuth=N});
+(function(e,t){typeof exports==`object`&&typeof module<`u`?t(exports,require("react"),require("react/jsx-runtime")):typeof define==`function`&&define.amd?define([`exports`,`react`,`react/jsx-runtime`],t):(e=typeof globalThis<`u`?globalThis:e||self,t(e.WitsAuthReactNativeClient={},e.React,e.jsxRuntime))})(this,function(e,t,n){Object.defineProperty(e,Symbol.toStringTag,{value:`Module`});var r=Object.create,i=Object.defineProperty,a=Object.getOwnPropertyDescriptor,o=Object.getOwnPropertyNames,s=Object.getPrototypeOf,c=Object.prototype.hasOwnProperty,l=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var s=o(t),l=0,u=s.length,d;l<u;l++)d=s[l],!c.call(e,d)&&d!==n&&i(e,d,{get:(e=>t[e]).bind(null,d),enumerable:!(r=a(t,d))||r.enumerable});return e};t=((e,t,n)=>(n=e==null?{}:r(s(e)),l(i(n,`default`,{value:e,enumerable:!0}),e)))(t,1);var u={ACCESS_TOKEN:`witsauth_access_token`,REFRESH_TOKEN:`witsauth_refresh_token`,TOKEN_EXPIRES_AT:`witsauth_expires_at`,TOKEN_TYPE:`witsauth_token_type`,SCOPE:`witsauth_scope`,ID_TOKEN:`witsauth_id_token`,CODE_VERIFIER:`witsauth_code_verifier`,STATE:`witsauth_state`,NONCE:`witsauth_nonce`},d=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_`,f=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]);function p(e,t){return t>>>e|t<<32-e}function m(e){if(typeof TextEncoder<`u`)return new TextEncoder().encode(e);let t=[];for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);r<128?t.push(r):r<2048?t.push(192|r>>6,128|r&63):r<55296||r>=57344?t.push(224|r>>12,128|r>>6&63,128|r&63):(n++,r=65536+((r&1023)<<10|e.charCodeAt(n)&1023),t.push(240|r>>18,128|r>>12&63,128|r>>6&63,128|r&63))}return new Uint8Array(t)}function h(e){let t=m(e),n=t.length*8,r=t.length+9+63>>6<<6,i=new Uint8Array(r);i.set(t),i[t.length]=128;let a=new DataView(i.buffer);a.setUint32(r-8,Math.floor(n/4294967296),!1),a.setUint32(r-4,n>>>0,!1);let o=1779033703,s=3144134277,c=1013904242,l=2773480762,u=1359893119,d=2600822924,h=528734635,g=1541459225,_=new Uint32Array(64);for(let e=0;e<r;e+=64){for(let t=0;t<16;t++)_[t]=a.getUint32(e+t*4,!1);for(let e=16;e<64;e++){let t=p(7,_[e-15])^p(18,_[e-15])^_[e-15]>>>3,n=p(17,_[e-2])^p(19,_[e-2])^_[e-2]>>>10;_[e]=_[e-16]+t+_[e-7]+n>>>0}let t=o,n=s,r=c,i=l,m=u,v=d,y=h,b=g;for(let e=0;e<64;e++){let a=p(6,m)^p(11,m)^p(25,m),o=m&v^~m&y,s=b+a+o+f[e]+_[e]>>>0,c=(p(2,t)^p(13,t)^p(22,t))+(t&n^t&r^n&r)>>>0;b=y,y=v,v=m,m=i+s>>>0,i=r,r=n,n=t,t=s+c>>>0}o=o+t>>>0,s=s+n>>>0,c=c+r>>>0,l=l+i>>>0,u=u+m>>>0,d=d+v>>>0,h=h+y>>>0,g=g+b>>>0}let v=new Uint8Array(32),y=new DataView(v.buffer);return y.setUint32(0,o,!1),y.setUint32(4,s,!1),y.setUint32(8,c,!1),y.setUint32(12,l,!1),y.setUint32(16,u,!1),y.setUint32(20,d,!1),y.setUint32(24,h,!1),y.setUint32(28,g,!1),v}function g(e){let t=``,n=e.length;for(let r=0;r<n;r+=3){let i=e[r],a=r+1<n?e[r+1]:0,o=r+2<n?e[r+2]:0;t+=d[i>>2],t+=d[(i&3)<<4|a>>4],r+1<n&&(t+=d[(a&15)<<2|o>>6]),r+2<n&&(t+=d[o&63])}return t}function _(e){let t=new Uint8Array(e),n=typeof globalThis<`u`?globalThis:void 0;if(n?.crypto&&typeof n.crypto.getRandomValues==`function`)return n.crypto.getRandomValues(t),t;try{let r=typeof n?.require==`function`?n.require:void 0;if(r){let n=r(`expo-crypto`);if(n&&typeof n.getRandomValues==`function`)return n.getRandomValues(t),t;if(n&&typeof n.getRandomBytes==`function`){let r=n.getRandomBytes(e);return t.set(r.subarray(0,e)),t}}}catch{}throw Error(`Cryptographically secure random number generator (CSPRNG) is unavailable. Please install and import "react-native-get-random-values" or "expo-crypto".`)}function v(e){let t=e.replace(/-/g,`+`).replace(/_/g,`/`),n=t+`=`.repeat((4-t.length%4)%4);if(typeof atob==`function`){let e=atob(n),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);if(typeof TextDecoder<`u`)return new TextDecoder().decode(t);let r=``;for(let e=0;e<t.length;e++)r+=String.fromCharCode(t[e]);return decodeURIComponent(escape(r))}let r=typeof globalThis<`u`?globalThis:void 0;if(r?.Buffer)return r.Buffer.from(n,`base64`).toString(`utf8`);throw Error(`Unable to decode base64url string.`)}function y(e){if(!e||typeof e!=`string`)return null;let t=e.split(`.`);if(t.length<2)return null;try{let e=v(t[1]);return JSON.parse(e)}catch{return null}}function b(e=64){let t=_(e),n=``;for(let r=0;r<e;r++)n+=`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~`[t[r]%66];return n}function x(){return b(64)}function S(){return b(32)}async function C(e){let t=typeof globalThis<`u`?globalThis:void 0;if(t?.crypto?.subtle&&typeof t.crypto.subtle.digest==`function`)try{let n=m(e),r=await t.crypto.subtle.digest(`SHA-256`,n);return g(new Uint8Array(r))}catch{}return g(h(e))}var w=Object.values(u),T=class{backend;cache=new Map;hydrated=!1;hydratePromise=null;constructor(e){this.backend=e||E()}async hydrate(){if(!this.hydrated)return this.hydratePromise||=(async()=>{await Promise.all(w.map(async e=>{try{let t=await this.backend.getItem(e);t!=null&&this.cache.set(e,t)}catch{}})),this.hydrated=!0})().finally(()=>{this.hydratePromise=null}),this.hydratePromise}getItemSync(e){return this.cache.get(e)??null}async getItem(e){if(this.cache.has(e))return this.cache.get(e);let t=await this.backend.getItem(e);return t==null?null:(this.cache.set(e,t),t)}async setItem(e,t){this.cache.set(e,t),await this.backend.setItem(e,t)}async removeItem(e){this.cache.delete(e),await this.backend.removeItem(e)}async clearTemporary(){await Promise.all([this.removeItem(u.CODE_VERIFIER),this.removeItem(u.STATE),this.removeItem(u.NONCE)])}async clearTokens(){await Promise.all([this.removeItem(u.ACCESS_TOKEN),this.removeItem(u.REFRESH_TOKEN),this.removeItem(u.TOKEN_EXPIRES_AT),this.removeItem(u.TOKEN_TYPE),this.removeItem(u.SCOPE),this.removeItem(u.ID_TOKEN)])}};function E(){let e=new Map;return{getItem:async t=>e.get(t)??null,setItem:async(t,n)=>{e.set(t,n)},removeItem:async t=>{e.delete(t)}}}var D=2e3,O=`__witsauth_chunked__:`;function k(e){let t=async t=>{try{let n=await e.getItemAsync(t);if(n&&n.startsWith(O)){let r=parseInt(n.slice(21),10);if(Number.isFinite(r)&&r>0){let n=[];for(let i=0;i<r;i++)n.push(e.deleteItemAsync(`${t}__chunk_${i}`));await Promise.all(n)}}}catch{}};return{getItem:async t=>{let n=await e.getItemAsync(t);if(!n)return null;if(n.startsWith(O)){let r=parseInt(n.slice(21),10);if(!Number.isFinite(r)||r<=0)return null;let i=[];for(let n=0;n<r;n++)i.push(e.getItemAsync(`${t}__chunk_${n}`));let a=await Promise.all(i);return a.some(e=>e==null)?null:a.join(``)}return n},setItem:async(n,r)=>{if(r.length<=D){await t(n),await e.setItemAsync(n,r);return}await t(n);let i=[];for(let e=0;e<r.length;e+=D)i.push(r.slice(e,e+D));await Promise.all(i.map((t,r)=>e.setItemAsync(`${n}__chunk_${r}`,t))),await e.setItemAsync(n,`${O}${i.length}`)},removeItem:async n=>{await t(n),await e.deleteItemAsync(n)}}}function A(e,t=`com.witsauth.tokens`){return{getItem:async n=>{let r=await e.getGenericPassword({service:`${t}.${n}`});return r?r.password:null},setItem:async(n,r)=>{await e.setGenericPassword(n,r,{service:`${t}.${n}`})},removeItem:async n=>{await e.resetGenericPassword({service:`${t}.${n}`})}}}function j(e){return async(t,n)=>{let r=await e.openAuthSessionAsync(t,n);return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function M(e){return async(t,n)=>{if(!await e.isAvailable())throw Error(`InAppBrowser is not available on this device.`);let r=await e.openAuth(t,n,{ephemeralWebSession:!1,showTitle:!1,enableUrlBarHiding:!0,enableDefaultShare:!1});return r.type===`success`&&r.url?{type:`success`,url:r.url}:r.type===`cancel`?{type:`cancel`}:{type:`dismiss`}}}function N(e){let t=e.indexOf(`?`);if(t===-1)return{code:null,state:null,error:null,errorDescription:null};let n=e.indexOf(`#`,t),r=n===-1?e.slice(t+1):e.slice(t+1,n),i=new URLSearchParams(r);return{code:i.get(`code`),state:i.get(`state`),error:i.get(`error`),errorDescription:i.get(`error_description`)}}var P=class{config;storage;refreshPromise=null;constructor(e,t){this.config=e,this.storage=t||new T(e.storage)}async initialize(){await this.storage.hydrate()}log(e,...t){let n={none:0,error:1,warn:2,info:3,debug:4},r=n[this.config.logLevel||`warn`]||0,i=n[e]||0;i>0&&r>=i&&console[e](...t)}async buildAuthorizationUrl(e){await this.storage.hydrate();let t=x(),n=await C(t),r=S(),i=this.config.nonce||S();await this.storage.setItem(u.CODE_VERIFIER,t),await this.storage.setItem(u.STATE,r),await this.storage.setItem(u.NONCE,i);let a=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri,response_type:this.config.responseType||`code`,code_challenge_method:this.config.codeChallengeMethod||`S256`,code_challenge:n,state:r,nonce:i});if(this.config.theme){let e=typeof this.config.theme==`function`?this.config.theme():this.config.theme;e&&a.append(`theme`,e)}let o=e?.scope??this.config.scope,s=e?.audience??this.config.audience;return o&&a.append(`scope`,o),s&&a.append(`audience`,s),e?.prompt&&a.append(`prompt`,e.prompt),`${this.config.authorizationEndpoint}?${a.toString()}`}async authorize(e){if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let t=await this.buildAuthorizationUrl(e),n=await this.config.openAuthSession(t,this.config.redirectUri);if(n.type!==`success`||!n.url)throw await this.storage.clearTemporary(),Error(`Authentication ${n.type}`);return this.handleCallbackUrl(n.url)}async handleCallbackUrl(e){let{code:t,state:n,error:r,errorDescription:i}=N(e);if(r)throw await this.storage.clearTemporary(),Error(i?`${r}: ${i}`:r);if(!t||!n)throw await this.storage.clearTemporary(),Error(`Callback URL is missing required code or state parameters.`);return this.exchangeCodeForTokens(t,n)}async exchangeCodeForTokens(e,t){await this.storage.hydrate();let n=await this.storage.getItem(u.STATE),r=await this.storage.getItem(u.CODE_VERIFIER);if(!n||t!==n)throw await this.storage.clearTemporary(),Error(`Invalid state parameter. Possible CSRF attack.`);if(!r)throw await this.storage.clearTemporary(),Error(`Code verifier missing from storage.`);let i=new URLSearchParams({grant_type:`authorization_code`,client_id:this.config.clientId,redirect_uri:this.config.redirectUri,code:e,code_verifier:r}),a=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:i.toString()});if(!a.ok)throw Error(`Failed to exchange code for tokens`);let o=await a.json(),s={accessToken:o.access_token,refreshToken:o.refresh_token,tokenType:o.token_type||`Bearer`,expiresAt:Date.now()+o.expires_in*1e3,scope:o.scope,idToken:o.id_token};return await this.saveTokenInfo(s),await this.storage.clearTemporary(),s}async refreshAccessToken(){return this.refreshPromise||=(async()=>{await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available`);let t=new URLSearchParams({grant_type:`refresh_token`,client_id:this.config.clientId,refresh_token:e}),n;try{n=await fetch(this.config.tokenEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:t.toString()})}catch(e){throw this.log(`error`,`Token refresh network request failed:`,e),e}if(!n.ok){let e={};try{e=await n.json()}catch{try{e={error:await n.text()}}catch{e={}}}this.log(`error`,`Token refresh failed with status:`,n.status,e),(n.status===400||n.status===401)&&await this.storage.clearTokens();let t=e.error_description||e.error||n.statusText||`Failed to refresh token`;throw Error(`Failed to refresh token (${n.status}): ${t}`)}let r=await n.json(),i={accessToken:r.access_token,refreshToken:r.refresh_token||e,tokenType:r.token_type||`Bearer`,expiresAt:Date.now()+r.expires_in*1e3,scope:r.scope,idToken:r.id_token};return await this.saveTokenInfo(i),i})().finally(()=>{this.refreshPromise=null}),this.refreshPromise}async saveTokenInfo(e){await this.storage.setItem(u.ACCESS_TOKEN,e.accessToken),await this.storage.setItem(u.TOKEN_EXPIRES_AT,e.expiresAt.toString()),await this.storage.setItem(u.TOKEN_TYPE,e.tokenType),e.refreshToken&&await this.storage.setItem(u.REFRESH_TOKEN,e.refreshToken),e.scope&&await this.storage.setItem(u.SCOPE,e.scope),e.idToken&&await this.storage.setItem(u.ID_TOKEN,e.idToken)}getAccessToken(){return this.storage.getItemSync(u.ACCESS_TOKEN)}getIdToken(){return this.storage.getItemSync(u.ID_TOKEN)}getUserProfile(){return y(this.getIdToken()||this.getAccessToken())}getRefreshToken(){return this.storage.getItemSync(u.REFRESH_TOKEN)}getExpiresAt(){let e=this.storage.getItemSync(u.TOKEN_EXPIRES_AT);if(!e)return null;let t=Number(e);return Number.isFinite(t)?t:null}isAuthenticated(){let e=this.getExpiresAt();return e!==null&&Date.now()<e-3e4&&!!this.getAccessToken()}async navigateToAccountManagement(){await this.storage.hydrate();let e=await this.storage.getItem(u.REFRESH_TOKEN);if(!e)throw Error(`No refresh token available to access account management.`);if(!this.config.openAuthSession)throw Error(`No openAuthSession launcher configured. Pass createExpoWebBrowserLauncher(WebBrowser) or createInAppBrowserLauncher(InAppBrowser) in OAuth2NativeConfig.`);let t=this.config.authorizationEndpoint.replace(/\/authorize\/?$/,``),n=await fetch(`${t}/account/ticket`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({refreshToken:e,clientId:this.config.clientId,redirectUri:this.config.redirectUri})});if(!n.ok)throw Error(`Failed to request account management ticket (${n.status})`);let{ticket:r}=await n.json();if(!r)throw Error(`Account management ticket missing from server response.`);let i=`${t}/account?ticket=${encodeURIComponent(r)}&return_to=${encodeURIComponent(this.config.redirectUri)}`;await this.config.openAuthSession(i,this.config.redirectUri)}async logout(e){await this.storage.hydrate();let t=this.getAccessToken(),n=await this.storage.getItem(u.REFRESH_TOKEN);if(await this.storage.clearTokens(),await this.storage.clearTemporary(),this.config.revokeEndpoint){let e=[...n?[{token:n,token_type_hint:`refresh_token`}]:[],...t?[{token:t,token_type_hint:`access_token`}]:[]];for(let t of e)try{await fetch(this.config.revokeEndpoint,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:t.token,token_type_hint:t.token_type_hint,client_id:this.config.clientId}).toString()})}catch(e){this.log(`error`,`Failed to revoke token during logout`,e)}}if(e?.clearBrowserSession&&this.config.logoutEndpoint&&this.config.openAuthSession){let e=new URLSearchParams({client_id:this.config.clientId,redirect_uri:this.config.redirectUri}),t=this.config.logoutEndpoint.includes(`?`)?`&`:`?`,n=`${this.config.logoutEndpoint}${t}${e.toString()}`;try{await this.config.openAuthSession(n,this.config.redirectUri)}catch(e){this.log(`warn`,`Browser logout session dismissed or failed`,e)}}}},F=(0,t.createContext)(null),I=({config:e,client:r,children:i,onLoginSuccess:a,onLoginError:o,subscribeAppState:s})=>{let[c]=(0,t.useState)(()=>{if(r)return r;if(e)return new P(e);throw Error("AuthProvider requires either a `client` or `config` prop.")}),[l,u]=(0,t.useState)(!1),[d,f]=(0,t.useState)(null),[p,m]=(0,t.useState)(null),[h,g]=(0,t.useState)(null),[_,v]=(0,t.useState)(!0),[y,b]=(0,t.useState)(null),x=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())u(!0),f(c.getAccessToken()),m(c.getIdToken()),g(c.getUserProfile());else{if(c.getRefreshToken())try{let e=await c.refreshAccessToken();u(!0),f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile());return}catch{u(!1),f(null),m(null),g(null);return}u(!1),f(null),m(null),g(null)}},[c]);(0,t.useEffect)(()=>{let e=!0;return(async()=>{try{await x()}finally{e&&v(!1)}})(),()=>{e=!1}},[x]),(0,t.useEffect)(()=>{if(!l)return;let e,t=()=>{let n=c.getExpiresAt();if(!n)return;let r=n-Date.now()-6e4;e=setTimeout(async()=>{try{let e=await c.refreshAccessToken();f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),t()}catch(n){c.log(`error`,`Background token refresh failed:`,n),c.getAccessToken()?e=setTimeout(t,3e4):(u(!1),f(null),m(null),g(null))}},Math.max(0,r))};t();let n=s?s(e=>{e===`active`&&x().catch(()=>{})}):void 0;return()=>{e&&clearTimeout(e),n&&n()}},[l,c,s,x]);let S=(0,t.useCallback)(async e=>{v(!0),b(null);try{let t=await c.authorize(e);f(t.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),a?.()}catch(e){let t=e instanceof Error?e:Error(`Authentication failed`);b(t),o?.(t)}finally{v(!1)}},[c,a,o]),C=(0,t.useCallback)(async e=>{v(!0);try{await c.logout(e),u(!1),f(null),m(null),g(null)}catch(e){b(e instanceof Error?e:Error(`Logout failed`))}finally{v(!1)}},[c]),w=(0,t.useCallback)(async()=>{if(await c.initialize(),c.isAuthenticated())return c.getAccessToken();try{let e=await c.refreshAccessToken();return f(e.accessToken),m(c.getIdToken()),g(c.getUserProfile()),u(!0),e.accessToken}catch{return u(!1),f(null),m(null),g(null),null}},[c]),T=(0,t.useCallback)(async()=>{await c.navigateToAccountManagement(),await x()},[c,x]);return(0,n.jsx)(F.Provider,{value:{isAuthenticated:l,isLoading:_,accessToken:d,idToken:p,user:h,error:y,login:S,logout:C,getToken:w,navigateToAccountManagement:T,authClient:c},children:i})},L=()=>{let e=(0,t.useContext)(F);if(!e)throw Error(`useAuth must be used within an AuthProvider`);return e};function R(e,t,n={}){let r=!1,i=[],a=(e,t=null)=>{i.forEach(n=>{e?n.reject(e):n.resolve(t)}),i=[]},o=e=>!e||!n.excludeUrls?!1:n.excludeUrls.some(t=>typeof t==`string`?e.includes(t):t.test(e)),s=e.interceptors.request.use(async e=>{if(o(e.url))return e;await t.initialize();let n=t.getAccessToken();if(!t.isAuthenticated()&&n)try{n=(await t.refreshAccessToken()).accessToken}catch{n=null}return n&&e.headers.set(`Authorization`,`Bearer ${n}`),e},e=>Promise.reject(e)),c=e.interceptors.response.use(e=>e,async s=>{let c=s.config;if(!c||o(c.url))return Promise.reject(s);if(s.response?.status===401&&!c._retry){if(r)return new Promise((e,t)=>{i.push({resolve:e,reject:t})}).then(t=>(t&&c.headers.set(`Authorization`,`Bearer ${t}`),e(c))).catch(e=>Promise.reject(e));c._retry=!0,r=!0;try{let n=(await t.refreshAccessToken()).accessToken;return a(null,n),c.headers.set(`Authorization`,`Bearer ${n}`),e(c)}catch(e){return a(e,null),await t.logout(),n.onUnauthorized&&n.onUnauthorized(),Promise.reject(e)}finally{r=!1}}return Promise.reject(s)});return()=>{e.interceptors.request.eject(s),e.interceptors.response.eject(c)}}e.AuthClient=P,e.AuthProvider=I,e.NativeTokenStorage=T,e.STORAGE_KEYS=u,e.base64UrlEncode=g,e.createCodeChallenge=C,e.createExpoSecureStoreAdapter=k,e.createExpoWebBrowserLauncher=j,e.createInAppBrowserLauncher=M,e.createKeychainStorageAdapter=A,e.createMemoryStorageAdapter=E,e.decodeJwtPayload=y,e.generateCodeVerifier=x,e.generateRandomString=b,e.generateState=S,e.getRandomBytes=_,e.parseCallbackUrl=N,e.setupAxiosInterceptors=R,e.sha256Bytes=h,e.useAuth=L});

package/dist/models/types.d.ts

@@ -91,6 +91,33 @@ export interface TokenInfo {
     scope?: string;
     idToken?: string;
 }
+export interface UserProfile {
+    sub?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    email?: string;
+    email_verified?: boolean;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    roles?: string[];
+    permissions?: string[];
+    amr?: string[];
+    act?: {
+        sub: string;
+        ticket_ref?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface AuthorizeOptions {
+    prompt?: 'login' | 'consent' | 'select_account';
+    scope?: string;
+    audience?: string;
+}
+export interface LogoutOptions {
+    clearBrowserSession?: boolean;
+}
 export declare const STORAGE_KEYS: {
     readonly ACCESS_TOKEN: 'witsauth_access_token';
     readonly REFRESH_TOKEN: 'witsauth_refresh_token';

package/dist/react/AuthContext.d.ts

@@ -1,13 +1,15 @@
 import React from 'react';
 import { AuthClient } from '../core/AuthClient';
-import { OAuth2NativeConfig } from '../models/types';
+import { AuthorizeOptions, LogoutOptions, OAuth2NativeConfig, UserProfile } from '../models/types';
 export interface AuthContextType {
     isAuthenticated: boolean;
     isLoading: boolean;
     accessToken: string | null;
+    idToken: string | null;
+    user: UserProfile | null;
     error: Error | null;
-    login: () => Promise<void>;
-    logout: () => Promise<void>;
+    login: (options?: AuthorizeOptions) => Promise<void>;
+    logout: (options?: LogoutOptions) => Promise<void>;
     getToken: () => Promise<string | null>;
     navigateToAccountManagement: () => Promise<void>;
     authClient: AuthClient;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@witsauth/react-native-client",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Official React Native client library (Expo and Bare React Native CLI) for integrating WitsAuth OAuth 2.0 + PKCE authentication on Android and iOS.",
   "main": "./dist/index.umd.js",
   "module": "./dist/index.es.js",
@@ -15,12 +15,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "dev": "vite",
-    "build": "tsc && vite build && tsc -p tsconfig.build.json",
-    "test": "vitest run",
-    "prepublishOnly": "pnpm test && pnpm build"
-  },
   "publishConfig": {
     "access": "public"
   },
@@ -61,5 +55,10 @@
     "typescript": "^7.0.2",
     "vite": "^8.1.5",
     "vitest": "^4.1.10"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build && tsc -p tsconfig.build.json",
+    "test": "vitest run"
   }
-}
+}