@wtfalch/auth 0.6.0 → 0.8.0

package/dist/qr.d.ts

@@ -0,0 +1,23 @@
+import type { ResolvedOptions } from './config.js';
+import { type Oidc, type Tokens } from './oidc.js';
+export interface DeviceAuthorization {
+    deviceCode: string;
+    userCode: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+}
+export declare function requestDeviceAuthorization(options: ResolvedOptions, scope: string): Promise<DeviceAuthorization>;
+export type DevicePoll = {
+    status: 'pending';
+} | {
+    status: 'slow_down';
+} | {
+    status: 'expired';
+} | {
+    status: 'denied';
+} | {
+    status: 'signed_in';
+    tokens: Tokens;
+};
+export declare function pollDeviceToken(options: ResolvedOptions, oidc: Oidc, deviceCode: string): Promise<DevicePoll>;

package/dist/qr.js

@@ -0,0 +1,75 @@
+import { AuthError } from './oidc.js';
+/**
+ * The OAuth device authorization grant (RFC 8628), for signing in a new
+ * device from a QR code a phone that is already signed in approves. Raw
+ * `fetch` against the issuer's own endpoints -- the same convention
+ * `browser.ts` and `namespace-browser.ts` use for their token calls -- rather
+ * than `openid-client`'s device-grant helpers, which poll synchronously and
+ * do not fit a request served once per browser poll.
+ */
+const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+export async function requestDeviceAuthorization(options, scope) {
+    const response = await options.fetch(`${options.issuer}/oauth/v2/device_authorization`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_id: options.clientId, scope }),
+    });
+    if (!response.ok) {
+        throw new AuthError('request', `the issuer refused the device authorization request (${response.status})`);
+    }
+    const body = (await response.json().catch(() => null));
+    const deviceCode = str(body?.device_code);
+    const userCode = str(body?.user_code);
+    const verificationUriComplete = str(body?.verification_uri_complete);
+    const expiresIn = num(body?.expires_in);
+    if (!deviceCode || !userCode || !verificationUriComplete || expiresIn === null) {
+        throw new AuthError('request', 'the issuer returned an incomplete device authorization');
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUriComplete,
+        expiresIn,
+        interval: num(body?.interval) ?? 5,
+    };
+}
+export async function pollDeviceToken(options, oidc, deviceCode) {
+    const response = await options.fetch(`${options.issuer}/oauth/v2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: DEVICE_GRANT_TYPE,
+            device_code: deviceCode,
+            client_id: options.clientId,
+        }),
+    });
+    const body = (await response.json().catch(() => null));
+    if (!response.ok) {
+        const error = str(body?.error);
+        if (error === 'authorization_pending')
+            return { status: 'pending' };
+        if (error === 'slow_down')
+            return { status: 'slow_down' };
+        if (error === 'expired_token')
+            return { status: 'expired' };
+        if (error === 'access_denied')
+            return { status: 'denied' };
+        throw new AuthError('exchange', str(body?.error_description) ?? error ?? 'device token request failed');
+    }
+    const idToken = str(body?.id_token);
+    if (!idToken)
+        throw new AuthError('exchange', 'the issuer returned no id token');
+    // Signature, issuer, audience, expiry and the organisation claim -- exactly
+    // the code-exchange path's checks, minus the nonce a device grant has none of.
+    const claims = await oidc.verify(idToken);
+    return {
+        status: 'signed_in',
+        tokens: { idToken, refreshToken: str(body?.refresh_token) ?? undefined, claims },
+    };
+}
+function str(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
-    "url": "https://github.com/wtfalch/auth",
+    "url": "git+https://github.com/wtfalch/auth.git",
     "directory": "packages/auth"
   },
   "type": "module",
@@ -22,6 +22,10 @@
       "types": "./dist/browser.d.ts",
       "default": "./dist/browser.js"
     },
+    "./passkey": {
+      "types": "./dist/passkey-browser.d.ts",
+      "default": "./dist/passkey-browser.js"
+    },
     "./namespaces": {
       "types": "./dist/namespaces.d.ts",
       "default": "./dist/namespaces.js"