@xemahq/oidc-session-nest 0.1.0

package/LICENSE

@@ -0,0 +1,176 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work
+(an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally
+submitted to Licensor for inclusion in the Work by the copyright owner
+or by an individual or Legal Entity authorized to submit on behalf of
+the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work,
+excluding those notices that do not pertain to any part of
+the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its
+distribution, then any Derivative Works that You distribute must
+include a readable copy of the attribution notices contained
+within such NOTICE file, excluding those notices that do not
+pertain to any part of the Derivative Works, in at least one
+of the following places: within a NOTICE text file distributed
+as part of the Derivative Works; within the Source form or
+documentation, if provided along with the Derivative Works; or,
+within a display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE text from the Work, provided
+that such additional attribution notices cannot be construed
+as modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work
+by You to the Licensor shall be under the terms and conditions of
+this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify
+the terms of any separate license agreement you may have executed
+with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,101 @@
+<!-- Banner: inline SVG (from assets/banner-template.svg). Renders on GitHub; npm strips inline SVG. -->
+<p align="center">
+<svg width="680" height="120" viewBox="0 0 680 120" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="@xemahq/oidc-session-nest">
+  <rect width="680" height="120" rx="14" fill="#0B1020"/>
+  <g transform="translate(28,34)">
+    <path d="M26 0 L52 15 L52 45 L26 60 L0 45 L0 15 Z" fill="#8B5CF6" opacity="0.18"/>
+    <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#8B5CF6"/>
+  </g>
+  <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="26" fill="#F8FAFC" font-weight="700">@xemahq/oidc-session-nest</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">The browser holds a cookie. The server holds the tokens.</text>
+  <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
+</svg>
+</p>
+
+<p align="center">
+  <a href="https://xema.dev">Website</a> &middot;
+  <a href="https://www.npmjs.com/package/@xemahq/oidc-session-nest">npm</a>
+</p>
+
+<p align="center">
+  <img alt="npm" src="https://img.shields.io/npm/v/%40xemahq%2Foidc-session-nest?color=2563eb&label=npm">
+  <img alt="license" src="https://img.shields.io/npm/l/%40xemahq%2Foidc-session-nest?color=10b981">
+  <img alt="types" src="https://img.shields.io/npm/types/%40xemahq%2Foidc-session-nest?color=3178c6">
+</p>
+
+# @xemahq/oidc-session-nest
+
+> The browser holds a cookie. The server holds the tokens.
+
+## Overview
+
+This package belongs to Layer 1 — it is an SDK a NestJS application composes, not
+a service. It gives a backend-for-frontend a complete server-side OIDC session:
+the authorization-code exchange with PKCE, a session store the application owns,
+a refresh that happens once no matter how many requests or replicas ask for it,
+and an ambient request scope the generated Xema clients read their bearer from.
+
+The browser receives exactly one thing — an httpOnly cookie carrying an opaque
+id. It never receives an access token, a refresh token or an id token, so there
+is no token in `localStorage` for a script to read and nothing to leak through a
+`postMessage`, a source map or a crash reporter.
+
+## When to use it
+
+- Use this when a browser talks to a backend you ship, and that backend talks to
+  Xema. It is the recommended shape for browsers and it is not mandated: a
+  server-to-server integration needs no session at all, and a mobile client that
+  already has an OIDC library keeps it.
+- Reach for `@xemahq/oidc-guard` instead when you only need to VERIFY a token
+  somebody else obtained — this package composes it for exactly that and adds
+  the session around it.
+
+## Installation
+
+```bash
+pnpm add @xemahq/oidc-session-nest
+```
+
+## Usage
+
+```ts
+import {
+  InMemorySessionStore,
+  OidcSessionModule,
+  loadOidcSessionOptionsFromEnv,
+  sessionClientTransport,
+} from '@xemahq/oidc-session-nest';
+
+@Module({
+  imports: [
+    OidcSessionModule.forRootAsync({
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => ({
+        options: loadOidcSessionOptionsFromEnv((name) => config.get(name)),
+        store: new InMemorySessionStore(), // RedisSessionStore when scaled
+      }),
+    }),
+  ],
+})
+export class AppModule {}
+
+// Once, at boot — every request then calls peers as whoever is signed in.
+configureClient({ baseUrl, ...sessionClientTransport() });
+```
+
+Fence a route with `OidcSessionGuard` and read the caller with `@SessionActor()`.
+A route without the guard still gets the ambient scope, so an anonymous page can
+render — it simply has no bearer to call Xema with.
+
+## Peer requirements
+
+- `@nestjs/common` and `@nestjs/core` `^10 || ^11` — the framework this mounts into.
+- `@xemahq/oidc-guard` `>=0.6.0` — verifies every token this package accepts.
+- `@xemahq/platform-common` `>=0.28.2` — supplies the org claim and header names.
+- `@xemahq/xema-decorators` `>=0.15.0` — declares the four browser routes public
+  so a global JWT guard does not fence the sign-in door.
+- `@xemahq/kernel-contracts` `>=34.0.0` — reached through the types above.
+
+## License
+
+Apache-2.0 &copy; Xema — [xema.dev](https://xema.dev)

package/dist/config/oidc-session-env.d.ts

@@ -0,0 +1,6 @@
+import { type OidcSessionOptions } from './oidc-session-options';
+export type EnvReader = (name: string) => string | undefined;
+export declare const OIDC_SESSION_REQUIRED_ENV_VARS: readonly string[];
+export declare const OIDC_SESSION_OPTIONAL_ENV_VARS: readonly string[];
+export declare function loadOidcSessionOptionsFromEnv(read: EnvReader): OidcSessionOptions;
+//# sourceMappingURL=oidc-session-env.d.ts.map

package/dist/config/oidc-session-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-env.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAK3D,CAAC;AAOF,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAa3D,CAAC;AAoBF,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,SAAS,GACd,kBAAkB,CA+CpB"}

package/dist/config/oidc-session-env.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.OIDC_SESSION_REQUIRED_ENV_VARS = void 0;
+exports.loadOidcSessionOptionsFromEnv = loadOidcSessionOptionsFromEnv;
+const oidc_session_options_1 = require("./oidc-session-options");
+exports.OIDC_SESSION_REQUIRED_ENV_VARS = [
+    'OIDC_ISSUER_URL',
+    'OIDC_CLIENT_ID',
+    'OIDC_REDIRECT_URI',
+    'SESSION_COOKIE_NAME',
+];
+exports.OIDC_SESSION_OPTIONAL_ENV_VARS = [
+    'OIDC_CLIENT_SECRET',
+    'OIDC_POST_LOGOUT_REDIRECT_URI',
+    'OIDC_SCOPE',
+    'SESSION_COOKIE_SECURE',
+    'SESSION_COOKIE_DOMAIN',
+    'SESSION_COOKIE_SAME_SITE',
+    'SESSION_COOKIE_PATH',
+    'SESSION_IDLE_TTL_SECONDS',
+    'SESSION_ABSOLUTE_TTL_SECONDS',
+    'SESSION_REFRESH_LEAD_SECONDS',
+    'SESSION_REFRESH_WAIT_MS',
+    'SESSION_KEY_PREFIX',
+];
+const DEFAULT_IDLE_TTL_SECONDS = 8 * 60 * 60;
+const DEFAULT_ABSOLUTE_TTL_SECONDS = 24 * 60 * 60;
+const DEFAULT_REFRESH_LEAD_SECONDS = 60;
+const DEFAULT_REFRESH_WAIT_MS = 2_000;
+const DEFAULT_KEY_PREFIX = 'oidc-session';
+const DEFAULT_COOKIE_PATH = '/';
+const DEFAULT_SAME_SITE = 'lax';
+const SAME_SITE_VALUES = ['lax', 'strict', 'none'];
+function loadOidcSessionOptionsFromEnv(read) {
+    const clientSecret = optional(read, 'OIDC_CLIENT_SECRET');
+    const postLogoutRedirectUri = optional(read, 'OIDC_POST_LOGOUT_REDIRECT_URI');
+    const cookieDomain = optional(read, 'SESSION_COOKIE_DOMAIN');
+    const options = {
+        oidc: {
+            issuerUrl: required(read, 'OIDC_ISSUER_URL'),
+            clientId: required(read, 'OIDC_CLIENT_ID'),
+            ...(clientSecret === undefined ? {} : { clientSecret }),
+            redirectUri: required(read, 'OIDC_REDIRECT_URI'),
+            ...(postLogoutRedirectUri === undefined ? {} : { postLogoutRedirectUri }),
+            scope: withRequiredScope(optional(read, 'OIDC_SCOPE') ?? oidc_session_options_1.REQUIRED_OIDC_SCOPE),
+        },
+        cookie: {
+            name: required(read, 'SESSION_COOKIE_NAME'),
+            secure: readBoolean(read, 'SESSION_COOKIE_SECURE', true),
+            ...(cookieDomain === undefined ? {} : { domain: cookieDomain }),
+            path: optional(read, 'SESSION_COOKIE_PATH') ?? DEFAULT_COOKIE_PATH,
+            sameSite: readSameSite(read, 'SESSION_COOKIE_SAME_SITE', DEFAULT_SAME_SITE),
+        },
+        ttl: {
+            idleTtlSeconds: readPositiveNumber(read, 'SESSION_IDLE_TTL_SECONDS', DEFAULT_IDLE_TTL_SECONDS),
+            absoluteTtlSeconds: readPositiveNumber(read, 'SESSION_ABSOLUTE_TTL_SECONDS', DEFAULT_ABSOLUTE_TTL_SECONDS),
+            refreshLeadSeconds: readPositiveNumber(read, 'SESSION_REFRESH_LEAD_SECONDS', DEFAULT_REFRESH_LEAD_SECONDS),
+            refreshWaitMs: readPositiveNumber(read, 'SESSION_REFRESH_WAIT_MS', DEFAULT_REFRESH_WAIT_MS),
+        },
+        keyPrefix: optional(read, 'SESSION_KEY_PREFIX') ?? DEFAULT_KEY_PREFIX,
+    };
+    return (0, oidc_session_options_1.assertOidcSessionOptions)(options);
+}
+function optional(read, name) {
+    const raw = read(name);
+    if (raw === undefined || raw.trim() === '') {
+        return undefined;
+    }
+    return raw.trim();
+}
+function required(read, name) {
+    const value = optional(read, name);
+    if (value === undefined) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${name} is required and is unset or empty. It has no safe default: ` +
+            'without it this application cannot complete a sign-in.');
+    }
+    return value;
+}
+function withRequiredScope(scope) {
+    const parts = scope.split(/\s+/u).filter((part) => part !== '');
+    if (parts.includes(oidc_session_options_1.REQUIRED_OIDC_SCOPE)) {
+        return parts.join(' ');
+    }
+    return [oidc_session_options_1.REQUIRED_OIDC_SCOPE, ...parts].join(' ');
+}
+function readBoolean(read, name, fallback) {
+    const raw = optional(read, name);
+    if (raw === undefined) {
+        return fallback;
+    }
+    const lowered = raw.toLowerCase();
+    if (lowered === 'true') {
+        return true;
+    }
+    if (lowered === 'false') {
+        return false;
+    }
+    throw new oidc_session_options_1.OidcSessionConfigError(`${name} must be "true" or "false"; got "${raw}".`);
+}
+function readPositiveNumber(read, name, fallback) {
+    const raw = optional(read, name);
+    if (raw === undefined) {
+        return fallback;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${name} must be a positive number; got "${raw}".`);
+    }
+    return parsed;
+}
+function readSameSite(read, name, fallback) {
+    const raw = optional(read, name);
+    if (raw === undefined) {
+        return fallback;
+    }
+    const lowered = raw.toLowerCase();
+    const match = SAME_SITE_VALUES.find((value) => value === lowered);
+    if (match === undefined) {
+        throw new oidc_session_options_1.OidcSessionConfigError(`${name} must be one of ${SAME_SITE_VALUES.join(', ')}; got "${raw}".`);
+    }
+    return match;
+}
+//# sourceMappingURL=oidc-session-env.js.map

package/dist/config/oidc-session-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-env.js","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":";;;AA4EA,sEAiDC;AAhHD,iEAKgC;AAanB,QAAA,8BAA8B,GAAsB;IAC/D,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAOW,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,+BAA+B;IAC/B,YAAY;IACZ,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,8BAA8B;IAC9B,yBAAyB;IACzB,oBAAoB;CACrB,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAU5D,SAAgB,6BAA6B,CAC3C,IAAe;IAEf,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAuB;QAClC,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC5C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC1C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;YAChD,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;YACzE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,0CAAmB,CAAC;SAC9E;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC;YACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/D,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,CAAC;SAC5E;QACD,GAAG,EAAE;YACH,cAAc,EAAE,kBAAkB,CAChC,IAAI,EACJ,0BAA0B,EAC1B,wBAAwB,CACzB;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,aAAa,EAAE,kBAAkB,CAC/B,IAAI,EACJ,yBAAyB,EACzB,uBAAuB,CACxB;SACF;QACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,kBAAkB;KACtE,CAAC;IAEF,OAAO,IAAA,+CAAwB,EAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,8DAA8D;YACnE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,0CAAmB,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,0CAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AASD,SAAS,WAAW,CAAC,IAAe,EAAE,IAAY,EAAE,QAAiB;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,IAAY,EACZ,QAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/config/oidc-session-options.d.ts

@@ -0,0 +1,33 @@
+export interface OidcProviderOptions {
+    readonly issuerUrl: string;
+    readonly clientId: string;
+    readonly clientSecret?: string;
+    readonly redirectUri: string;
+    readonly postLogoutRedirectUri?: string;
+    readonly scope: string;
+}
+export interface SessionCookieOptions {
+    readonly name: string;
+    readonly secure: boolean;
+    readonly domain?: string;
+    readonly path: string;
+    readonly sameSite: 'lax' | 'strict' | 'none';
+}
+export interface SessionTtlOptions {
+    readonly idleTtlSeconds: number;
+    readonly absoluteTtlSeconds: number;
+    readonly refreshLeadSeconds: number;
+    readonly refreshWaitMs: number;
+}
+export interface OidcSessionOptions {
+    readonly oidc: OidcProviderOptions;
+    readonly cookie: SessionCookieOptions;
+    readonly ttl: SessionTtlOptions;
+    readonly keyPrefix: string;
+}
+export declare class OidcSessionConfigError extends Error {
+    constructor(message: string);
+}
+export declare const REQUIRED_OIDC_SCOPE = "openid";
+export declare function assertOidcSessionOptions(options: OidcSessionOptions): OidcSessionOptions;
+//# sourceMappingURL=oidc-session-options.d.ts.map

package/dist/config/oidc-session-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-options.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,mBAAmB;IAQlC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAM/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAKxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAOtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC9C;AAGD,MAAM,WAAW,iBAAiB;IAMhC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAKhC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAMpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAOpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAMhC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAGD,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAU5C,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CAwDpB"}

package/dist/config/oidc-session-options.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = void 0;
+exports.assertOidcSessionOptions = assertOidcSessionOptions;
+class OidcSessionConfigError extends Error {
+    constructor(message) {
+        super(`[oidc-session-nest] ${message}`);
+        this.name = 'OidcSessionConfigError';
+    }
+}
+exports.OidcSessionConfigError = OidcSessionConfigError;
+exports.REQUIRED_OIDC_SCOPE = 'openid';
+function assertOidcSessionOptions(options) {
+    const { oidc, cookie, ttl, keyPrefix } = options;
+    for (const [name, value] of [
+        ['issuerUrl', oidc.issuerUrl],
+        ['clientId', oidc.clientId],
+        ['redirectUri', oidc.redirectUri],
+        ['cookie.name', cookie.name],
+        ['keyPrefix', keyPrefix],
+    ]) {
+        if (typeof value !== 'string' || value.trim() === '') {
+            throw new OidcSessionConfigError(`${name} must be a non-empty string.`);
+        }
+    }
+    assertAbsoluteHttpUrl('issuerUrl', oidc.issuerUrl);
+    assertAbsoluteHttpUrl('redirectUri', oidc.redirectUri);
+    if (oidc.postLogoutRedirectUri !== undefined) {
+        assertAbsoluteHttpUrl('postLogoutRedirectUri', oidc.postLogoutRedirectUri);
+    }
+    if (!oidc.scope.split(/\s+/u).includes(exports.REQUIRED_OIDC_SCOPE)) {
+        throw new OidcSessionConfigError(`scope must include "${exports.REQUIRED_OIDC_SCOPE}"; got "${oidc.scope}".`);
+    }
+    for (const [name, value] of [
+        ['ttl.idleTtlSeconds', ttl.idleTtlSeconds],
+        ['ttl.absoluteTtlSeconds', ttl.absoluteTtlSeconds],
+        ['ttl.refreshLeadSeconds', ttl.refreshLeadSeconds],
+        ['ttl.refreshWaitMs', ttl.refreshWaitMs],
+    ]) {
+        if (!Number.isFinite(value) || value <= 0) {
+            throw new OidcSessionConfigError(`${name} must be a positive finite number; got ${String(value)}.`);
+        }
+    }
+    if (ttl.idleTtlSeconds > ttl.absoluteTtlSeconds) {
+        throw new OidcSessionConfigError(`ttl.idleTtlSeconds (${ttl.idleTtlSeconds}) exceeds ttl.absoluteTtlSeconds ` +
+            `(${ttl.absoluteTtlSeconds}), so the idle window could never be reached. ` +
+            'Lower the idle TTL or raise the absolute one.');
+    }
+    if (cookie.sameSite === 'none' && !cookie.secure) {
+        throw new OidcSessionConfigError('cookie.sameSite "none" requires cookie.secure — browsers reject the pair, ' +
+            'so the session cookie would be silently dropped on every response.');
+    }
+    return options;
+}
+function assertAbsoluteHttpUrl(name, value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new OidcSessionConfigError(`${name} must be an absolute URL; got "${value}".`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new OidcSessionConfigError(`${name} must be http or https; got "${parsed.protocol}".`);
+    }
+}
+//# sourceMappingURL=oidc-session-options.js.map

package/dist/config/oidc-session-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-session-options.js","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":";;;AA4HA,4DA0DC;AA5ED,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAGY,QAAA,mBAAmB,GAAG,QAAQ,CAAC;AAU5C,SAAgB,wBAAwB,CACtC,OAA2B;IAE3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,sBAAsB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAAmB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,2BAAmB,WAAW,IAAI,CAAC,KAAK,IAAI,CACpE,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC;QAC1C,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,0CAA0C,MAAM,CAAC,KAAK,CAAC,GAAG,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,GAAG,CAAC,cAAc,mCAAmC;YAC1E,IAAI,GAAG,CAAC,kBAAkB,gDAAgD;YAC1E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAC9B,4EAA4E;YAC1E,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,GAAG,IAAI,kCAAkC,KAAK,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,sBAAsB,CAC9B,GAAG,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,37 @@
+import { HttpException, HttpStatus } from '@nestjs/common';
+export declare enum OidcSessionErrorCode {
+    SessionRequired = "SESSION_REQUIRED",
+    SessionExpired = "SESSION_EXPIRED",
+    OidcCallbackRejected = "OIDC_CALLBACK_REJECTED",
+    OidcLoginStateUnknown = "OIDC_LOGIN_STATE_UNKNOWN",
+    OidcTokenEndpointFailed = "OIDC_TOKEN_ENDPOINT_FAILED",
+    SessionRefreshContended = "SESSION_REFRESH_CONTENDED"
+}
+export interface OidcSessionErrorBody {
+    readonly code: OidcSessionErrorCode;
+    readonly title: string;
+    readonly detail: string;
+}
+export declare class OidcSessionError extends HttpException {
+    readonly code: OidcSessionErrorCode;
+    constructor(code: OidcSessionErrorCode, status: HttpStatus, title: string, detail: string);
+}
+export declare class SessionRequiredError extends OidcSessionError {
+    constructor(detail?: string);
+}
+export declare class SessionExpiredError extends OidcSessionError {
+    constructor(detail?: string);
+}
+export declare class OidcCallbackRejectedError extends OidcSessionError {
+    constructor(detail: string);
+}
+export declare class OidcLoginStateUnknownError extends OidcSessionError {
+    constructor(detail?: string);
+}
+export declare class OidcTokenEndpointFailedError extends OidcSessionError {
+    constructor(detail: string);
+}
+export declare class SessionRefreshContendedError extends OidcSessionError {
+    constructor(detail?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAM3D,oBAAY,oBAAoB;IAE9B,eAAe,qBAAqB;IAOpC,cAAc,oBAAoB;IAElC,oBAAoB,2BAA2B;IAM/C,qBAAqB,6BAA6B;IAMlD,uBAAuB,+BAA+B;IAMtD,uBAAuB,8BAA8B;CACtD;AAGD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;IACjD,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAGlC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM;CAYjB;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;gBAC5C,MAAM,SAAgD;CAQnE;AAED,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,MAAM,SAAsD;CAQzE;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;gBACjD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,0BAA2B,SAAQ,gBAAgB;gBAE5D,MAAM,SAAgF;CASzF;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBACpD,MAAM,EAAE,MAAM;CAQ3B;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;gBAE9D,MAAM,SAA+D;CASxE"}

package/dist/errors.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRefreshContendedError = exports.OidcTokenEndpointFailedError = exports.OidcLoginStateUnknownError = exports.OidcCallbackRejectedError = exports.SessionExpiredError = exports.SessionRequiredError = exports.OidcSessionError = exports.OidcSessionErrorCode = void 0;
+const common_1 = require("@nestjs/common");
+var OidcSessionErrorCode;
+(function (OidcSessionErrorCode) {
+    OidcSessionErrorCode["SessionRequired"] = "SESSION_REQUIRED";
+    OidcSessionErrorCode["SessionExpired"] = "SESSION_EXPIRED";
+    OidcSessionErrorCode["OidcCallbackRejected"] = "OIDC_CALLBACK_REJECTED";
+    OidcSessionErrorCode["OidcLoginStateUnknown"] = "OIDC_LOGIN_STATE_UNKNOWN";
+    OidcSessionErrorCode["OidcTokenEndpointFailed"] = "OIDC_TOKEN_ENDPOINT_FAILED";
+    OidcSessionErrorCode["SessionRefreshContended"] = "SESSION_REFRESH_CONTENDED";
+})(OidcSessionErrorCode || (exports.OidcSessionErrorCode = OidcSessionErrorCode = {}));
+class OidcSessionError extends common_1.HttpException {
+    code;
+    constructor(code, status, title, detail) {
+        const body = { code, title, detail };
+        super(body, status);
+        this.code = code;
+        this.message = detail;
+    }
+}
+exports.OidcSessionError = OidcSessionError;
+class SessionRequiredError extends OidcSessionError {
+    constructor(detail = 'This endpoint requires a signed-in session.') {
+        super(OidcSessionErrorCode.SessionRequired, common_1.HttpStatus.UNAUTHORIZED, 'Session required', detail);
+    }
+}
+exports.SessionRequiredError = SessionRequiredError;
+class SessionExpiredError extends OidcSessionError {
+    constructor(detail = 'The session has ended. Sign in again to continue.') {
+        super(OidcSessionErrorCode.SessionExpired, common_1.HttpStatus.UNAUTHORIZED, 'Session expired', detail);
+    }
+}
+exports.SessionExpiredError = SessionExpiredError;
+class OidcCallbackRejectedError extends OidcSessionError {
+    constructor(detail) {
+        super(OidcSessionErrorCode.OidcCallbackRejected, common_1.HttpStatus.BAD_REQUEST, 'Sign-in was rejected', detail);
+    }
+}
+exports.OidcCallbackRejectedError = OidcCallbackRejectedError;
+class OidcLoginStateUnknownError extends OidcSessionError {
+    constructor(detail = 'This sign-in attempt is unknown, already used, or has expired. Start again.') {
+        super(OidcSessionErrorCode.OidcLoginStateUnknown, common_1.HttpStatus.BAD_REQUEST, 'Unknown sign-in attempt', detail);
+    }
+}
+exports.OidcLoginStateUnknownError = OidcLoginStateUnknownError;
+class OidcTokenEndpointFailedError extends OidcSessionError {
+    constructor(detail) {
+        super(OidcSessionErrorCode.OidcTokenEndpointFailed, common_1.HttpStatus.BAD_GATEWAY, 'Identity provider unavailable', detail);
+    }
+}
+exports.OidcTokenEndpointFailedError = OidcTokenEndpointFailedError;
+class SessionRefreshContendedError extends OidcSessionError {
+    constructor(detail = 'Another request is refreshing this session. Retry shortly.') {
+        super(OidcSessionErrorCode.SessionRefreshContended, common_1.HttpStatus.SERVICE_UNAVAILABLE, 'Session refresh in progress', detail);
+    }
+}
+exports.SessionRefreshContendedError = SessionRefreshContendedError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAyBA,2CAA2D;AAM3D,IAAY,oBA8BX;AA9BD,WAAY,oBAAoB;IAE9B,4DAAoC,CAAA;IAOpC,0DAAkC,CAAA;IAElC,uEAA+C,CAAA;IAM/C,0EAAkD,CAAA;IAMlD,8EAAsD,CAAA;IAMtD,6EAAqD,CAAA;AACvD,CAAC,EA9BW,oBAAoB,oCAApB,oBAAoB,QA8B/B;AAUD,MAAa,gBAAiB,SAAQ,sBAAa;IACxC,IAAI,CAAuB;IAEpC,YACE,IAA0B,EAC1B,MAAkB,EAClB,KAAa,EACb,MAAc;QAEd,MAAM,IAAI,GAAyB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QAMjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;CACF;AAnBD,4CAmBC;AAED,MAAa,oBAAqB,SAAQ,gBAAgB;IACxD,YAAY,MAAM,GAAG,6CAA6C;QAChE,KAAK,CACH,oBAAoB,CAAC,eAAe,EACpC,mBAAU,CAAC,YAAY,EACvB,kBAAkB,EAClB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oDASC;AAED,MAAa,mBAAoB,SAAQ,gBAAgB;IACvD,YAAY,MAAM,GAAG,mDAAmD;QACtE,KAAK,CACH,oBAAoB,CAAC,cAAc,EACnC,mBAAU,CAAC,YAAY,EACvB,iBAAiB,EACjB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,kDASC;AAED,MAAa,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,oBAAoB,EACzC,mBAAU,CAAC,WAAW,EACtB,sBAAsB,EACtB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,8DASC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YACE,MAAM,GAAG,6EAA6E;QAEtF,KAAK,CACH,oBAAoB,CAAC,qBAAqB,EAC1C,mBAAU,CAAC,WAAW,EACtB,yBAAyB,EACzB,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,gEAWC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YAAY,MAAc;QACxB,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,WAAW,EACtB,+BAA+B,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AATD,oEASC;AAED,MAAa,4BAA6B,SAAQ,gBAAgB;IAChE,YACE,MAAM,GAAG,4DAA4D;QAErE,KAAK,CACH,oBAAoB,CAAC,uBAAuB,EAC5C,mBAAU,CAAC,mBAAmB,EAC9B,6BAA6B,EAC7B,MAAM,CACP,CAAC;IACJ,CAAC;CACF;AAXD,oEAWC"}