@yaotoshi/auth-sdk 0.1.1 → 0.1.2

package/dist/index.cjs

@@ -194,13 +194,21 @@ var YaotoshiAuth = class {
   logout() {
     const token = this.getAccessToken();
     this.storage.clearAll();
-    const params = new URLSearchParams();
-    if (token) params.set("token", token);
-    if (this.config.clientId) params.set("client_id", this.config.clientId);
-    if (this.config.postLogoutRedirectUri) {
-      params.set("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
-    }
-    window.location.href = `${this.config.accountsUrl}/api/proxy/logout?${params.toString()}`;
+    const form = document.createElement("form");
+    form.method = "POST";
+    form.action = `${this.config.accountsUrl}/api/proxy/logout`;
+    const addField = (name, value) => {
+      const input = document.createElement("input");
+      input.type = "hidden";
+      input.name = name;
+      input.value = value;
+      form.appendChild(input);
+    };
+    if (token) addField("token", token);
+    if (this.config.clientId) addField("client_id", this.config.clientId);
+    if (this.config.postLogoutRedirectUri) addField("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
+    document.body.appendChild(form);
+    form.submit();
   }
   isAuthenticated() {
     return !!this.getAccessToken();

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { YaotoshiAuth } from './client';\nexport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n","function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const params = new URLSearchParams();\n    if (token) params.set('token', token);\n    if (this.config.clientId) params.set('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) {\n      params.set('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n    }\n\n    window.location.href = `${this.config.accountsUrl}/api/proxy/logout?${params.toString()}`;\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,MAAO,QAAO,IAAI,SAAS,KAAK;AACpC,QAAI,KAAK,OAAO,SAAU,QAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AACtE,QAAI,KAAK,OAAO,uBAAuB;AACrC,aAAO,IAAI,4BAA4B,KAAK,OAAO,qBAAqB;AAAA,IAC1E;AAEA,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,qBAAqB,OAAO,SAAS,CAAC;AAAA,EACzF;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { YaotoshiAuth } from './client';\nexport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n","function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const form = document.createElement('form');\n    form.method = 'POST';\n    form.action = `${this.config.accountsUrl}/api/proxy/logout`;\n\n    const addField = (name: string, value: string) => {\n      const input = document.createElement('input');\n      input.type = 'hidden';\n      input.name = name;\n      input.value = value;\n      form.appendChild(input);\n    };\n\n    if (token) addField('token', token);\n    if (this.config.clientId) addField('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) addField('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n\n    document.body.appendChild(form);\n    form.submit();\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,SAAK,SAAS;AACd,SAAK,SAAS,GAAG,KAAK,OAAO,WAAW;AAExC,UAAM,WAAW,CAAC,MAAc,UAAkB;AAChD,YAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,YAAM,OAAO;AACb,YAAM,OAAO;AACb,YAAM,QAAQ;AACd,WAAK,YAAY,KAAK;AAAA,IACxB;AAEA,QAAI,MAAO,UAAS,SAAS,KAAK;AAClC,QAAI,KAAK,OAAO,SAAU,UAAS,aAAa,KAAK,OAAO,QAAQ;AACpE,QAAI,KAAK,OAAO,sBAAuB,UAAS,4BAA4B,KAAK,OAAO,qBAAqB;AAE7G,aAAS,KAAK,YAAY,IAAI;AAC9B,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}

package/dist/index.js

@@ -168,13 +168,21 @@ var YaotoshiAuth = class {
   logout() {
     const token = this.getAccessToken();
     this.storage.clearAll();
-    const params = new URLSearchParams();
-    if (token) params.set("token", token);
-    if (this.config.clientId) params.set("client_id", this.config.clientId);
-    if (this.config.postLogoutRedirectUri) {
-      params.set("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
-    }
-    window.location.href = `${this.config.accountsUrl}/api/proxy/logout?${params.toString()}`;
+    const form = document.createElement("form");
+    form.method = "POST";
+    form.action = `${this.config.accountsUrl}/api/proxy/logout`;
+    const addField = (name, value) => {
+      const input = document.createElement("input");
+      input.type = "hidden";
+      input.name = name;
+      input.value = value;
+      form.appendChild(input);
+    };
+    if (token) addField("token", token);
+    if (this.config.clientId) addField("client_id", this.config.clientId);
+    if (this.config.postLogoutRedirectUri) addField("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
+    document.body.appendChild(form);
+    form.submit();
   }
   isAuthenticated() {
     return !!this.getAccessToken();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const params = new URLSearchParams();\n    if (token) params.set('token', token);\n    if (this.config.clientId) params.set('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) {\n      params.set('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n    }\n\n    window.location.href = `${this.config.accountsUrl}/api/proxy/logout?${params.toString()}`;\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,MAAO,QAAO,IAAI,SAAS,KAAK;AACpC,QAAI,KAAK,OAAO,SAAU,QAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AACtE,QAAI,KAAK,OAAO,uBAAuB;AACrC,aAAO,IAAI,4BAA4B,KAAK,OAAO,qBAAqB;AAAA,IAC1E;AAEA,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,qBAAqB,OAAO,SAAS,CAAC;AAAA,EACzF;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}
+{"version":3,"sources":["../src/pkce.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["function generateRandomBytes(length: number): Uint8Array {\n  const array = new Uint8Array(length);\n  crypto.getRandomValues(array);\n  return array;\n}\n\nfunction base64UrlEncode(buffer: ArrayBuffer): string {\n  const bytes = new Uint8Array(buffer);\n  let binary = '';\n  for (let i = 0; i < bytes.length; i++) {\n    binary += String.fromCharCode(bytes[i]);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nexport function generateCodeVerifier(): string {\n  const bytes = generateRandomBytes(32);\n  return base64UrlEncode(bytes);\n}\n\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const data = encoder.encode(verifier);\n  const digest = await crypto.subtle.digest('SHA-256', data);\n  return base64UrlEncode(digest);\n}\n\nexport function generateState(): string {\n  const bytes = generateRandomBytes(16);\n  return base64UrlEncode(bytes);\n}\n","export class AuthStorage {\n  private prefix: string;\n\n  constructor(prefix = 'yaotoshi_auth') {\n    this.prefix = prefix;\n  }\n\n  private key(name: string): string {\n    return `${this.prefix}_${name}`;\n  }\n\n  get(name: string): string | null {\n    try {\n      return sessionStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  set(name: string, value: string): void {\n    try {\n      sessionStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  remove(name: string): void {\n    try {\n      sessionStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  getPersistent(name: string): string | null {\n    try {\n      return localStorage.getItem(this.key(name));\n    } catch {\n      return null;\n    }\n  }\n\n  setPersistent(name: string, value: string): void {\n    try {\n      localStorage.setItem(this.key(name), value);\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  removePersistent(name: string): void {\n    try {\n      localStorage.removeItem(this.key(name));\n    } catch {\n      // Storage unavailable\n    }\n  }\n\n  clearAll(): void {\n    this.remove('code_verifier');\n    this.remove('state');\n    this.removePersistent('access_token');\n  }\n}\n","import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce';\nimport { AuthStorage } from './storage';\nimport type { YaotoshiAuthConfig, TokenResponse, UserInfo, AuthResult } from './types';\n\nexport class YaotoshiAuth {\n  private config: Required<Pick<YaotoshiAuthConfig, 'clientId' | 'redirectUri' | 'accountsUrl'>> &\n    YaotoshiAuthConfig;\n  private storage: AuthStorage;\n\n  constructor(config: YaotoshiAuthConfig) {\n    this.config = {\n      scopes: ['openid', 'email'],\n      postLogoutRedirectUri: undefined,\n      storagePrefix: 'yaotoshi_auth',\n      ...config,\n    };\n    this.storage = new AuthStorage(this.config.storagePrefix);\n  }\n\n  async login(): Promise<void> {\n    const codeVerifier = generateCodeVerifier();\n    const codeChallenge = await generateCodeChallenge(codeVerifier);\n    const state = generateState();\n\n    this.storage.set('code_verifier', codeVerifier);\n    this.storage.set('state', state);\n\n    const params = new URLSearchParams({\n      response_type: 'code',\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      scope: (this.config.scopes ?? ['openid', 'email']).join(' '),\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    window.location.href = `${this.config.accountsUrl}/authorize?${params.toString()}`;\n  }\n\n  async handleCallback(): Promise<AuthResult> {\n    const params = new URLSearchParams(window.location.search);\n    const code = params.get('code');\n    const state = params.get('state');\n    const error = params.get('error');\n\n    if (error) {\n      throw new Error(`Authorization error: ${error}`);\n    }\n\n    if (!code || !state) {\n      throw new Error('Missing code or state in callback');\n    }\n\n    const savedState = this.storage.get('state');\n    if (state !== savedState) {\n      throw new Error('State mismatch — possible CSRF attack');\n    }\n\n    const codeVerifier = this.storage.get('code_verifier');\n    if (!codeVerifier) {\n      throw new Error('Missing code verifier — login flow may have been interrupted');\n    }\n\n    // Exchange code for token\n    const tokenResponse = await fetch(`${this.config.accountsUrl}/api/proxy/token`, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        grant_type: 'authorization_code',\n        code,\n        client_id: this.config.clientId,\n        redirect_uri: this.config.redirectUri,\n        code_verifier: codeVerifier,\n      }),\n    });\n\n    if (!tokenResponse.ok) {\n      const err = await tokenResponse.json().catch(() => ({}));\n      throw new Error(err.message || 'Token exchange failed');\n    }\n\n    const tokenData: TokenResponse = await tokenResponse.json();\n\n    // Clean up PKCE state\n    this.storage.remove('code_verifier');\n    this.storage.remove('state');\n\n    // Persist the access token\n    this.storage.setPersistent('access_token', tokenData.access_token);\n\n    // Fetch user info\n    const user = await this.getUser(tokenData.access_token);\n\n    return { accessToken: tokenData.access_token, user };\n  }\n\n  async getUser(token?: string): Promise<UserInfo> {\n    const accessToken = token || this.getAccessToken();\n    if (!accessToken) {\n      throw new Error('No access token available');\n    }\n\n    const response = await fetch(`${this.config.accountsUrl}/api/proxy/me`, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n\n    if (!response.ok) {\n      if (response.status === 401) {\n        this.storage.removePersistent('access_token');\n      }\n      throw new Error('Failed to fetch user info');\n    }\n\n    return response.json();\n  }\n\n  logout(): void {\n    const token = this.getAccessToken();\n    this.storage.clearAll();\n\n    const form = document.createElement('form');\n    form.method = 'POST';\n    form.action = `${this.config.accountsUrl}/api/proxy/logout`;\n\n    const addField = (name: string, value: string) => {\n      const input = document.createElement('input');\n      input.type = 'hidden';\n      input.name = name;\n      input.value = value;\n      form.appendChild(input);\n    };\n\n    if (token) addField('token', token);\n    if (this.config.clientId) addField('client_id', this.config.clientId);\n    if (this.config.postLogoutRedirectUri) addField('post_logout_redirect_uri', this.config.postLogoutRedirectUri);\n\n    document.body.appendChild(form);\n    form.submit();\n  }\n\n  isAuthenticated(): boolean {\n    return !!this.getAccessToken();\n  }\n\n  getAccessToken(): string | null {\n    return this.storage.getPersistent('access_token');\n  }\n}\n"],"mappings":";AAAA,SAAS,oBAAoB,QAA4B;AACvD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,SAAO,gBAAgB,KAAK;AAC5B,SAAO;AACT;AAEA,SAAS,gBAAgB,QAA6B;AACpD,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEO,SAAS,uBAA+B;AAC7C,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;AAEA,eAAsB,sBAAsB,UAAmC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AACzD,SAAO,gBAAgB,MAAM;AAC/B;AAEO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,oBAAoB,EAAE;AACpC,SAAO,gBAAgB,KAAK;AAC9B;;;AC9BO,IAAM,cAAN,MAAkB;AAAA,EAGvB,YAAY,SAAS,iBAAiB;AACpC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEQ,IAAI,MAAsB;AAChC,WAAO,GAAG,KAAK,MAAM,IAAI,IAAI;AAAA,EAC/B;AAAA,EAEA,IAAI,MAA6B;AAC/B,QAAI;AACF,aAAO,eAAe,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,IAAI,MAAc,OAAqB;AACrC,QAAI;AACF,qBAAe,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC9C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,OAAO,MAAoB;AACzB,QAAI;AACF,qBAAe,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IAC1C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,cAAc,MAA6B;AACzC,QAAI;AACF,aAAO,aAAa,QAAQ,KAAK,IAAI,IAAI,CAAC;AAAA,IAC5C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAc,MAAc,OAAqB;AAC/C,QAAI;AACF,mBAAa,QAAQ,KAAK,IAAI,IAAI,GAAG,KAAK;AAAA,IAC5C,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,iBAAiB,MAAoB;AACnC,QAAI;AACF,mBAAa,WAAW,KAAK,IAAI,IAAI,CAAC;AAAA,IACxC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,SAAK,OAAO,eAAe;AAC3B,SAAK,OAAO,OAAO;AACnB,SAAK,iBAAiB,cAAc;AAAA,EACtC;AACF;;;AC5DO,IAAM,eAAN,MAAmB;AAAA,EAKxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,MACZ,QAAQ,CAAC,UAAU,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,eAAe;AAAA,MACf,GAAG;AAAA,IACL;AACA,SAAK,UAAU,IAAI,YAAY,KAAK,OAAO,aAAa;AAAA,EAC1D;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,eAAe,qBAAqB;AAC1C,UAAM,gBAAgB,MAAM,sBAAsB,YAAY;AAC9D,UAAM,QAAQ,cAAc;AAE5B,SAAK,QAAQ,IAAI,iBAAiB,YAAY;AAC9C,SAAK,QAAQ,IAAI,SAAS,KAAK;AAE/B,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,eAAe;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO,UAAU,CAAC,UAAU,OAAO,GAAG,KAAK,GAAG;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,WAAO,SAAS,OAAO,GAAG,KAAK,OAAO,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,iBAAsC;AAC1C,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,UAAM,QAAQ,OAAO,IAAI,OAAO;AAEhC,QAAI,OAAO;AACT,YAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AAAA,IACjD;AAEA,QAAI,CAAC,QAAQ,CAAC,OAAO;AACnB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AAEA,UAAM,aAAa,KAAK,QAAQ,IAAI,OAAO;AAC3C,QAAI,UAAU,YAAY;AACxB,YAAM,IAAI,MAAM,4CAAuC;AAAA,IACzD;AAEA,UAAM,eAAe,KAAK,QAAQ,IAAI,eAAe;AACrD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,MAAM,mEAA8D;AAAA,IAChF;AAGA,UAAM,gBAAgB,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,oBAAoB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW,KAAK,OAAO;AAAA,QACvB,cAAc,KAAK,OAAO;AAAA,QAC1B,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,cAAc,IAAI;AACrB,YAAM,MAAM,MAAM,cAAc,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACvD,YAAM,IAAI,MAAM,IAAI,WAAW,uBAAuB;AAAA,IACxD;AAEA,UAAM,YAA2B,MAAM,cAAc,KAAK;AAG1D,SAAK,QAAQ,OAAO,eAAe;AACnC,SAAK,QAAQ,OAAO,OAAO;AAG3B,SAAK,QAAQ,cAAc,gBAAgB,UAAU,YAAY;AAGjE,UAAM,OAAO,MAAM,KAAK,QAAQ,UAAU,YAAY;AAEtD,WAAO,EAAE,aAAa,UAAU,cAAc,KAAK;AAAA,EACrD;AAAA,EAEA,MAAM,QAAQ,OAAmC;AAC/C,UAAM,cAAc,SAAS,KAAK,eAAe;AACjD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,WAAW,iBAAiB;AAAA,MACtE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,SAAS,WAAW,KAAK;AAC3B,aAAK,QAAQ,iBAAiB,cAAc;AAAA,MAC9C;AACA,YAAM,IAAI,MAAM,2BAA2B;AAAA,IAC7C;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,SAAe;AACb,UAAM,QAAQ,KAAK,eAAe;AAClC,SAAK,QAAQ,SAAS;AAEtB,UAAM,OAAO,SAAS,cAAc,MAAM;AAC1C,SAAK,SAAS;AACd,SAAK,SAAS,GAAG,KAAK,OAAO,WAAW;AAExC,UAAM,WAAW,CAAC,MAAc,UAAkB;AAChD,YAAM,QAAQ,SAAS,cAAc,OAAO;AAC5C,YAAM,OAAO;AACb,YAAM,OAAO;AACb,YAAM,QAAQ;AACd,WAAK,YAAY,KAAK;AAAA,IACxB;AAEA,QAAI,MAAO,UAAS,SAAS,KAAK;AAClC,QAAI,KAAK,OAAO,SAAU,UAAS,aAAa,KAAK,OAAO,QAAQ;AACpE,QAAI,KAAK,OAAO,sBAAuB,UAAS,4BAA4B,KAAK,OAAO,qBAAqB;AAE7G,aAAS,KAAK,YAAY,IAAI;AAC9B,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,kBAA2B;AACzB,WAAO,CAAC,CAAC,KAAK,eAAe;AAAA,EAC/B;AAAA,EAEA,iBAAgC;AAC9B,WAAO,KAAK,QAAQ,cAAc,cAAc;AAAA,EAClD;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaotoshi/auth-sdk",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Authentication SDK for Yaotoshi ecosystem apps",
   "license": "MIT",
   "type": "module",