@zskj-idaas/sdk 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 IDaaS Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,197 @@
+# @zskj-idaas/sdk
+
+IDaaS OIDC Client SDK — 适用于浏览器应用的 OpenID Connect 客户端，支持 Authorization Code Flow with PKCE。
+
+## 特性
+
+- **零运行时依赖** — 轻量、无外部依赖
+- **PKCE 支持** — 自动生成 code_verifier / code_challenge
+- **双模块输出** — 同时支持 ESM 和 CommonJS
+- **TypeScript** — 完整的类型定义
+- **OIDC Discovery** — 自动发现 OpenID 配置端点
+- **Token 管理** — 自动存储、过期检测、静默刷新
+- **认证 Fetch** — 内置带 Bearer Token 的 fetch 封装
+
+## 安装
+
+```bash
+npm install @zskj-idaas/sdk
+# 或
+pnpm add @zskj-idaas/sdk
+# 或
+yarn add @zskj-idaas/sdk
+```
+
+## 快速开始
+
+```typescript
+import { IdaasClient } from '@zskj-idaas/sdk';
+
+const client = new IdaasClient({
+  issuer: 'https://your-idaas-server.com',
+  clientId: 'your-client-id',
+  redirectUri: 'http://localhost:3000/callback',
+  scope: 'openid profile email',
+});
+
+// 初始化（自动发现 OIDC 端点）
+await client.init();
+
+// 发起登录
+await client.login();
+```
+
+## API 参考
+
+### `new IdaasClient(config)`
+
+创建 SDK 客户端实例。
+
+```typescript
+interface IdaasConfig {
+  issuer: string;               // OIDC 提供者地址
+  clientId: string;             // 客户端 ID
+  clientSecret?: string;        // 客户端密钥（机密客户端）
+  redirectUri: string;          // 登录回调地址
+  postLogoutRedirectUri?: string; // 登出后跳转地址
+  scope?: string;               // 请求的 scope（默认: 'openid profile email'）
+  autoDiscovery?: boolean;      // 是否自动发现端点（默认: true）
+  storagePrefix?: string;       // 存储 key 前缀（默认: 'idaas'）
+}
+```
+
+### `client.init(): Promise<AuthState>`
+
+初始化客户端，执行 OIDC Discovery 并返回当前认证状态。
+
+### `client.login(extraParams?): Promise<void>`
+
+发起 OIDC 授权码登录流程，跳转到授权端点。
+
+```typescript
+// 附加额外参数
+await client.login({ prompt: 'login', login_hint: 'user@example.com' });
+```
+
+### `client.handleCallback(callbackUrl?): Promise<TokenSet>`
+
+处理授权回调，用授权码交换 Token。
+
+```typescript
+// 在回调页面调用
+const tokens = await client.handleCallback();
+```
+
+### `client.getUserInfo(forceRefresh?): Promise<UserInfo | null>`
+
+获取当前用户信息。
+
+### `client.getAccessToken(): Promise<string | null>`
+
+获取有效的 Access Token（过期时自动刷新）。
+
+### `client.getIdToken(): string | null`
+
+获取 ID Token。
+
+### `client.getAuthState(): AuthState`
+
+获取当前认证状态。
+
+```typescript
+interface AuthState {
+  isAuthenticated: boolean;
+  user: UserInfo | null;
+  accessToken: string | null;
+  idToken: string | null;
+  expiresAt: number | null;
+}
+```
+
+### `client.isAuthenticated(): boolean`
+
+检查是否已认证。
+
+### `client.logout(): Promise<void>`
+
+执行 OIDC 登出流程。
+
+### `client.revokeToken(): Promise<void>`
+
+撤销 Refresh Token。
+
+### `client.fetch(url, init?): Promise<Response>`
+
+带认证的 fetch 封装，自动附加 Authorization 头。
+
+```typescript
+const res = await client.fetch('/api/protected-resource');
+const data = await res.json();
+```
+
+## 完整示例
+
+```typescript
+import { IdaasClient } from '@zskj-idaas/sdk';
+import type { AuthState, UserInfo } from '@zskj-idaas/sdk';
+
+const client = new IdaasClient({
+  issuer: 'https://idaas.example.com',
+  clientId: 'my-app',
+  redirectUri: `${window.location.origin}/callback`,
+  postLogoutRedirectUri: window.location.origin,
+});
+
+// 应用启动时初始化
+async function bootstrap() {
+  const state: AuthState = await client.init();
+
+  if (state.isAuthenticated) {
+    const user: UserInfo | null = await client.getUserInfo();
+    console.log('已登录:', user?.name);
+  }
+}
+
+// 回调页面处理
+async function handleCallback() {
+  try {
+    await client.handleCallback();
+    window.location.href = '/';
+  } catch (err) {
+    console.error('登录失败:', err);
+  }
+}
+
+// 调用受保护的 API
+async function fetchData() {
+  const res = await client.fetch('https://api.example.com/data');
+  return res.json();
+}
+```
+
+## 导出内容
+
+```typescript
+// 类
+export { IdaasClient } from './client';
+export { TokenStorage } from './storage';
+
+// 工具函数
+export { createPKCE, generateState, generateNonce } from './crypto';
+
+// 类型
+export type { IdaasConfig, TokenSet, UserInfo, AuthState } from './types';
+```
+
+## 浏览器兼容性
+
+需要支持 Web Crypto API 的现代浏览器：
+
+- Chrome 63+
+- Firefox 57+
+- Safari 11.1+
+- Edge 79+
+
+## License
+
+MIT

package/dist/index.d.mts

@@ -0,0 +1,89 @@
+interface IdaasConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    postLogoutRedirectUri?: string;
+    scope?: string;
+    /** Auto-discover OIDC endpoints from issuer */
+    autoDiscovery?: boolean;
+    /** Storage key prefix */
+    storagePrefix?: string;
+}
+interface TokenSet {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    id_token?: string;
+    refresh_token?: string;
+    scope: string;
+}
+interface UserInfo {
+    sub: string;
+    preferred_username?: string;
+    name?: string;
+    email?: string;
+    phone_number?: string;
+    picture?: string;
+    roles?: string[];
+    [key: string]: unknown;
+}
+interface AuthState {
+    isAuthenticated: boolean;
+    user: UserInfo | null;
+    accessToken: string | null;
+    idToken: string | null;
+    expiresAt: number | null;
+}
+interface PKCEPair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+
+declare class IdaasClient {
+    private config;
+    private endpoints;
+    private storage;
+    private userInfo;
+    constructor(config: IdaasConfig);
+    init(): Promise<AuthState>;
+    private discover;
+    login(extraParams?: Record<string, string>): Promise<void>;
+    handleCallback(callbackUrl?: string): Promise<TokenSet>;
+    refreshToken(): Promise<TokenSet | null>;
+    getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
+    getAccessToken(): Promise<string | null>;
+    getIdToken(): string | null;
+    getAuthState(): AuthState;
+    isAuthenticated(): boolean;
+    logout(): Promise<void>;
+    revokeToken(): Promise<void>;
+    /** Create an authenticated fetch wrapper */
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+}
+
+declare function createPKCE(): Promise<PKCEPair>;
+declare function generateState(): string;
+declare function generateNonce(): string;
+
+declare class TokenStorage {
+    private prefix;
+    constructor(prefix?: string);
+    private key;
+    saveTokens(tokens: TokenSet): void;
+    getAccessToken(): string | null;
+    getIdToken(): string | null;
+    getRefreshToken(): string | null;
+    getExpiresAt(): number | null;
+    isTokenExpired(): boolean;
+    clear(): void;
+    saveState(state: string): void;
+    getState(): string | null;
+    saveCodeVerifier(verifier: string): void;
+    getCodeVerifier(): string | null;
+    saveNonce(nonce: string): void;
+    getNonce(): string | null;
+    clearAuthState(): void;
+}
+
+export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.d.ts

@@ -0,0 +1,89 @@
+interface IdaasConfig {
+    issuer: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    postLogoutRedirectUri?: string;
+    scope?: string;
+    /** Auto-discover OIDC endpoints from issuer */
+    autoDiscovery?: boolean;
+    /** Storage key prefix */
+    storagePrefix?: string;
+}
+interface TokenSet {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    id_token?: string;
+    refresh_token?: string;
+    scope: string;
+}
+interface UserInfo {
+    sub: string;
+    preferred_username?: string;
+    name?: string;
+    email?: string;
+    phone_number?: string;
+    picture?: string;
+    roles?: string[];
+    [key: string]: unknown;
+}
+interface AuthState {
+    isAuthenticated: boolean;
+    user: UserInfo | null;
+    accessToken: string | null;
+    idToken: string | null;
+    expiresAt: number | null;
+}
+interface PKCEPair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+
+declare class IdaasClient {
+    private config;
+    private endpoints;
+    private storage;
+    private userInfo;
+    constructor(config: IdaasConfig);
+    init(): Promise<AuthState>;
+    private discover;
+    login(extraParams?: Record<string, string>): Promise<void>;
+    handleCallback(callbackUrl?: string): Promise<TokenSet>;
+    refreshToken(): Promise<TokenSet | null>;
+    getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
+    getAccessToken(): Promise<string | null>;
+    getIdToken(): string | null;
+    getAuthState(): AuthState;
+    isAuthenticated(): boolean;
+    logout(): Promise<void>;
+    revokeToken(): Promise<void>;
+    /** Create an authenticated fetch wrapper */
+    fetch(url: string, init?: RequestInit): Promise<Response>;
+}
+
+declare function createPKCE(): Promise<PKCEPair>;
+declare function generateState(): string;
+declare function generateNonce(): string;
+
+declare class TokenStorage {
+    private prefix;
+    constructor(prefix?: string);
+    private key;
+    saveTokens(tokens: TokenSet): void;
+    getAccessToken(): string | null;
+    getIdToken(): string | null;
+    getRefreshToken(): string | null;
+    getExpiresAt(): number | null;
+    isTokenExpired(): boolean;
+    clear(): void;
+    saveState(state: string): void;
+    getState(): string | null;
+    saveCodeVerifier(verifier: string): void;
+    getCodeVerifier(): string | null;
+    saveNonce(nonce: string): void;
+    getNonce(): string | null;
+    clearAuthState(): void;
+}
+
+export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.js

@@ -0,0 +1,344 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  IdaasClient: () => IdaasClient,
+  TokenStorage: () => TokenStorage,
+  createPKCE: () => createPKCE,
+  generateNonce: () => generateNonce,
+  generateState: () => generateState
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/crypto.ts
+function generateRandomString(length) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").substring(0, length);
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  bytes.forEach((b) => {
+    binary += String.fromCharCode(b);
+  });
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createPKCE() {
+  const codeVerifier = generateRandomString(64);
+  const encoder = new TextEncoder();
+  const data = encoder.encode(codeVerifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const codeChallenge = base64UrlEncode(digest);
+  return { codeVerifier, codeChallenge };
+}
+function generateState() {
+  return generateRandomString(32);
+}
+function generateNonce() {
+  return generateRandomString(32);
+}
+
+// src/storage.ts
+var TokenStorage = class {
+  constructor(prefix = "idaas") {
+    this.prefix = prefix;
+  }
+  key(name) {
+    return `${this.prefix}:${name}`;
+  }
+  saveTokens(tokens) {
+    const expiresAt = Date.now() + tokens.expires_in * 1e3;
+    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
+    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    if (tokens.id_token) {
+      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+    }
+    if (tokens.refresh_token) {
+      localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
+    }
+    sessionStorage.setItem(this.key("scope"), tokens.scope);
+  }
+  getAccessToken() {
+    const token = sessionStorage.getItem(this.key("access_token"));
+    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    if (!token || !expiresAt) return null;
+    if (Date.now() > parseInt(expiresAt, 10)) return null;
+    return token;
+  }
+  getIdToken() {
+    return sessionStorage.getItem(this.key("id_token"));
+  }
+  getRefreshToken() {
+    return localStorage.getItem(this.key("refresh_token"));
+  }
+  getExpiresAt() {
+    const val = sessionStorage.getItem(this.key("expires_at"));
+    return val ? parseInt(val, 10) : null;
+  }
+  isTokenExpired() {
+    const expiresAt = this.getExpiresAt();
+    if (!expiresAt) return true;
+    return Date.now() > expiresAt - 6e4;
+  }
+  clear() {
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("id_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
+    sessionStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
+  }
+  saveState(state) {
+    sessionStorage.setItem(this.key("state"), state);
+  }
+  getState() {
+    return sessionStorage.getItem(this.key("state"));
+  }
+  saveCodeVerifier(verifier) {
+    sessionStorage.setItem(this.key("code_verifier"), verifier);
+  }
+  getCodeVerifier() {
+    return sessionStorage.getItem(this.key("code_verifier"));
+  }
+  saveNonce(nonce) {
+    sessionStorage.setItem(this.key("nonce"), nonce);
+  }
+  getNonce() {
+    return sessionStorage.getItem(this.key("nonce"));
+  }
+  clearAuthState() {
+    sessionStorage.removeItem(this.key("state"));
+    sessionStorage.removeItem(this.key("code_verifier"));
+    sessionStorage.removeItem(this.key("nonce"));
+  }
+};
+
+// src/client.ts
+var IdaasClient = class {
+  constructor(config) {
+    this.endpoints = null;
+    this.userInfo = null;
+    this.config = {
+      scope: "openid profile email",
+      autoDiscovery: true,
+      storagePrefix: "idaas",
+      ...config
+    };
+    this.storage = new TokenStorage(this.config.storagePrefix);
+  }
+  async init() {
+    if (this.config.autoDiscovery) {
+      await this.discover();
+    } else {
+      this.endpoints = {
+        authorization_endpoint: `${this.config.issuer}/oauth2/authorize`,
+        token_endpoint: `${this.config.issuer}/oauth2/token`,
+        userinfo_endpoint: `${this.config.issuer}/oauth2/userinfo`,
+        end_session_endpoint: `${this.config.issuer}/oauth2/logout`,
+        jwks_uri: `${this.config.issuer}/.well-known/jwks.json`,
+        revocation_endpoint: `${this.config.issuer}/oauth2/revoke`,
+        introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
+      };
+    }
+    return this.getAuthState();
+  }
+  async discover() {
+    const res = await fetch(`${this.config.issuer}/.well-known/openid-configuration`);
+    if (!res.ok) throw new Error("Failed to fetch OIDC discovery document");
+    const doc = await res.json();
+    this.endpoints = {
+      authorization_endpoint: doc.authorization_endpoint,
+      token_endpoint: doc.token_endpoint,
+      userinfo_endpoint: doc.userinfo_endpoint,
+      end_session_endpoint: doc.end_session_endpoint,
+      jwks_uri: doc.jwks_uri,
+      revocation_endpoint: doc.revocation_endpoint,
+      introspection_endpoint: doc.introspection_endpoint
+    };
+  }
+  async login(extraParams) {
+    if (!this.endpoints) await this.init();
+    const { codeVerifier, codeChallenge } = await createPKCE();
+    const state = generateState();
+    const nonce = generateNonce();
+    this.storage.saveCodeVerifier(codeVerifier);
+    this.storage.saveState(state);
+    this.storage.saveNonce(nonce);
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      scope: this.config.scope,
+      state,
+      nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      ...extraParams
+    });
+    window.location.href = `${this.endpoints.authorization_endpoint}?${params.toString()}`;
+  }
+  async handleCallback(callbackUrl) {
+    if (!this.endpoints) await this.init();
+    const url = new URL(callbackUrl || window.location.href);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const error = url.searchParams.get("error");
+    if (error) {
+      const desc = url.searchParams.get("error_description") || error;
+      throw new Error(desc);
+    }
+    if (!code) throw new Error("No authorization code in callback URL");
+    const savedState = this.storage.getState();
+    if (state !== savedState) {
+      throw new Error("State mismatch - possible CSRF attack");
+    }
+    const codeVerifier = this.storage.getCodeVerifier();
+    if (!codeVerifier) throw new Error("No code verifier found");
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: this.config.redirectUri,
+      client_id: this.config.clientId,
+      code_verifier: codeVerifier
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.endpoints.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({ error: "token_exchange_failed" }));
+      throw new Error(err.error_description || err.error || "Token exchange failed");
+    }
+    const tokens = await res.json();
+    this.storage.saveTokens(tokens);
+    this.storage.clearAuthState();
+    return tokens;
+  }
+  async refreshToken() {
+    if (!this.endpoints) await this.init();
+    const refreshToken = this.storage.getRefreshToken();
+    if (!refreshToken) return null;
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: this.config.clientId
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.endpoints.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      this.storage.clear();
+      return null;
+    }
+    const tokens = await res.json();
+    this.storage.saveTokens(tokens);
+    return tokens;
+  }
+  async getUserInfo(forceRefresh = false) {
+    if (!this.endpoints) await this.init();
+    if (this.userInfo && !forceRefresh) return this.userInfo;
+    const accessToken = await this.getAccessToken();
+    if (!accessToken) return null;
+    const res = await fetch(this.endpoints.userinfo_endpoint, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) return null;
+    this.userInfo = await res.json();
+    return this.userInfo;
+  }
+  async getAccessToken() {
+    let token = this.storage.getAccessToken();
+    if (token) return token;
+    if (this.storage.isTokenExpired()) {
+      const tokens = await this.refreshToken();
+      if (tokens) return tokens.access_token;
+    }
+    return null;
+  }
+  getIdToken() {
+    return this.storage.getIdToken();
+  }
+  getAuthState() {
+    const accessToken = this.storage.getAccessToken();
+    return {
+      isAuthenticated: !!accessToken,
+      user: this.userInfo,
+      accessToken,
+      idToken: this.storage.getIdToken(),
+      expiresAt: this.storage.getExpiresAt()
+    };
+  }
+  isAuthenticated() {
+    return !!this.storage.getAccessToken();
+  }
+  async logout() {
+    if (!this.endpoints) await this.init();
+    const idToken = this.storage.getIdToken();
+    this.storage.clear();
+    this.userInfo = null;
+    const params = new URLSearchParams();
+    if (idToken) params.set("id_token_hint", idToken);
+    if (this.config.postLogoutRedirectUri) {
+      params.set("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
+    }
+    window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
+  }
+  async revokeToken() {
+    if (!this.endpoints) await this.init();
+    const refreshToken = this.storage.getRefreshToken();
+    if (refreshToken) {
+      await fetch(this.endpoints.revocation_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token: refreshToken,
+          token_type_hint: "refresh_token"
+        }).toString()
+      });
+    }
+  }
+  /** Create an authenticated fetch wrapper */
+  async fetch(url, init) {
+    const token = await this.getAccessToken();
+    const headers = new Headers(init?.headers);
+    if (token) {
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    return fetch(url, { ...init, headers });
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdaasClient,
+  TokenStorage,
+  createPKCE,
+  generateNonce,
+  generateState
+});

package/dist/index.mjs

@@ -0,0 +1,313 @@
+// src/crypto.ts
+function generateRandomString(length) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("").substring(0, length);
+}
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  bytes.forEach((b) => {
+    binary += String.fromCharCode(b);
+  });
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createPKCE() {
+  const codeVerifier = generateRandomString(64);
+  const encoder = new TextEncoder();
+  const data = encoder.encode(codeVerifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  const codeChallenge = base64UrlEncode(digest);
+  return { codeVerifier, codeChallenge };
+}
+function generateState() {
+  return generateRandomString(32);
+}
+function generateNonce() {
+  return generateRandomString(32);
+}
+
+// src/storage.ts
+var TokenStorage = class {
+  constructor(prefix = "idaas") {
+    this.prefix = prefix;
+  }
+  key(name) {
+    return `${this.prefix}:${name}`;
+  }
+  saveTokens(tokens) {
+    const expiresAt = Date.now() + tokens.expires_in * 1e3;
+    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
+    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    if (tokens.id_token) {
+      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+    }
+    if (tokens.refresh_token) {
+      localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
+    }
+    sessionStorage.setItem(this.key("scope"), tokens.scope);
+  }
+  getAccessToken() {
+    const token = sessionStorage.getItem(this.key("access_token"));
+    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    if (!token || !expiresAt) return null;
+    if (Date.now() > parseInt(expiresAt, 10)) return null;
+    return token;
+  }
+  getIdToken() {
+    return sessionStorage.getItem(this.key("id_token"));
+  }
+  getRefreshToken() {
+    return localStorage.getItem(this.key("refresh_token"));
+  }
+  getExpiresAt() {
+    const val = sessionStorage.getItem(this.key("expires_at"));
+    return val ? parseInt(val, 10) : null;
+  }
+  isTokenExpired() {
+    const expiresAt = this.getExpiresAt();
+    if (!expiresAt) return true;
+    return Date.now() > expiresAt - 6e4;
+  }
+  clear() {
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("id_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
+    sessionStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
+  }
+  saveState(state) {
+    sessionStorage.setItem(this.key("state"), state);
+  }
+  getState() {
+    return sessionStorage.getItem(this.key("state"));
+  }
+  saveCodeVerifier(verifier) {
+    sessionStorage.setItem(this.key("code_verifier"), verifier);
+  }
+  getCodeVerifier() {
+    return sessionStorage.getItem(this.key("code_verifier"));
+  }
+  saveNonce(nonce) {
+    sessionStorage.setItem(this.key("nonce"), nonce);
+  }
+  getNonce() {
+    return sessionStorage.getItem(this.key("nonce"));
+  }
+  clearAuthState() {
+    sessionStorage.removeItem(this.key("state"));
+    sessionStorage.removeItem(this.key("code_verifier"));
+    sessionStorage.removeItem(this.key("nonce"));
+  }
+};
+
+// src/client.ts
+var IdaasClient = class {
+  constructor(config) {
+    this.endpoints = null;
+    this.userInfo = null;
+    this.config = {
+      scope: "openid profile email",
+      autoDiscovery: true,
+      storagePrefix: "idaas",
+      ...config
+    };
+    this.storage = new TokenStorage(this.config.storagePrefix);
+  }
+  async init() {
+    if (this.config.autoDiscovery) {
+      await this.discover();
+    } else {
+      this.endpoints = {
+        authorization_endpoint: `${this.config.issuer}/oauth2/authorize`,
+        token_endpoint: `${this.config.issuer}/oauth2/token`,
+        userinfo_endpoint: `${this.config.issuer}/oauth2/userinfo`,
+        end_session_endpoint: `${this.config.issuer}/oauth2/logout`,
+        jwks_uri: `${this.config.issuer}/.well-known/jwks.json`,
+        revocation_endpoint: `${this.config.issuer}/oauth2/revoke`,
+        introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
+      };
+    }
+    return this.getAuthState();
+  }
+  async discover() {
+    const res = await fetch(`${this.config.issuer}/.well-known/openid-configuration`);
+    if (!res.ok) throw new Error("Failed to fetch OIDC discovery document");
+    const doc = await res.json();
+    this.endpoints = {
+      authorization_endpoint: doc.authorization_endpoint,
+      token_endpoint: doc.token_endpoint,
+      userinfo_endpoint: doc.userinfo_endpoint,
+      end_session_endpoint: doc.end_session_endpoint,
+      jwks_uri: doc.jwks_uri,
+      revocation_endpoint: doc.revocation_endpoint,
+      introspection_endpoint: doc.introspection_endpoint
+    };
+  }
+  async login(extraParams) {
+    if (!this.endpoints) await this.init();
+    const { codeVerifier, codeChallenge } = await createPKCE();
+    const state = generateState();
+    const nonce = generateNonce();
+    this.storage.saveCodeVerifier(codeVerifier);
+    this.storage.saveState(state);
+    this.storage.saveNonce(nonce);
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      scope: this.config.scope,
+      state,
+      nonce,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      ...extraParams
+    });
+    window.location.href = `${this.endpoints.authorization_endpoint}?${params.toString()}`;
+  }
+  async handleCallback(callbackUrl) {
+    if (!this.endpoints) await this.init();
+    const url = new URL(callbackUrl || window.location.href);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    const error = url.searchParams.get("error");
+    if (error) {
+      const desc = url.searchParams.get("error_description") || error;
+      throw new Error(desc);
+    }
+    if (!code) throw new Error("No authorization code in callback URL");
+    const savedState = this.storage.getState();
+    if (state !== savedState) {
+      throw new Error("State mismatch - possible CSRF attack");
+    }
+    const codeVerifier = this.storage.getCodeVerifier();
+    if (!codeVerifier) throw new Error("No code verifier found");
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: this.config.redirectUri,
+      client_id: this.config.clientId,
+      code_verifier: codeVerifier
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.endpoints.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({ error: "token_exchange_failed" }));
+      throw new Error(err.error_description || err.error || "Token exchange failed");
+    }
+    const tokens = await res.json();
+    this.storage.saveTokens(tokens);
+    this.storage.clearAuthState();
+    return tokens;
+  }
+  async refreshToken() {
+    if (!this.endpoints) await this.init();
+    const refreshToken = this.storage.getRefreshToken();
+    if (!refreshToken) return null;
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: this.config.clientId
+    });
+    if (this.config.clientSecret) {
+      body.set("client_secret", this.config.clientSecret);
+    }
+    const res = await fetch(this.endpoints.token_endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!res.ok) {
+      this.storage.clear();
+      return null;
+    }
+    const tokens = await res.json();
+    this.storage.saveTokens(tokens);
+    return tokens;
+  }
+  async getUserInfo(forceRefresh = false) {
+    if (!this.endpoints) await this.init();
+    if (this.userInfo && !forceRefresh) return this.userInfo;
+    const accessToken = await this.getAccessToken();
+    if (!accessToken) return null;
+    const res = await fetch(this.endpoints.userinfo_endpoint, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) return null;
+    this.userInfo = await res.json();
+    return this.userInfo;
+  }
+  async getAccessToken() {
+    let token = this.storage.getAccessToken();
+    if (token) return token;
+    if (this.storage.isTokenExpired()) {
+      const tokens = await this.refreshToken();
+      if (tokens) return tokens.access_token;
+    }
+    return null;
+  }
+  getIdToken() {
+    return this.storage.getIdToken();
+  }
+  getAuthState() {
+    const accessToken = this.storage.getAccessToken();
+    return {
+      isAuthenticated: !!accessToken,
+      user: this.userInfo,
+      accessToken,
+      idToken: this.storage.getIdToken(),
+      expiresAt: this.storage.getExpiresAt()
+    };
+  }
+  isAuthenticated() {
+    return !!this.storage.getAccessToken();
+  }
+  async logout() {
+    if (!this.endpoints) await this.init();
+    const idToken = this.storage.getIdToken();
+    this.storage.clear();
+    this.userInfo = null;
+    const params = new URLSearchParams();
+    if (idToken) params.set("id_token_hint", idToken);
+    if (this.config.postLogoutRedirectUri) {
+      params.set("post_logout_redirect_uri", this.config.postLogoutRedirectUri);
+    }
+    window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
+  }
+  async revokeToken() {
+    if (!this.endpoints) await this.init();
+    const refreshToken = this.storage.getRefreshToken();
+    if (refreshToken) {
+      await fetch(this.endpoints.revocation_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          token: refreshToken,
+          token_type_hint: "refresh_token"
+        }).toString()
+      });
+    }
+  }
+  /** Create an authenticated fetch wrapper */
+  async fetch(url, init) {
+    const token = await this.getAccessToken();
+    const headers = new Headers(init?.headers);
+    if (token) {
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    return fetch(url, { ...init, headers });
+  }
+};
+export {
+  IdaasClient,
+  TokenStorage,
+  createPKCE,
+  generateNonce,
+  generateState
+};

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@zskj-idaas/sdk",
+  "version": "1.0.0",
+  "description": "IDaaS OIDC Client SDK for browser applications — supports Authorization Code Flow with PKCE, token management, and authenticated fetch.",
+  "main": "dist/index.js",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts --clean",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "idaas",
+    "oidc",
+    "oauth2",
+    "pkce",
+    "sso",
+    "authentication",
+    "identity",
+    "openid-connect",
+    "browser-sdk"
+  ],
+  "license": "MIT",
+  "author": "IDaaS Team",
+  "repository": {
+    "type": "git",
+    "url": ""
+  },
+  "homepage": "",
+  "bugs": {
+    "url": ""
+  },
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "browserslist": [
+    "> 0.5%",
+    "not dead",
+    "not ie 11"
+  ],
+  "dependencies": {},
+  "devDependencies": {
+    "tsup": "^8.2.0",
+    "typescript": "^5.6.0"
+  }
+}