@zskj-idaas/sdk 1.0.0 → 1.0.3

package/dist/index.d.mts

@@ -18,6 +18,11 @@ interface TokenSet {
     refresh_token?: string;
     scope: string;
 }
+interface ServiceTokenState {
+    accessToken: string;
+    expiresAt: number;
+    scope: string;
+}
 interface UserInfo {
     sub: string;
     preferred_username?: string;
@@ -35,6 +40,10 @@ interface AuthState {
     idToken: string | null;
     expiresAt: number | null;
 }
+interface SessionLogoutOptions {
+    /** Redirect after the server-side session and local tokens are cleared. */
+    redirectTo?: string;
+}
 interface PKCEPair {
     codeVerifier: string;
     codeChallenge: string;
@@ -45,6 +54,7 @@ declare class IdaasClient {
     private endpoints;
     private storage;
     private userInfo;
+    private serviceTokens;
     constructor(config: IdaasConfig);
     init(): Promise<AuthState>;
     private discover;
@@ -53,13 +63,16 @@ declare class IdaasClient {
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
     getAccessToken(): Promise<string | null>;
+    getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
     getAuthState(): AuthState;
     isAuthenticated(): boolean;
     logout(): Promise<void>;
+    logoutSession(options?: SessionLogoutOptions): Promise<void>;
     revokeToken(): Promise<void>;
     /** Create an authenticated fetch wrapper */
     fetch(url: string, init?: RequestInit): Promise<Response>;
+    fetchService(serviceKey: string, url: string, init?: RequestInit): Promise<Response>;
 }
 
 declare function createPKCE(): Promise<PKCEPair>;
@@ -86,4 +99,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.d.ts

@@ -18,6 +18,11 @@ interface TokenSet {
     refresh_token?: string;
     scope: string;
 }
+interface ServiceTokenState {
+    accessToken: string;
+    expiresAt: number;
+    scope: string;
+}
 interface UserInfo {
     sub: string;
     preferred_username?: string;
@@ -35,6 +40,10 @@ interface AuthState {
     idToken: string | null;
     expiresAt: number | null;
 }
+interface SessionLogoutOptions {
+    /** Redirect after the server-side session and local tokens are cleared. */
+    redirectTo?: string;
+}
 interface PKCEPair {
     codeVerifier: string;
     codeChallenge: string;
@@ -45,6 +54,7 @@ declare class IdaasClient {
     private endpoints;
     private storage;
     private userInfo;
+    private serviceTokens;
     constructor(config: IdaasConfig);
     init(): Promise<AuthState>;
     private discover;
@@ -53,13 +63,16 @@ declare class IdaasClient {
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
     getAccessToken(): Promise<string | null>;
+    getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
     getAuthState(): AuthState;
     isAuthenticated(): boolean;
     logout(): Promise<void>;
+    logoutSession(options?: SessionLogoutOptions): Promise<void>;
     revokeToken(): Promise<void>;
     /** Create an authenticated fetch wrapper */
     fetch(url: string, init?: RequestInit): Promise<Response>;
+    fetchService(serviceKey: string, url: string, init?: RequestInit): Promise<Response>;
 }
 
 declare function createPKCE(): Promise<PKCEPair>;
@@ -86,4 +99,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.js

@@ -42,11 +42,129 @@ function base64UrlEncode(buffer) {
   });
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+async function sha256(data) {
+  if (typeof crypto !== "undefined" && crypto.subtle) {
+    return crypto.subtle.digest("SHA-256", data);
+  }
+  const K = [
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+  ];
+  const rotr = (n, x) => x >>> n | x << 32 - n;
+  const ch = (x, y, z) => x & y ^ ~x & z;
+  const maj = (x, y, z) => x & y ^ x & z ^ y & z;
+  const sigma0 = (x) => rotr(2, x) ^ rotr(13, x) ^ rotr(22, x);
+  const sigma1 = (x) => rotr(6, x) ^ rotr(11, x) ^ rotr(25, x);
+  const gamma0 = (x) => rotr(7, x) ^ rotr(18, x) ^ x >>> 3;
+  const gamma1 = (x) => rotr(17, x) ^ rotr(19, x) ^ x >>> 10;
+  const len = data.length;
+  const bitLen = len * 8;
+  const padLen = (len + 8 >> 6 << 6) + 64;
+  const padded = new Uint8Array(padLen);
+  padded.set(data);
+  padded[len] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padLen - 4, bitLen, false);
+  let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
+  let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
+  for (let offset = 0; offset < padLen; offset += 64) {
+    const w = new Array(64);
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(offset + i * 4, false);
+    for (let i = 16; i < 64; i++) w[i] = gamma1(w[i - 2]) + w[i - 7] + gamma0(w[i - 15]) + w[i - 16] | 0;
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+    for (let i = 0; i < 64; i++) {
+      const t1 = h + sigma1(e) + ch(e, f, g) + K[i] + w[i] | 0;
+      const t2 = sigma0(a) + maj(a, b, c) | 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + t1 | 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 | 0;
+    }
+    h0 = h0 + a | 0;
+    h1 = h1 + b | 0;
+    h2 = h2 + c | 0;
+    h3 = h3 + d | 0;
+    h4 = h4 + e | 0;
+    h5 = h5 + f | 0;
+    h6 = h6 + g | 0;
+    h7 = h7 + h | 0;
+  }
+  const result = new ArrayBuffer(32);
+  const dv = new DataView(result);
+  [h0, h1, h2, h3, h4, h5, h6, h7].forEach((v, i) => dv.setUint32(i * 4, v, false));
+  return result;
+}
 async function createPKCE() {
   const codeVerifier = generateRandomString(64);
   const encoder = new TextEncoder();
   const data = encoder.encode(codeVerifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
+  const digest = await sha256(data);
   const codeChallenge = base64UrlEncode(digest);
   return { codeVerifier, codeChallenge };
 }
@@ -136,6 +254,7 @@ var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
     this.userInfo = null;
+    this.serviceTokens = /* @__PURE__ */ new Map();
     this.config = {
       scope: "openid profile email",
       autoDiscovery: true,
@@ -158,6 +277,7 @@ var IdaasClient = class {
         introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
       };
     }
+    await this.getAccessToken();
     return this.getAuthState();
   }
   async discover() {
@@ -274,14 +394,40 @@ var IdaasClient = class {
     return this.userInfo;
   }
   async getAccessToken() {
-    let token = this.storage.getAccessToken();
-    if (token) return token;
-    if (this.storage.isTokenExpired()) {
-      const tokens = await this.refreshToken();
-      if (tokens) return tokens.access_token;
-    }
+    const token = this.storage.getAccessToken();
+    if (token && !this.storage.isTokenExpired()) return token;
+    const tokens = await this.refreshToken();
+    if (tokens) return tokens.access_token;
     return null;
   }
+  async getServiceToken(serviceKey) {
+    if (!this.endpoints) await this.init();
+    const cached = this.serviceTokens.get(serviceKey);
+    if (cached && Date.now() < cached.expiresAt - 6e4) {
+      return cached.accessToken;
+    }
+    const baseToken = await this.getAccessToken();
+    if (!baseToken) return null;
+    const res = await fetch(`${this.config.issuer}/oauth2/business-token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${baseToken}`
+      },
+      body: JSON.stringify({ service_key: serviceKey })
+    });
+    if (!res.ok) {
+      this.serviceTokens.delete(serviceKey);
+      return null;
+    }
+    const tokenSet = await res.json();
+    this.serviceTokens.set(serviceKey, {
+      accessToken: tokenSet.access_token,
+      expiresAt: Date.now() + tokenSet.expires_in * 1e3,
+      scope: tokenSet.scope
+    });
+    return tokenSet.access_token;
+  }
   getIdToken() {
     return this.storage.getIdToken();
   }
@@ -310,6 +456,17 @@ var IdaasClient = class {
     }
     window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
   }
+  async logoutSession(options = {}) {
+    this.storage.clear();
+    this.userInfo = null;
+    await fetch(`${this.config.issuer}/auth/logout`, {
+      method: "POST",
+      credentials: "include"
+    }).catch(() => void 0);
+    if (options.redirectTo) {
+      window.location.href = options.redirectTo;
+    }
+  }
   async revokeToken() {
     if (!this.endpoints) await this.init();
     const refreshToken = this.storage.getRefreshToken();
@@ -333,6 +490,13 @@ var IdaasClient = class {
     }
     return fetch(url, { ...init, headers });
   }
+  async fetchService(serviceKey, url, init) {
+    const token = await this.getServiceToken(serviceKey);
+    if (!token) throw new Error(`No service token available for ${serviceKey}`);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(url, { ...init, headers });
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.mjs

@@ -12,11 +12,129 @@ function base64UrlEncode(buffer) {
   });
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+async function sha256(data) {
+  if (typeof crypto !== "undefined" && crypto.subtle) {
+    return crypto.subtle.digest("SHA-256", data);
+  }
+  const K = [
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+  ];
+  const rotr = (n, x) => x >>> n | x << 32 - n;
+  const ch = (x, y, z) => x & y ^ ~x & z;
+  const maj = (x, y, z) => x & y ^ x & z ^ y & z;
+  const sigma0 = (x) => rotr(2, x) ^ rotr(13, x) ^ rotr(22, x);
+  const sigma1 = (x) => rotr(6, x) ^ rotr(11, x) ^ rotr(25, x);
+  const gamma0 = (x) => rotr(7, x) ^ rotr(18, x) ^ x >>> 3;
+  const gamma1 = (x) => rotr(17, x) ^ rotr(19, x) ^ x >>> 10;
+  const len = data.length;
+  const bitLen = len * 8;
+  const padLen = (len + 8 >> 6 << 6) + 64;
+  const padded = new Uint8Array(padLen);
+  padded.set(data);
+  padded[len] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padLen - 4, bitLen, false);
+  let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
+  let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
+  for (let offset = 0; offset < padLen; offset += 64) {
+    const w = new Array(64);
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(offset + i * 4, false);
+    for (let i = 16; i < 64; i++) w[i] = gamma1(w[i - 2]) + w[i - 7] + gamma0(w[i - 15]) + w[i - 16] | 0;
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+    for (let i = 0; i < 64; i++) {
+      const t1 = h + sigma1(e) + ch(e, f, g) + K[i] + w[i] | 0;
+      const t2 = sigma0(a) + maj(a, b, c) | 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + t1 | 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 | 0;
+    }
+    h0 = h0 + a | 0;
+    h1 = h1 + b | 0;
+    h2 = h2 + c | 0;
+    h3 = h3 + d | 0;
+    h4 = h4 + e | 0;
+    h5 = h5 + f | 0;
+    h6 = h6 + g | 0;
+    h7 = h7 + h | 0;
+  }
+  const result = new ArrayBuffer(32);
+  const dv = new DataView(result);
+  [h0, h1, h2, h3, h4, h5, h6, h7].forEach((v, i) => dv.setUint32(i * 4, v, false));
+  return result;
+}
 async function createPKCE() {
   const codeVerifier = generateRandomString(64);
   const encoder = new TextEncoder();
   const data = encoder.encode(codeVerifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
+  const digest = await sha256(data);
   const codeChallenge = base64UrlEncode(digest);
   return { codeVerifier, codeChallenge };
 }
@@ -106,6 +224,7 @@ var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
     this.userInfo = null;
+    this.serviceTokens = /* @__PURE__ */ new Map();
     this.config = {
       scope: "openid profile email",
       autoDiscovery: true,
@@ -128,6 +247,7 @@ var IdaasClient = class {
         introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
       };
     }
+    await this.getAccessToken();
     return this.getAuthState();
   }
   async discover() {
@@ -244,14 +364,40 @@ var IdaasClient = class {
     return this.userInfo;
   }
   async getAccessToken() {
-    let token = this.storage.getAccessToken();
-    if (token) return token;
-    if (this.storage.isTokenExpired()) {
-      const tokens = await this.refreshToken();
-      if (tokens) return tokens.access_token;
-    }
+    const token = this.storage.getAccessToken();
+    if (token && !this.storage.isTokenExpired()) return token;
+    const tokens = await this.refreshToken();
+    if (tokens) return tokens.access_token;
     return null;
   }
+  async getServiceToken(serviceKey) {
+    if (!this.endpoints) await this.init();
+    const cached = this.serviceTokens.get(serviceKey);
+    if (cached && Date.now() < cached.expiresAt - 6e4) {
+      return cached.accessToken;
+    }
+    const baseToken = await this.getAccessToken();
+    if (!baseToken) return null;
+    const res = await fetch(`${this.config.issuer}/oauth2/business-token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${baseToken}`
+      },
+      body: JSON.stringify({ service_key: serviceKey })
+    });
+    if (!res.ok) {
+      this.serviceTokens.delete(serviceKey);
+      return null;
+    }
+    const tokenSet = await res.json();
+    this.serviceTokens.set(serviceKey, {
+      accessToken: tokenSet.access_token,
+      expiresAt: Date.now() + tokenSet.expires_in * 1e3,
+      scope: tokenSet.scope
+    });
+    return tokenSet.access_token;
+  }
   getIdToken() {
     return this.storage.getIdToken();
   }
@@ -280,6 +426,17 @@ var IdaasClient = class {
     }
     window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
   }
+  async logoutSession(options = {}) {
+    this.storage.clear();
+    this.userInfo = null;
+    await fetch(`${this.config.issuer}/auth/logout`, {
+      method: "POST",
+      credentials: "include"
+    }).catch(() => void 0);
+    if (options.redirectTo) {
+      window.location.href = options.redirectTo;
+    }
+  }
   async revokeToken() {
     if (!this.endpoints) await this.init();
     const refreshToken = this.storage.getRefreshToken();
@@ -303,6 +460,13 @@ var IdaasClient = class {
     }
     return fetch(url, { ...init, headers });
   }
+  async fetchService(serviceKey, url, init) {
+    const token = await this.getServiceToken(serviceKey);
+    if (!token) throw new Error(`No service token available for ${serviceKey}`);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(url, { ...init, headers });
+  }
 };
 export {
   IdaasClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zskj-idaas/sdk",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "IDaaS OIDC Client SDK for browser applications — supports Authorization Code Flow with PKCE, token management, and authenticated fetch.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -26,6 +26,7 @@
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean",
     "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "test": "vitest run",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -57,9 +58,9 @@
     "not dead",
     "not ie 11"
   ],
-  "dependencies": {},
   "devDependencies": {
     "tsup": "^8.2.0",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.7"
   }
 }