@zskj-idaas/sdk 1.0.1 → 1.0.4

package/dist/index.d.mts

@@ -18,6 +18,11 @@ interface TokenSet {
     refresh_token?: string;
     scope: string;
 }
+interface ServiceTokenState {
+    accessToken: string;
+    expiresAt: number;
+    scope: string;
+}
 interface UserInfo {
     sub: string;
     preferred_username?: string;
@@ -35,6 +40,10 @@ interface AuthState {
     idToken: string | null;
     expiresAt: number | null;
 }
+interface SessionLogoutOptions {
+    /** Redirect after the server-side session and local tokens are cleared. */
+    redirectTo?: string;
+}
 interface PKCEPair {
     codeVerifier: string;
     codeChallenge: string;
@@ -45,6 +54,7 @@ declare class IdaasClient {
     private endpoints;
     private storage;
     private userInfo;
+    private serviceTokens;
     constructor(config: IdaasConfig);
     init(): Promise<AuthState>;
     private discover;
@@ -53,13 +63,16 @@ declare class IdaasClient {
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
     getAccessToken(): Promise<string | null>;
+    getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
     getAuthState(): AuthState;
     isAuthenticated(): boolean;
     logout(): Promise<void>;
+    logoutSession(options?: SessionLogoutOptions): Promise<void>;
     revokeToken(): Promise<void>;
     /** Create an authenticated fetch wrapper */
     fetch(url: string, init?: RequestInit): Promise<Response>;
+    fetchService(serviceKey: string, url: string, init?: RequestInit): Promise<Response>;
 }
 
 declare function createPKCE(): Promise<PKCEPair>;
@@ -70,6 +83,7 @@ declare class TokenStorage {
     private prefix;
     constructor(prefix?: string);
     private key;
+    private migrateTokenValue;
     saveTokens(tokens: TokenSet): void;
     getAccessToken(): string | null;
     getIdToken(): string | null;
@@ -86,4 +100,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.d.ts

@@ -18,6 +18,11 @@ interface TokenSet {
     refresh_token?: string;
     scope: string;
 }
+interface ServiceTokenState {
+    accessToken: string;
+    expiresAt: number;
+    scope: string;
+}
 interface UserInfo {
     sub: string;
     preferred_username?: string;
@@ -35,6 +40,10 @@ interface AuthState {
     idToken: string | null;
     expiresAt: number | null;
 }
+interface SessionLogoutOptions {
+    /** Redirect after the server-side session and local tokens are cleared. */
+    redirectTo?: string;
+}
 interface PKCEPair {
     codeVerifier: string;
     codeChallenge: string;
@@ -45,6 +54,7 @@ declare class IdaasClient {
     private endpoints;
     private storage;
     private userInfo;
+    private serviceTokens;
     constructor(config: IdaasConfig);
     init(): Promise<AuthState>;
     private discover;
@@ -53,13 +63,16 @@ declare class IdaasClient {
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
     getAccessToken(): Promise<string | null>;
+    getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
     getAuthState(): AuthState;
     isAuthenticated(): boolean;
     logout(): Promise<void>;
+    logoutSession(options?: SessionLogoutOptions): Promise<void>;
     revokeToken(): Promise<void>;
     /** Create an authenticated fetch wrapper */
     fetch(url: string, init?: RequestInit): Promise<Response>;
+    fetchService(serviceKey: string, url: string, init?: RequestInit): Promise<Response>;
 }
 
 declare function createPKCE(): Promise<PKCEPair>;
@@ -70,6 +83,7 @@ declare class TokenStorage {
     private prefix;
     constructor(prefix?: string);
     private key;
+    private migrateTokenValue;
     saveTokens(tokens: TokenSet): void;
     getAccessToken(): string | null;
     getIdToken(): string | null;
@@ -86,4 +100,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.js

@@ -183,33 +183,48 @@ var TokenStorage = class {
   key(name) {
     return `${this.prefix}:${name}`;
   }
+  migrateTokenValue(name) {
+    const key = this.key(name);
+    const current = localStorage.getItem(key);
+    if (current) return current;
+    const legacy = sessionStorage.getItem(key);
+    if (!legacy) return null;
+    localStorage.setItem(key, legacy);
+    sessionStorage.removeItem(key);
+    return legacy;
+  }
   saveTokens(tokens) {
     const expiresAt = Date.now() + tokens.expires_in * 1e3;
-    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
-    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    localStorage.setItem(this.key("access_token"), tokens.access_token);
+    localStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
     if (tokens.id_token) {
-      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+      localStorage.setItem(this.key("id_token"), tokens.id_token);
+      sessionStorage.removeItem(this.key("id_token"));
     }
     if (tokens.refresh_token) {
       localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
     }
-    sessionStorage.setItem(this.key("scope"), tokens.scope);
+    localStorage.setItem(this.key("scope"), tokens.scope);
+    sessionStorage.removeItem(this.key("scope"));
   }
   getAccessToken() {
-    const token = sessionStorage.getItem(this.key("access_token"));
-    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    const token = this.migrateTokenValue("access_token");
+    const expiresAt = this.migrateTokenValue("expires_at");
+    this.migrateTokenValue("scope");
     if (!token || !expiresAt) return null;
     if (Date.now() > parseInt(expiresAt, 10)) return null;
     return token;
   }
   getIdToken() {
-    return sessionStorage.getItem(this.key("id_token"));
+    return this.migrateTokenValue("id_token");
   }
   getRefreshToken() {
     return localStorage.getItem(this.key("refresh_token"));
   }
   getExpiresAt() {
-    const val = sessionStorage.getItem(this.key("expires_at"));
+    const val = this.migrateTokenValue("expires_at");
     return val ? parseInt(val, 10) : null;
   }
   isTokenExpired() {
@@ -218,11 +233,15 @@ var TokenStorage = class {
     return Date.now() > expiresAt - 6e4;
   }
   clear() {
+    localStorage.removeItem(this.key("access_token"));
+    localStorage.removeItem(this.key("id_token"));
+    localStorage.removeItem(this.key("expires_at"));
+    localStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
     sessionStorage.removeItem(this.key("access_token"));
     sessionStorage.removeItem(this.key("id_token"));
     sessionStorage.removeItem(this.key("expires_at"));
     sessionStorage.removeItem(this.key("scope"));
-    localStorage.removeItem(this.key("refresh_token"));
   }
   saveState(state) {
     sessionStorage.setItem(this.key("state"), state);
@@ -254,6 +273,7 @@ var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
     this.userInfo = null;
+    this.serviceTokens = /* @__PURE__ */ new Map();
     this.config = {
       scope: "openid profile email",
       autoDiscovery: true,
@@ -276,6 +296,7 @@ var IdaasClient = class {
         introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
       };
     }
+    await this.getAccessToken();
     return this.getAuthState();
   }
   async discover() {
@@ -392,14 +413,40 @@ var IdaasClient = class {
     return this.userInfo;
   }
   async getAccessToken() {
-    let token = this.storage.getAccessToken();
-    if (token) return token;
-    if (this.storage.isTokenExpired()) {
-      const tokens = await this.refreshToken();
-      if (tokens) return tokens.access_token;
-    }
+    const token = this.storage.getAccessToken();
+    if (token && !this.storage.isTokenExpired()) return token;
+    const tokens = await this.refreshToken();
+    if (tokens) return tokens.access_token;
     return null;
   }
+  async getServiceToken(serviceKey) {
+    if (!this.endpoints) await this.init();
+    const cached = this.serviceTokens.get(serviceKey);
+    if (cached && Date.now() < cached.expiresAt - 6e4) {
+      return cached.accessToken;
+    }
+    const baseToken = await this.getAccessToken();
+    if (!baseToken) return null;
+    const res = await fetch(`${this.config.issuer}/oauth2/business-token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${baseToken}`
+      },
+      body: JSON.stringify({ service_key: serviceKey })
+    });
+    if (!res.ok) {
+      this.serviceTokens.delete(serviceKey);
+      return null;
+    }
+    const tokenSet = await res.json();
+    this.serviceTokens.set(serviceKey, {
+      accessToken: tokenSet.access_token,
+      expiresAt: Date.now() + tokenSet.expires_in * 1e3,
+      scope: tokenSet.scope
+    });
+    return tokenSet.access_token;
+  }
   getIdToken() {
     return this.storage.getIdToken();
   }
@@ -428,6 +475,17 @@ var IdaasClient = class {
     }
     window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
   }
+  async logoutSession(options = {}) {
+    this.storage.clear();
+    this.userInfo = null;
+    await fetch(`${this.config.issuer}/auth/logout`, {
+      method: "POST",
+      credentials: "include"
+    }).catch(() => void 0);
+    if (options.redirectTo) {
+      window.location.href = options.redirectTo;
+    }
+  }
   async revokeToken() {
     if (!this.endpoints) await this.init();
     const refreshToken = this.storage.getRefreshToken();
@@ -451,6 +509,13 @@ var IdaasClient = class {
     }
     return fetch(url, { ...init, headers });
   }
+  async fetchService(serviceKey, url, init) {
+    const token = await this.getServiceToken(serviceKey);
+    if (!token) throw new Error(`No service token available for ${serviceKey}`);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(url, { ...init, headers });
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/index.mjs

@@ -153,33 +153,48 @@ var TokenStorage = class {
   key(name) {
     return `${this.prefix}:${name}`;
   }
+  migrateTokenValue(name) {
+    const key = this.key(name);
+    const current = localStorage.getItem(key);
+    if (current) return current;
+    const legacy = sessionStorage.getItem(key);
+    if (!legacy) return null;
+    localStorage.setItem(key, legacy);
+    sessionStorage.removeItem(key);
+    return legacy;
+  }
   saveTokens(tokens) {
     const expiresAt = Date.now() + tokens.expires_in * 1e3;
-    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
-    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    localStorage.setItem(this.key("access_token"), tokens.access_token);
+    localStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
     if (tokens.id_token) {
-      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+      localStorage.setItem(this.key("id_token"), tokens.id_token);
+      sessionStorage.removeItem(this.key("id_token"));
     }
     if (tokens.refresh_token) {
       localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
     }
-    sessionStorage.setItem(this.key("scope"), tokens.scope);
+    localStorage.setItem(this.key("scope"), tokens.scope);
+    sessionStorage.removeItem(this.key("scope"));
   }
   getAccessToken() {
-    const token = sessionStorage.getItem(this.key("access_token"));
-    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    const token = this.migrateTokenValue("access_token");
+    const expiresAt = this.migrateTokenValue("expires_at");
+    this.migrateTokenValue("scope");
     if (!token || !expiresAt) return null;
     if (Date.now() > parseInt(expiresAt, 10)) return null;
     return token;
   }
   getIdToken() {
-    return sessionStorage.getItem(this.key("id_token"));
+    return this.migrateTokenValue("id_token");
   }
   getRefreshToken() {
     return localStorage.getItem(this.key("refresh_token"));
   }
   getExpiresAt() {
-    const val = sessionStorage.getItem(this.key("expires_at"));
+    const val = this.migrateTokenValue("expires_at");
     return val ? parseInt(val, 10) : null;
   }
   isTokenExpired() {
@@ -188,11 +203,15 @@ var TokenStorage = class {
     return Date.now() > expiresAt - 6e4;
   }
   clear() {
+    localStorage.removeItem(this.key("access_token"));
+    localStorage.removeItem(this.key("id_token"));
+    localStorage.removeItem(this.key("expires_at"));
+    localStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
     sessionStorage.removeItem(this.key("access_token"));
     sessionStorage.removeItem(this.key("id_token"));
     sessionStorage.removeItem(this.key("expires_at"));
     sessionStorage.removeItem(this.key("scope"));
-    localStorage.removeItem(this.key("refresh_token"));
   }
   saveState(state) {
     sessionStorage.setItem(this.key("state"), state);
@@ -224,6 +243,7 @@ var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
     this.userInfo = null;
+    this.serviceTokens = /* @__PURE__ */ new Map();
     this.config = {
       scope: "openid profile email",
       autoDiscovery: true,
@@ -246,6 +266,7 @@ var IdaasClient = class {
         introspection_endpoint: `${this.config.issuer}/oauth2/introspect`
       };
     }
+    await this.getAccessToken();
     return this.getAuthState();
   }
   async discover() {
@@ -362,14 +383,40 @@ var IdaasClient = class {
     return this.userInfo;
   }
   async getAccessToken() {
-    let token = this.storage.getAccessToken();
-    if (token) return token;
-    if (this.storage.isTokenExpired()) {
-      const tokens = await this.refreshToken();
-      if (tokens) return tokens.access_token;
-    }
+    const token = this.storage.getAccessToken();
+    if (token && !this.storage.isTokenExpired()) return token;
+    const tokens = await this.refreshToken();
+    if (tokens) return tokens.access_token;
     return null;
   }
+  async getServiceToken(serviceKey) {
+    if (!this.endpoints) await this.init();
+    const cached = this.serviceTokens.get(serviceKey);
+    if (cached && Date.now() < cached.expiresAt - 6e4) {
+      return cached.accessToken;
+    }
+    const baseToken = await this.getAccessToken();
+    if (!baseToken) return null;
+    const res = await fetch(`${this.config.issuer}/oauth2/business-token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${baseToken}`
+      },
+      body: JSON.stringify({ service_key: serviceKey })
+    });
+    if (!res.ok) {
+      this.serviceTokens.delete(serviceKey);
+      return null;
+    }
+    const tokenSet = await res.json();
+    this.serviceTokens.set(serviceKey, {
+      accessToken: tokenSet.access_token,
+      expiresAt: Date.now() + tokenSet.expires_in * 1e3,
+      scope: tokenSet.scope
+    });
+    return tokenSet.access_token;
+  }
   getIdToken() {
     return this.storage.getIdToken();
   }
@@ -398,6 +445,17 @@ var IdaasClient = class {
     }
     window.location.href = `${this.endpoints.end_session_endpoint}?${params.toString()}`;
   }
+  async logoutSession(options = {}) {
+    this.storage.clear();
+    this.userInfo = null;
+    await fetch(`${this.config.issuer}/auth/logout`, {
+      method: "POST",
+      credentials: "include"
+    }).catch(() => void 0);
+    if (options.redirectTo) {
+      window.location.href = options.redirectTo;
+    }
+  }
   async revokeToken() {
     if (!this.endpoints) await this.init();
     const refreshToken = this.storage.getRefreshToken();
@@ -421,6 +479,13 @@ var IdaasClient = class {
     }
     return fetch(url, { ...init, headers });
   }
+  async fetchService(serviceKey, url, init) {
+    const token = await this.getServiceToken(serviceKey);
+    if (!token) throw new Error(`No service token available for ${serviceKey}`);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return fetch(url, { ...init, headers });
+  }
 };
 export {
   IdaasClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zskj-idaas/sdk",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "IDaaS OIDC Client SDK for browser applications — supports Authorization Code Flow with PKCE, token management, and authenticated fetch.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -26,6 +26,7 @@
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean",
     "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "test": "vitest run",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -57,9 +58,9 @@
     "not dead",
     "not ie 11"
   ],
-  "dependencies": {},
   "devDependencies": {
     "tsup": "^8.2.0",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.7"
   }
 }