@zskj-idaas/sdk 1.0.3 → 2.3.0

package/README.md

@@ -2,6 +2,8 @@
 
 IDaaS OIDC Client SDK — 适用于浏览器应用的 OpenID Connect 客户端，支持 Authorization Code Flow with PKCE。
 
+当前生产环境的 OIDC Issuer 是 `https://account.genisomai.com`。本文中的 IDaaS 端点均填写为完整生产地址。
+
 ## 特性
 
 - **零运行时依赖** — 轻量、无外部依赖
@@ -28,9 +30,10 @@ yarn add @zskj-idaas/sdk
 import { IdaasClient } from '@zskj-idaas/sdk';
 
 const client = new IdaasClient({
-  issuer: 'https://your-idaas-server.com',
-  clientId: 'your-client-id',
-  redirectUri: 'http://localhost:3000/callback',
+  issuer: 'https://account.genisomai.com',
+  clientId: 'my-app',
+  redirectUri: `${window.location.origin}/callback`,
+  postLogoutRedirectUri: window.location.origin,
   scope: 'openid profile email',
 });
 
@@ -41,6 +44,30 @@ await client.init();
 await client.login();
 ```
 
+`clientId` 必须替换为 IDaaS 管理员分配的 Public Client ID。当前 Origin、`${window.location.origin}/callback` 和 `window.location.origin` 必须分别登记到管理后台的 CORS Origins、Redirect URIs 和 Post Logout Redirect URIs。
+
+## 生产端点
+
+SDK 默认从 Discovery 自动读取标准 OIDC 端点。当前生产环境的完整地址如下：
+
+| 用途 | 方法 | 完整地址 |
+| --- | --- | --- |
+| OIDC Discovery | GET | `https://account.genisomai.com/.well-known/openid-configuration` |
+| JWKS 公钥 | GET | `https://account.genisomai.com/.well-known/jwks.json` |
+| Authorization | GET | `https://account.genisomai.com/oauth2/authorize` |
+| Token | POST | `https://account.genisomai.com/oauth2/token` |
+| UserInfo | GET / POST | `https://account.genisomai.com/oauth2/userinfo` |
+| 企业资料（当前用户） | GET | `https://account.genisomai.com/oauth2/enterprise-profile` |
+| Business Token | POST | `https://account.genisomai.com/oauth2/business-token` |
+| Logout | GET | `https://account.genisomai.com/oauth2/logout` |
+| Revoke | POST | `https://account.genisomai.com/oauth2/revoke` |
+| Introspect | POST | `https://account.genisomai.com/oauth2/introspect` |
+| 清理 IDaaS Session | POST | `https://account.genisomai.com/auth/logout` |
+| Service Token Verify（仅业务后端） | POST | `https://account.genisomai.com/api/service-auth/verify` |
+| Authorization Evaluate（仅业务后端，以 `my-app-service` 为例） | POST | `https://account.genisomai.com/api/service-auth/my-app-service/evaluate` |
+
+浏览器不能持有 ServiceCredential，因此不能直接调用最后两个服务端授权端点。`my-app-service` 是 Service Key 示例，实际接入时使用管理员分配的值。
+
 ## API 参考
 
 ### `new IdaasClient(config)`
@@ -51,7 +78,6 @@ await client.login();
 interface IdaasConfig {
   issuer: string;               // OIDC 提供者地址
   clientId: string;             // 客户端 ID
-  clientSecret?: string;        // 客户端密钥（机密客户端）
   redirectUri: string;          // 登录回调地址
   postLogoutRedirectUri?: string; // 登出后跳转地址
   scope?: string;               // 请求的 scope（默认: 'openid profile email'）
@@ -60,6 +86,8 @@ interface IdaasConfig {
 }
 ```
 
+该 SDK 仅用于浏览器 Public Client，始终使用 PKCE，不能配置或传输 Client Secret。
+
 ### `client.init(): Promise<AuthState>`
 
 初始化客户端，执行 OIDC Discovery 并返回当前认证状态。
@@ -70,7 +98,7 @@ interface IdaasConfig {
 
 ```typescript
 // 附加额外参数
-await client.login({ prompt: 'login', login_hint: 'user@example.com' });
+await client.login({ prompt: 'login', login_hint: 'user@company.test' });
 ```
 
 ### `client.handleCallback(callbackUrl?): Promise<TokenSet>`
@@ -86,10 +114,56 @@ const tokens = await client.handleCallback();
 
 获取当前用户信息。
 
+管理员为 Client 开放 `feishu_identity`，并在登录时申请且经用户同意后，可返回以下可选字段：
+
+- `feishu_union_id` 与 `feishu_tenant_key`：必须成对完整，供同企业、同应用开发商范围内的跨飞书应用身份关联。
+- `feishu_open_id`：同一身份元数据中合法的 Open ID，供 IDaaS 所用飞书应用内关联，可与 `primary_department_leaders[].feishu_open_id` 对应。
+
+未授权、身份歧义或 UnionID/企业标识缺失时不返回上述字段；仅 Open ID 缺失或非法时省略 `feishu_open_id`，保留原有完整关联键。不得从用户名推导 Open ID，也不得用它跨飞书应用匹配。身份字段不授予业务权限，不写入 ID Token 或业务 Token。
+
+```typescript
+const user = await client.getUserInfo(true); // 强制重新获取，避免沿用先前缓存
+const feishuOpenId = user?.feishu_open_id;
+// 使用 feishuOpenId 进行同一飞书应用内关联；缺失时跳过关联，不记录身份值到日志。
+```
+
+### `client.getEnterpriseProfile(): Promise<EnterpriseProfile | null>`
+
+按当前应用获准且用户已同意的 Scope 获取当前用户的敏感企业资料。支持的独立 Scope 为 `phone`、`employee_number` 和 `primary_department`；对应字段不会进入 ID Token。
+
+```typescript
+import { EnterpriseProfileError } from '@zskj-idaas/sdk';
+
+try {
+  const profile = await client.getEnterpriseProfile();
+  console.log(profile?.employee_number);
+  console.log(profile?.primary_department_path_name);
+  console.log(profile?.primary_department_leaders);
+} catch (error) {
+  if (error instanceof EnterpriseProfileError && error.retryable) {
+    // 提示用户稍后重试，不要把查询失败当成字段为空。
+  }
+}
+```
+
+`primary_department_path` 按一级部门到叶子部门排序，每项包含 `id` 和 `name`，不包含公司根节点；`primary_department_path_name` 是使用 ` / ` 连接的可展示路径。`primary_department_leaders` 返回主部门的主负责人和副负责人，每项包含 `feishu_open_id`、`name`、`avatar_url` 和 `leader_type`；`leader_type` 取值为 `primary` 或 `deputy`。负责人仍只需 `primary_department` scope，读取本人 `feishu_open_id` 则需 `feishu_identity`。兼容旧服务时，调用方可回退到 `primary_department_name`。
+
+### 2.3.0 兼容升级
+
+本版本为 `EnterpriseDepartmentLeader` 新增 `feishu_open_id`，并保留 `open_id` 等值兼容别名（标记为废弃）；新服务端同时返回两个字段。为兼容旧服务和 2.x 调用方创建的对象，SDK 将新增字段声明为可选，可使用 `leader.feishu_open_id ?? leader.open_id`。`UserInfo` 新增可选的 `feishu_open_id`、`feishu_union_id` 和 `feishu_tenant_key` 类型。SDK 版本更新不等于服务端已部署或 npm 已发布。
+
 ### `client.getAccessToken(): Promise<string | null>`
 
 获取有效的 Access Token（过期时自动刷新）。
 
+### `client.refreshToken(): Promise<TokenSet | null>`
+
+使用 Refresh Token 主动刷新 Token；刷新失败时清理本地登录态并返回 `null`。
+
+### `client.getServiceToken(serviceKey): Promise<string | null>`
+
+调用 `https://account.genisomai.com/oauth2/business-token` 获取指定 Service 的业务 Token，并按 `serviceKey` 隔离缓存。
+
 ### `client.getIdToken(): string | null`
 
 获取 ID Token。
@@ -114,7 +188,11 @@ interface AuthState {
 
 ### `client.logout(): Promise<void>`
 
-执行 OIDC 登出流程。
+清理本地 Token，并跳转到 `https://account.genisomai.com/oauth2/logout` 执行 OIDC 登出。
+
+### `client.logoutSession(options?): Promise<void>`
+
+清理本地 Token，并调用 `https://account.genisomai.com/auth/logout` 销毁 IDaaS Session；可通过 `redirectTo` 指定完成后的前端地址。
 
 ### `client.revokeToken(): Promise<void>`
 
@@ -122,10 +200,19 @@ interface AuthState {
 
 ### `client.fetch(url, init?): Promise<Response>`
 
-带认证的 fetch 封装，自动附加 Authorization 头。
+带基础 IDaaS Access Token 的 fetch 封装，自动附加 Authorization 头。基础 Token 只允许用于 IDaaS UserInfo 和 Business Token 端点，不能用于业务 API；读取用户信息时优先使用 `getUserInfo()`。
+
+```typescript
+const res = await client.fetch('https://account.genisomai.com/oauth2/userinfo');
+const data = await res.json();
+```
+
+### `client.fetchService(serviceKey, url, init?): Promise<Response>`
+
+获取指定 Service 的业务 Token，并以 Bearer Token 调用业务 API。
 
 ```typescript
-const res = await client.fetch('/api/protected-resource');
+const res = await client.fetchService('my-app-service', '/api/customers');
 const data = await res.json();
 ```
 
@@ -136,7 +223,7 @@ import { IdaasClient } from '@zskj-idaas/sdk';
 import type { AuthState, UserInfo } from '@zskj-idaas/sdk';
 
 const client = new IdaasClient({
-  issuer: 'https://idaas.example.com',
+  issuer: 'https://account.genisomai.com',
   clientId: 'my-app',
   redirectUri: `${window.location.origin}/callback`,
   postLogoutRedirectUri: window.location.origin,
@@ -164,7 +251,7 @@ async function handleCallback() {
 
 // 调用受保护的 API
 async function fetchData() {
-  const res = await client.fetch('https://api.example.com/data');
+  const res = await client.fetchService('my-app-service', '/api/data');
   return res.json();
 }
 ```
@@ -173,14 +260,14 @@ async function fetchData() {
 
 ```typescript
 // 类
-export { IdaasClient } from './client';
+export { EnterpriseProfileError, IdaasClient } from './client';
 export { TokenStorage } from './storage';
 
 // 工具函数
 export { createPKCE, generateState, generateNonce } from './crypto';
 
 // 类型
-export type { IdaasConfig, TokenSet, UserInfo, AuthState } from './types';
+export type { IdaasConfig, TokenSet, UserInfo, EnterpriseDepartmentPathItem, EnterpriseProfile, AuthState } from './types';
 ```
 
 ## 浏览器兼容性

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 interface IdaasConfig {
     issuer: string;
     clientId: string;
-    clientSecret?: string;
     redirectUri: string;
     postLogoutRedirectUri?: string;
     scope?: string;
@@ -28,11 +27,51 @@ interface UserInfo {
     preferred_username?: string;
     name?: string;
     email?: string;
-    phone_number?: string;
+    email_verified?: boolean;
     picture?: string;
+    /** Requires feishu_identity. Scoped to the Feishu app used by IDaaS; never use across Feishu apps. */
+    feishu_open_id?: string;
+    /** Requires feishu_identity. Returned together with feishu_tenant_key for cross-app identity linking. */
+    feishu_union_id?: string;
+    /** Enterprise identity namespace; only returned together with feishu_union_id. */
+    feishu_tenant_key?: string;
     roles?: string[];
     [key: string]: unknown;
 }
+/** Sensitive enterprise attributes returned only when the current client and user grant the matching scopes. */
+interface EnterpriseDepartmentPathItem {
+    id: string;
+    name: string;
+}
+type EnterpriseDepartmentLeaderType = 'primary' | 'deputy';
+interface EnterpriseDepartmentLeader {
+    /** Scoped to the same Feishu app as UserInfo.feishu_open_id. */
+    feishu_open_id?: string;
+    /** @deprecated Use feishu_open_id. Kept as an equal-valued alias for 2.x compatibility. */
+    open_id: string;
+    name: string | null;
+    avatar_url: string | null;
+    /** primary = 主负责人；deputy = 副负责人。 */
+    leader_type: EnterpriseDepartmentLeaderType;
+}
+interface EnterpriseProfile {
+    phone_number?: string | null;
+    employee_number?: string | null;
+    primary_department_id?: string | null;
+    primary_department_name?: string | null;
+    /** Ordered from the top-level department to the user's primary (leaf) department. */
+    primary_department_path?: EnterpriseDepartmentPathItem[] | null;
+    /** Human-readable path such as "一级部门 / 二级部门 / 叶子部门". */
+    primary_department_path_name?: string | null;
+    /** Main and deputy leaders of the primary department. */
+    primary_department_leaders?: EnterpriseDepartmentLeader[] | null;
+}
+interface EnterpriseProfileErrorBody {
+    statusCode?: number;
+    code?: string;
+    message?: string | string[];
+    retryable?: boolean;
+}
 interface AuthState {
     isAuthenticated: boolean;
     user: UserInfo | null;
@@ -49,6 +88,16 @@ interface PKCEPair {
     codeChallenge: string;
 }
 
+declare class EnterpriseProfileError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly retryable: boolean;
+    constructor(message: string, options: {
+        status: number;
+        code?: string;
+        retryable?: boolean;
+    });
+}
 declare class IdaasClient {
     private config;
     private endpoints;
@@ -62,6 +111,11 @@ declare class IdaasClient {
     handleCallback(callbackUrl?: string): Promise<TokenSet>;
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
+    /**
+     * Fetch sensitive attributes for the current user. The server enforces both
+     * the client's scope allowlist and the user's consent before returning fields.
+     */
+    getEnterpriseProfile(): Promise<EnterpriseProfile | null>;
     getAccessToken(): Promise<string | null>;
     getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
@@ -83,6 +137,7 @@ declare class TokenStorage {
     private prefix;
     constructor(prefix?: string);
     private key;
+    private migrateTokenValue;
     saveTokens(tokens: TokenSet): void;
     getAccessToken(): string | null;
     getIdToken(): string | null;
@@ -99,4 +154,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, type EnterpriseDepartmentLeader, type EnterpriseDepartmentLeaderType, type EnterpriseDepartmentPathItem, type EnterpriseProfile, EnterpriseProfileError, type EnterpriseProfileErrorBody, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.d.ts

@@ -1,7 +1,6 @@
 interface IdaasConfig {
     issuer: string;
     clientId: string;
-    clientSecret?: string;
     redirectUri: string;
     postLogoutRedirectUri?: string;
     scope?: string;
@@ -28,11 +27,51 @@ interface UserInfo {
     preferred_username?: string;
     name?: string;
     email?: string;
-    phone_number?: string;
+    email_verified?: boolean;
     picture?: string;
+    /** Requires feishu_identity. Scoped to the Feishu app used by IDaaS; never use across Feishu apps. */
+    feishu_open_id?: string;
+    /** Requires feishu_identity. Returned together with feishu_tenant_key for cross-app identity linking. */
+    feishu_union_id?: string;
+    /** Enterprise identity namespace; only returned together with feishu_union_id. */
+    feishu_tenant_key?: string;
     roles?: string[];
     [key: string]: unknown;
 }
+/** Sensitive enterprise attributes returned only when the current client and user grant the matching scopes. */
+interface EnterpriseDepartmentPathItem {
+    id: string;
+    name: string;
+}
+type EnterpriseDepartmentLeaderType = 'primary' | 'deputy';
+interface EnterpriseDepartmentLeader {
+    /** Scoped to the same Feishu app as UserInfo.feishu_open_id. */
+    feishu_open_id?: string;
+    /** @deprecated Use feishu_open_id. Kept as an equal-valued alias for 2.x compatibility. */
+    open_id: string;
+    name: string | null;
+    avatar_url: string | null;
+    /** primary = 主负责人；deputy = 副负责人。 */
+    leader_type: EnterpriseDepartmentLeaderType;
+}
+interface EnterpriseProfile {
+    phone_number?: string | null;
+    employee_number?: string | null;
+    primary_department_id?: string | null;
+    primary_department_name?: string | null;
+    /** Ordered from the top-level department to the user's primary (leaf) department. */
+    primary_department_path?: EnterpriseDepartmentPathItem[] | null;
+    /** Human-readable path such as "一级部门 / 二级部门 / 叶子部门". */
+    primary_department_path_name?: string | null;
+    /** Main and deputy leaders of the primary department. */
+    primary_department_leaders?: EnterpriseDepartmentLeader[] | null;
+}
+interface EnterpriseProfileErrorBody {
+    statusCode?: number;
+    code?: string;
+    message?: string | string[];
+    retryable?: boolean;
+}
 interface AuthState {
     isAuthenticated: boolean;
     user: UserInfo | null;
@@ -49,6 +88,16 @@ interface PKCEPair {
     codeChallenge: string;
 }
 
+declare class EnterpriseProfileError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly retryable: boolean;
+    constructor(message: string, options: {
+        status: number;
+        code?: string;
+        retryable?: boolean;
+    });
+}
 declare class IdaasClient {
     private config;
     private endpoints;
@@ -62,6 +111,11 @@ declare class IdaasClient {
     handleCallback(callbackUrl?: string): Promise<TokenSet>;
     refreshToken(): Promise<TokenSet | null>;
     getUserInfo(forceRefresh?: boolean): Promise<UserInfo | null>;
+    /**
+     * Fetch sensitive attributes for the current user. The server enforces both
+     * the client's scope allowlist and the user's consent before returning fields.
+     */
+    getEnterpriseProfile(): Promise<EnterpriseProfile | null>;
     getAccessToken(): Promise<string | null>;
     getServiceToken(serviceKey: string): Promise<string | null>;
     getIdToken(): string | null;
@@ -83,6 +137,7 @@ declare class TokenStorage {
     private prefix;
     constructor(prefix?: string);
     private key;
+    private migrateTokenValue;
     saveTokens(tokens: TokenSet): void;
     getAccessToken(): string | null;
     getIdToken(): string | null;
@@ -99,4 +154,4 @@ declare class TokenStorage {
     clearAuthState(): void;
 }
 
-export { type AuthState, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };
+export { type AuthState, type EnterpriseDepartmentLeader, type EnterpriseDepartmentLeaderType, type EnterpriseDepartmentPathItem, type EnterpriseProfile, EnterpriseProfileError, type EnterpriseProfileErrorBody, IdaasClient, type IdaasConfig, type ServiceTokenState, type SessionLogoutOptions, type TokenSet, TokenStorage, type UserInfo, createPKCE, generateNonce, generateState };

package/dist/index.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  EnterpriseProfileError: () => EnterpriseProfileError,
   IdaasClient: () => IdaasClient,
   TokenStorage: () => TokenStorage,
   createPKCE: () => createPKCE,
@@ -183,33 +184,48 @@ var TokenStorage = class {
   key(name) {
     return `${this.prefix}:${name}`;
   }
+  migrateTokenValue(name) {
+    const key = this.key(name);
+    const current = localStorage.getItem(key);
+    if (current) return current;
+    const legacy = sessionStorage.getItem(key);
+    if (!legacy) return null;
+    localStorage.setItem(key, legacy);
+    sessionStorage.removeItem(key);
+    return legacy;
+  }
   saveTokens(tokens) {
     const expiresAt = Date.now() + tokens.expires_in * 1e3;
-    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
-    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    localStorage.setItem(this.key("access_token"), tokens.access_token);
+    localStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
     if (tokens.id_token) {
-      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+      localStorage.setItem(this.key("id_token"), tokens.id_token);
+      sessionStorage.removeItem(this.key("id_token"));
     }
     if (tokens.refresh_token) {
       localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
     }
-    sessionStorage.setItem(this.key("scope"), tokens.scope);
+    localStorage.setItem(this.key("scope"), tokens.scope);
+    sessionStorage.removeItem(this.key("scope"));
   }
   getAccessToken() {
-    const token = sessionStorage.getItem(this.key("access_token"));
-    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    const token = this.migrateTokenValue("access_token");
+    const expiresAt = this.migrateTokenValue("expires_at");
+    this.migrateTokenValue("scope");
     if (!token || !expiresAt) return null;
     if (Date.now() > parseInt(expiresAt, 10)) return null;
     return token;
   }
   getIdToken() {
-    return sessionStorage.getItem(this.key("id_token"));
+    return this.migrateTokenValue("id_token");
   }
   getRefreshToken() {
     return localStorage.getItem(this.key("refresh_token"));
   }
   getExpiresAt() {
-    const val = sessionStorage.getItem(this.key("expires_at"));
+    const val = this.migrateTokenValue("expires_at");
     return val ? parseInt(val, 10) : null;
   }
   isTokenExpired() {
@@ -218,11 +234,15 @@ var TokenStorage = class {
     return Date.now() > expiresAt - 6e4;
   }
   clear() {
+    localStorage.removeItem(this.key("access_token"));
+    localStorage.removeItem(this.key("id_token"));
+    localStorage.removeItem(this.key("expires_at"));
+    localStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
     sessionStorage.removeItem(this.key("access_token"));
     sessionStorage.removeItem(this.key("id_token"));
     sessionStorage.removeItem(this.key("expires_at"));
     sessionStorage.removeItem(this.key("scope"));
-    localStorage.removeItem(this.key("refresh_token"));
   }
   saveState(state) {
     sessionStorage.setItem(this.key("state"), state);
@@ -250,6 +270,15 @@ var TokenStorage = class {
 };
 
 // src/client.ts
+var EnterpriseProfileError = class extends Error {
+  constructor(message, options) {
+    super(message);
+    this.name = "EnterpriseProfileError";
+    this.status = options.status;
+    this.code = options.code;
+    this.retryable = options.retryable ?? options.status >= 500;
+  }
+};
 var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
@@ -271,6 +300,7 @@ var IdaasClient = class {
         authorization_endpoint: `${this.config.issuer}/oauth2/authorize`,
         token_endpoint: `${this.config.issuer}/oauth2/token`,
         userinfo_endpoint: `${this.config.issuer}/oauth2/userinfo`,
+        enterprise_profile_endpoint: `${this.config.issuer}/oauth2/enterprise-profile`,
         end_session_endpoint: `${this.config.issuer}/oauth2/logout`,
         jwks_uri: `${this.config.issuer}/.well-known/jwks.json`,
         revocation_endpoint: `${this.config.issuer}/oauth2/revoke`,
@@ -288,6 +318,7 @@ var IdaasClient = class {
       authorization_endpoint: doc.authorization_endpoint,
       token_endpoint: doc.token_endpoint,
       userinfo_endpoint: doc.userinfo_endpoint,
+      enterprise_profile_endpoint: doc.enterprise_profile_endpoint || `${this.config.issuer}/oauth2/enterprise-profile`,
       end_session_endpoint: doc.end_session_endpoint,
       jwks_uri: doc.jwks_uri,
       revocation_endpoint: doc.revocation_endpoint,
@@ -339,9 +370,6 @@ var IdaasClient = class {
       client_id: this.config.clientId,
       code_verifier: codeVerifier
     });
-    if (this.config.clientSecret) {
-      body.set("client_secret", this.config.clientSecret);
-    }
     const res = await fetch(this.endpoints.token_endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -365,9 +393,6 @@ var IdaasClient = class {
       refresh_token: refreshToken,
       client_id: this.config.clientId
     });
-    if (this.config.clientSecret) {
-      body.set("client_secret", this.config.clientSecret);
-    }
     const res = await fetch(this.endpoints.token_endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -393,6 +418,28 @@ var IdaasClient = class {
     this.userInfo = await res.json();
     return this.userInfo;
   }
+  /**
+   * Fetch sensitive attributes for the current user. The server enforces both
+   * the client's scope allowlist and the user's consent before returning fields.
+   */
+  async getEnterpriseProfile() {
+    if (!this.endpoints) await this.init();
+    const accessToken = await this.getAccessToken();
+    if (!accessToken) return null;
+    const res = await fetch(this.endpoints.enterprise_profile_endpoint, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      const message = Array.isArray(body.message) ? body.message.join(", ") : body.message || "Enterprise profile is temporarily unavailable";
+      throw new EnterpriseProfileError(message, {
+        status: res.status,
+        code: body.code,
+        retryable: body.retryable
+      });
+    }
+    return await res.json();
+  }
   async getAccessToken() {
     const token = this.storage.getAccessToken();
     if (token && !this.storage.isTokenExpired()) return token;
@@ -500,6 +547,7 @@ var IdaasClient = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  EnterpriseProfileError,
   IdaasClient,
   TokenStorage,
   createPKCE,

package/dist/index.mjs

@@ -153,33 +153,48 @@ var TokenStorage = class {
   key(name) {
     return `${this.prefix}:${name}`;
   }
+  migrateTokenValue(name) {
+    const key = this.key(name);
+    const current = localStorage.getItem(key);
+    if (current) return current;
+    const legacy = sessionStorage.getItem(key);
+    if (!legacy) return null;
+    localStorage.setItem(key, legacy);
+    sessionStorage.removeItem(key);
+    return legacy;
+  }
   saveTokens(tokens) {
     const expiresAt = Date.now() + tokens.expires_in * 1e3;
-    sessionStorage.setItem(this.key("access_token"), tokens.access_token);
-    sessionStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    localStorage.setItem(this.key("access_token"), tokens.access_token);
+    localStorage.setItem(this.key("expires_at"), expiresAt.toString());
+    sessionStorage.removeItem(this.key("access_token"));
+    sessionStorage.removeItem(this.key("expires_at"));
     if (tokens.id_token) {
-      sessionStorage.setItem(this.key("id_token"), tokens.id_token);
+      localStorage.setItem(this.key("id_token"), tokens.id_token);
+      sessionStorage.removeItem(this.key("id_token"));
     }
     if (tokens.refresh_token) {
       localStorage.setItem(this.key("refresh_token"), tokens.refresh_token);
     }
-    sessionStorage.setItem(this.key("scope"), tokens.scope);
+    localStorage.setItem(this.key("scope"), tokens.scope);
+    sessionStorage.removeItem(this.key("scope"));
   }
   getAccessToken() {
-    const token = sessionStorage.getItem(this.key("access_token"));
-    const expiresAt = sessionStorage.getItem(this.key("expires_at"));
+    const token = this.migrateTokenValue("access_token");
+    const expiresAt = this.migrateTokenValue("expires_at");
+    this.migrateTokenValue("scope");
     if (!token || !expiresAt) return null;
     if (Date.now() > parseInt(expiresAt, 10)) return null;
     return token;
   }
   getIdToken() {
-    return sessionStorage.getItem(this.key("id_token"));
+    return this.migrateTokenValue("id_token");
   }
   getRefreshToken() {
     return localStorage.getItem(this.key("refresh_token"));
   }
   getExpiresAt() {
-    const val = sessionStorage.getItem(this.key("expires_at"));
+    const val = this.migrateTokenValue("expires_at");
     return val ? parseInt(val, 10) : null;
   }
   isTokenExpired() {
@@ -188,11 +203,15 @@ var TokenStorage = class {
     return Date.now() > expiresAt - 6e4;
   }
   clear() {
+    localStorage.removeItem(this.key("access_token"));
+    localStorage.removeItem(this.key("id_token"));
+    localStorage.removeItem(this.key("expires_at"));
+    localStorage.removeItem(this.key("scope"));
+    localStorage.removeItem(this.key("refresh_token"));
     sessionStorage.removeItem(this.key("access_token"));
     sessionStorage.removeItem(this.key("id_token"));
     sessionStorage.removeItem(this.key("expires_at"));
     sessionStorage.removeItem(this.key("scope"));
-    localStorage.removeItem(this.key("refresh_token"));
   }
   saveState(state) {
     sessionStorage.setItem(this.key("state"), state);
@@ -220,6 +239,15 @@ var TokenStorage = class {
 };
 
 // src/client.ts
+var EnterpriseProfileError = class extends Error {
+  constructor(message, options) {
+    super(message);
+    this.name = "EnterpriseProfileError";
+    this.status = options.status;
+    this.code = options.code;
+    this.retryable = options.retryable ?? options.status >= 500;
+  }
+};
 var IdaasClient = class {
   constructor(config) {
     this.endpoints = null;
@@ -241,6 +269,7 @@ var IdaasClient = class {
         authorization_endpoint: `${this.config.issuer}/oauth2/authorize`,
         token_endpoint: `${this.config.issuer}/oauth2/token`,
         userinfo_endpoint: `${this.config.issuer}/oauth2/userinfo`,
+        enterprise_profile_endpoint: `${this.config.issuer}/oauth2/enterprise-profile`,
         end_session_endpoint: `${this.config.issuer}/oauth2/logout`,
         jwks_uri: `${this.config.issuer}/.well-known/jwks.json`,
         revocation_endpoint: `${this.config.issuer}/oauth2/revoke`,
@@ -258,6 +287,7 @@ var IdaasClient = class {
       authorization_endpoint: doc.authorization_endpoint,
       token_endpoint: doc.token_endpoint,
       userinfo_endpoint: doc.userinfo_endpoint,
+      enterprise_profile_endpoint: doc.enterprise_profile_endpoint || `${this.config.issuer}/oauth2/enterprise-profile`,
       end_session_endpoint: doc.end_session_endpoint,
       jwks_uri: doc.jwks_uri,
       revocation_endpoint: doc.revocation_endpoint,
@@ -309,9 +339,6 @@ var IdaasClient = class {
       client_id: this.config.clientId,
       code_verifier: codeVerifier
     });
-    if (this.config.clientSecret) {
-      body.set("client_secret", this.config.clientSecret);
-    }
     const res = await fetch(this.endpoints.token_endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -335,9 +362,6 @@ var IdaasClient = class {
       refresh_token: refreshToken,
       client_id: this.config.clientId
     });
-    if (this.config.clientSecret) {
-      body.set("client_secret", this.config.clientSecret);
-    }
     const res = await fetch(this.endpoints.token_endpoint, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -363,6 +387,28 @@ var IdaasClient = class {
     this.userInfo = await res.json();
     return this.userInfo;
   }
+  /**
+   * Fetch sensitive attributes for the current user. The server enforces both
+   * the client's scope allowlist and the user's consent before returning fields.
+   */
+  async getEnterpriseProfile() {
+    if (!this.endpoints) await this.init();
+    const accessToken = await this.getAccessToken();
+    if (!accessToken) return null;
+    const res = await fetch(this.endpoints.enterprise_profile_endpoint, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) {
+      const body = await res.json().catch(() => ({}));
+      const message = Array.isArray(body.message) ? body.message.join(", ") : body.message || "Enterprise profile is temporarily unavailable";
+      throw new EnterpriseProfileError(message, {
+        status: res.status,
+        code: body.code,
+        retryable: body.retryable
+      });
+    }
+    return await res.json();
+  }
   async getAccessToken() {
     const token = this.storage.getAccessToken();
     if (token && !this.storage.isTokenExpired()) return token;
@@ -469,6 +515,7 @@ var IdaasClient = class {
   }
 };
 export {
+  EnterpriseProfileError,
   IdaasClient,
   TokenStorage,
   createPKCE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zskj-idaas/sdk",
-  "version": "1.0.3",
+  "version": "2.3.0",
   "description": "IDaaS OIDC Client SDK for browser applications — supports Authorization Code Flow with PKCE, token management, and authenticated fetch.",
   "main": "dist/index.js",
   "module": "dist/index.mjs",