binoauth 0.0.11 → 0.0.13

package/dist/core/src/oauth/storage/index.d.ts

@@ -0,0 +1,201 @@
+import type { StorageConfig, StorageStrategy, Token, TokenSet } from "../types";
+import { Encryptor } from "./encryption";
+type TokenType = "access_token" | "refresh_token" | "id_token" | "state" | "verifier";
+/**
+ * Secure token storage with encryption support
+ *
+ * Manages OAuth tokens with automatic encryption, storage strategy selection,
+ * and secure token operations. Supports multiple storage backends including
+ * memory, localStorage, sessionStorage, and secure cookies.
+ *
+ * Features:
+ * - Automatic token encryption/decryption
+ * - Multiple storage strategies (memory, web storage, secure cookies)
+ * - Token expiration checking
+ * - Secure token clearing
+ * - Cross-platform compatibility (browser/Node.js)
+ *
+ * @example
+ * ```typescript
+ * import { TokenStorage, InMemoryTokenStorage } from 'binoauth';
+ *
+ * // Basic configuration
+ * const storage = new TokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-32-char-encryption-key-here!',
+ *   storage: 'localStorage',
+ *   secure: true
+ * });
+ *
+ * // Store tokens
+ * await storage.setTokens({
+ *   accessToken: { value: 'access_token_jwt', expiresAt: Date.now() + 3600000 },
+ *   refreshToken: { value: 'refresh_token_jwt', expiresAt: Date.now() + 86400000 }
+ * });
+ *
+ * // Retrieve tokens
+ * const accessToken = await storage.getAccessToken();
+ * if (accessToken && !storage.isTokenExpired(accessToken)) {
+ *   console.log('Valid access token:', accessToken.value);
+ * }
+ *
+ * // Clear all tokens
+ * storage.clearTokens();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Using pre-configured storage strategies
+ * import { InMemoryTokenStorage, LocalStorageTokenStorage } from 'binoauth';
+ *
+ * // In-memory storage (for server-side or testing)
+ * const memoryStorage = new InMemoryTokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-encryption-key'
+ * });
+ *
+ * // localStorage storage (for browsers)
+ * const localStorageStorage = new LocalStorageTokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-encryption-key'
+ * });
+ * ```
+ */
+export declare class TokenStorage {
+    protected config: StorageConfig;
+    protected strategy: StorageStrategy;
+    protected readonly prefix: string;
+    protected encryptor: Encryptor;
+    protected readonly isBrowser: boolean;
+    protected encryptorInitialized: boolean;
+    /**
+     * Creates a new TokenStorage instance
+     *
+     * @param config - Storage configuration including encryption key and storage type
+     *
+     * @example
+     * ```typescript
+     * const storage = new TokenStorage({
+     *   clientId: 'your_client_id',
+     *   encryptionKey: 'your-32-char-encryption-key-here!',
+     *   storage: 'localStorage', // 'memory', 'localStorage', 'sessionStorage'
+     *   prefix: 'myapp_auth_', // optional custom prefix
+     *   secure: true // enables secure cookies in browser
+     * });
+     * ```
+     *
+     * @throws {Error} When encryptionKey is missing from config
+     */
+    constructor(config: StorageConfig);
+    protected initializeEncryptor(): Promise<void>;
+    /**
+     * Sets a custom storage strategy
+     *
+     * @param strategy - Storage strategy implementation
+     *
+     * @example
+     * ```typescript
+     * import { MemoryStorageStrategy } from 'binoauth';
+     *
+     * const customStrategy = new MemoryStorageStrategy();
+     * storage.setStrategy(customStrategy);
+     * ```
+     */
+    setStrategy(strategy: StorageStrategy): void;
+    /**
+     * Gets the current storage strategy
+     *
+     * @returns The current storage strategy instance
+     */
+    getStrategy(): StorageStrategy;
+    protected createDefaultStrategy(): StorageStrategy;
+    getPrefix(): string;
+    protected generatePrefix(config: StorageConfig): string;
+    protected safeCreateWebStorage(getStorage: () => Storage): StorageStrategy;
+    protected getKey(key: string): string;
+    /**
+     * Stores encrypted tokens in the configured storage
+     *
+     * @param tokens - Set of tokens to store
+     *
+     * @example
+     * ```typescript
+     * await storage.setTokens({
+     *   accessToken: {
+     *     value: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+     *     expiresAt: Date.now() + 3600000
+     *   },
+     *   refreshToken: {
+     *     value: 'refresh_token_jwt',
+     *     expiresAt: Date.now() + 86400000
+     *   }
+     * });
+     * ```
+     *
+     * @throws {Error} When token storage fails
+     */
+    setTokens(tokens: TokenSet): Promise<void>;
+    getToken(type: TokenType): Promise<Token | null>;
+    /**
+     * Retrieves and decrypts the access token
+     *
+     * @returns Promise resolving to access token or null if not found
+     *
+     * @example
+     * ```typescript
+     * const accessToken = await storage.getAccessToken();
+     * if (accessToken && !storage.isTokenExpired(accessToken)) {
+     *   console.log('Valid token:', accessToken.value);
+     * }
+     * ```
+     */
+    getAccessToken(): Promise<Token | null>;
+    /**
+     * Retrieves and decrypts the refresh token
+     *
+     * @returns Promise resolving to refresh token or null if not found
+     */
+    getRefreshToken(): Promise<Token | null>;
+    /**
+     * Retrieves and decrypts the ID token
+     *
+     * @returns Promise resolving to ID token or null if not found
+     */
+    getIdToken(): Promise<Token | null>;
+    getStateToken(): Promise<Token | null>;
+    getVerifierToken(): Promise<Token | null>;
+    /**
+     * Clears all stored tokens
+     *
+     * @example
+     * ```typescript
+     * // Clear all tokens on logout
+     * storage.clearTokens();
+     * ```
+     */
+    clearTokens(): void;
+    /**
+     * Clears only state and verifier tokens (used after OAuth callback)
+     */
+    clearStateAndVerifier(): void;
+    /**
+     * Checks if a token is expired
+     *
+     * @param token - Token to check
+     * @returns True if token is expired or null, false if still valid
+     *
+     * @example
+     * ```typescript
+     * const accessToken = await storage.getAccessToken();
+     * if (storage.isTokenExpired(accessToken)) {
+     *   console.log('Token expired, need to refresh');
+     * }
+     * ```
+     */
+    isTokenExpired(token: Token | null): boolean;
+    setItem(key: string, value: string): void;
+    getItem(key: string): string | null;
+    removeItem(key: string): void;
+}
+export { TokenStorage as default };
+//# sourceMappingURL=index.d.ts.map

package/dist/core/src/oauth/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAMhF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,KAAK,SAAS,GACV,cAAc,GACd,eAAe,GACf,UAAU,GACV,OAAO,GACP,UAAU,CAAC;AAEf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,qBAAa,YAAY;IAyBX,SAAS,CAAC,MAAM,EAAE,aAAa;IAxB3C,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC;IACpC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;IAC/B,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IACtC,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAS;IAEhD;;;;;;;;;;;;;;;;;OAiBG;gBACmB,MAAM,EAAE,aAAa;cAa3B,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOpD;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAO5C;;;;OAIG;IACH,WAAW,IAAI,eAAe;IAI9B,SAAS,CAAC,qBAAqB,IAAI,eAAe;IAkBlD,SAAS,IAAI,MAAM;IAInB,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM;IAYvD,SAAS,CAAC,oBAAoB,CAAC,UAAU,EAAE,MAAM,OAAO,GAAG,eAAe;IAc1E,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B1C,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAetD;;;;;;;;;;;;OAYG;IACG,cAAc,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI7C;;;;OAIG;IACG,eAAe,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI9C;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAInC,aAAa,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAItC,gBAAgB,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;IAI/C;;;;;;;;OAQG;IACH,WAAW,IAAI,IAAI;IAcnB;;OAEG;IACH,qBAAqB,IAAI,IAAI;IAK7B;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,GAAG,OAAO;IAK5C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B;AAED,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,CAAC"}

package/dist/core/src/oauth/storage/index.js

@@ -0,0 +1,322 @@
+import { MemoryStorageStrategy, WebStorageStrategy, SecureCookieStrategy, } from "./strategies";
+import { Encryptor } from "./encryption";
+/**
+ * Secure token storage with encryption support
+ *
+ * Manages OAuth tokens with automatic encryption, storage strategy selection,
+ * and secure token operations. Supports multiple storage backends including
+ * memory, localStorage, sessionStorage, and secure cookies.
+ *
+ * Features:
+ * - Automatic token encryption/decryption
+ * - Multiple storage strategies (memory, web storage, secure cookies)
+ * - Token expiration checking
+ * - Secure token clearing
+ * - Cross-platform compatibility (browser/Node.js)
+ *
+ * @example
+ * ```typescript
+ * import { TokenStorage, InMemoryTokenStorage } from 'binoauth';
+ *
+ * // Basic configuration
+ * const storage = new TokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-32-char-encryption-key-here!',
+ *   storage: 'localStorage',
+ *   secure: true
+ * });
+ *
+ * // Store tokens
+ * await storage.setTokens({
+ *   accessToken: { value: 'access_token_jwt', expiresAt: Date.now() + 3600000 },
+ *   refreshToken: { value: 'refresh_token_jwt', expiresAt: Date.now() + 86400000 }
+ * });
+ *
+ * // Retrieve tokens
+ * const accessToken = await storage.getAccessToken();
+ * if (accessToken && !storage.isTokenExpired(accessToken)) {
+ *   console.log('Valid access token:', accessToken.value);
+ * }
+ *
+ * // Clear all tokens
+ * storage.clearTokens();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Using pre-configured storage strategies
+ * import { InMemoryTokenStorage, LocalStorageTokenStorage } from 'binoauth';
+ *
+ * // In-memory storage (for server-side or testing)
+ * const memoryStorage = new InMemoryTokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-encryption-key'
+ * });
+ *
+ * // localStorage storage (for browsers)
+ * const localStorageStorage = new LocalStorageTokenStorage({
+ *   clientId: 'your_client_id',
+ *   encryptionKey: 'your-encryption-key'
+ * });
+ * ```
+ */
+export class TokenStorage {
+    config;
+    strategy;
+    prefix;
+    encryptor;
+    isBrowser;
+    encryptorInitialized = false;
+    /**
+     * Creates a new TokenStorage instance
+     *
+     * @param config - Storage configuration including encryption key and storage type
+     *
+     * @example
+     * ```typescript
+     * const storage = new TokenStorage({
+     *   clientId: 'your_client_id',
+     *   encryptionKey: 'your-32-char-encryption-key-here!',
+     *   storage: 'localStorage', // 'memory', 'localStorage', 'sessionStorage'
+     *   prefix: 'myapp_auth_', // optional custom prefix
+     *   secure: true // enables secure cookies in browser
+     * });
+     * ```
+     *
+     * @throws {Error} When encryptionKey is missing from config
+     */
+    constructor(config) {
+        this.config = config;
+        if (!config.encryptionKey) {
+            throw new Error("encryptionKey is required in StorageConfig");
+        }
+        this.isBrowser =
+            typeof window !== "undefined" && typeof document !== "undefined";
+        this.prefix = this.generatePrefix(config);
+        this.encryptor = new Encryptor();
+        this.strategy = this.createDefaultStrategy();
+    }
+    async initializeEncryptor() {
+        if (!this.encryptorInitialized) {
+            await this.encryptor.initialize(this.config.encryptionKey);
+            this.encryptorInitialized = true;
+        }
+    }
+    /**
+     * Sets a custom storage strategy
+     *
+     * @param strategy - Storage strategy implementation
+     *
+     * @example
+     * ```typescript
+     * import { MemoryStorageStrategy } from 'binoauth';
+     *
+     * const customStrategy = new MemoryStorageStrategy();
+     * storage.setStrategy(customStrategy);
+     * ```
+     */
+    setStrategy(strategy) {
+        if (!strategy) {
+            throw new Error("Strategy cannot be null or undefined");
+        }
+        this.strategy = strategy;
+    }
+    /**
+     * Gets the current storage strategy
+     *
+     * @returns The current storage strategy instance
+     */
+    getStrategy() {
+        return this.strategy;
+    }
+    createDefaultStrategy() {
+        if (this.config.secure) {
+            if (this.isBrowser) {
+                return new SecureCookieStrategy();
+            }
+            return new MemoryStorageStrategy();
+        }
+        switch (this.config.storage) {
+            case "localStorage":
+                return this.safeCreateWebStorage(() => localStorage);
+            case "sessionStorage":
+                return this.safeCreateWebStorage(() => sessionStorage);
+            default:
+                return new MemoryStorageStrategy();
+        }
+    }
+    getPrefix() {
+        return this.prefix;
+    }
+    generatePrefix(config) {
+        if (config.prefix) {
+            return config.prefix;
+        }
+        if (config.clientId) {
+            return `auth_${config.clientId}_`;
+        }
+        return "auth_";
+    }
+    safeCreateWebStorage(getStorage) {
+        if (this.isBrowser) {
+            try {
+                const storage = getStorage();
+                storage.setItem("test", "test");
+                storage.removeItem("test");
+                return new WebStorageStrategy(storage);
+            }
+            catch (e) {
+                console.warn("Web storage unavailable, falling back to memory");
+            }
+        }
+        return new MemoryStorageStrategy();
+    }
+    getKey(key) {
+        return `${this.prefix}${key}`;
+    }
+    /**
+     * Stores encrypted tokens in the configured storage
+     *
+     * @param tokens - Set of tokens to store
+     *
+     * @example
+     * ```typescript
+     * await storage.setTokens({
+     *   accessToken: {
+     *     value: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+     *     expiresAt: Date.now() + 3600000
+     *   },
+     *   refreshToken: {
+     *     value: 'refresh_token_jwt',
+     *     expiresAt: Date.now() + 86400000
+     *   }
+     * });
+     * ```
+     *
+     * @throws {Error} When token storage fails
+     */
+    async setTokens(tokens) {
+        await this.initializeEncryptor();
+        const entries = Object.entries(tokens).filter(([_, value]) => !!value);
+        try {
+            await Promise.all(entries.map(async ([type, token]) => {
+                const encrypted = await this.encryptor.encrypt(JSON.stringify(token));
+                this.strategy.setItem(this.getKey(type.replace(/Token$/, "_token").toLowerCase()), encrypted);
+            }));
+        }
+        catch (error) {
+            this.clearTokens();
+            throw new Error(`Failed to store tokens: ${error instanceof Error ? error.message : error}`);
+        }
+    }
+    async getToken(type) {
+        await this.initializeEncryptor();
+        const encrypted = this.strategy.getItem(this.getKey(type));
+        if (!encrypted)
+            return null;
+        try {
+            const decrypted = await this.encryptor.decrypt(encrypted);
+            return JSON.parse(decrypted);
+        }
+        catch (error) {
+            console.warn(`Error decrypting token (${type}):`, error);
+            return null;
+        }
+    }
+    /**
+     * Retrieves and decrypts the access token
+     *
+     * @returns Promise resolving to access token or null if not found
+     *
+     * @example
+     * ```typescript
+     * const accessToken = await storage.getAccessToken();
+     * if (accessToken && !storage.isTokenExpired(accessToken)) {
+     *   console.log('Valid token:', accessToken.value);
+     * }
+     * ```
+     */
+    async getAccessToken() {
+        return this.getToken("access_token");
+    }
+    /**
+     * Retrieves and decrypts the refresh token
+     *
+     * @returns Promise resolving to refresh token or null if not found
+     */
+    async getRefreshToken() {
+        return this.getToken("refresh_token");
+    }
+    /**
+     * Retrieves and decrypts the ID token
+     *
+     * @returns Promise resolving to ID token or null if not found
+     */
+    async getIdToken() {
+        return this.getToken("id_token");
+    }
+    async getStateToken() {
+        return this.getToken("state");
+    }
+    async getVerifierToken() {
+        return this.getToken("verifier");
+    }
+    /**
+     * Clears all stored tokens
+     *
+     * @example
+     * ```typescript
+     * // Clear all tokens on logout
+     * storage.clearTokens();
+     * ```
+     */
+    clearTokens() {
+        const tokenTypes = [
+            "access_token",
+            "refresh_token",
+            "id_token",
+            "state",
+            "verifier"
+        ];
+        tokenTypes.forEach(type => {
+            this.strategy.removeItem(this.getKey(type));
+        });
+    }
+    /**
+     * Clears only state and verifier tokens (used after OAuth callback)
+     */
+    clearStateAndVerifier() {
+        this.strategy.removeItem(this.getKey("state"));
+        this.strategy.removeItem(this.getKey("verifier"));
+    }
+    /**
+     * Checks if a token is expired
+     *
+     * @param token - Token to check
+     * @returns True if token is expired or null, false if still valid
+     *
+     * @example
+     * ```typescript
+     * const accessToken = await storage.getAccessToken();
+     * if (storage.isTokenExpired(accessToken)) {
+     *   console.log('Token expired, need to refresh');
+     * }
+     * ```
+     */
+    isTokenExpired(token) {
+        if (!token || !token.expiresAt)
+            return true;
+        return Date.now() >= token.expiresAt;
+    }
+    setItem(key, value) {
+        this.strategy.setItem(this.getKey(key), value);
+    }
+    getItem(key) {
+        return this.strategy.getItem(this.getKey(key));
+    }
+    removeItem(key) {
+        this.strategy.removeItem(this.getKey(key));
+    }
+}
+export { TokenStorage as default };
+//# sourceMappingURL=index.js.map

package/dist/core/src/oauth/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/oauth/storage/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,OAAO,YAAY;IAyBD;IAxBZ,QAAQ,CAAkB;IACjB,MAAM,CAAS;IACxB,SAAS,CAAY;IACZ,SAAS,CAAU;IAC5B,oBAAoB,GAAY,KAAK,CAAC;IAEhD;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAsB,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,SAAS;YACZ,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW,CAAC;QACnE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;QAEjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/C,CAAC;IAES,KAAK,CAAC,mBAAmB;QACjC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAC;YACrE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAyB;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAES,qBAAqB;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO,IAAI,oBAAoB,EAAE,CAAC;YACpC,CAAC;YACD,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACrC,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC5B,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;YACvD,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;YACzD;gBACE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAES,cAAc,CAAC,MAAqB;QAC5C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,QAAQ,MAAM,CAAC,QAAQ,GAAG,CAAC;QACpC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,oBAAoB,CAAC,UAAyB;QACtD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;gBAC7B,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAChC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,qBAAqB,EAAE,CAAC;IACrC,CAAC;IAES,MAAM,CAAC,GAAW;QAC1B,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,SAAS,CAAC,MAAgB;QAC9B,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAGlE,CAAC;QAEJ,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;gBAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,IAAI,CAAC,QAAQ,CAAC,OAAO,CACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,EAC3D,SAAS,CACV,CAAC;YACJ,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAe;QAC5B,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW;QACT,MAAM,UAAU,GAAgB;YAC9B,cAAc;YACd,eAAe;YACf,UAAU;YACV,OAAO;YACP,UAAU;SACX,CAAC;QAEF,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,KAAmB;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,OAAO,EAAE,YAAY,IAAI,OAAO,EAAE,CAAC"}

package/dist/core/src/oauth/storage/strategies.d.ts

@@ -0,0 +1,34 @@
+import type { StorageStrategy } from "../types";
+export declare class MemoryStorageStrategy implements StorageStrategy {
+    private storage;
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+    clear(): void;
+}
+export declare class WebStorageStrategy implements StorageStrategy {
+    private storage;
+    constructor(storage: Storage);
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+    clear(): void;
+}
+export declare class SecureCookieStrategy implements StorageStrategy {
+    private options;
+    constructor(options?: {
+        secure?: boolean;
+        sameSite?: "strict" | "lax" | "none";
+        path?: string;
+        httpOnly?: boolean;
+        maxAge?: number;
+        domain?: string;
+    });
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+    clear(): void;
+    private setCookie;
+    private getCookie;
+}
+//# sourceMappingURL=strategies.d.ts.map

package/dist/core/src/oauth/storage/strategies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategies.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/storage/strategies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAE5C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,KAAK,IAAI,IAAI;CAGd;AAED,qBAAa,kBAAmB,YAAW,eAAe;IAC5C,OAAO,CAAC,OAAO;gBAAP,OAAO,EAAE,OAAO;IAEpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAInC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,KAAK,IAAI,IAAI;CAGd;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC1D,OAAO,CAAC,OAAO,CAOb;gBAEU,OAAO,CAAC,EAAE;QACpB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAqBD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUnC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIzC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAO7B,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,SAAS;IAwBjB,OAAO,CAAC,SAAS;CAUlB"}

package/dist/core/src/oauth/storage/strategies.js

@@ -0,0 +1,100 @@
+export class MemoryStorageStrategy {
+    storage = new Map();
+    getItem(key) {
+        return this.storage.get(key) || null;
+    }
+    setItem(key, value) {
+        this.storage.set(key, value);
+    }
+    removeItem(key) {
+        this.storage.delete(key);
+    }
+    clear() {
+        this.storage.clear();
+    }
+}
+export class WebStorageStrategy {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    getItem(key) {
+        return this.storage.getItem(key);
+    }
+    setItem(key, value) {
+        this.storage.setItem(key, value);
+    }
+    removeItem(key) {
+        this.storage.removeItem(key);
+    }
+    clear() {
+        this.storage.clear();
+    }
+}
+export class SecureCookieStrategy {
+    options;
+    constructor(options) {
+        const isProduction = typeof process !== 'undefined' && process.env.NODE_ENV === 'production';
+        this.options = {
+            secure: isProduction,
+            sameSite: "lax",
+            path: "/",
+            httpOnly: true,
+            maxAge: 3600,
+            ...options,
+        };
+        if (!this.options.secure && isProduction) {
+            console.warn('SECURITY WARNING: Cookies are not marked secure in production environment');
+        }
+        if (!this.options.httpOnly) {
+            console.warn('SECURITY WARNING: Cookies are not httpOnly - vulnerable to XSS attacks');
+        }
+    }
+    getItem(key) {
+        if (this.options.httpOnly) {
+            console.warn("Cannot read httpOnly cookies from JavaScript. Consider using server-side storage for httpOnly cookies.");
+            return null;
+        }
+        return this.getCookie(key);
+    }
+    setItem(key, value) {
+        this.setCookie(key, value, this.options);
+    }
+    removeItem(key) {
+        this.setCookie(key, "", {
+            ...this.options,
+            maxAge: 0,
+        });
+    }
+    clear() {
+        console.warn("SecureCookieStrategy.clear() cannot selectively clear cookies. " +
+            "Use TokenStorage.clearTokens() for safe token clearing.");
+    }
+    setCookie(name, value, options) {
+        let cookie = `${name}=${encodeURIComponent(value)}`;
+        if (options.secure)
+            cookie += ";secure";
+        if (options.sameSite)
+            cookie += `;samesite=${options.sameSite}`;
+        if (options.path)
+            cookie += `;path=${options.path}`;
+        if (options.httpOnly)
+            cookie += ";httponly";
+        if (options.maxAge !== undefined)
+            cookie += `;max-age=${options.maxAge}`;
+        if (options.domain)
+            cookie += `;domain=${options.domain}`;
+        document.cookie = cookie;
+    }
+    getCookie(name) {
+        const cookies = document.cookie.split(";");
+        for (const cookie of cookies) {
+            const [key, value] = cookie.split("=");
+            if (key.trim() === name) {
+                return decodeURIComponent(value);
+            }
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=strategies.js.map

package/dist/core/src/oauth/storage/strategies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategies.js","sourceRoot":"","sources":["../../../../../src/oauth/storage/strategies.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,qBAAqB;IACxB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACT;IAApB,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAExC,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACvB,OAAO,CAOb;IAEF,YAAY,OAOX;QACC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE7F,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,GAAG,OAAO;SACX,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CACV,wGAAwG,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,KAAa;QAChC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE;YACtB,GAAG,IAAI,CAAC,OAAO;YACf,MAAM,EAAE,CAAC;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,OAAO,CAAC,IAAI,CACV,iEAAiE;YACjE,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,IAAY,EACZ,KAAa,EACb,OAOC;QAED,IAAI,MAAM,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAEpD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;QAE1D,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;IAC3B,CAAC;IAEO,SAAS,CAAC,IAAY;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}