capacitor-oidc 0.0.1-alpha.0 → 0.0.1-alpha.2

package/CapacitorOidc.podspec

@@ -1,6 +1,7 @@
 require 'json'
 
 package = JSON.parse(File.read(File.join(__dir__, 'package.json')))
+repository_url = package['repository']['url'].sub(/\Agit\+/, '')
 
 Pod::Spec.new do |spec|
   spec.name = 'CapacitorOidc'
@@ -9,9 +10,9 @@ Pod::Spec.new do |spec|
   spec.license = package['license']
   spec.homepage = package['homepage']
   spec.author = package['author']
-  spec.source = { git: package['repository']['url'], tag: spec.version.to_s }
+  spec.source = { git: repository_url, tag: spec.version.to_s }
   spec.source_files = 'ios/Sources/**/*.{swift,h,m,c,cc,mm,cpp}'
   spec.ios.deployment_target = '15.0'
-  spec.dependency 'Capacitor'
+  spec.dependency 'Capacitor', '>= 7.0'
   spec.swift_version = '5.9'
 end

package/Package.swift

@@ -8,7 +8,7 @@ let package = Package(
         .library(name: "CapacitorOidc", targets: ["CapacitorOidcPlugin"])
     ],
     dependencies: [
-        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")
+        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", "7.0.0"..<"9.0.0")
     ],
     targets: [
         .target(

package/README.md

@@ -20,6 +20,8 @@ npm install capacitor-oidc oidc-client-ts @capacitor/app
 npx cap sync
 ```
 
+The package supports Capacitor 7 and newer.
+
 All discovery, token, refresh, UserInfo, and revocation requests use normal WebView `fetch`. The provider must allow the app's configured Capacitor origin through CORS.
 
 Authorization and logout endpoints must use HTTPS. Plain HTTP is accepted only for loopback local development.
@@ -40,11 +42,11 @@ const manager = await CapacitorUserManager.create(
     revokeTokensOnSignout: true,
   },
   {
+    prefersEphemeralWebBrowserSession: false,
     storageNamespace: 'primary',
     ios: {
       keychainAccessGroup: 'TEAMID.group.com.example.app',
       keychainAccessibility: 'afterFirstUnlockThisDeviceOnly',
-      prefersEphemeralWebBrowserSession: false,
     },
   },
 );
@@ -65,9 +67,35 @@ Register the redirect URI as a native public-client redirect at the provider. Ne
 
 For an iOS custom scheme, add it to the application target's `CFBundleURLTypes`. HTTPS callbacks through `ASWebAuthenticationSession` require iOS 17.4 or newer and the appropriate Associated Domains configuration.
 
-For Android custom-scheme fallback, add an intent filter to the app's `BridgeActivity`. HTTPS callbacks require a verified App Link and Digital Asset Links. Auth Tab handles the result directly when the installed browser supports it; its intent is intentionally compatible with Custom Tabs on older browsers.
+For an Android custom-scheme redirect, keep the host app's `MainActivity` in Capacitor's default `singleTask` launch mode and add this intent filter inside that existing activity declaration. This ensures callbacks from Auth Tab's Custom Tab fallback reach the plugin instance that opened the session. Replace the scheme with the one used by your redirect URI:
+
+```xml
+<activity
+  android:name=".MainActivity"
+  android:launchMode="singleTask">
+  <intent-filter>
+    <action android:name="android.intent.action.VIEW" />
+    <category android:name="android.intent.category.DEFAULT" />
+    <category android:name="android.intent.category.BROWSABLE" />
+    <data android:scheme="com.example.app" />
+  </intent-filter>
+</activity>
+```
+
+HTTPS callbacks require a verified App Link and Digital Asset Links. Auth Tab handles the result directly when the installed browser supports it and falls back to a Custom Tab on older browsers.
+
+Calling `cancel()` on Android rejects the pending JavaScript promise, but Android does not provide an API to forcibly close an already-open system Auth Tab or Custom Tab. Ephemeral browsing is requested on both platforms and may be ignored by an Android fallback browser.
+
+Provider-specific logout parameters remain available through `oidc-client-ts`. For Amazon Cognito, leave `post_logout_redirect_uri` unset in the manager settings and pass its `client_id` and `logout_uri` parameters when signing out:
 
-Calling `cancel()` on Android rejects the pending JavaScript promise, but Android does not provide an API to forcibly close an already-open system Auth Tab or Custom Tab. Ephemeral browsing is a request to the installed browser and may be ignored by a fallback browser.
+```ts
+await manager.signout({
+  extraQueryParams: {
+    client_id: 'mobile-app',
+    logout_uri: 'com.example.app:/logout-callback',
+  },
+});
+```
 
 ## Secure storage and widgets
 

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security
+
+## Design boundary
+
+`capacitor-oidc` delegates OAuth and OpenID Connect protocol behavior to
+`oidc-client-ts`. Native code is limited to presenting system authentication UI
+and storing state securely. The package does not patch `fetch`, process JWTs, or
+implement OAuth endpoints in Swift or Java.
+
+## Known limitation in the pinned OIDC engine
+
+This prerelease pins `oidc-client-ts` 3.5.0. Its ID-token response validation
+checks `sub`, `nonce`, and selected refresh-token continuity claims, but does not
+check the required `iss`, `aud`, and `exp` claims. The behavior is visible in the
+[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
+and is tracked in [authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
+
+The current alpha must not be treated as production-ready. Before a stable
+release, use an upstream version that performs the required validation and cover
+it with provider integration tests, or replace ADR 0001 with a different protocol
+engine decision. Do not add package-local JWT or cryptographic validation as a
+workaround.
+
+## Runtime assumptions
+
+`oidc-client-ts` requires `crypto.subtle` and `crypto.getRandomValues`.
+`CapacitorUserManager.create()` rejects with `UNSUPPORTED_RUNTIME` when they are
+absent. Their presence and behavior must also be verified in packaged applications
+on physical iOS and Android devices.
+
+See [Testing](docs/TESTING.md) for the remaining device and provider coverage.

package/android/build.gradle

@@ -14,7 +14,7 @@ buildscript {
         mavenCentral()
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:8.13.0'
+        classpath 'com.android.tools.build:gradle:8.9.1'
     }
 }
 

package/android/src/main/java/com/jojopirker/capacitor/oidc/CapacitorOidcPlugin.java

@@ -16,9 +16,15 @@ import java.security.GeneralSecurityException;
 import java.util.List;
 import org.json.JSONObject;
 
-@CapacitorPlugin(name = NativeContract.PLUGIN_NAME)
+@CapacitorPlugin(name = "CapacitorOidc")
 public final class CapacitorOidcPlugin extends Plugin {
 
+    private static final String AUTH_SESSION_IN_PROGRESS = "AUTH_SESSION_IN_PROGRESS";
+    private static final String USER_CANCELLED = "USER_CANCELLED";
+    private static final String BROWSER_UNAVAILABLE = "BROWSER_UNAVAILABLE";
+    private static final String INVALID_CALLBACK = "INVALID_CALLBACK";
+    private static final String SECURE_STORAGE_ERROR = "SECURE_STORAGE_ERROR";
+
     private ActivityResultLauncher<Intent> authLauncher;
     private PluginCall pendingAuthCall;
     private Uri pendingCallback;
@@ -38,26 +44,26 @@ public final class CapacitorOidcPlugin extends Plugin {
     @PluginMethod
     public void open(PluginCall call) {
         if (pendingAuthCall != null) {
-            call.reject("An authentication session is already active.", NativeContract.ERROR_AUTH_SESSION_IN_PROGRESS);
+            call.reject("An authentication session is already active.", AUTH_SESSION_IN_PROGRESS);
             return;
         }
 
-        String urlValue = requiredString(call, NativeContract.FIELD_URL);
-        String callbackValue = requiredString(call, NativeContract.FIELD_CALLBACK_URL);
+        String urlValue = requiredString(call, "url");
+        String callbackValue = requiredString(call, "callbackUrl");
         if (urlValue == null || callbackValue == null) return;
 
         Uri url = Uri.parse(urlValue);
         Uri callback = Uri.parse(callbackValue);
         if (!isSecureRequestUrl(url)) {
-            call.reject("The authentication URL must use HTTPS outside loopback development.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+            call.reject("The authentication URL must use HTTPS outside loopback development.", BROWSER_UNAVAILABLE);
             return;
         }
         if (!isSupportedCallback(callback)) {
-            call.reject("The callback URL must use HTTPS or a custom scheme.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The callback URL must use HTTPS or a custom scheme.", INVALID_CALLBACK);
             return;
         }
 
-        boolean ephemeral = Boolean.TRUE.equals(call.getBoolean(NativeContract.FIELD_PREFERS_EPHEMERAL_WEB_BROWSER_SESSION, false));
+        boolean ephemeral = Boolean.TRUE.equals(call.getBoolean("prefersEphemeralWebBrowserSession", false));
         AuthTabIntent authTab = new AuthTabIntent.Builder().setEphemeralBrowsingEnabled(ephemeral).build();
         pendingAuthCall = call;
         pendingCallback = callback;
@@ -70,7 +76,7 @@ public final class CapacitorOidcPlugin extends Plugin {
             }
         } catch (ActivityNotFoundException | IllegalStateException error) {
             clearPendingAuth();
-            call.reject("No compatible system browser is available.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+            call.reject("No compatible system browser is available.", BROWSER_UNAVAILABLE);
         }
     }
 
@@ -78,7 +84,7 @@ public final class CapacitorOidcPlugin extends Plugin {
     public void cancel(PluginCall call) {
         PluginCall authCall = pendingAuthCall;
         clearPendingAuth();
-        if (authCall != null) authCall.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+        if (authCall != null) authCall.reject("The authentication session was cancelled.", USER_CANCELLED);
         call.resolve();
     }
 
@@ -90,15 +96,15 @@ public final class CapacitorOidcPlugin extends Plugin {
 
         clearPendingAuth();
         JSObject response = new JSObject();
-        response.put(NativeContract.FIELD_URL, callback.toString());
+        response.put("url", callback.toString());
         call.resolve(response);
     }
 
     @PluginMethod
     public void storageSet(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
-        String value = call.getString(NativeContract.FIELD_VALUE);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
+        String value = call.getString("value");
         if (namespace == null || key == null) return;
         if (value == null) {
             call.reject("value is required.");
@@ -115,8 +121,8 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageGet(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
         if (namespace == null || key == null) return;
 
         try {
@@ -128,8 +134,8 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageRemove(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
         if (namespace == null || key == null) return;
 
         try {
@@ -141,13 +147,13 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageGetAllKeys(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String namespace = requiredString(call, "namespace");
         if (namespace == null) return;
 
         try {
             List<String> keys = vault.getAllKeys(namespace);
             JSObject result = new JSObject();
-            result.put(NativeContract.FIELD_KEYS, new JSArray(keys));
+            result.put("keys", new JSArray(keys));
             call.resolve(result);
         } catch (GeneralSecurityException | IOException error) {
             rejectStorage(call);
@@ -156,11 +162,11 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void setSessionSnapshot(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String namespace = requiredString(call, "namespace");
         if (namespace == null) return;
 
         try {
-            vault.setSessionSnapshot(namespace, call.getString(NativeContract.FIELD_VALUE));
+            vault.setSessionSnapshot(namespace, call.getString("value"));
             call.resolve();
         } catch (GeneralSecurityException | IOException error) {
             rejectStorage(call);
@@ -174,20 +180,20 @@ public final class CapacitorOidcPlugin extends Plugin {
         if (call == null) return;
 
         if (result.resultCode == AuthTabIntent.RESULT_CANCELED) {
-            call.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+            call.reject("The authentication session was cancelled.", USER_CANCELLED);
             return;
         }
         if (result.resultCode != AuthTabIntent.RESULT_OK || result.resultUri == null) {
-            call.reject("The browser did not return a valid callback.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The browser did not return a valid callback.", INVALID_CALLBACK);
             return;
         }
         if (!CallbackUriMatcher.matches(result.resultUri, expectedCallback)) {
-            call.reject("The authentication callback does not match the configured redirect URL.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The authentication callback does not match the configured redirect URL.", INVALID_CALLBACK);
             return;
         }
 
         JSObject response = new JSObject();
-        response.put(NativeContract.FIELD_URL, result.resultUri.toString());
+        response.put("url", result.resultUri.toString());
         call.resolve(response);
     }
 
@@ -230,11 +236,11 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     private static void resolveValue(PluginCall call, String value) {
         JSObject result = new JSObject();
-        result.put(NativeContract.FIELD_VALUE, value == null ? JSONObject.NULL : value);
+        result.put("value", value == null ? JSONObject.NULL : value);
         call.resolve(result);
     }
 
     private static void rejectStorage(PluginCall call) {
-        call.reject("Secure storage failed.", NativeContract.ERROR_SECURE_STORAGE_ERROR);
+        call.reject("Secure storage failed.", SECURE_STORAGE_ERROR);
     }
 }

package/contracts/fixtures/stored-session-v1.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "issuer": "https://issuer.example",
+  "clientId": "mobile",
+  "accessToken": "access",
+  "refreshToken": "refresh",
+  "idToken": "id-token",
+  "tokenType": "Bearer",
+  "scope": "openid profile offline_access",
+  "expiresAt": 1800000000
+}

package/contracts/stored-session-v1.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/jojopirker/capacitor-oidc/contracts/stored-session-v1.schema.json",
+  "title": "StoredSessionV1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "issuer", "clientId", "accessToken", "tokenType"],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "issuer": {
+      "type": "string",
+      "format": "uri"
+    },
+    "clientId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "accessToken": {
+      "type": "string",
+      "minLength": 1
+    },
+    "refreshToken": {
+      "type": "string"
+    },
+    "idToken": {
+      "type": "string"
+    },
+    "tokenType": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "string"
+    },
+    "expiresAt": {
+      "type": "integer",
+      "minimum": 0
+    }
+  }
+}

package/dist/esm/capacitor-navigator.js

@@ -1,5 +1,4 @@
 import { CapacitorOidcError, unsupported } from './errors';
-import { nativeContract } from './generated/native-contract';
 import { NativeOidc } from './native';
 export class CapacitorNavigator {
     prefersEphemeralWebBrowserSession;
@@ -22,14 +21,14 @@ class CapacitorWindow {
         assertSecureRequestUrl(url);
         const callbackUrl = callbackUrlFromRequest(url);
         const response = await NativeOidc.open({
-            [nativeContract.fields.url]: url,
-            [nativeContract.fields.callbackUrl]: callbackUrl,
-            [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,
+            url,
+            callbackUrl,
+            prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,
         });
-        if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {
-            throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The authentication callback does not match the configured redirect URI');
+        if (!isExpectedCallback(response.url, callbackUrl)) {
+            throw new CapacitorOidcError('INVALID_CALLBACK', 'The authentication callback does not match the configured redirect URI');
         }
-        return { url: response[nativeContract.fields.url] };
+        return response;
     }
     close() {
         void NativeOidc.cancel();
@@ -37,16 +36,19 @@ class CapacitorWindow {
 }
 export function assertSecureRequestUrl(requestUrl) {
     const url = new URL(requestUrl);
-    const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
-    if (url.protocol !== 'https:' && !isLocalDevelopment) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.browserUnavailable, 'OIDC authorization and logout endpoints must use HTTPS');
+    const isHttpLoopback = url.protocol === 'http:' &&
+        (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');
+    if (url.protocol !== 'https:' && !isHttpLoopback) {
+        throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');
     }
 }
 export function callbackUrlFromRequest(requestUrl) {
     const url = new URL(requestUrl);
-    const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');
+    const callback = url.searchParams.get('post_logout_redirect_uri') ??
+        url.searchParams.get('logout_uri') ??
+        url.searchParams.get('redirect_uri');
     if (!callback) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The OIDC request does not contain a redirect URI');
+        throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');
     }
     return callback;
 }

package/dist/esm/capacitor-navigator.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-navigator.js","sourceRoot":"","sources":["../../src/capacitor-navigator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,eAAe;IACU;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAkB;QACpC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;YAChC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW;YAChD,CAAC,cAAc,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC,iCAAiC;SAClG,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,eAAe,EACzC,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,KAAK;QACH,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,kBAAkB,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAC5C,wDAAwD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,eAAe,EACzC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;QACjE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;QACzD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO;QACX,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import type { INavigator, IWindow, NavigateParams, NavigateResponse } from 'oidc-client-ts';\n\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\n\nexport class CapacitorNavigator implements INavigator {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async prepare(): Promise<IWindow> {\n    return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Navigator callbacks');\n  }\n}\n\nclass CapacitorWindow implements IWindow {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async navigate({ url }: NavigateParams): Promise<NavigateResponse> {\n    assertSecureRequestUrl(url);\n    const callbackUrl = callbackUrlFromRequest(url);\n    const response = await NativeOidc.open({\n      [nativeContract.fields.url]: url,\n      [nativeContract.fields.callbackUrl]: callbackUrl,\n      [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,\n    });\n\n    if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {\n      throw new CapacitorOidcError(\n        nativeContract.errorCodes.invalidCallback,\n        'The authentication callback does not match the configured redirect URI',\n      );\n    }\n\n    return { url: response[nativeContract.fields.url] };\n  }\n\n  close(): void {\n    void NativeOidc.cancel();\n  }\n}\n\nexport function assertSecureRequestUrl(requestUrl: string): void {\n  const url = new URL(requestUrl);\n  const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';\n  if (url.protocol !== 'https:' && !isLocalDevelopment) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.browserUnavailable,\n      'OIDC authorization and logout endpoints must use HTTPS',\n    );\n  }\n}\n\nexport function callbackUrlFromRequest(requestUrl: string): string {\n  const url = new URL(requestUrl);\n  const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');\n  if (!callback) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.invalidCallback,\n      'The OIDC request does not contain a redirect URI',\n    );\n  }\n  return callback;\n}\n\nexport function isExpectedCallback(actualValue: string, expectedValue: string): boolean {\n  const actual = new URL(actualValue);\n  const expected = new URL(expectedValue);\n  return (\n    actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n    actual.host.toLowerCase() === expected.host.toLowerCase() &&\n    actual.pathname === expected.pathname\n  );\n}\n\nexport class UnsupportedIframeNavigator implements INavigator {\n  async prepare(): Promise<IWindow> {\n    unsupported('Iframe navigation');\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n}\n"]}
+{"version":3,"file":"capacitor-navigator.js","sourceRoot":"","sources":["../../src/capacitor-navigator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,eAAe;IACU;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAkB;QACpC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YACrC,GAAG;YACH,WAAW;YACX,iCAAiC,EAAE,IAAI,CAAC,iCAAiC;SAC1E,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK;QACH,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,cAAc,GAClB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,QAAQ,GACZ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;QACjE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;QACzD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO;QACX,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import type { INavigator, IWindow, NavigateParams, NavigateResponse } from 'oidc-client-ts';\n\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { NativeOidc } from './native';\n\nexport class CapacitorNavigator implements INavigator {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async prepare(): Promise<IWindow> {\n    return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Navigator callbacks');\n  }\n}\n\nclass CapacitorWindow implements IWindow {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async navigate({ url }: NavigateParams): Promise<NavigateResponse> {\n    assertSecureRequestUrl(url);\n    const callbackUrl = callbackUrlFromRequest(url);\n    const response = await NativeOidc.open({\n      url,\n      callbackUrl,\n      prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,\n    });\n\n    if (!isExpectedCallback(response.url, callbackUrl)) {\n      throw new CapacitorOidcError(\n        'INVALID_CALLBACK',\n        'The authentication callback does not match the configured redirect URI',\n      );\n    }\n\n    return response;\n  }\n\n  close(): void {\n    void NativeOidc.cancel();\n  }\n}\n\nexport function assertSecureRequestUrl(requestUrl: string): void {\n  const url = new URL(requestUrl);\n  const isHttpLoopback =\n    url.protocol === 'http:' &&\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');\n  if (url.protocol !== 'https:' && !isHttpLoopback) {\n    throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');\n  }\n}\n\nexport function callbackUrlFromRequest(requestUrl: string): string {\n  const url = new URL(requestUrl);\n  const callback =\n    url.searchParams.get('post_logout_redirect_uri') ??\n    url.searchParams.get('logout_uri') ??\n    url.searchParams.get('redirect_uri');\n  if (!callback) {\n    throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');\n  }\n  return callback;\n}\n\nexport function isExpectedCallback(actualValue: string, expectedValue: string): boolean {\n  const actual = new URL(actualValue);\n  const expected = new URL(expectedValue);\n  return (\n    actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n    actual.host.toLowerCase() === expected.host.toLowerCase() &&\n    actual.pathname === expected.pathname\n  );\n}\n\nexport class UnsupportedIframeNavigator implements INavigator {\n  async prepare(): Promise<IWindow> {\n    unsupported('Iframe navigation');\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n}\n"]}

package/dist/esm/capacitor-secure-state-store.js

@@ -1,4 +1,3 @@
-import { nativeContract } from './generated/native-contract';
 import { NativeOidc } from './native';
 export class CapacitorSecureStateStore {
     namespace;
@@ -6,31 +5,16 @@ export class CapacitorSecureStateStore {
         this.namespace = namespace;
     }
     async set(key, value) {
-        await NativeOidc.storageSet({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-            [nativeContract.fields.value]: value,
-        });
+        await NativeOidc.storageSet({ namespace: this.namespace, key, value });
     }
     async get(key) {
-        const result = await NativeOidc.storageGet({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-        });
-        return result[nativeContract.fields.value];
+        return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;
     }
     async remove(key) {
-        const result = await NativeOidc.storageRemove({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-        });
-        return result[nativeContract.fields.value];
+        return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;
     }
     async getAllKeys() {
-        const result = await NativeOidc.storageGetAllKeys({
-            [nativeContract.fields.namespace]: this.namespace,
-        });
-        return result[nativeContract.fields.keys];
+        return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;
     }
 }
 //# sourceMappingURL=capacitor-secure-state-store.js.map

package/dist/esm/capacitor-secure-state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-secure-state-store.js","sourceRoot":"","sources":["../../src/capacitor-secure-state-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,UAAU,CAAC,UAAU,CAAC;YAC1B,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;YAChC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK;SACrC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;YACzC,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC;YAC5C,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC;YAChD,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;SAClD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { StateStore } from 'oidc-client-ts';\n\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\n\nexport class CapacitorSecureStateStore implements StateStore {\n  constructor(private readonly namespace: string) {}\n\n  async set(key: string, value: string): Promise<void> {\n    await NativeOidc.storageSet({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n      [nativeContract.fields.value]: value,\n    });\n  }\n\n  async get(key: string): Promise<string | null> {\n    const result = await NativeOidc.storageGet({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n    });\n    return result[nativeContract.fields.value];\n  }\n\n  async remove(key: string): Promise<string | null> {\n    const result = await NativeOidc.storageRemove({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n    });\n    return result[nativeContract.fields.value];\n  }\n\n  async getAllKeys(): Promise<string[]> {\n    const result = await NativeOidc.storageGetAllKeys({\n      [nativeContract.fields.namespace]: this.namespace,\n    });\n    return result[nativeContract.fields.keys];\n  }\n}\n"]}
+{"version":3,"file":"capacitor-secure-state-store.js","sourceRoot":"","sources":["../../src/capacitor-secure-state-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;CACF","sourcesContent":["import type { StateStore } from 'oidc-client-ts';\n\nimport { NativeOidc } from './native';\n\nexport class CapacitorSecureStateStore implements StateStore {\n  constructor(private readonly namespace: string) {}\n\n  async set(key: string, value: string): Promise<void> {\n    await NativeOidc.storageSet({ namespace: this.namespace, key, value });\n  }\n\n  async get(key: string): Promise<string | null> {\n    return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;\n  }\n\n  async remove(key: string): Promise<string | null> {\n    return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;\n  }\n\n  async getAllKeys(): Promise<string[]> {\n    return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;\n  }\n}\n"]}

package/dist/esm/capacitor-user-manager.js

@@ -3,7 +3,6 @@ import { ErrorResponse, UserManager, } from 'oidc-client-ts';
 import { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator';
 import { CapacitorSecureStateStore } from './capacitor-secure-state-store';
 import { CapacitorOidcError, unsupported } from './errors';
-import { nativeContract } from './generated/native-contract';
 import { NativeOidc } from './native';
 export class CapacitorUserManager extends UserManager {
     storageNamespace;
@@ -12,7 +11,7 @@ export class CapacitorUserManager extends UserManager {
     constructor(settings, nativeOptions, storageNamespace) {
         const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);
         const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);
-        const navigator = new CapacitorNavigator(nativeOptions.ios?.prefersEphemeralWebBrowserSession ?? false);
+        const navigator = new CapacitorNavigator(nativeOptions.prefersEphemeralWebBrowserSession ?? false);
         super({
             ...settings,
             response_type: 'code',
@@ -28,11 +27,7 @@ export class CapacitorUserManager extends UserManager {
     static async create(settings, nativeOptions = {}) {
         assertRuntime();
         assertSettings(settings);
-        await NativeOidc.configure({
-            [nativeContract.fields.prefersEphemeralWebBrowserSession]: nativeOptions.ios?.prefersEphemeralWebBrowserSession,
-            [nativeContract.fields.keychainAccessGroup]: nativeOptions.ios?.keychainAccessGroup,
-            [nativeContract.fields.keychainAccessibility]: nativeOptions.ios?.keychainAccessibility,
-        });
+        await NativeOidc.configure(nativeOptions.ios ?? {});
         const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');
         await manager.getValidUser();
         manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {
@@ -83,9 +78,9 @@ export class CapacitorUserManager extends UserManager {
     async storeUser(user) {
         await super.storeUser(user);
         await NativeOidc.setSessionSnapshot({
-            [nativeContract.fields.namespace]: this.storageNamespace,
-            [nativeContract.fields.value]: user
-                ? JSON.stringify(toStoredSession(user, this.settings.authority, this.settings.client_id))
+            namespace: this.storageNamespace,
+            value: user
+                ? JSON.stringify(toStoredSession(user, user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority, this.settings.client_id))
                 : null,
         });
     }
@@ -133,15 +128,15 @@ export class CapacitorUserManager extends UserManager {
 }
 function assertRuntime() {
     if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Web Crypto is required by oidc-client-ts');
+        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');
     }
 }
 function assertSettings(settings) {
     if ('client_secret' in settings) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Native public clients must not contain a client secret');
+        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native public clients must not contain a client secret');
     }
     if ('client_authentication' in settings || 'dpop' in settings) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'The supplied settings contain an unsupported native-client option');
+        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'The supplied settings contain an unsupported native-client option');
     }
 }
 function toStoredSession(user, issuer, clientId) {

package/dist/esm/capacitor-user-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-user-manager.js","sourceRoot":"","sources":["../../src/capacitor-user-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,OAAO,EACL,aAAa,EACb,WAAW,GAOZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IAOhC;IANX,cAAc,CAAwB;IACtC,gBAAgB,CAAwB;IAEhD,YACE,QAAsC,EACtC,aAAyC,EACxB,gBAAwB;QAEzC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,eAAe,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,UAAU,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,GAAG,EAAE,iCAAiC,IAAI,KAAK,CAAC,CAAC;QAExG,KAAK,CACH;YACE,GAAG,QAAQ;YACX,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,QAAQ,CAAC,YAAY;YACzC,8BAA8B,EAAE,QAAQ,CAAC,wBAAwB;YACjE,UAAU;YACV,SAAS;SACV,EACD,SAAS,EACT,SAAS,EACT,IAAI,0BAA0B,EAAE,CACjC,CAAC;QApBe,qBAAgB,GAAhB,gBAAgB,CAAQ;IAqB3C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,QAAsC,EACtC,gBAA4C,EAAE;QAE9C,aAAa,EAAE,CAAC;QAChB,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,UAAU,CAAC,SAAS,CAAC;YACzB,CAAC,cAAc,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,iCAAiC;YAC/G,CAAC,cAAc,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB;YACnF,CAAC,cAAc,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,qBAAqB;SACxF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC;QAC/G,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,gBAAgB,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClF,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,OAAO;qBACT,YAAY,EAAE;qBACd,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAC3G,CAAC;YACN,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE;QACrC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE;QACvC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,sBAAsB,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEQ,YAAY,CAAC,OAAyB,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACpD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAsB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,OAAO;gBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YACrG,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;gBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/F,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAAiB;QACxC,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,UAAU,CAAC,kBAAkB,CAAC;YAClC,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB;YACxD,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI;gBACjC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACzF,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAEQ,KAAK,CAAC,cAAc;QAC3B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,sBAAsB,CAAC,IAAa;QACjD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,IAAa;QACzC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,8BAA8B,CAAC,KAAyC;QACrF,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAEQ,KAAK,CAAC,oBAAoB,CAAC,IAAa;QAC/C,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,eAAe;QAC5B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,uBAAuB,CAAC,IAAa;QAClD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,SAAmB;QAC/D,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,aAAa;QAC1B,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,qBAAqB,CAAC,IAAa;QAChD,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,kBAAkB;QAC/B,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAC5C,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,uBAAuB,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAC5C,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAU,EAAE,MAAc,EAAE,QAAgB;IACnE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { App } from '@capacitor/app';\nimport type { PluginListenerHandle } from '@capacitor/core';\nimport {\n  ErrorResponse,\n  UserManager,\n  type SigninPopupArgs,\n  type SigninResourceOwnerCredentialsArgs,\n  type SigninSilentArgs,\n  type SignoutResponse,\n  type SignoutPopupArgs,\n  type User,\n} from 'oidc-client-ts';\n\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store';\nimport type { CapacitorOidcNativeOptions, CapacitorUserManagerSettings, StoredSessionV1 } from './definitions';\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\n\nexport class CapacitorUserManager extends UserManager {\n  private refreshPromise?: Promise<User | null>;\n  private appStateListener?: PluginListenerHandle;\n\n  private constructor(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions,\n    private readonly storageNamespace: string,\n  ) {\n    const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n    const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n    const navigator = new CapacitorNavigator(nativeOptions.ios?.prefersEphemeralWebBrowserSession ?? false);\n\n    super(\n      {\n        ...settings,\n        response_type: 'code',\n        disablePKCE: false,\n        monitorSession: false,\n        popup_redirect_uri: settings.redirect_uri,\n        popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,\n        stateStore,\n        userStore,\n      },\n      navigator,\n      navigator,\n      new UnsupportedIframeNavigator(),\n    );\n  }\n\n  static async create(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions = {},\n  ): Promise<CapacitorUserManager> {\n    assertRuntime();\n    assertSettings(settings);\n    await NativeOidc.configure({\n      [nativeContract.fields.prefersEphemeralWebBrowserSession]: nativeOptions.ios?.prefersEphemeralWebBrowserSession,\n      [nativeContract.fields.keychainAccessGroup]: nativeOptions.ios?.keychainAccessGroup,\n      [nativeContract.fields.keychainAccessibility]: nativeOptions.ios?.keychainAccessibility,\n    });\n    const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');\n    await manager.getValidUser();\n    manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n      if (isActive) {\n        void manager\n          .getValidUser()\n          .catch((error: unknown) =>\n            manager.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')),\n          );\n      }\n    });\n    return manager;\n  }\n\n  async signin(args: SigninPopupArgs = {}): Promise<User> {\n    return super.signinPopup(args);\n  }\n\n  async signout(args: SignoutPopupArgs = {}): Promise<void> {\n    await super.signoutPopup(args);\n  }\n\n  async getValidUser(minimumValiditySeconds = 60): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user) return null;\n    if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds) return user;\n    return this.signinSilent();\n  }\n\n  override signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refresh(args).finally(() => {\n        this.refreshPromise = undefined;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  private async refresh(args: SigninSilentArgs): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user?.refresh_token) {\n      if (user?.expired) await this.removeUser();\n      return null;\n    }\n\n    const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error: unknown) => {\n      if (error instanceof ErrorResponse && error.error === 'invalid_grant') await this.removeUser();\n      throw error;\n    });\n    return refresh;\n  }\n\n  override async storeUser(user: User | null): Promise<void> {\n    await super.storeUser(user);\n    await NativeOidc.setSessionSnapshot({\n      [nativeContract.fields.namespace]: this.storageNamespace,\n      [nativeContract.fields.value]: user\n        ? JSON.stringify(toStoredSession(user, this.settings.authority, this.settings.client_id))\n        : null,\n    });\n  }\n\n  async cancel(): Promise<void> {\n    await NativeOidc.cancel();\n  }\n\n  async dispose(): Promise<void> {\n    this.stopSilentRenew();\n    await this.appStateListener?.remove();\n    await this.cancel();\n  }\n\n  override async signinRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinRedirectCallback(_url?: string): Promise<User> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinCallback(_url?: string): Promise<User | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User> {\n    unsupported('Resource Owner Password Credentials');\n  }\n\n  override async signinSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n\n  override async signoutRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutRedirectCallback(_url?: string): Promise<SignoutResponse> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutCallback(_url?: string, _keepOpen?: boolean): Promise<SignoutResponse | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signoutSilent(): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async signoutSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async querySessionStatus(): Promise<null> {\n    unsupported('Browser session monitoring');\n  }\n}\n\nfunction assertRuntime(): void {\n  if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.unsupportedRuntime,\n      'Web Crypto is required by oidc-client-ts',\n    );\n  }\n}\n\nfunction assertSettings(settings: CapacitorUserManagerSettings): void {\n  if ('client_secret' in settings) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.unsupportedRuntime,\n      'Native public clients must not contain a client secret',\n    );\n  }\n  if ('client_authentication' in settings || 'dpop' in settings) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.unsupportedRuntime,\n      'The supplied settings contain an unsupported native-client option',\n    );\n  }\n}\n\nfunction toStoredSession(user: User, issuer: string, clientId: string): StoredSessionV1 {\n  return {\n    version: 1,\n    issuer,\n    clientId,\n    accessToken: user.access_token,\n    refreshToken: user.refresh_token,\n    idToken: user.id_token,\n    tokenType: user.token_type,\n    scope: user.scope,\n    expiresAt: user.expires_at,\n  };\n}\n"]}
+{"version":3,"file":"capacitor-user-manager.js","sourceRoot":"","sources":["../../src/capacitor-user-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,OAAO,EACL,aAAa,EACb,WAAW,GAOZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IAOhC;IANX,cAAc,CAAwB;IACtC,gBAAgB,CAAwB;IAEhD,YACE,QAAsC,EACtC,aAAyC,EACxB,gBAAwB;QAEzC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,eAAe,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,UAAU,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,iCAAiC,IAAI,KAAK,CAAC,CAAC;QAEnG,KAAK,CACH;YACE,GAAG,QAAQ;YACX,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,QAAQ,CAAC,YAAY;YACzC,8BAA8B,EAAE,QAAQ,CAAC,wBAAwB;YACjE,UAAU;YACV,SAAS;SACV,EACD,SAAS,EACT,SAAS,EACT,IAAI,0BAA0B,EAAE,CACjC,CAAC;QApBe,qBAAgB,GAAhB,gBAAgB,CAAQ;IAqB3C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,QAAsC,EACtC,gBAA4C,EAAE;QAE9C,aAAa,EAAE,CAAC;QAChB,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC;QAC/G,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,gBAAgB,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClF,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,OAAO;qBACT,YAAY,EAAE;qBACd,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAC3G,CAAC;YACN,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE;QACrC,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE;QACvC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,sBAAsB,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEQ,YAAY,CAAC,OAAyB,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACpD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAsB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,OAAO;gBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YACrG,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;gBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/F,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAAiB;QACxC,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,UAAU,CAAC,kBAAkB,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,gBAAgB;YAChC,KAAK,EAAE,IAAI;gBACT,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,eAAe,CACb,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAC7E,IAAI,CAAC,QAAQ,CAAC,SAAS,CACxB,CACF;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAEQ,KAAK,CAAC,cAAc;QAC3B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,sBAAsB,CAAC,IAAa;QACjD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,IAAa;QACzC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,8BAA8B,CAAC,KAAyC;QACrF,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAEQ,KAAK,CAAC,oBAAoB,CAAC,IAAa;QAC/C,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,eAAe;QAC5B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,uBAAuB,CAAC,IAAa;QAClD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,SAAmB;QAC/D,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,aAAa;QAC1B,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,qBAAqB,CAAC,IAAa;QAChD,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,kBAAkB;QAC/B,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,uBAAuB,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAU,EAAE,MAAc,EAAE,QAAgB;IACnE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { App } from '@capacitor/app';\nimport type { PluginListenerHandle } from '@capacitor/core';\nimport {\n  ErrorResponse,\n  UserManager,\n  type SigninPopupArgs,\n  type SigninResourceOwnerCredentialsArgs,\n  type SigninSilentArgs,\n  type SignoutResponse,\n  type SignoutPopupArgs,\n  type User,\n} from 'oidc-client-ts';\n\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store';\nimport type { CapacitorOidcNativeOptions, CapacitorUserManagerSettings, StoredSessionV1 } from './definitions';\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { NativeOidc } from './native';\n\nexport class CapacitorUserManager extends UserManager {\n  private refreshPromise?: Promise<User | null>;\n  private appStateListener?: PluginListenerHandle;\n\n  private constructor(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions,\n    private readonly storageNamespace: string,\n  ) {\n    const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n    const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n    const navigator = new CapacitorNavigator(nativeOptions.prefersEphemeralWebBrowserSession ?? false);\n\n    super(\n      {\n        ...settings,\n        response_type: 'code',\n        disablePKCE: false,\n        monitorSession: false,\n        popup_redirect_uri: settings.redirect_uri,\n        popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,\n        stateStore,\n        userStore,\n      },\n      navigator,\n      navigator,\n      new UnsupportedIframeNavigator(),\n    );\n  }\n\n  static async create(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions = {},\n  ): Promise<CapacitorUserManager> {\n    assertRuntime();\n    assertSettings(settings);\n    await NativeOidc.configure(nativeOptions.ios ?? {});\n    const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');\n    await manager.getValidUser();\n    manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n      if (isActive) {\n        void manager\n          .getValidUser()\n          .catch((error: unknown) =>\n            manager.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')),\n          );\n      }\n    });\n    return manager;\n  }\n\n  async signin(args: SigninPopupArgs = {}): Promise<User> {\n    return super.signinPopup(args);\n  }\n\n  async signout(args: SignoutPopupArgs = {}): Promise<void> {\n    await super.signoutPopup(args);\n  }\n\n  async getValidUser(minimumValiditySeconds = 60): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user) return null;\n    if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds) return user;\n    return this.signinSilent();\n  }\n\n  override signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refresh(args).finally(() => {\n        this.refreshPromise = undefined;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  private async refresh(args: SigninSilentArgs): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user?.refresh_token) {\n      if (user?.expired) await this.removeUser();\n      return null;\n    }\n\n    const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error: unknown) => {\n      if (error instanceof ErrorResponse && error.error === 'invalid_grant') await this.removeUser();\n      throw error;\n    });\n    return refresh;\n  }\n\n  override async storeUser(user: User | null): Promise<void> {\n    await super.storeUser(user);\n    await NativeOidc.setSessionSnapshot({\n      namespace: this.storageNamespace,\n      value: user\n        ? JSON.stringify(\n            toStoredSession(\n              user,\n              user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority,\n              this.settings.client_id,\n            ),\n          )\n        : null,\n    });\n  }\n\n  async cancel(): Promise<void> {\n    await NativeOidc.cancel();\n  }\n\n  async dispose(): Promise<void> {\n    this.stopSilentRenew();\n    await this.appStateListener?.remove();\n    await this.cancel();\n  }\n\n  override async signinRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinRedirectCallback(_url?: string): Promise<User> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinCallback(_url?: string): Promise<User | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User> {\n    unsupported('Resource Owner Password Credentials');\n  }\n\n  override async signinSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n\n  override async signoutRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutRedirectCallback(_url?: string): Promise<SignoutResponse> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutCallback(_url?: string, _keepOpen?: boolean): Promise<SignoutResponse | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signoutSilent(): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async signoutSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async querySessionStatus(): Promise<null> {\n    unsupported('Browser session monitoring');\n  }\n}\n\nfunction assertRuntime(): void {\n  if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');\n  }\n}\n\nfunction assertSettings(settings: CapacitorUserManagerSettings): void {\n  if ('client_secret' in settings) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native public clients must not contain a client secret');\n  }\n  if ('client_authentication' in settings || 'dpop' in settings) {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'The supplied settings contain an unsupported native-client option',\n    );\n  }\n}\n\nfunction toStoredSession(user: User, issuer: string, clientId: string): StoredSessionV1 {\n  return {\n    version: 1,\n    issuer,\n    clientId,\n    accessToken: user.access_token,\n    refreshToken: user.refresh_token,\n    idToken: user.id_token,\n    tokenType: user.token_type,\n    scope: user.scope,\n    expiresAt: user.expires_at,\n  };\n}\n"]}