capacitor-oidc 0.0.1-alpha.0

package/dist/plugin.cjs

@@ -0,0 +1,304 @@
+'use strict';
+
+var app = require('@capacitor/app');
+var oidcClientTs = require('oidc-client-ts');
+var core = require('@capacitor/core');
+
+// Generated by scripts/generate-native-contract.mjs. Do not edit.
+const nativeContract = {
+    pluginName: 'CapacitorOidc',
+    fields: {
+        url: 'url',
+        callbackUrl: 'callbackUrl',
+        prefersEphemeralWebBrowserSession: 'prefersEphemeralWebBrowserSession',
+        keychainAccessGroup: 'keychainAccessGroup',
+        keychainAccessibility: 'keychainAccessibility',
+        namespace: 'namespace',
+        key: 'key',
+        value: 'value',
+        keys: 'keys',
+    },
+    errorCodes: {
+        browserUnavailable: 'BROWSER_UNAVAILABLE',
+        invalidCallback: 'INVALID_CALLBACK',
+        unsupportedRuntime: 'UNSUPPORTED_RUNTIME',
+    }};
+
+class CapacitorOidcError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'CapacitorOidcError';
+    }
+}
+function unsupported(feature) {
+    throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, `${feature} is not available in a native Capacitor runtime`);
+}
+
+const NativeOidc = core.registerPlugin(nativeContract.pluginName);
+
+class CapacitorNavigator {
+    prefersEphemeralWebBrowserSession;
+    constructor(prefersEphemeralWebBrowserSession) {
+        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;
+    }
+    async prepare() {
+        return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);
+    }
+    async callback() {
+        unsupported('Navigator callbacks');
+    }
+}
+class CapacitorWindow {
+    prefersEphemeralWebBrowserSession;
+    constructor(prefersEphemeralWebBrowserSession) {
+        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;
+    }
+    async navigate({ url }) {
+        assertSecureRequestUrl(url);
+        const callbackUrl = callbackUrlFromRequest(url);
+        const response = await NativeOidc.open({
+            [nativeContract.fields.url]: url,
+            [nativeContract.fields.callbackUrl]: callbackUrl,
+            [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,
+        });
+        if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {
+            throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The authentication callback does not match the configured redirect URI');
+        }
+        return { url: response[nativeContract.fields.url] };
+    }
+    close() {
+        void NativeOidc.cancel();
+    }
+}
+function assertSecureRequestUrl(requestUrl) {
+    const url = new URL(requestUrl);
+    const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+    if (url.protocol !== 'https:' && !isLocalDevelopment) {
+        throw new CapacitorOidcError(nativeContract.errorCodes.browserUnavailable, 'OIDC authorization and logout endpoints must use HTTPS');
+    }
+}
+function callbackUrlFromRequest(requestUrl) {
+    const url = new URL(requestUrl);
+    const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');
+    if (!callback) {
+        throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The OIDC request does not contain a redirect URI');
+    }
+    return callback;
+}
+function isExpectedCallback(actualValue, expectedValue) {
+    const actual = new URL(actualValue);
+    const expected = new URL(expectedValue);
+    return (actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&
+        actual.host.toLowerCase() === expected.host.toLowerCase() &&
+        actual.pathname === expected.pathname);
+}
+class UnsupportedIframeNavigator {
+    async prepare() {
+        unsupported('Iframe navigation');
+    }
+    async callback() {
+        unsupported('Iframe navigation');
+    }
+}
+
+class CapacitorSecureStateStore {
+    namespace;
+    constructor(namespace) {
+        this.namespace = namespace;
+    }
+    async set(key, value) {
+        await NativeOidc.storageSet({
+            [nativeContract.fields.namespace]: this.namespace,
+            [nativeContract.fields.key]: key,
+            [nativeContract.fields.value]: value,
+        });
+    }
+    async get(key) {
+        const result = await NativeOidc.storageGet({
+            [nativeContract.fields.namespace]: this.namespace,
+            [nativeContract.fields.key]: key,
+        });
+        return result[nativeContract.fields.value];
+    }
+    async remove(key) {
+        const result = await NativeOidc.storageRemove({
+            [nativeContract.fields.namespace]: this.namespace,
+            [nativeContract.fields.key]: key,
+        });
+        return result[nativeContract.fields.value];
+    }
+    async getAllKeys() {
+        const result = await NativeOidc.storageGetAllKeys({
+            [nativeContract.fields.namespace]: this.namespace,
+        });
+        return result[nativeContract.fields.keys];
+    }
+}
+
+class CapacitorUserManager extends oidcClientTs.UserManager {
+    storageNamespace;
+    refreshPromise;
+    appStateListener;
+    constructor(settings, nativeOptions, storageNamespace) {
+        const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);
+        const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);
+        const navigator = new CapacitorNavigator(nativeOptions.ios?.prefersEphemeralWebBrowserSession ?? false);
+        super({
+            ...settings,
+            response_type: 'code',
+            disablePKCE: false,
+            monitorSession: false,
+            popup_redirect_uri: settings.redirect_uri,
+            popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,
+            stateStore,
+            userStore,
+        }, navigator, navigator, new UnsupportedIframeNavigator());
+        this.storageNamespace = storageNamespace;
+    }
+    static async create(settings, nativeOptions = {}) {
+        assertRuntime();
+        assertSettings(settings);
+        await NativeOidc.configure({
+            [nativeContract.fields.prefersEphemeralWebBrowserSession]: nativeOptions.ios?.prefersEphemeralWebBrowserSession,
+            [nativeContract.fields.keychainAccessGroup]: nativeOptions.ios?.keychainAccessGroup,
+            [nativeContract.fields.keychainAccessibility]: nativeOptions.ios?.keychainAccessibility,
+        });
+        const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');
+        await manager.getValidUser();
+        manager.appStateListener = await app.App.addListener('appStateChange', ({ isActive }) => {
+            if (isActive) {
+                void manager
+                    .getValidUser()
+                    .catch((error) => manager.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')));
+            }
+        });
+        return manager;
+    }
+    async signin(args = {}) {
+        return super.signinPopup(args);
+    }
+    async signout(args = {}) {
+        await super.signoutPopup(args);
+    }
+    async getValidUser(minimumValiditySeconds = 60) {
+        const user = await this.getUser();
+        if (!user)
+            return null;
+        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)
+            return user;
+        return this.signinSilent();
+    }
+    signinSilent(args = {}) {
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.refresh(args).finally(() => {
+                this.refreshPromise = undefined;
+            });
+        }
+        return this.refreshPromise;
+    }
+    async refresh(args) {
+        const user = await this.getUser();
+        if (!user?.refresh_token) {
+            if (user?.expired)
+                await this.removeUser();
+            return null;
+        }
+        const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error) => {
+            if (error instanceof oidcClientTs.ErrorResponse && error.error === 'invalid_grant')
+                await this.removeUser();
+            throw error;
+        });
+        return refresh;
+    }
+    async storeUser(user) {
+        await super.storeUser(user);
+        await NativeOidc.setSessionSnapshot({
+            [nativeContract.fields.namespace]: this.storageNamespace,
+            [nativeContract.fields.value]: user
+                ? JSON.stringify(toStoredSession(user, this.settings.authority, this.settings.client_id))
+                : null,
+        });
+    }
+    async cancel() {
+        await NativeOidc.cancel();
+    }
+    async dispose() {
+        this.stopSilentRenew();
+        await this.appStateListener?.remove();
+        await this.cancel();
+    }
+    async signinRedirect() {
+        unsupported('Redirect navigation');
+    }
+    async signinRedirectCallback(_url) {
+        unsupported('Redirect navigation');
+    }
+    async signinCallback(_url) {
+        unsupported('Browser callback dispatch');
+    }
+    async signinResourceOwnerCredentials(_args) {
+        unsupported('Resource Owner Password Credentials');
+    }
+    async signinSilentCallback(_url) {
+        unsupported('Iframe navigation');
+    }
+    async signoutRedirect() {
+        unsupported('Redirect navigation');
+    }
+    async signoutRedirectCallback(_url) {
+        unsupported('Redirect navigation');
+    }
+    async signoutCallback(_url, _keepOpen) {
+        unsupported('Browser callback dispatch');
+    }
+    async signoutSilent() {
+        unsupported('Iframe logout');
+    }
+    async signoutSilentCallback(_url) {
+        unsupported('Iframe logout');
+    }
+    async querySessionStatus() {
+        unsupported('Browser session monitoring');
+    }
+}
+function assertRuntime() {
+    if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {
+        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Web Crypto is required by oidc-client-ts');
+    }
+}
+function assertSettings(settings) {
+    if ('client_secret' in settings) {
+        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Native public clients must not contain a client secret');
+    }
+    if ('client_authentication' in settings || 'dpop' in settings) {
+        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'The supplied settings contain an unsupported native-client option');
+    }
+}
+function toStoredSession(user, issuer, clientId) {
+    return {
+        version: 1,
+        issuer,
+        clientId,
+        accessToken: user.access_token,
+        refreshToken: user.refresh_token,
+        idToken: user.id_token,
+        tokenType: user.token_type,
+        scope: user.scope,
+        expiresAt: user.expires_at,
+    };
+}
+
+Object.defineProperty(exports, "User", {
+    enumerable: true,
+    get: function () { return oidcClientTs.User; }
+});
+Object.defineProperty(exports, "UserManagerEvents", {
+    enumerable: true,
+    get: function () { return oidcClientTs.UserManagerEvents; }
+});
+exports.CapacitorOidcError = CapacitorOidcError;
+exports.CapacitorSecureStateStore = CapacitorSecureStateStore;
+exports.CapacitorUserManager = CapacitorUserManager;
+//# sourceMappingURL=plugin.cjs.map

package/dist/plugin.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.cjs","sources":["esm/generated/native-contract.js","esm/errors.js","esm/native.js","esm/capacitor-navigator.js","esm/capacitor-secure-state-store.js","esm/capacitor-user-manager.js"],"sourcesContent":["// Generated by scripts/generate-native-contract.mjs. Do not edit.\nexport const nativeContract = {\n    pluginName: 'CapacitorOidc',\n    methods: {\n        configure: 'configure',\n        open: 'open',\n        cancel: 'cancel',\n        storageSet: 'storageSet',\n        storageGet: 'storageGet',\n        storageRemove: 'storageRemove',\n        storageGetAllKeys: 'storageGetAllKeys',\n        setSessionSnapshot: 'setSessionSnapshot',\n    },\n    fields: {\n        url: 'url',\n        callbackUrl: 'callbackUrl',\n        prefersEphemeralWebBrowserSession: 'prefersEphemeralWebBrowserSession',\n        keychainAccessGroup: 'keychainAccessGroup',\n        keychainAccessibility: 'keychainAccessibility',\n        namespace: 'namespace',\n        key: 'key',\n        value: 'value',\n        keys: 'keys',\n    },\n    errorCodes: {\n        authSessionInProgress: 'AUTH_SESSION_IN_PROGRESS',\n        userCancelled: 'USER_CANCELLED',\n        browserUnavailable: 'BROWSER_UNAVAILABLE',\n        invalidCallback: 'INVALID_CALLBACK',\n        secureStorageError: 'SECURE_STORAGE_ERROR',\n        unsupportedRuntime: 'UNSUPPORTED_RUNTIME',\n    },\n    keychainAccessibility: {\n        afterFirstUnlockThisDeviceOnly: 'afterFirstUnlockThisDeviceOnly',\n        whenUnlockedThisDeviceOnly: 'whenUnlockedThisDeviceOnly',\n    },\n};\n//# sourceMappingURL=native-contract.js.map","import { nativeContract } from './generated/native-contract';\nexport class CapacitorOidcError extends Error {\n    code;\n    constructor(code, message) {\n        super(message);\n        this.code = code;\n        this.name = 'CapacitorOidcError';\n    }\n}\nexport function unsupported(feature) {\n    throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, `${feature} is not available in a native Capacitor runtime`);\n}\n//# sourceMappingURL=errors.js.map","import { registerPlugin } from '@capacitor/core';\nimport { nativeContract } from './generated/native-contract';\nexport const NativeOidc = registerPlugin(nativeContract.pluginName);\n//# sourceMappingURL=native.js.map","import { CapacitorOidcError, unsupported } from './errors';\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\nexport class CapacitorNavigator {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async prepare() {\n        return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n    }\n    async callback() {\n        unsupported('Navigator callbacks');\n    }\n}\nclass CapacitorWindow {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async navigate({ url }) {\n        assertSecureRequestUrl(url);\n        const callbackUrl = callbackUrlFromRequest(url);\n        const response = await NativeOidc.open({\n            [nativeContract.fields.url]: url,\n            [nativeContract.fields.callbackUrl]: callbackUrl,\n            [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,\n        });\n        if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {\n            throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The authentication callback does not match the configured redirect URI');\n        }\n        return { url: response[nativeContract.fields.url] };\n    }\n    close() {\n        void NativeOidc.cancel();\n    }\n}\nexport function assertSecureRequestUrl(requestUrl) {\n    const url = new URL(requestUrl);\n    const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';\n    if (url.protocol !== 'https:' && !isLocalDevelopment) {\n        throw new CapacitorOidcError(nativeContract.errorCodes.browserUnavailable, 'OIDC authorization and logout endpoints must use HTTPS');\n    }\n}\nexport function callbackUrlFromRequest(requestUrl) {\n    const url = new URL(requestUrl);\n    const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');\n    if (!callback) {\n        throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The OIDC request does not contain a redirect URI');\n    }\n    return callback;\n}\nexport function isExpectedCallback(actualValue, expectedValue) {\n    const actual = new URL(actualValue);\n    const expected = new URL(expectedValue);\n    return (actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n        actual.host.toLowerCase() === expected.host.toLowerCase() &&\n        actual.pathname === expected.pathname);\n}\nexport class UnsupportedIframeNavigator {\n    async prepare() {\n        unsupported('Iframe navigation');\n    }\n    async callback() {\n        unsupported('Iframe navigation');\n    }\n}\n//# sourceMappingURL=capacitor-navigator.js.map","import { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\nexport class CapacitorSecureStateStore {\n    namespace;\n    constructor(namespace) {\n        this.namespace = namespace;\n    }\n    async set(key, value) {\n        await NativeOidc.storageSet({\n            [nativeContract.fields.namespace]: this.namespace,\n            [nativeContract.fields.key]: key,\n            [nativeContract.fields.value]: value,\n        });\n    }\n    async get(key) {\n        const result = await NativeOidc.storageGet({\n            [nativeContract.fields.namespace]: this.namespace,\n            [nativeContract.fields.key]: key,\n        });\n        return result[nativeContract.fields.value];\n    }\n    async remove(key) {\n        const result = await NativeOidc.storageRemove({\n            [nativeContract.fields.namespace]: this.namespace,\n            [nativeContract.fields.key]: key,\n        });\n        return result[nativeContract.fields.value];\n    }\n    async getAllKeys() {\n        const result = await NativeOidc.storageGetAllKeys({\n            [nativeContract.fields.namespace]: this.namespace,\n        });\n        return result[nativeContract.fields.keys];\n    }\n}\n//# sourceMappingURL=capacitor-secure-state-store.js.map","import { App } from '@capacitor/app';\nimport { ErrorResponse, UserManager, } from 'oidc-client-ts';\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store';\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\nexport class CapacitorUserManager extends UserManager {\n    storageNamespace;\n    refreshPromise;\n    appStateListener;\n    constructor(settings, nativeOptions, storageNamespace) {\n        const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n        const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n        const navigator = new CapacitorNavigator(nativeOptions.ios?.prefersEphemeralWebBrowserSession ?? false);\n        super({\n            ...settings,\n            response_type: 'code',\n            disablePKCE: false,\n            monitorSession: false,\n            popup_redirect_uri: settings.redirect_uri,\n            popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,\n            stateStore,\n            userStore,\n        }, navigator, navigator, new UnsupportedIframeNavigator());\n        this.storageNamespace = storageNamespace;\n    }\n    static async create(settings, nativeOptions = {}) {\n        assertRuntime();\n        assertSettings(settings);\n        await NativeOidc.configure({\n            [nativeContract.fields.prefersEphemeralWebBrowserSession]: nativeOptions.ios?.prefersEphemeralWebBrowserSession,\n            [nativeContract.fields.keychainAccessGroup]: nativeOptions.ios?.keychainAccessGroup,\n            [nativeContract.fields.keychainAccessibility]: nativeOptions.ios?.keychainAccessibility,\n        });\n        const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');\n        await manager.getValidUser();\n        manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n            if (isActive) {\n                void manager\n                    .getValidUser()\n                    .catch((error) => manager.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')));\n            }\n        });\n        return manager;\n    }\n    async signin(args = {}) {\n        return super.signinPopup(args);\n    }\n    async signout(args = {}) {\n        await super.signoutPopup(args);\n    }\n    async getValidUser(minimumValiditySeconds = 60) {\n        const user = await this.getUser();\n        if (!user)\n            return null;\n        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)\n            return user;\n        return this.signinSilent();\n    }\n    signinSilent(args = {}) {\n        if (!this.refreshPromise) {\n            this.refreshPromise = this.refresh(args).finally(() => {\n                this.refreshPromise = undefined;\n            });\n        }\n        return this.refreshPromise;\n    }\n    async refresh(args) {\n        const user = await this.getUser();\n        if (!user?.refresh_token) {\n            if (user?.expired)\n                await this.removeUser();\n            return null;\n        }\n        const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error) => {\n            if (error instanceof ErrorResponse && error.error === 'invalid_grant')\n                await this.removeUser();\n            throw error;\n        });\n        return refresh;\n    }\n    async storeUser(user) {\n        await super.storeUser(user);\n        await NativeOidc.setSessionSnapshot({\n            [nativeContract.fields.namespace]: this.storageNamespace,\n            [nativeContract.fields.value]: user\n                ? JSON.stringify(toStoredSession(user, this.settings.authority, this.settings.client_id))\n                : null,\n        });\n    }\n    async cancel() {\n        await NativeOidc.cancel();\n    }\n    async dispose() {\n        this.stopSilentRenew();\n        await this.appStateListener?.remove();\n        await this.cancel();\n    }\n    async signinRedirect() {\n        unsupported('Redirect navigation');\n    }\n    async signinRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signinCallback(_url) {\n        unsupported('Browser callback dispatch');\n    }\n    async signinResourceOwnerCredentials(_args) {\n        unsupported('Resource Owner Password Credentials');\n    }\n    async signinSilentCallback(_url) {\n        unsupported('Iframe navigation');\n    }\n    async signoutRedirect() {\n        unsupported('Redirect navigation');\n    }\n    async signoutRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signoutCallback(_url, _keepOpen) {\n        unsupported('Browser callback dispatch');\n    }\n    async signoutSilent() {\n        unsupported('Iframe logout');\n    }\n    async signoutSilentCallback(_url) {\n        unsupported('Iframe logout');\n    }\n    async querySessionStatus() {\n        unsupported('Browser session monitoring');\n    }\n}\nfunction assertRuntime() {\n    if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Web Crypto is required by oidc-client-ts');\n    }\n}\nfunction assertSettings(settings) {\n    if ('client_secret' in settings) {\n        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'Native public clients must not contain a client secret');\n    }\n    if ('client_authentication' in settings || 'dpop' in settings) {\n        throw new CapacitorOidcError(nativeContract.errorCodes.unsupportedRuntime, 'The supplied settings contain an unsupported native-client option');\n    }\n}\nfunction toStoredSession(user, issuer, clientId) {\n    return {\n        version: 1,\n        issuer,\n        clientId,\n        accessToken: user.access_token,\n        refreshToken: user.refresh_token,\n        idToken: user.id_token,\n        tokenType: user.token_type,\n        scope: user.scope,\n        expiresAt: user.expires_at,\n    };\n}\n//# sourceMappingURL=capacitor-user-manager.js.map"],"names":["registerPlugin","UserManager","App","ErrorResponse"],"mappings":";;;;;;AAAA;AACO,MAAM,cAAc,GAAG;AAC9B,IAAI,UAAU,EAAE,eAAe;AAC/B,IAUI,MAAM,EAAE;AACZ,QAAQ,GAAG,EAAE,KAAK;AAClB,QAAQ,WAAW,EAAE,aAAa;AAClC,QAAQ,iCAAiC,EAAE,mCAAmC;AAC9E,QAAQ,mBAAmB,EAAE,qBAAqB;AAClD,QAAQ,qBAAqB,EAAE,uBAAuB;AACtD,QAAQ,SAAS,EAAE,WAAW;AAC9B,QAAQ,GAAG,EAAE,KAAK;AAClB,QAAQ,KAAK,EAAE,OAAO;AACtB,QAAQ,IAAI,EAAE,MAAM;AACpB,KAAK;AACL,IAAI,UAAU,EAAE;AAChB,QAEQ,kBAAkB,EAAE,qBAAqB;AACjD,QAAQ,eAAe,EAAE,kBAAkB;AAC3C,QACQ,kBAAkB,EAAE,qBAAqB;AACjD,KAKA,CAAC;;ACnCM,MAAM,kBAAkB,SAAS,KAAK,CAAC;AAC9C,IAAI,IAAI;AACR,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC/B,QAAQ,KAAK,CAAC,OAAO,CAAC;AACtB,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI;AACxB,QAAQ,IAAI,CAAC,IAAI,GAAG,oBAAoB;AACxC,IAAI;AACJ;AACO,SAAS,WAAW,CAAC,OAAO,EAAE;AACrC,IAAI,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC,EAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;AAC3I;;ACTO,MAAM,UAAU,GAAGA,mBAAc,CAAC,cAAc,CAAC,UAAU,CAAC;;ACC5D,MAAM,kBAAkB,CAAC;AAChC,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ;AACA,MAAM,eAAe,CAAC;AACtB,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE;AAC5B,QAAQ,sBAAsB,CAAC,GAAG,CAAC;AACnC,QAAQ,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC;AACvD,QAAQ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;AAC/C,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG;AAC5C,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,GAAG,WAAW;AAC5D,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,iCAAiC,GAAG,IAAI,CAAC,iCAAiC;AAC7G,SAAS,CAAC;AACV,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE;AACnF,YAAY,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,EAAE,wEAAwE,CAAC;AAC7J,QAAQ;AACR,QAAQ,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;AAC3D,IAAI;AACJ,IAAI,KAAK,GAAG;AACZ,QAAQ,KAAK,UAAU,CAAC,MAAM,EAAE;AAChC,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,kBAAkB,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;AACvH,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE;AAC1D,QAAQ,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;AAC5I,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC;AAC7G,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,EAAE,kDAAkD,CAAC;AACnI,IAAI;AACJ,IAAI,OAAO,QAAQ;AACnB;AACO,SAAS,kBAAkB,CAAC,WAAW,EAAE,aAAa,EAAE;AAC/D,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC;AACvC,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC;AAC3C,IAAI,QAAQ,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC7E,QAAQ,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;AACjE,QAAQ,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;AAC7C;AACO,MAAM,0BAA0B,CAAC;AACxC,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ;;AChEO,MAAM,yBAAyB,CAAC;AACvC,IAAI,SAAS;AACb,IAAI,WAAW,CAAC,SAAS,EAAE;AAC3B,QAAQ,IAAI,CAAC,SAAS,GAAG,SAAS;AAClC,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1B,QAAQ,MAAM,UAAU,CAAC,UAAU,CAAC;AACpC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;AAC7D,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG;AAC5C,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,GAAG,KAAK;AAChD,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE;AACnB,QAAQ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;AACnD,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;AAC7D,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG;AAC5C,SAAS,CAAC;AACV,QAAQ,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE;AACtB,QAAQ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC;AACtD,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;AAC7D,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG;AAC5C,SAAS,CAAC;AACV,QAAQ,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC;AAC1D,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;AAC7D,SAAS,CAAC;AACV,QAAQ,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;AACjD,IAAI;AACJ;;AC3BO,MAAM,oBAAoB,SAASC,wBAAW,CAAC;AACtD,IAAI,gBAAgB;AACpB,IAAI,cAAc;AAClB,IAAI,gBAAgB;AACpB,IAAI,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE;AAC3D,QAAQ,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAC5F,QAAQ,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACtF,QAAQ,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,GAAG,EAAE,iCAAiC,IAAI,KAAK,CAAC;AAC/G,QAAQ,KAAK,CAAC;AACd,YAAY,GAAG,QAAQ;AACvB,YAAY,aAAa,EAAE,MAAM;AACjC,YAAY,WAAW,EAAE,KAAK;AAC9B,YAAY,cAAc,EAAE,KAAK;AACjC,YAAY,kBAAkB,EAAE,QAAQ,CAAC,YAAY;AACrD,YAAY,8BAA8B,EAAE,QAAQ,CAAC,wBAAwB;AAC7E,YAAY,UAAU;AACtB,YAAY,SAAS;AACrB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,0BAA0B,EAAE,CAAC;AAClE,QAAQ,IAAI,CAAC,gBAAgB,GAAG,gBAAgB;AAChD,IAAI;AACJ,IAAI,aAAa,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,EAAE,EAAE;AACtD,QAAQ,aAAa,EAAE;AACvB,QAAQ,cAAc,CAAC,QAAQ,CAAC;AAChC,QAAQ,MAAM,UAAU,CAAC,SAAS,CAAC;AACnC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,iCAAiC,GAAG,aAAa,CAAC,GAAG,EAAE,iCAAiC;AAC3H,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,mBAAmB,GAAG,aAAa,CAAC,GAAG,EAAE,mBAAmB;AAC/F,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,qBAAqB,GAAG,aAAa,CAAC,GAAG,EAAE,qBAAqB;AACnG,SAAS,CAAC;AACV,QAAQ,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,IAAI,SAAS,CAAC;AACtH,QAAQ,MAAM,OAAO,CAAC,YAAY,EAAE;AACpC,QAAQ,OAAO,CAAC,gBAAgB,GAAG,MAAMC,OAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK;AAC7F,YAAY,IAAI,QAAQ,EAAE;AAC1B,gBAAgB,KAAK;AACrB,qBAAqB,YAAY;AACjC,qBAAqB,KAAK,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;AACjJ,YAAY;AACZ,QAAQ,CAAC,CAAC;AACV,QAAQ,OAAO,OAAO;AACtB,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE;AAC7B,QAAQ,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,YAAY,CAAC,sBAAsB,GAAG,EAAE,EAAE;AACpD,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI;AACjB,YAAY,OAAO,IAAI;AACvB,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;AACrF,YAAY,OAAO,IAAI;AACvB,QAAQ,OAAO,IAAI,CAAC,YAAY,EAAE;AAClC,IAAI;AACJ,IAAI,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM;AACnE,gBAAgB,IAAI,CAAC,cAAc,GAAG,SAAS;AAC/C,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE;AACxB,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;AAClC,YAAY,IAAI,IAAI,EAAE,OAAO;AAC7B,gBAAgB,MAAM,IAAI,CAAC,UAAU,EAAE;AACvC,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK;AACvG,YAAY,IAAI,KAAK,YAAYC,0BAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;AACjF,gBAAgB,MAAM,IAAI,CAAC,UAAU,EAAE;AACvC,YAAY,MAAM,KAAK;AACvB,QAAQ,CAAC,CAAC;AACV,QAAQ,OAAO,OAAO;AACtB,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE;AAC1B,QAAQ,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;AACnC,QAAQ,MAAM,UAAU,CAAC,kBAAkB,CAAC;AAC5C,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,gBAAgB;AACpE,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,GAAG;AAC3C,kBAAkB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;AACxG,kBAAkB,IAAI;AACtB,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,MAAM,GAAG;AACnB,QAAQ,MAAM,UAAU,CAAC,MAAM,EAAE;AACjC,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,QAAQ,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE;AAC7C,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE;AAC3B,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,IAAI,EAAE;AACvC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE;AAC/B,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,8BAA8B,CAAC,KAAK,EAAE;AAChD,QAAQ,WAAW,CAAC,qCAAqC,CAAC;AAC1D,IAAI;AACJ,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE;AACrC,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,eAAe,GAAG;AAC5B,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,uBAAuB,CAAC,IAAI,EAAE;AACxC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE;AAC3C,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,aAAa,GAAG;AAC1B,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,qBAAqB,CAAC,IAAI,EAAE;AACtC,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,kBAAkB,GAAG;AAC/B,QAAQ,WAAW,CAAC,4BAA4B,CAAC;AACjD,IAAI;AACJ;AACA,SAAS,aAAa,GAAG;AACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE;AAC1E,QAAQ,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;AAC9H,IAAI;AACJ;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE;AAClC,IAAI,IAAI,eAAe,IAAI,QAAQ,EAAE;AACrC,QAAQ,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;AAC5I,IAAI;AACJ,IAAI,IAAI,uBAAuB,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE;AACnE,QAAQ,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAAE,mEAAmE,CAAC;AACvJ,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;AACjD,IAAI,OAAO;AACX,QAAQ,OAAO,EAAE,CAAC;AAClB,QAAQ,MAAM;AACd,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,IAAI,CAAC,YAAY;AACtC,QAAQ,YAAY,EAAE,IAAI,CAAC,aAAa;AACxC,QAAQ,OAAO,EAAE,IAAI,CAAC,QAAQ;AAC9B,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK;AACzB,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,KAAK;AACL;;;;;;;;;;;;;;"}

package/ios/Sources/CapacitorOidcPlugin/CapacitorOidcPlugin.swift

@@ -0,0 +1,177 @@
+import AuthenticationServices
+import Capacitor
+import Foundation
+
+@objc(CapacitorOidcPlugin)
+public final class CapacitorOidcPlugin: CAPPlugin, CAPBridgedPlugin, ASWebAuthenticationPresentationContextProviding {
+    public let identifier = "CapacitorOidcPlugin"
+    public let jsName = NativeContract.pluginName
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: NativeContract.Method.configure, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.open, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.cancel, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.storageSet, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.storageGet, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.storageRemove, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.storageGetAllKeys, returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: NativeContract.Method.setSessionSnapshot, returnType: CAPPluginReturnPromise)
+    ]
+
+    private var accessGroup: String?
+    private var accessibility = TokenVaultAccessibility.afterFirstUnlockThisDeviceOnly
+    private var authenticationSession: ASWebAuthenticationSession?
+    private var authenticationCall: CAPPluginCall?
+
+    @objc public func configure(_ call: CAPPluginCall) {
+        accessGroup = call.getString(NativeContract.Field.keychainAccessGroup)
+        if call.getString(NativeContract.Field.keychainAccessibility) == NativeContract.KeychainAccessibility.whenUnlockedThisDeviceOnly {
+            accessibility = .whenUnlockedThisDeviceOnly
+        } else {
+            accessibility = .afterFirstUnlockThisDeviceOnly
+        }
+        call.resolve()
+    }
+
+    @objc public func open(_ call: CAPPluginCall) {
+        guard authenticationSession == nil else {
+            call.reject("An authentication session is already active", NativeContract.ErrorCode.authSessionInProgress)
+            return
+        }
+        guard let urlValue = call.getString(NativeContract.Field.url), let url = URL(string: urlValue),
+              let callbackValue = call.getString(NativeContract.Field.callbackUrl), let callbackURL = URL(string: callbackValue),
+              let scheme = callbackURL.scheme else {
+            call.reject("The authentication URL or callback URL is invalid", NativeContract.ErrorCode.invalidCallback)
+            return
+        }
+        guard isSecureRequestURL(url) else {
+            call.reject("The authentication URL must use HTTPS outside loopback development", NativeContract.ErrorCode.browserUnavailable)
+            return
+        }
+
+        let completion: ASWebAuthenticationSession.CompletionHandler = { [weak self] callbackURL, error in
+            DispatchQueue.main.async { self?.completeAuthentication(callbackURL: callbackURL, error: error) }
+        }
+
+        let session: ASWebAuthenticationSession
+        if #available(iOS 17.4, *), scheme.lowercased() == "https" {
+            guard let host = callbackURL.host else {
+                call.reject("The HTTPS callback URL has no host", NativeContract.ErrorCode.invalidCallback)
+                return
+            }
+            session = ASWebAuthenticationSession(
+                url: url,
+                callback: .https(host: host, path: callbackURL.path),
+                completionHandler: completion
+            )
+        } else {
+            guard scheme.lowercased() != "https" else {
+                call.reject("HTTPS callbacks require iOS 17.4 or newer", NativeContract.ErrorCode.browserUnavailable)
+                return
+            }
+            session = ASWebAuthenticationSession(url: url, callbackURLScheme: scheme, completionHandler: completion)
+        }
+
+        session.presentationContextProvider = self
+        session.prefersEphemeralWebBrowserSession = call.getBool(NativeContract.Field.prefersEphemeralWebBrowserSession) ?? false
+        authenticationCall = call
+        authenticationSession = session
+        guard session.start() else {
+            authenticationCall = nil
+            authenticationSession = nil
+            call.reject("The system authentication session could not start", NativeContract.ErrorCode.browserUnavailable)
+            return
+        }
+    }
+
+    @objc public func cancel(_ call: CAPPluginCall) {
+        let activeCall = authenticationCall
+        let activeSession = authenticationSession
+        authenticationCall = nil
+        authenticationSession = nil
+        activeSession?.cancel()
+        activeCall?.reject("The user cancelled authentication", NativeContract.ErrorCode.userCancelled)
+        call.resolve()
+    }
+
+    @objc public func storageSet(_ call: CAPPluginCall) {
+        guard let namespace = call.getString(NativeContract.Field.namespace), let key = call.getString(NativeContract.Field.key),
+              let value = call.getString(NativeContract.Field.value) else {
+            call.reject("Storage input is invalid", NativeContract.ErrorCode.secureStorageError)
+            return
+        }
+        resolveStorage(call) { try vault().set(namespace: namespace, key: key, value: value); return [:] }
+    }
+
+    @objc public func storageGet(_ call: CAPPluginCall) {
+        guard let namespace = call.getString(NativeContract.Field.namespace), let key = call.getString(NativeContract.Field.key) else {
+            call.reject("Storage input is invalid", NativeContract.ErrorCode.secureStorageError)
+            return
+        }
+        resolveStorage(call) { [NativeContract.Field.value: try vault().get(namespace: namespace, key: key) as Any] }
+    }
+
+    @objc public func storageRemove(_ call: CAPPluginCall) {
+        guard let namespace = call.getString(NativeContract.Field.namespace), let key = call.getString(NativeContract.Field.key) else {
+            call.reject("Storage input is invalid", NativeContract.ErrorCode.secureStorageError)
+            return
+        }
+        resolveStorage(call) { [NativeContract.Field.value: try vault().remove(namespace: namespace, key: key) as Any] }
+    }
+
+    @objc public func storageGetAllKeys(_ call: CAPPluginCall) {
+        guard let namespace = call.getString(NativeContract.Field.namespace) else {
+            call.reject("Storage input is invalid", NativeContract.ErrorCode.secureStorageError)
+            return
+        }
+        resolveStorage(call) { [NativeContract.Field.keys: try vault().getAllKeys(namespace: namespace)] }
+    }
+
+    @objc public func setSessionSnapshot(_ call: CAPPluginCall) {
+        guard let namespace = call.getString(NativeContract.Field.namespace) else {
+            call.reject("Storage input is invalid", NativeContract.ErrorCode.secureStorageError)
+            return
+        }
+        resolveStorage(call) {
+            try vault().setSessionSnapshot(namespace: namespace, value: call.getString(NativeContract.Field.value))
+            return [:]
+        }
+    }
+
+    public func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+        bridge?.viewController?.view.window ?? ASPresentationAnchor()
+    }
+
+    private func completeAuthentication(callbackURL: URL?, error: Error?) {
+        let call = authenticationCall
+        authenticationCall = nil
+        authenticationSession = nil
+
+        if let sessionError = error as? ASWebAuthenticationSessionError, sessionError.code == .canceledLogin {
+            call?.reject("The user cancelled authentication", NativeContract.ErrorCode.userCancelled)
+        } else if error != nil {
+            call?.reject("The system authentication session failed", NativeContract.ErrorCode.browserUnavailable)
+        } else if let callbackURL {
+            call?.resolve([NativeContract.Field.url: callbackURL.absoluteString])
+        } else {
+            call?.reject("The authentication session returned no callback", NativeContract.ErrorCode.invalidCallback)
+        }
+    }
+
+    private func vault() -> TokenVault {
+        TokenVault(accessGroup: accessGroup, accessibility: accessibility)
+    }
+
+    private func isSecureRequestURL(_ url: URL) -> Bool {
+        if url.scheme?.lowercased() == "https" { return true }
+        guard url.scheme?.lowercased() == "http", let host = url.host?.lowercased() else { return false }
+        return host == "localhost" || host == "127.0.0.1" || host == "::1"
+    }
+
+    private func resolveStorage(_ call: CAPPluginCall, operation: () throws -> [String: Any]) {
+        do {
+            call.resolve(try operation())
+        } catch {
+            call.reject("Secure storage failed", NativeContract.ErrorCode.secureStorageError)
+        }
+    }
+}

package/ios/Sources/CapacitorOidcPlugin/NativeContract.generated.swift

@@ -0,0 +1,39 @@
+// Generated by scripts/generate-native-contract.mjs. Do not edit.
+
+enum NativeContract {
+    static let pluginName = "CapacitorOidc"
+
+    enum Method {
+        static let configure = "configure"
+        static let open = "open"
+        static let cancel = "cancel"
+        static let storageSet = "storageSet"
+        static let storageGet = "storageGet"
+        static let storageRemove = "storageRemove"
+        static let storageGetAllKeys = "storageGetAllKeys"
+        static let setSessionSnapshot = "setSessionSnapshot"
+    }
+    enum Field {
+        static let url = "url"
+        static let callbackUrl = "callbackUrl"
+        static let prefersEphemeralWebBrowserSession = "prefersEphemeralWebBrowserSession"
+        static let keychainAccessGroup = "keychainAccessGroup"
+        static let keychainAccessibility = "keychainAccessibility"
+        static let namespace = "namespace"
+        static let key = "key"
+        static let value = "value"
+        static let keys = "keys"
+    }
+    enum ErrorCode {
+        static let authSessionInProgress = "AUTH_SESSION_IN_PROGRESS"
+        static let userCancelled = "USER_CANCELLED"
+        static let browserUnavailable = "BROWSER_UNAVAILABLE"
+        static let invalidCallback = "INVALID_CALLBACK"
+        static let secureStorageError = "SECURE_STORAGE_ERROR"
+        static let unsupportedRuntime = "UNSUPPORTED_RUNTIME"
+    }
+    enum KeychainAccessibility {
+        static let afterFirstUnlockThisDeviceOnly = "afterFirstUnlockThisDeviceOnly"
+        static let whenUnlockedThisDeviceOnly = "whenUnlockedThisDeviceOnly"
+    }
+}

package/ios/Sources/CapacitorOidcPlugin/StoredSessionV1.swift

@@ -0,0 +1,35 @@
+import Foundation
+
+public struct StoredSessionV1: Codable, Equatable, Sendable {
+    public let version: Int
+    public let issuer: String
+    public let clientId: String
+    public let accessToken: String
+    public let refreshToken: String?
+    public let idToken: String?
+    public let tokenType: String
+    public let scope: String?
+    public let expiresAt: Int?
+
+    public init(
+        version: Int = 1,
+        issuer: String,
+        clientId: String,
+        accessToken: String,
+        refreshToken: String? = nil,
+        idToken: String? = nil,
+        tokenType: String,
+        scope: String? = nil,
+        expiresAt: Int? = nil
+    ) {
+        self.version = version
+        self.issuer = issuer
+        self.clientId = clientId
+        self.accessToken = accessToken
+        self.refreshToken = refreshToken
+        self.idToken = idToken
+        self.tokenType = tokenType
+        self.scope = scope
+        self.expiresAt = expiresAt
+    }
+}