capacitor-oidc 0.0.1-alpha.1 → 0.0.1

package/CapacitorOidc.podspec

@@ -13,6 +13,6 @@ Pod::Spec.new do |spec|
   spec.source = { git: repository_url, tag: spec.version.to_s }
   spec.source_files = 'ios/Sources/**/*.{swift,h,m,c,cc,mm,cpp}'
   spec.ios.deployment_target = '15.0'
-  spec.dependency 'Capacitor'
+  spec.dependency 'Capacitor', '>= 7.0'
   spec.swift_version = '5.9'
 end

package/Package.swift

@@ -8,7 +8,7 @@ let package = Package(
         .library(name: "CapacitorOidc", targets: ["CapacitorOidcPlugin"])
     ],
     dependencies: [
-        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", from: "8.0.0")
+        .package(url: "https://github.com/ionic-team/capacitor-swift-pm.git", "7.0.0"..<"9.0.0")
     ],
     targets: [
         .target(

package/README.md

@@ -1,30 +1,49 @@
 # capacitor-oidc
 
-A small native Capacitor adapter for [`oidc-client-ts`](https://github.com/authts/oidc-client-ts).
+[![npm](https://img.shields.io/npm/v/capacitor-oidc)](https://www.npmjs.com/package/capacitor-oidc)
+[![CI](https://github.com/jojopirker/capacitor-oidc/actions/workflows/ci.yml/badge.svg)](https://github.com/jojopirker/capacitor-oidc/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/capacitor-oidc)](LICENSE)
 
-> [!WARNING]
-> This package is not ready for production use. `oidc-client-ts` 3.5.0 does not validate the required ID-token `iss`, `aud`, and `exp` claims. See [Security](SECURITY.md).
+Native OAuth 2.0 and OpenID Connect for Capacitor, powered by
+[`oidc-client-ts`](https://github.com/authts/oidc-client-ts).
 
-The package keeps OAuth and OpenID Connect in `oidc-client-ts`. Its native code only presents system authentication UI and stores state securely:
+`capacitor-oidc` adapts the familiar `UserManager` API to native iOS and Android
+applications. It keeps protocol behavior in `oidc-client-ts` and adds only the
+Capacitor-specific pieces:
 
-- iOS: `ASWebAuthenticationSession` and Keychain.
-- Android: Auth Tab with its Custom Tab fallback, plus AES-GCM protected storage with a key held by Android Keystore.
-- TypeScript: a native `INavigator`, secure `StateStore`, foreground refresh serialization, and a resume check.
+- system authentication UI instead of an embedded WebView;
+- secure native storage for OIDC transactions and sessions;
+- refresh-token renewal when the app is active or resumes;
+- a native-readable session snapshot for app widgets.
 
-It does not patch `fetch`, add native OIDC networking, accept client secrets, render authentication in a WebView, or implement iframe renewal.
+On iOS, authentication uses `ASWebAuthenticationSession`. On Android, it uses
+AndroidX Auth Tab with its Custom Tab fallback.
+
+> [!CAUTION]
+> This package is an alpha. The public API and stored-session format can still
+> change before v1. See [Security](SECURITY.md) and
+> [current test coverage](docs/TESTING.md) before making a production decision.
+
+## Requirements
+
+- Capacitor 7 or 8
+- iOS 15 or newer
+- Android API 24 or newer
+- Android compile SDK 36, Java 21, and a compatible Android Gradle Plugin
+- an OAuth public client using Authorization Code Flow with PKCE
+- Web Crypto in the packaged Capacitor WebView
+- CORS support for the app's Capacitor origin on OIDC HTTP endpoints
+
+Never ship a client secret in a Capacitor application.
 
 ## Install
 
 ```sh
-npm install capacitor-oidc oidc-client-ts @capacitor/app
+npm install capacitor-oidc @capacitor/app
 npx cap sync
 ```
 
-All discovery, token, refresh, UserInfo, and revocation requests use normal WebView `fetch`. The provider must allow the app's configured Capacitor origin through CORS.
-
-Authorization and logout endpoints must use HTTPS. Plain HTTP is accepted only for loopback local development.
-
-## Usage
+## Quick start
 
 ```ts
 import { CapacitorUserManager } from 'capacitor-oidc';
@@ -41,69 +60,54 @@ const manager = await CapacitorUserManager.create(
   },
   {
     storageNamespace: 'primary',
-    ios: {
-      keychainAccessGroup: 'TEAMID.group.com.example.app',
-      keychainAccessibility: 'afterFirstUnlockThisDeviceOnly',
-      prefersEphemeralWebBrowserSession: false,
-    },
   },
 );
 
 const user = await manager.signin();
 const validUser = await manager.getValidUser(30);
+
 await manager.signout();
 await manager.dispose();
 ```
 
-`automaticSilentRenew` uses `oidc-client-ts`'s foreground expiry timer. Native silent renewal uses a refresh token only and never falls back to an iframe. Concurrent renewal triggers share one request. Returning to the foreground calls `getValidUser()` so a token that expired while the app was suspended is refreshed.
-
-The operating system can suspend or terminate the app, so exact background refresh timing is not promised.
-
-## Redirect setup
-
-Register the redirect URI as a native public-client redirect at the provider. Never put a client secret in the app.
+Register the redirect and post-logout redirect URIs exactly at your provider and
+in the native application. The provider client must be public and must allow
+Authorization Code Flow with PKCE.
 
-For an iOS custom scheme, add it to the application target's `CFBundleURLTypes`. HTTPS callbacks through `ASWebAuthenticationSession` require iOS 17.4 or newer and the appropriate Associated Domains configuration.
+`CapacitorUserManager` is for native Capacitor runtimes. For a browser build, use
+the normal `UserManager` from `oidc-client-ts` and select the implementation with
+`Capacitor.isNativePlatform()` in the application.
 
-For Android custom-scheme fallback, add an intent filter to the app's `BridgeActivity`. HTTPS callbacks require a verified App Link and Digital Asset Links. Auth Tab handles the result directly when the installed browser supports it; its intent is intentionally compatible with Custom Tabs on older browsers.
+## Documentation
 
-Calling `cancel()` on Android rejects the pending JavaScript promise, but Android does not provide an API to forcibly close an already-open system Auth Tab or Custom Tab. Ephemeral browsing is a request to the installed browser and may be ignored by a fallback browser.
+- [Getting started](docs/GETTING_STARTED.md)
+- [iOS and Android setup](docs/PLATFORM_SETUP.md)
+- [Provider configuration](docs/PROVIDERS.md)
+- [API and `oidc-client-ts` compatibility](docs/API.md)
+- [Sessions, secure storage, and widgets](docs/SESSIONS_AND_WIDGETS.md)
+- [Troubleshooting](docs/TROUBLESHOOTING.md)
+- [Testing status](docs/TESTING.md)
+- [Security](SECURITY.md)
 
-## Secure storage and widgets
+## Session renewal
 
-`userStore` and transaction `stateStore` are separate secure namespaces. Each successful user write also updates a versioned native `StoredSessionV1` snapshot. The snapshot is an eventually consistent widget cache, not the canonical OIDC session.
+`automaticSilentRenew` uses the foreground expiry timer from `oidc-client-ts`.
+Native silent renewal uses the refresh token and never falls back to an iframe.
+Concurrent renewal triggers share one request. When the app returns to the
+foreground, the manager checks whether the current user needs renewal.
 
-An iOS app and WidgetKit extension can construct the public `TokenVault` with the same Keychain access group:
+The operating system can suspend or terminate the app, so the package does not
+promise exact background refresh timing.
 
-```swift
-let vault = TokenVault(accessGroup: "TEAMID.group.com.example.app")
-let session = try vault.loadSession(namespace: "primary")
-```
-
-Replace `TEAMID` with the Apple Developer Team ID. Both targets must carry the same
-Keychain Sharing entitlement, normally declared as
-`$(AppIdentifierPrefix)group.com.example.app`; the runtime option uses its expanded
-`TEAMID.group.com.example.app` value. The default accessibility is
-`AfterFirstUnlockThisDeviceOnly`; Keychain synchronization and biometric gating are disabled.
-
-An Android app widget in the same package can use the public native vault:
-
-```java
-TokenVault vault = new TokenVault(context);
-StoredSessionV1 session = vault.loadSession("primary");
-```
+## Networking
 
-Widgets may read the current session. Autonomous native refresh is deliberately not implemented.
+Discovery, token exchange, refresh, UserInfo, and revocation are performed by
+`oidc-client-ts` through the unmodified WebView `fetch`. The corresponding
+provider endpoints must allow the application's configured Capacitor origin
+through CORS.
 
-## Logout behavior
-
-`signout()` uses the provider's end-session endpoint in the same native authentication UI. If `revokeTokensOnSignout` is enabled, upstream revocation runs before local state is cleared. A revocation failure therefore preserves the local session and its renewal timer; after revocation succeeds, a later browser or callback failure leaves the app locally signed out. Removing the user cancels its expiry timer without disabling renewal for a later sign-in with the same manager.
-
-## Unsupported APIs
-
-Use `signin()` and `signout()` for interactive flows. Redirect navigation, iframe logout, and browser session monitoring reject with `UNSUPPORTED_RUNTIME`. Resource Owner Password Credentials, DPoP, client secrets, exact background scheduling, and autonomous widget refresh are outside v1.
-
-Only one interactive native authentication session and one configured manager are supported at a time.
+The package does not patch `fetch`, add native OIDC networking, accept client
+secrets, or render authentication inside a WebView.
 
 ## Development
 
@@ -113,9 +117,9 @@ npm run verify:ios
 npm run verify:android
 ```
 
-Physical-device verification remains required for Web Crypto, system consent UI, redirects, and shared widget access before a production release. See [Testing](docs/TESTING.md) for the full matrix.
-
-See [Publishing](docs/PUBLISHING.md) for the guarded npm trusted-publishing setup and release process.
+Architecture decisions and contributor constraints are documented in
+[ARCHITECTURE.md](ARCHITECTURE.md), [REQUIREMENTS.md](REQUIREMENTS.md), and
+[docs/adr](docs/adr).
 
 ## License
 

package/SECURITY.md

@@ -0,0 +1,60 @@
+# Security
+
+## Design boundary
+
+`capacitor-oidc` delegates OAuth and OpenID Connect protocol behavior to
+`oidc-client-ts`. Native code is limited to presenting system authentication UI
+and storing state securely. The package does not patch `fetch`, process JWTs, or
+implement OAuth endpoints in Swift or Java.
+
+Installed applications are public clients. They must use Authorization Code Flow
+with PKCE and must not contain a client secret. Authorization and provider logout
+run in system authentication UI, never an embedded WebView.
+
+## ID-token validation in `oidc-client-ts` 3.5.0
+
+The pinned `oidc-client-ts` 3.5.0 decodes ID-token claims and validates `sub`,
+`nonce`, and selected refresh-token continuity claims. It does not independently
+compare the decoded `iss`, `aud`, and `exp` claims with the configured client and
+current time. This behavior is visible in the
+[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
+and is the subject of the open upstream report
+[authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
+
+The practical exposure is narrower than an implicit-flow token parser: this
+package uses Authorization Code Flow only, and the token response comes from the
+configured token endpoint over TLS after state, nonce, and PKCE processing. The
+upstream project has not yet classified or resolved the report.
+
+This is a standards-conformance and threat-model consideration, not a categorical
+claim that every application using `oidc-client-ts` is unsafe. Consumers should
+evaluate it against their provider, reliance on ID-token claims, and assurance
+requirements. Resource servers must always validate access tokens independently;
+an application must not use unverified client-side profile claims as its API
+authorization boundary.
+
+The package will follow the upstream resolution and cover the expected behavior
+in provider integration tests before a stable v1 decision. It will not add a
+package-local JWT or cryptographic-validation layer, because duplicating protocol
+security code would expand the attack surface and create a second OIDC engine.
+
+## Secure-storage boundary
+
+OIDC transactions and sessions are stored through iOS Keychain or an Android
+Keystore-backed vault. Configuring an iOS Keychain access group gives every
+entitled target access to the plugin's canonical session, transaction data, and
+widget snapshot. Treat those extensions as part of the application's credential
+trust boundary.
+
+The widget snapshot can contain access, refresh, and ID tokens. Autonomous widget
+refresh is not currently implemented; see
+[Sessions, secure storage, and widgets](docs/SESSIONS_AND_WIDGETS.md).
+
+## Runtime assumptions
+
+`oidc-client-ts` requires `crypto.subtle` and `crypto.getRandomValues`.
+`CapacitorUserManager.create()` rejects with `UNSUPPORTED_RUNTIME` when they are
+absent. Their behavior must be verified in packaged applications on supported
+physical devices.
+
+See [Testing](docs/TESTING.md) for current platform and provider coverage.

package/android/build.gradle

@@ -14,7 +14,7 @@ buildscript {
         mavenCentral()
     }
     dependencies {
-        classpath 'com.android.tools.build:gradle:8.13.0'
+        classpath 'com.android.tools.build:gradle:8.9.1'
     }
 }
 

package/android/src/main/java/com/jojopirker/capacitor/oidc/CapacitorOidcPlugin.java

@@ -16,9 +16,15 @@ import java.security.GeneralSecurityException;
 import java.util.List;
 import org.json.JSONObject;
 
-@CapacitorPlugin(name = NativeContract.PLUGIN_NAME)
+@CapacitorPlugin(name = "CapacitorOidc")
 public final class CapacitorOidcPlugin extends Plugin {
 
+    private static final String AUTH_SESSION_IN_PROGRESS = "AUTH_SESSION_IN_PROGRESS";
+    private static final String USER_CANCELLED = "USER_CANCELLED";
+    private static final String BROWSER_UNAVAILABLE = "BROWSER_UNAVAILABLE";
+    private static final String INVALID_CALLBACK = "INVALID_CALLBACK";
+    private static final String SECURE_STORAGE_ERROR = "SECURE_STORAGE_ERROR";
+
     private ActivityResultLauncher<Intent> authLauncher;
     private PluginCall pendingAuthCall;
     private Uri pendingCallback;
@@ -38,26 +44,26 @@ public final class CapacitorOidcPlugin extends Plugin {
     @PluginMethod
     public void open(PluginCall call) {
         if (pendingAuthCall != null) {
-            call.reject("An authentication session is already active.", NativeContract.ERROR_AUTH_SESSION_IN_PROGRESS);
+            call.reject("An authentication session is already active.", AUTH_SESSION_IN_PROGRESS);
             return;
         }
 
-        String urlValue = requiredString(call, NativeContract.FIELD_URL);
-        String callbackValue = requiredString(call, NativeContract.FIELD_CALLBACK_URL);
+        String urlValue = requiredString(call, "url");
+        String callbackValue = requiredString(call, "callbackUrl");
         if (urlValue == null || callbackValue == null) return;
 
         Uri url = Uri.parse(urlValue);
         Uri callback = Uri.parse(callbackValue);
         if (!isSecureRequestUrl(url)) {
-            call.reject("The authentication URL must use HTTPS outside loopback development.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+            call.reject("The authentication URL must use HTTPS outside loopback development.", BROWSER_UNAVAILABLE);
             return;
         }
         if (!isSupportedCallback(callback)) {
-            call.reject("The callback URL must use HTTPS or a custom scheme.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The callback URL must use HTTPS or a custom scheme.", INVALID_CALLBACK);
             return;
         }
 
-        boolean ephemeral = Boolean.TRUE.equals(call.getBoolean(NativeContract.FIELD_PREFERS_EPHEMERAL_WEB_BROWSER_SESSION, false));
+        boolean ephemeral = Boolean.TRUE.equals(call.getBoolean("prefersEphemeralWebBrowserSession", false));
         AuthTabIntent authTab = new AuthTabIntent.Builder().setEphemeralBrowsingEnabled(ephemeral).build();
         pendingAuthCall = call;
         pendingCallback = callback;
@@ -70,7 +76,7 @@ public final class CapacitorOidcPlugin extends Plugin {
             }
         } catch (ActivityNotFoundException | IllegalStateException error) {
             clearPendingAuth();
-            call.reject("No compatible system browser is available.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+            call.reject("No compatible system browser is available.", BROWSER_UNAVAILABLE);
         }
     }
 
@@ -78,7 +84,7 @@ public final class CapacitorOidcPlugin extends Plugin {
     public void cancel(PluginCall call) {
         PluginCall authCall = pendingAuthCall;
         clearPendingAuth();
-        if (authCall != null) authCall.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+        if (authCall != null) authCall.reject("The authentication session was cancelled.", USER_CANCELLED);
         call.resolve();
     }
 
@@ -90,15 +96,15 @@ public final class CapacitorOidcPlugin extends Plugin {
 
         clearPendingAuth();
         JSObject response = new JSObject();
-        response.put(NativeContract.FIELD_URL, callback.toString());
+        response.put("url", callback.toString());
         call.resolve(response);
     }
 
     @PluginMethod
     public void storageSet(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
-        String value = call.getString(NativeContract.FIELD_VALUE);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
+        String value = call.getString("value");
         if (namespace == null || key == null) return;
         if (value == null) {
             call.reject("value is required.");
@@ -115,8 +121,8 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageGet(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
         if (namespace == null || key == null) return;
 
         try {
@@ -128,8 +134,8 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageRemove(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
-        String key = requiredString(call, NativeContract.FIELD_KEY);
+        String namespace = requiredString(call, "namespace");
+        String key = requiredString(call, "key");
         if (namespace == null || key == null) return;
 
         try {
@@ -141,13 +147,13 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void storageGetAllKeys(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String namespace = requiredString(call, "namespace");
         if (namespace == null) return;
 
         try {
             List<String> keys = vault.getAllKeys(namespace);
             JSObject result = new JSObject();
-            result.put(NativeContract.FIELD_KEYS, new JSArray(keys));
+            result.put("keys", new JSArray(keys));
             call.resolve(result);
         } catch (GeneralSecurityException | IOException error) {
             rejectStorage(call);
@@ -156,11 +162,11 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     @PluginMethod
     public void setSessionSnapshot(PluginCall call) {
-        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String namespace = requiredString(call, "namespace");
         if (namespace == null) return;
 
         try {
-            vault.setSessionSnapshot(namespace, call.getString(NativeContract.FIELD_VALUE));
+            vault.setSessionSnapshot(namespace, call.getString("value"));
             call.resolve();
         } catch (GeneralSecurityException | IOException error) {
             rejectStorage(call);
@@ -174,20 +180,20 @@ public final class CapacitorOidcPlugin extends Plugin {
         if (call == null) return;
 
         if (result.resultCode == AuthTabIntent.RESULT_CANCELED) {
-            call.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+            call.reject("The authentication session was cancelled.", USER_CANCELLED);
             return;
         }
         if (result.resultCode != AuthTabIntent.RESULT_OK || result.resultUri == null) {
-            call.reject("The browser did not return a valid callback.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The browser did not return a valid callback.", INVALID_CALLBACK);
             return;
         }
         if (!CallbackUriMatcher.matches(result.resultUri, expectedCallback)) {
-            call.reject("The authentication callback does not match the configured redirect URL.", NativeContract.ERROR_INVALID_CALLBACK);
+            call.reject("The authentication callback does not match the configured redirect URL.", INVALID_CALLBACK);
             return;
         }
 
         JSObject response = new JSObject();
-        response.put(NativeContract.FIELD_URL, result.resultUri.toString());
+        response.put("url", result.resultUri.toString());
         call.resolve(response);
     }
 
@@ -230,11 +236,11 @@ public final class CapacitorOidcPlugin extends Plugin {
 
     private static void resolveValue(PluginCall call, String value) {
         JSObject result = new JSObject();
-        result.put(NativeContract.FIELD_VALUE, value == null ? JSONObject.NULL : value);
+        result.put("value", value == null ? JSONObject.NULL : value);
         call.resolve(result);
     }
 
     private static void rejectStorage(PluginCall call) {
-        call.reject("Secure storage failed.", NativeContract.ERROR_SECURE_STORAGE_ERROR);
+        call.reject("Secure storage failed.", SECURE_STORAGE_ERROR);
     }
 }

package/contracts/fixtures/stored-session-v1.json

@@ -0,0 +1,11 @@
+{
+  "version": 1,
+  "issuer": "https://issuer.example",
+  "clientId": "mobile",
+  "accessToken": "access",
+  "refreshToken": "refresh",
+  "idToken": "id-token",
+  "tokenType": "Bearer",
+  "scope": "openid profile offline_access",
+  "expiresAt": 1800000000
+}

package/contracts/stored-session-v1.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/jojopirker/capacitor-oidc/contracts/stored-session-v1.schema.json",
+  "title": "StoredSessionV1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "issuer", "clientId", "accessToken", "tokenType"],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "issuer": {
+      "type": "string",
+      "format": "uri"
+    },
+    "clientId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "accessToken": {
+      "type": "string",
+      "minLength": 1
+    },
+    "refreshToken": {
+      "type": "string"
+    },
+    "idToken": {
+      "type": "string"
+    },
+    "tokenType": {
+      "type": "string",
+      "minLength": 1
+    },
+    "scope": {
+      "type": "string"
+    },
+    "expiresAt": {
+      "type": "integer",
+      "minimum": 0
+    }
+  }
+}

package/dist/esm/capacitor-navigator.js

@@ -1,5 +1,4 @@
 import { CapacitorOidcError, unsupported } from './errors';
-import { nativeContract } from './generated/native-contract';
 import { NativeOidc } from './native';
 export class CapacitorNavigator {
     prefersEphemeralWebBrowserSession;
@@ -22,14 +21,14 @@ class CapacitorWindow {
         assertSecureRequestUrl(url);
         const callbackUrl = callbackUrlFromRequest(url);
         const response = await NativeOidc.open({
-            [nativeContract.fields.url]: url,
-            [nativeContract.fields.callbackUrl]: callbackUrl,
-            [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,
+            url,
+            callbackUrl,
+            prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,
         });
-        if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {
-            throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The authentication callback does not match the configured redirect URI');
+        if (!isExpectedCallback(response.url, callbackUrl)) {
+            throw new CapacitorOidcError('INVALID_CALLBACK', 'The authentication callback does not match the configured redirect URI');
         }
-        return { url: response[nativeContract.fields.url] };
+        return response;
     }
     close() {
         void NativeOidc.cancel();
@@ -37,16 +36,19 @@ class CapacitorWindow {
 }
 export function assertSecureRequestUrl(requestUrl) {
     const url = new URL(requestUrl);
-    const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
-    if (url.protocol !== 'https:' && !isLocalDevelopment) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.browserUnavailable, 'OIDC authorization and logout endpoints must use HTTPS');
+    const isHttpLoopback = url.protocol === 'http:' &&
+        (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');
+    if (url.protocol !== 'https:' && !isHttpLoopback) {
+        throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');
     }
 }
 export function callbackUrlFromRequest(requestUrl) {
     const url = new URL(requestUrl);
-    const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');
+    const callback = url.searchParams.get('post_logout_redirect_uri') ??
+        url.searchParams.get('logout_uri') ??
+        url.searchParams.get('redirect_uri');
     if (!callback) {
-        throw new CapacitorOidcError(nativeContract.errorCodes.invalidCallback, 'The OIDC request does not contain a redirect URI');
+        throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');
     }
     return callback;
 }

package/dist/esm/capacitor-navigator.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-navigator.js","sourceRoot":"","sources":["../../src/capacitor-navigator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,eAAe;IACU;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAkB;QACpC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;YAChC,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,WAAW;YAChD,CAAC,cAAc,CAAC,MAAM,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC,iCAAiC;SAClG,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,eAAe,EACzC,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,KAAK;QACH,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,kBAAkB,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IACpH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,kBAAkB,EAC5C,wDAAwD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,cAAc,CAAC,UAAU,CAAC,eAAe,EACzC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;QACjE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;QACzD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO;QACX,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import type { INavigator, IWindow, NavigateParams, NavigateResponse } from 'oidc-client-ts';\n\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\n\nexport class CapacitorNavigator implements INavigator {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async prepare(): Promise<IWindow> {\n    return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Navigator callbacks');\n  }\n}\n\nclass CapacitorWindow implements IWindow {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async navigate({ url }: NavigateParams): Promise<NavigateResponse> {\n    assertSecureRequestUrl(url);\n    const callbackUrl = callbackUrlFromRequest(url);\n    const response = await NativeOidc.open({\n      [nativeContract.fields.url]: url,\n      [nativeContract.fields.callbackUrl]: callbackUrl,\n      [nativeContract.fields.prefersEphemeralWebBrowserSession]: this.prefersEphemeralWebBrowserSession,\n    });\n\n    if (!isExpectedCallback(response[nativeContract.fields.url], callbackUrl)) {\n      throw new CapacitorOidcError(\n        nativeContract.errorCodes.invalidCallback,\n        'The authentication callback does not match the configured redirect URI',\n      );\n    }\n\n    return { url: response[nativeContract.fields.url] };\n  }\n\n  close(): void {\n    void NativeOidc.cancel();\n  }\n}\n\nexport function assertSecureRequestUrl(requestUrl: string): void {\n  const url = new URL(requestUrl);\n  const isLocalDevelopment = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';\n  if (url.protocol !== 'https:' && !isLocalDevelopment) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.browserUnavailable,\n      'OIDC authorization and logout endpoints must use HTTPS',\n    );\n  }\n}\n\nexport function callbackUrlFromRequest(requestUrl: string): string {\n  const url = new URL(requestUrl);\n  const callback = url.searchParams.get('redirect_uri') ?? url.searchParams.get('post_logout_redirect_uri');\n  if (!callback) {\n    throw new CapacitorOidcError(\n      nativeContract.errorCodes.invalidCallback,\n      'The OIDC request does not contain a redirect URI',\n    );\n  }\n  return callback;\n}\n\nexport function isExpectedCallback(actualValue: string, expectedValue: string): boolean {\n  const actual = new URL(actualValue);\n  const expected = new URL(expectedValue);\n  return (\n    actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n    actual.host.toLowerCase() === expected.host.toLowerCase() &&\n    actual.pathname === expected.pathname\n  );\n}\n\nexport class UnsupportedIframeNavigator implements INavigator {\n  async prepare(): Promise<IWindow> {\n    unsupported('Iframe navigation');\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n}\n"]}
+{"version":3,"file":"capacitor-navigator.js","sourceRoot":"","sources":["../../src/capacitor-navigator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,eAAe;IACU;IAA7B,YAA6B,iCAA0C;QAA1C,sCAAiC,GAAjC,iCAAiC,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAkB;QACpC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;YACrC,GAAG;YACH,WAAW;YACX,iCAAiC,EAAE,IAAI,CAAC,iCAAiC;SAC1E,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK;QACH,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,cAAc,GAClB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC7F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,QAAQ,GACZ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,aAAqB;IAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;QACjE,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;QACzD,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,OAAO;QACX,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;CACF","sourcesContent":["import type { INavigator, IWindow, NavigateParams, NavigateResponse } from 'oidc-client-ts';\n\nimport { CapacitorOidcError, unsupported } from './errors';\nimport { NativeOidc } from './native';\n\nexport class CapacitorNavigator implements INavigator {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async prepare(): Promise<IWindow> {\n    return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Navigator callbacks');\n  }\n}\n\nclass CapacitorWindow implements IWindow {\n  constructor(private readonly prefersEphemeralWebBrowserSession: boolean) {}\n\n  async navigate({ url }: NavigateParams): Promise<NavigateResponse> {\n    assertSecureRequestUrl(url);\n    const callbackUrl = callbackUrlFromRequest(url);\n    const response = await NativeOidc.open({\n      url,\n      callbackUrl,\n      prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,\n    });\n\n    if (!isExpectedCallback(response.url, callbackUrl)) {\n      throw new CapacitorOidcError(\n        'INVALID_CALLBACK',\n        'The authentication callback does not match the configured redirect URI',\n      );\n    }\n\n    return response;\n  }\n\n  close(): void {\n    void NativeOidc.cancel();\n  }\n}\n\nexport function assertSecureRequestUrl(requestUrl: string): void {\n  const url = new URL(requestUrl);\n  const isHttpLoopback =\n    url.protocol === 'http:' &&\n    (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');\n  if (url.protocol !== 'https:' && !isHttpLoopback) {\n    throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');\n  }\n}\n\nexport function callbackUrlFromRequest(requestUrl: string): string {\n  const url = new URL(requestUrl);\n  const callback =\n    url.searchParams.get('post_logout_redirect_uri') ??\n    url.searchParams.get('logout_uri') ??\n    url.searchParams.get('redirect_uri');\n  if (!callback) {\n    throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');\n  }\n  return callback;\n}\n\nexport function isExpectedCallback(actualValue: string, expectedValue: string): boolean {\n  const actual = new URL(actualValue);\n  const expected = new URL(expectedValue);\n  return (\n    actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n    actual.host.toLowerCase() === expected.host.toLowerCase() &&\n    actual.pathname === expected.pathname\n  );\n}\n\nexport class UnsupportedIframeNavigator implements INavigator {\n  async prepare(): Promise<IWindow> {\n    unsupported('Iframe navigation');\n  }\n\n  async callback(): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n}\n"]}

package/dist/esm/capacitor-secure-state-store.js

@@ -1,4 +1,3 @@
-import { nativeContract } from './generated/native-contract';
 import { NativeOidc } from './native';
 export class CapacitorSecureStateStore {
     namespace;
@@ -6,31 +5,16 @@ export class CapacitorSecureStateStore {
         this.namespace = namespace;
     }
     async set(key, value) {
-        await NativeOidc.storageSet({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-            [nativeContract.fields.value]: value,
-        });
+        await NativeOidc.storageSet({ namespace: this.namespace, key, value });
     }
     async get(key) {
-        const result = await NativeOidc.storageGet({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-        });
-        return result[nativeContract.fields.value];
+        return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;
     }
     async remove(key) {
-        const result = await NativeOidc.storageRemove({
-            [nativeContract.fields.namespace]: this.namespace,
-            [nativeContract.fields.key]: key,
-        });
-        return result[nativeContract.fields.value];
+        return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;
     }
     async getAllKeys() {
-        const result = await NativeOidc.storageGetAllKeys({
-            [nativeContract.fields.namespace]: this.namespace,
-        });
-        return result[nativeContract.fields.keys];
+        return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;
     }
 }
 //# sourceMappingURL=capacitor-secure-state-store.js.map

package/dist/esm/capacitor-secure-state-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-secure-state-store.js","sourceRoot":"","sources":["../../src/capacitor-secure-state-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,UAAU,CAAC,UAAU,CAAC;YAC1B,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;YAChC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK;SACrC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;YACzC,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC;YAC5C,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;YACjD,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG;SACjC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC;YAChD,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS;SAClD,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;CACF","sourcesContent":["import type { StateStore } from 'oidc-client-ts';\n\nimport { nativeContract } from './generated/native-contract';\nimport { NativeOidc } from './native';\n\nexport class CapacitorSecureStateStore implements StateStore {\n  constructor(private readonly namespace: string) {}\n\n  async set(key: string, value: string): Promise<void> {\n    await NativeOidc.storageSet({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n      [nativeContract.fields.value]: value,\n    });\n  }\n\n  async get(key: string): Promise<string | null> {\n    const result = await NativeOidc.storageGet({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n    });\n    return result[nativeContract.fields.value];\n  }\n\n  async remove(key: string): Promise<string | null> {\n    const result = await NativeOidc.storageRemove({\n      [nativeContract.fields.namespace]: this.namespace,\n      [nativeContract.fields.key]: key,\n    });\n    return result[nativeContract.fields.value];\n  }\n\n  async getAllKeys(): Promise<string[]> {\n    const result = await NativeOidc.storageGetAllKeys({\n      [nativeContract.fields.namespace]: this.namespace,\n    });\n    return result[nativeContract.fields.keys];\n  }\n}\n"]}
+{"version":3,"file":"capacitor-secure-state-store.js","sourceRoot":"","sources":["../../src/capacitor-secure-state-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;CACF","sourcesContent":["import type { StateStore } from 'oidc-client-ts';\n\nimport { NativeOidc } from './native';\n\nexport class CapacitorSecureStateStore implements StateStore {\n  constructor(private readonly namespace: string) {}\n\n  async set(key: string, value: string): Promise<void> {\n    await NativeOidc.storageSet({ namespace: this.namespace, key, value });\n  }\n\n  async get(key: string): Promise<string | null> {\n    return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;\n  }\n\n  async remove(key: string): Promise<string | null> {\n    return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;\n  }\n\n  async getAllKeys(): Promise<string[]> {\n    return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;\n  }\n}\n"]}