capacitor-oidc 0.0.6 → 0.1.1

package/README.md

@@ -4,16 +4,17 @@
 [![CI](https://github.com/jojopirker/capacitor-oidc/actions/workflows/ci.yml/badge.svg)](https://github.com/jojopirker/capacitor-oidc/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/capacitor-oidc)](LICENSE)
 
-`capacitor-oidc` is a simple OAuth 2.0 and OpenID Connect implementation for
-Capacitor 7 and 8 on native iOS and Android, powered by
+`capacitor-oidc` is one OAuth 2.0 and OpenID Connect client for Capacitor web,
+iOS, and Android applications, powered by
 [`oidc-client-ts`](https://github.com/authts/oidc-client-ts). It uses
-Authorization Code Flow with PKCE, native system authentication UI, and secure
-storage.
+Authorization Code Flow with PKCE, native system authentication UI and secure
+storage on mobile, and standard browser navigation and storage on web.
 
 ## Why `capacitor-oidc`?
 
 - Simple standards-based OAuth 2.0 and OIDC for Capacitor, without
   provider-specific SDKs.
+- One manager and configuration contract across web, iOS, and Android.
 - The familiar `oidc-client-ts` `UserManager` API, session objects, and events.
 - System authentication UI instead of an embedded WebView.
 - Secure native storage for OIDC transactions and sessions.
@@ -32,7 +33,7 @@ AndroidX Auth Tab with its Custom Tab fallback.
 | Android   | API 24 or newer; Auth Tab or Custom Tab      |
 | Flow      | Authorization Code Flow with PKCE            |
 | Providers | Compatible OAuth 2.0 and OpenID Connect APIs |
-| Web       | Use `oidc-client-ts` directly                |
+| Web       | Redirect or popup navigation                 |
 
 ## Demo
 
@@ -49,8 +50,8 @@ the provider.
 - Android API 24 or newer
 - Android compile SDK 36, Java 21, and a compatible Android Gradle Plugin
 - an OAuth public client using Authorization Code Flow with PKCE
-- Web Crypto in the packaged Capacitor WebView
-- CORS support for the app's Capacitor origin on OIDC HTTP endpoints
+- Web Crypto in every target runtime
+- CORS support for web application and Capacitor origins on OIDC HTTP endpoints
 
 Never ship a client secret in a Capacitor application.
 
@@ -66,38 +67,44 @@ npx cap sync
 ```ts
 import { CapacitorUserManager } from 'capacitor-oidc';
 
-const manager = await CapacitorUserManager.create(
-  {
+const manager = await CapacitorUserManager.create({
+  common: {
     authority: 'https://identity.example.com',
-    client_id: 'mobile-app',
-    redirect_uri: 'com.example.app:/callback',
-    post_logout_redirect_uri: 'com.example.app:/logout-callback',
+    client_id: 'public-app',
     scope: 'openid profile offline_access',
     automaticSilentRenew: true,
     revokeTokensOnSignout: true,
   },
-  {
-    storageNamespace: 'primary',
+  web: {
+    settings: {
+      redirect_uri: `${window.location.origin}/callback`,
+      post_logout_redirect_uri: `${window.location.origin}/logout-callback`,
+    },
   },
-);
+  native: {
+    settings: {
+      redirect_uri: 'com.example.app:/callback',
+      post_logout_redirect_uri: 'com.example.app:/logout-callback',
+    },
+    options: { storageNamespace: 'primary' },
+  },
+});
 
-const user = await manager.signin();
+await manager.signin();
 const validUser = await manager.getValidUser(30);
 
 await manager.signout();
 await manager.dispose();
 ```
 
-Register the redirect and post-logout redirect URIs exactly at your provider and
-in the native application. The provider client must be public and must allow
-Authorization Code Flow with PKCE.
-
-`CapacitorUserManager` is for native Capacitor runtimes. For a browser build, use
-the normal `UserManager` from `oidc-client-ts` and select the implementation with
-`Capacitor.isNativePlatform()` in the application.
+Register every configured redirect and post-logout redirect URI exactly at your
+provider, and register the native schemes in each native application. On the web
+callback route, call `signinCallback()`; on the web logout callback route, call
+`signoutCallback()`. The package detects the runtime and applies `common`, then
+`web` or `native`, then the matching `ios` or `android` override.
 
 A runnable Keycloak-backed iOS application and its UI test live in
-[`example`](example).
+[`example`](example/).
 
 ## Documentation
 
@@ -120,7 +127,7 @@ npm run verify:android
 
 Architecture decisions and contributor constraints are documented in
 [ARCHITECTURE.md](ARCHITECTURE.md), [REQUIREMENTS.md](REQUIREMENTS.md), and
-[docs/adr](docs/adr).
+[docs/adr](docs/adr/).
 
 ## License
 

package/SECURITY.md

@@ -7,36 +7,10 @@
 and storing state securely. The package does not patch `fetch`, process JWTs, or
 implement OAuth endpoints in Swift or Java.
 
-Installed applications are public clients. They must use Authorization Code Flow
-with PKCE and must not contain a client secret. Authorization and provider logout
-run in system authentication UI, never an embedded WebView.
-
-## ID-token validation in `oidc-client-ts` 3.5.0
-
-The pinned `oidc-client-ts` 3.5.0 decodes ID-token claims and validates `sub`,
-`nonce`, and selected refresh-token continuity claims. It does not independently
-compare the decoded `iss`, `aud`, and `exp` claims with the configured client and
-current time. This behavior is visible in the
-[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
-and is the subject of the open upstream report
-[authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
-
-The practical exposure is narrower than an implicit-flow token parser: this
-package uses Authorization Code Flow only, and the token response comes from the
-configured token endpoint over TLS after state, nonce, and PKCE processing. The
-upstream project has not yet classified or resolved the report.
-
-This is a standards-conformance and threat-model consideration, not a categorical
-claim that every application using `oidc-client-ts` is unsafe. Consumers should
-evaluate it against their provider, reliance on ID-token claims, and assurance
-requirements. Resource servers must always validate access tokens independently;
-an application must not use unverified client-side profile claims as its API
-authorization boundary.
-
-The package will follow the upstream resolution and cover the expected behavior
-in provider integration tests before a stable v1 decision. It will not add a
-package-local JWT or cryptographic-validation layer, because duplicating protocol
-security code would expand the attack surface and create a second OIDC engine.
+All configured applications are public clients. They use Authorization Code Flow
+with PKCE and cannot contain a client secret. Native authorization and provider
+logout run in system authentication UI, never an embedded WebView; web uses
+normal browser redirect or popup navigation.
 
 ## Secure-storage boundary
 
@@ -58,3 +32,26 @@ absent. Their behavior must be verified in packaged applications on supported
 physical devices.
 
 See [Testing](docs/TESTING.md) for current platform and provider coverage.
+
+## Known issues
+
+### ID-token claim validation in `oidc-client-ts` 3.5.0
+
+The pinned `oidc-client-ts` 3.5.0 decodes ID-token claims and validates `sub`,
+`nonce`, and selected refresh-token continuity claims. It does not independently
+compare the decoded `iss`, `aud`, and `exp` claims with the configured client and
+current time. This behavior is visible in the
+[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
+and is the subject of the unresolved upstream report
+[authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
+
+This package uses Authorization Code Flow, so the token response comes from the
+configured token endpoint over TLS after state, nonce, and PKCE processing.
+Applications that rely on `iss`, `aud`, or `exp` claims should still evaluate
+the upstream gap against their assurance requirements. Resource servers must
+validate access tokens independently, and client-side ID-token claims must not
+be an API authorization boundary.
+
+The package will follow the upstream resolution and cover the expected behavior
+in provider integration tests before a stable v1 decision. It will not add a
+package-local JWT validation layer that would duplicate protocol security code.

package/dist/esm/base-capacitor-user-manager.d.ts

@@ -0,0 +1,30 @@
+import { UserManager, type INavigator, type SigninRedirectArgs, type SigninResourceOwnerCredentialsArgs, type SigninSilentArgs, type SignoutRedirectArgs, type User } from 'oidc-client-ts';
+import type { ResolvedUserManagerConfiguration } from './configuration.js';
+import type { CapacitorSigninArgs, CapacitorSignoutArgs } from './definitions.js';
+export declare abstract class BaseCapacitorUserManager extends UserManager {
+    private automaticRenewalPromise?;
+    private refreshPromise?;
+    private readonly signinMode;
+    private readonly signoutMode;
+    private readonly defaultSigninArgs;
+    private readonly defaultSignoutArgs;
+    protected constructor(configuration: ResolvedUserManagerConfiguration, redirectNavigator?: INavigator, popupNavigator?: INavigator, iframeNavigator?: INavigator);
+    protected initialize(): Promise<void>;
+    signin(args?: CapacitorSigninArgs): Promise<void>;
+    signout(args?: CapacitorSignoutArgs): Promise<void>;
+    getValidUser(minimumValiditySeconds?: number): Promise<User | null>;
+    signinPopup(args?: CapacitorSigninArgs): Promise<User>;
+    signoutPopup(args?: CapacitorSignoutArgs): Promise<void>;
+    signinRedirect(args?: SigninRedirectArgs): Promise<void>;
+    signoutRedirect(args?: SignoutRedirectArgs): Promise<void>;
+    signinSilent(args?: SigninSilentArgs): Promise<User | null>;
+    signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User>;
+    removeUser(): Promise<void>;
+    cancel(): Promise<void>;
+    dispose(): Promise<void>;
+    protected performSilentSignin(args: SigninSilentArgs): Promise<User | null>;
+    protected removeUserWithoutWaiting(): Promise<void>;
+    protected checkForAutomaticRenewal(): void;
+    protected abstract disposePlatform(): Promise<void>;
+    private waitForRenewal;
+}

package/dist/esm/base-capacitor-user-manager.js

@@ -0,0 +1,104 @@
+import { UserManager, } from 'oidc-client-ts';
+import { unsupported } from './errors.js';
+export class BaseCapacitorUserManager extends UserManager {
+    automaticRenewalPromise;
+    refreshPromise;
+    signinMode;
+    signoutMode;
+    defaultSigninArgs;
+    defaultSignoutArgs;
+    constructor(configuration, redirectNavigator, popupNavigator, iframeNavigator) {
+        super(configuration.settings, redirectNavigator, popupNavigator, iframeNavigator);
+        this.signinMode = configuration.signinMode;
+        this.signoutMode = configuration.signoutMode;
+        this.defaultSigninArgs = configuration.signinArgs;
+        this.defaultSignoutArgs = configuration.signoutArgs;
+    }
+    async initialize() {
+        await this.getUser();
+    }
+    async signin(args = {}) {
+        const mergedArgs = { ...this.defaultSigninArgs, ...args };
+        if (this.signinMode === 'redirect')
+            return this.signinRedirect(mergedArgs);
+        await this.signinPopup(mergedArgs);
+    }
+    async signout(args = {}) {
+        const mergedArgs = { ...this.defaultSignoutArgs, ...args };
+        if (this.signoutMode === 'redirect')
+            return this.signoutRedirect(mergedArgs);
+        await this.signoutPopup(mergedArgs);
+    }
+    async getValidUser(minimumValiditySeconds = 60) {
+        const user = await this.getUser();
+        if (!user)
+            return null;
+        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)
+            return user;
+        return this.signinSilent();
+    }
+    async signinPopup(args = {}) {
+        await this.waitForRenewal();
+        return super.signinPopup(args);
+    }
+    async signoutPopup(args = {}) {
+        await this.waitForRenewal();
+        await super.signoutPopup(args);
+    }
+    async signinRedirect(args = {}) {
+        await this.waitForRenewal();
+        await super.signinRedirect(args);
+    }
+    async signoutRedirect(args = {}) {
+        await this.waitForRenewal();
+        await super.signoutRedirect(args);
+    }
+    signinSilent(args = {}) {
+        if (!this.refreshPromise) {
+            const refresh = this.performSilentSignin(args);
+            this.refreshPromise = refresh.finally(() => {
+                this.refreshPromise = undefined;
+            });
+        }
+        return this.refreshPromise;
+    }
+    async signinResourceOwnerCredentials(_args) {
+        unsupported('Resource Owner Password Credentials');
+    }
+    async removeUser() {
+        await this.waitForRenewal();
+        await this.removeUserWithoutWaiting();
+    }
+    cancel() {
+        return Promise.resolve();
+    }
+    async dispose() {
+        this.stopSilentRenew();
+        await this.disposePlatform();
+        await this.waitForRenewal();
+        await this.cancel();
+    }
+    performSilentSignin(args) {
+        return super.signinSilent(args);
+    }
+    removeUserWithoutWaiting() {
+        return super.removeUser();
+    }
+    checkForAutomaticRenewal() {
+        if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise)
+            return;
+        const renewal = this.getValidUser();
+        this.automaticRenewalPromise = renewal;
+        void renewal
+            .catch((error) => this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')))
+            .finally(() => {
+            if (this.automaticRenewalPromise === renewal)
+                this.automaticRenewalPromise = undefined;
+        });
+    }
+    async waitForRenewal() {
+        await this.automaticRenewalPromise?.catch(() => undefined);
+        await this.refreshPromise?.catch(() => undefined);
+    }
+}
+//# sourceMappingURL=base-capacitor-user-manager.js.map

package/dist/esm/base-capacitor-user-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-capacitor-user-manager.js","sourceRoot":"","sources":["../../src/base-capacitor-user-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAOZ,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAgB,wBAAyB,SAAQ,WAAW;IACxD,uBAAuB,CAAwB;IAC/C,cAAc,CAAwB;IAC7B,UAAU,CAAuB;IACjC,WAAW,CAAuB;IAClC,iBAAiB,CAAsB;IACvC,kBAAkB,CAAuB;IAE1D,YACE,aAA+C,EAC/C,iBAA8B,EAC9B,cAA2B,EAC3B,eAA4B;QAE5B,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC;IACtD,CAAC;IAES,KAAK,CAAC,UAAU;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA4B,EAAE;QACzC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA6B,EAAE;QAC3C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3D,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,sBAAsB,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAA4B,EAAE;QACvD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,YAAY,CAAC,OAA6B,EAAE;QACzD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,OAA2B,EAAE;QACzD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,eAAe,CAAC,OAA4B,EAAE;QAC3D,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAEQ,YAAY,CAAC,OAAyB,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBACzC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEQ,KAAK,CAAC,8BAA8B,CAAC,KAAyC;QACrF,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAEQ,KAAK,CAAC,UAAU;QACvB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAES,mBAAmB,CAAC,IAAsB;QAClD,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAES,wBAAwB;QAChC,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAES,wBAAwB;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC,uBAAuB;YAAE,OAAO;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC;QACvC,KAAK,OAAO;aACT,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CACxG;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,uBAAuB,KAAK,OAAO;gBAAE,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACzF,CAAC,CAAC,CAAC;IACP,CAAC;IAIO,KAAK,CAAC,cAAc;QAC1B,MAAM,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF","sourcesContent":["import {\n  UserManager,\n  type INavigator,\n  type SigninRedirectArgs,\n  type SigninResourceOwnerCredentialsArgs,\n  type SigninSilentArgs,\n  type SignoutRedirectArgs,\n  type User,\n} from 'oidc-client-ts';\n\nimport type { ResolvedUserManagerConfiguration } from './configuration.js';\nimport type { CapacitorSigninArgs, CapacitorSignoutArgs } from './definitions.js';\nimport { unsupported } from './errors.js';\n\nexport abstract class BaseCapacitorUserManager extends UserManager {\n  private automaticRenewalPromise?: Promise<User | null>;\n  private refreshPromise?: Promise<User | null>;\n  private readonly signinMode: 'popup' | 'redirect';\n  private readonly signoutMode: 'popup' | 'redirect';\n  private readonly defaultSigninArgs: CapacitorSigninArgs;\n  private readonly defaultSignoutArgs: CapacitorSignoutArgs;\n\n  protected constructor(\n    configuration: ResolvedUserManagerConfiguration,\n    redirectNavigator?: INavigator,\n    popupNavigator?: INavigator,\n    iframeNavigator?: INavigator,\n  ) {\n    super(configuration.settings, redirectNavigator, popupNavigator, iframeNavigator);\n    this.signinMode = configuration.signinMode;\n    this.signoutMode = configuration.signoutMode;\n    this.defaultSigninArgs = configuration.signinArgs;\n    this.defaultSignoutArgs = configuration.signoutArgs;\n  }\n\n  protected async initialize(): Promise<void> {\n    await this.getUser();\n  }\n\n  async signin(args: CapacitorSigninArgs = {}): Promise<void> {\n    const mergedArgs = { ...this.defaultSigninArgs, ...args };\n    if (this.signinMode === 'redirect') return this.signinRedirect(mergedArgs);\n    await this.signinPopup(mergedArgs);\n  }\n\n  async signout(args: CapacitorSignoutArgs = {}): Promise<void> {\n    const mergedArgs = { ...this.defaultSignoutArgs, ...args };\n    if (this.signoutMode === 'redirect') return this.signoutRedirect(mergedArgs);\n    await this.signoutPopup(mergedArgs);\n  }\n\n  async getValidUser(minimumValiditySeconds = 60): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user) return null;\n    if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds) return user;\n    return this.signinSilent();\n  }\n\n  override async signinPopup(args: CapacitorSigninArgs = {}): Promise<User> {\n    await this.waitForRenewal();\n    return super.signinPopup(args);\n  }\n\n  override async signoutPopup(args: CapacitorSignoutArgs = {}): Promise<void> {\n    await this.waitForRenewal();\n    await super.signoutPopup(args);\n  }\n\n  override async signinRedirect(args: SigninRedirectArgs = {}): Promise<void> {\n    await this.waitForRenewal();\n    await super.signinRedirect(args);\n  }\n\n  override async signoutRedirect(args: SignoutRedirectArgs = {}): Promise<void> {\n    await this.waitForRenewal();\n    await super.signoutRedirect(args);\n  }\n\n  override signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {\n    if (!this.refreshPromise) {\n      const refresh = this.performSilentSignin(args);\n      this.refreshPromise = refresh.finally(() => {\n        this.refreshPromise = undefined;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  override async signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User> {\n    unsupported('Resource Owner Password Credentials');\n  }\n\n  override async removeUser(): Promise<void> {\n    await this.waitForRenewal();\n    await this.removeUserWithoutWaiting();\n  }\n\n  cancel(): Promise<void> {\n    return Promise.resolve();\n  }\n\n  async dispose(): Promise<void> {\n    this.stopSilentRenew();\n    await this.disposePlatform();\n    await this.waitForRenewal();\n    await this.cancel();\n  }\n\n  protected performSilentSignin(args: SigninSilentArgs): Promise<User | null> {\n    return super.signinSilent(args);\n  }\n\n  protected removeUserWithoutWaiting(): Promise<void> {\n    return super.removeUser();\n  }\n\n  protected checkForAutomaticRenewal(): void {\n    if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise) return;\n    const renewal = this.getValidUser();\n    this.automaticRenewalPromise = renewal;\n    void renewal\n      .catch((error: unknown) =>\n        this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')),\n      )\n      .finally(() => {\n        if (this.automaticRenewalPromise === renewal) this.automaticRenewalPromise = undefined;\n      });\n  }\n\n  protected abstract disposePlatform(): Promise<void>;\n\n  private async waitForRenewal(): Promise<void> {\n    await this.automaticRenewalPromise?.catch(() => undefined);\n    await this.refreshPromise?.catch(() => undefined);\n  }\n}\n"]}

package/dist/esm/capacitor-user-manager.d.ts

@@ -1,34 +1,11 @@
-import { UserManager, type SigninPopupArgs, type SigninResourceOwnerCredentialsArgs, type SigninSilentArgs, type SignoutResponse, type SignoutPopupArgs, type User } from 'oidc-client-ts';
-import type { CapacitorOidcNativeOptions, CapacitorUserManagerSettings } from './definitions.js';
-export declare class CapacitorUserManager extends UserManager {
-    private readonly storageNamespace;
-    private automaticRenewalPromise?;
-    private refreshPromise?;
-    private appStateListener?;
-    private constructor();
+import { BaseCapacitorUserManager } from './base-capacitor-user-manager.js';
+import { type ResolvedUserManagerConfiguration } from './configuration.js';
+import type { CapacitorOidcNativeOptions, CapacitorUserManagerConfiguration, CapacitorUserManagerSettings } from './definitions.js';
+export declare abstract class CapacitorUserManager extends BaseCapacitorUserManager {
+    static create(configuration: CapacitorUserManagerConfiguration): Promise<CapacitorUserManager>;
+    /** @deprecated Use the platform configuration object. */
     static create(settings: CapacitorUserManagerSettings, nativeOptions?: CapacitorOidcNativeOptions): Promise<CapacitorUserManager>;
-    signin(args?: SigninPopupArgs): Promise<User>;
-    signinPopup(args?: SigninPopupArgs): Promise<User>;
-    signout(args?: SignoutPopupArgs): Promise<void>;
-    signoutPopup(args?: SignoutPopupArgs): Promise<void>;
-    private checkForAutomaticRenewal;
-    getValidUser(minimumValiditySeconds?: number): Promise<User | null>;
-    removeUser(): Promise<void>;
-    signinSilent(args?: SigninSilentArgs): Promise<User | null>;
-    private refresh;
-    private waitForRenewal;
-    storeUser(user: User | null): Promise<void>;
-    cancel(): Promise<void>;
-    dispose(): Promise<void>;
-    signinRedirect(): Promise<void>;
-    signinRedirectCallback(_url?: string): Promise<User>;
-    signinCallback(_url?: string): Promise<User | undefined>;
-    signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User>;
-    signinSilentCallback(_url?: string): Promise<void>;
-    signoutRedirect(): Promise<void>;
-    signoutRedirectCallback(_url?: string): Promise<SignoutResponse>;
-    signoutCallback(_url?: string, _keepOpen?: boolean): Promise<SignoutResponse | undefined>;
-    signoutSilent(): Promise<void>;
-    signoutSilentCallback(_url?: string): Promise<void>;
-    querySessionStatus(): Promise<null>;
 }
+type PlatformUserManagerFactory = (configuration: ResolvedUserManagerConfiguration) => CapacitorUserManager | Promise<CapacitorUserManager>;
+export declare function setPlatformUserManagerFactory(factory: PlatformUserManagerFactory): void;
+export {};

package/dist/esm/capacitor-user-manager.js

@@ -1,184 +1,30 @@
-import { App } from '@capacitor/app';
-import { ErrorResponse, UserManager, } from 'oidc-client-ts';
-import { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator.js';
-import { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';
-import { CapacitorOidcError, unsupported } from './errors.js';
-import { NativeOidc } from './native.js';
-export class CapacitorUserManager extends UserManager {
-    storageNamespace;
-    automaticRenewalPromise;
-    refreshPromise;
-    appStateListener;
-    constructor(settings, nativeOptions, storageNamespace) {
-        const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);
-        const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);
-        const navigator = new CapacitorNavigator(nativeOptions.prefersEphemeralWebBrowserSession ?? false);
-        super({
-            ...settings,
-            response_type: 'code',
-            disablePKCE: false,
-            monitorSession: false,
-            popup_redirect_uri: settings.redirect_uri,
-            popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,
-            stateStore,
-            userStore,
-        }, navigator, navigator, new UnsupportedIframeNavigator());
-        this.storageNamespace = storageNamespace;
-    }
-    static async create(settings, nativeOptions = {}) {
+import { Capacitor } from '@capacitor/core';
+import { BaseCapacitorUserManager } from './base-capacitor-user-manager.js';
+import { resolveConfiguration, resolveLegacyNativeConfiguration, } from './configuration.js';
+import { CapacitorOidcError } from './errors.js';
+export class CapacitorUserManager extends BaseCapacitorUserManager {
+    static async create(configuration, nativeOptions = {}) {
         assertRuntime();
-        assertSettings(settings);
-        await NativeOidc.configure(nativeOptions.ios ?? {});
-        const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');
-        await manager.getUser();
-        manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {
-            if (isActive) {
-                manager.checkForAutomaticRenewal();
-            }
-        });
-        manager.checkForAutomaticRenewal();
+        const platform = currentPlatform();
+        const resolved = 'redirect_uri' in configuration
+            ? resolveLegacyNativeConfiguration(configuration, nativeOptions, platform)
+            : resolveConfiguration(configuration, platform);
+        const manager = await platformUserManagerFactory(resolved);
+        await manager.initialize();
         return manager;
     }
-    async signin(args = {}) {
-        return this.signinPopup(args);
-    }
-    async signinPopup(args = {}) {
-        await this.waitForRenewal();
-        return super.signinPopup(args);
-    }
-    async signout(args = {}) {
-        await this.signoutPopup(args);
-    }
-    async signoutPopup(args = {}) {
-        await this.waitForRenewal();
-        await super.signoutPopup(args);
-    }
-    checkForAutomaticRenewal() {
-        if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise)
-            return;
-        const renewal = this.getValidUser();
-        this.automaticRenewalPromise = renewal;
-        void renewal
-            .catch((error) => this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')))
-            .finally(() => {
-            if (this.automaticRenewalPromise === renewal)
-                this.automaticRenewalPromise = undefined;
-        });
-    }
-    async getValidUser(minimumValiditySeconds = 60) {
-        const user = await this.getUser();
-        if (!user)
-            return null;
-        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)
-            return user;
-        return this.signinSilent();
-    }
-    async removeUser() {
-        await this.waitForRenewal();
-        await super.removeUser();
-    }
-    signinSilent(args = {}) {
-        if (!this.refreshPromise) {
-            this.refreshPromise = this.refresh(args).finally(() => {
-                this.refreshPromise = undefined;
-            });
-        }
-        return this.refreshPromise;
-    }
-    async refresh(args) {
-        const user = await this.getUser();
-        if (!user?.refresh_token) {
-            if (user?.expired)
-                await super.removeUser();
-            return null;
-        }
-        const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error) => {
-            if (error instanceof ErrorResponse && error.error === 'invalid_grant')
-                await super.removeUser();
-            throw error;
-        });
-        return refresh;
-    }
-    async waitForRenewal() {
-        await this.automaticRenewalPromise?.catch(() => undefined);
-        await this.refreshPromise?.catch(() => undefined);
-    }
-    async storeUser(user) {
-        await super.storeUser(user);
-        await NativeOidc.setSessionSnapshot({
-            namespace: this.storageNamespace,
-            value: user
-                ? JSON.stringify(toStoredSession(user, user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority, this.settings.client_id))
-                : null,
-        });
-    }
-    async cancel() {
-        await NativeOidc.cancel();
-    }
-    async dispose() {
-        this.stopSilentRenew();
-        await this.appStateListener?.remove();
-        await this.waitForRenewal();
-        await this.cancel();
-    }
-    async signinRedirect() {
-        unsupported('Redirect navigation');
-    }
-    async signinRedirectCallback(_url) {
-        unsupported('Redirect navigation');
-    }
-    async signinCallback(_url) {
-        unsupported('Browser callback dispatch');
-    }
-    async signinResourceOwnerCredentials(_args) {
-        unsupported('Resource Owner Password Credentials');
-    }
-    async signinSilentCallback(_url) {
-        unsupported('Iframe navigation');
-    }
-    async signoutRedirect() {
-        unsupported('Redirect navigation');
-    }
-    async signoutRedirectCallback(_url) {
-        unsupported('Redirect navigation');
-    }
-    async signoutCallback(_url, _keepOpen) {
-        unsupported('Browser callback dispatch');
-    }
-    async signoutSilent() {
-        unsupported('Iframe logout');
-    }
-    async signoutSilentCallback(_url) {
-        unsupported('Iframe logout');
-    }
-    async querySessionStatus() {
-        unsupported('Browser session monitoring');
-    }
+}
+let platformUserManagerFactory;
+export function setPlatformUserManagerFactory(factory) {
+    platformUserManagerFactory = factory;
+}
+function currentPlatform() {
+    const platform = Capacitor.getPlatform();
+    return platform === 'ios' || platform === 'android' ? platform : 'web';
 }
 function assertRuntime() {
     if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {
         throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');
     }
 }
-function assertSettings(settings) {
-    if ('client_secret' in settings) {
-        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native public clients must not contain a client secret');
-    }
-    if ('client_authentication' in settings || 'dpop' in settings) {
-        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'The supplied settings contain an unsupported native-client option');
-    }
-}
-function toStoredSession(user, issuer, clientId) {
-    return {
-        version: 1,
-        issuer,
-        clientId,
-        accessToken: user.access_token,
-        refreshToken: user.refresh_token,
-        idToken: user.id_token,
-        tokenType: user.token_type,
-        scope: user.scope,
-        expiresAt: user.expires_at,
-    };
-}
 //# sourceMappingURL=capacitor-user-manager.js.map

package/dist/esm/capacitor-user-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"capacitor-user-manager.js","sourceRoot":"","sources":["../../src/capacitor-user-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,OAAO,EACL,aAAa,EACb,WAAW,GAOZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IAQhC;IAPX,uBAAuB,CAAwB;IAC/C,cAAc,CAAwB;IACtC,gBAAgB,CAAwB;IAEhD,YACE,QAAsC,EACtC,aAAyC,EACxB,gBAAwB;QAEzC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,eAAe,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,GAAG,gBAAgB,UAAU,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,iCAAiC,IAAI,KAAK,CAAC,CAAC;QAEnG,KAAK,CACH;YACE,GAAG,QAAQ;YACX,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,KAAK;YAClB,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,QAAQ,CAAC,YAAY;YACzC,8BAA8B,EAAE,QAAQ,CAAC,wBAAwB;YACjE,UAAU;YACV,SAAS;SACV,EACD,SAAS,EACT,SAAS,EACT,IAAI,0BAA0B,EAAE,CACjC,CAAC;QApBe,qBAAgB,GAAhB,gBAAgB,CAAQ;IAqB3C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,QAAsC,EACtC,gBAA4C,EAAE;QAE9C,aAAa,EAAE,CAAC;QAChB,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC;QAC/G,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,gBAAgB,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YAClF,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAwB,EAAE;QACnD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE;QACvC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAEQ,KAAK,CAAC,YAAY,CAAC,OAAyB,EAAE;QACrD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,wBAAwB;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC,uBAAuB;YAAE,OAAO;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC;QACvC,KAAK,OAAO;aACT,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CACxG;aACA,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,uBAAuB,KAAK,OAAO;gBAAE,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC;QACzF,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,sBAAsB,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAEQ,KAAK,CAAC,UAAU;QACvB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAEQ,YAAY,CAAC,OAAyB,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACpD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAsB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;YACzB,IAAI,IAAI,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YACrG,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;gBAAE,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;YAChG,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAAiB;QACxC,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,UAAU,CAAC,kBAAkB,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,gBAAgB;YAChC,KAAK,EAAE,IAAI;gBACT,CAAC,CAAC,IAAI,CAAC,SAAS,CACZ,eAAe,CACb,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAC7E,IAAI,CAAC,QAAQ,CAAC,SAAS,CACxB,CACF;gBACH,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAEQ,KAAK,CAAC,cAAc;QAC3B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,sBAAsB,CAAC,IAAa;QACjD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,cAAc,CAAC,IAAa;QACzC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,8BAA8B,CAAC,KAAyC;QACrF,WAAW,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAEQ,KAAK,CAAC,oBAAoB,CAAC,IAAa;QAC/C,WAAW,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,eAAe;QAC5B,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,uBAAuB,CAAC,IAAa;QAClD,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,SAAmB;QAC/D,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAEQ,KAAK,CAAC,aAAa;QAC1B,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,qBAAqB,CAAC,IAAa;QAChD,WAAW,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAEQ,KAAK,CAAC,kBAAkB;QAC/B,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,uBAAuB,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAU,EAAE,MAAc,EAAE,QAAgB;IACnE,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM;QACN,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { App } from '@capacitor/app';\nimport type { PluginListenerHandle } from '@capacitor/core';\nimport {\n  ErrorResponse,\n  UserManager,\n  type SigninPopupArgs,\n  type SigninResourceOwnerCredentialsArgs,\n  type SigninSilentArgs,\n  type SignoutResponse,\n  type SignoutPopupArgs,\n  type User,\n} from 'oidc-client-ts';\n\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator.js';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';\nimport type { CapacitorOidcNativeOptions, CapacitorUserManagerSettings, StoredSessionV1 } from './definitions.js';\nimport { CapacitorOidcError, unsupported } from './errors.js';\nimport { NativeOidc } from './native.js';\n\nexport class CapacitorUserManager extends UserManager {\n  private automaticRenewalPromise?: Promise<User | null>;\n  private refreshPromise?: Promise<User | null>;\n  private appStateListener?: PluginListenerHandle;\n\n  private constructor(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions,\n    private readonly storageNamespace: string,\n  ) {\n    const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n    const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n    const navigator = new CapacitorNavigator(nativeOptions.prefersEphemeralWebBrowserSession ?? false);\n\n    super(\n      {\n        ...settings,\n        response_type: 'code',\n        disablePKCE: false,\n        monitorSession: false,\n        popup_redirect_uri: settings.redirect_uri,\n        popup_post_logout_redirect_uri: settings.post_logout_redirect_uri,\n        stateStore,\n        userStore,\n      },\n      navigator,\n      navigator,\n      new UnsupportedIframeNavigator(),\n    );\n  }\n\n  static async create(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions = {},\n  ): Promise<CapacitorUserManager> {\n    assertRuntime();\n    assertSettings(settings);\n    await NativeOidc.configure(nativeOptions.ios ?? {});\n    const manager = new CapacitorUserManager(settings, nativeOptions, nativeOptions.storageNamespace ?? 'default');\n    await manager.getUser();\n    manager.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n      if (isActive) {\n        manager.checkForAutomaticRenewal();\n      }\n    });\n    manager.checkForAutomaticRenewal();\n    return manager;\n  }\n\n  async signin(args: SigninPopupArgs = {}): Promise<User> {\n    return this.signinPopup(args);\n  }\n\n  override async signinPopup(args: SigninPopupArgs = {}): Promise<User> {\n    await this.waitForRenewal();\n    return super.signinPopup(args);\n  }\n\n  async signout(args: SignoutPopupArgs = {}): Promise<void> {\n    await this.signoutPopup(args);\n  }\n\n  override async signoutPopup(args: SignoutPopupArgs = {}): Promise<void> {\n    await this.waitForRenewal();\n    await super.signoutPopup(args);\n  }\n\n  private checkForAutomaticRenewal(): void {\n    if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise) return;\n    const renewal = this.getValidUser();\n    this.automaticRenewalPromise = renewal;\n    void renewal\n      .catch((error: unknown) =>\n        this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')),\n      )\n      .finally(() => {\n        if (this.automaticRenewalPromise === renewal) this.automaticRenewalPromise = undefined;\n      });\n  }\n\n  async getValidUser(minimumValiditySeconds = 60): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user) return null;\n    if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds) return user;\n    return this.signinSilent();\n  }\n\n  override async removeUser(): Promise<void> {\n    await this.waitForRenewal();\n    await super.removeUser();\n  }\n\n  override signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {\n    if (!this.refreshPromise) {\n      this.refreshPromise = this.refresh(args).finally(() => {\n        this.refreshPromise = undefined;\n      });\n    }\n    return this.refreshPromise;\n  }\n\n  private async refresh(args: SigninSilentArgs): Promise<User | null> {\n    const user = await this.getUser();\n    if (!user?.refresh_token) {\n      if (user?.expired) await super.removeUser();\n      return null;\n    }\n\n    const refresh = super.signinSilent({ ...args, forceIframeAuth: false }).catch(async (error: unknown) => {\n      if (error instanceof ErrorResponse && error.error === 'invalid_grant') await super.removeUser();\n      throw error;\n    });\n    return refresh;\n  }\n\n  private async waitForRenewal(): Promise<void> {\n    await this.automaticRenewalPromise?.catch(() => undefined);\n    await this.refreshPromise?.catch(() => undefined);\n  }\n\n  override async storeUser(user: User | null): Promise<void> {\n    await super.storeUser(user);\n    await NativeOidc.setSessionSnapshot({\n      namespace: this.storageNamespace,\n      value: user\n        ? JSON.stringify(\n            toStoredSession(\n              user,\n              user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority,\n              this.settings.client_id,\n            ),\n          )\n        : null,\n    });\n  }\n\n  async cancel(): Promise<void> {\n    await NativeOidc.cancel();\n  }\n\n  async dispose(): Promise<void> {\n    this.stopSilentRenew();\n    await this.appStateListener?.remove();\n    await this.waitForRenewal();\n    await this.cancel();\n  }\n\n  override async signinRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinRedirectCallback(_url?: string): Promise<User> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signinCallback(_url?: string): Promise<User | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signinResourceOwnerCredentials(_args: SigninResourceOwnerCredentialsArgs): Promise<User> {\n    unsupported('Resource Owner Password Credentials');\n  }\n\n  override async signinSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe navigation');\n  }\n\n  override async signoutRedirect(): Promise<void> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutRedirectCallback(_url?: string): Promise<SignoutResponse> {\n    unsupported('Redirect navigation');\n  }\n\n  override async signoutCallback(_url?: string, _keepOpen?: boolean): Promise<SignoutResponse | undefined> {\n    unsupported('Browser callback dispatch');\n  }\n\n  override async signoutSilent(): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async signoutSilentCallback(_url?: string): Promise<void> {\n    unsupported('Iframe logout');\n  }\n\n  override async querySessionStatus(): Promise<null> {\n    unsupported('Browser session monitoring');\n  }\n}\n\nfunction assertRuntime(): void {\n  if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');\n  }\n}\n\nfunction assertSettings(settings: CapacitorUserManagerSettings): void {\n  if ('client_secret' in settings) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native public clients must not contain a client secret');\n  }\n  if ('client_authentication' in settings || 'dpop' in settings) {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'The supplied settings contain an unsupported native-client option',\n    );\n  }\n}\n\nfunction toStoredSession(user: User, issuer: string, clientId: string): StoredSessionV1 {\n  return {\n    version: 1,\n    issuer,\n    clientId,\n    accessToken: user.access_token,\n    refreshToken: user.refresh_token,\n    idToken: user.id_token,\n    tokenType: user.token_type,\n    scope: user.scope,\n    expiresAt: user.expires_at,\n  };\n}\n"]}
+{"version":3,"file":"capacitor-user-manager.js","sourceRoot":"","sources":["../../src/capacitor-user-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EACL,oBAAoB,EACpB,gCAAgC,GAGjC,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,OAAgB,oBAAqB,SAAQ,wBAAwB;IAOzE,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,aAA+E,EAC/E,gBAA4C,EAAE;QAE9C,aAAa,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,QAAQ,GACZ,cAAc,IAAI,aAAa;YAC7B,CAAC,CAAC,gCAAgC,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;YAC1E,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAEpD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAMD,IAAI,0BAAsD,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,OAAmC;IAC/E,0BAA0B,GAAG,OAAO,CAAC;AACvC,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAClG,CAAC;AACH,CAAC","sourcesContent":["import { Capacitor } from '@capacitor/core';\n\nimport { BaseCapacitorUserManager } from './base-capacitor-user-manager.js';\nimport {\n  resolveConfiguration,\n  resolveLegacyNativeConfiguration,\n  type ResolvedUserManagerConfiguration,\n  type RuntimePlatform,\n} from './configuration.js';\nimport type {\n  CapacitorOidcNativeOptions,\n  CapacitorUserManagerConfiguration,\n  CapacitorUserManagerSettings,\n} from './definitions.js';\nimport { CapacitorOidcError } from './errors.js';\n\nexport abstract class CapacitorUserManager extends BaseCapacitorUserManager {\n  static create(configuration: CapacitorUserManagerConfiguration): Promise<CapacitorUserManager>;\n  /** @deprecated Use the platform configuration object. */\n  static create(\n    settings: CapacitorUserManagerSettings,\n    nativeOptions?: CapacitorOidcNativeOptions,\n  ): Promise<CapacitorUserManager>;\n  static async create(\n    configuration: CapacitorUserManagerConfiguration | CapacitorUserManagerSettings,\n    nativeOptions: CapacitorOidcNativeOptions = {},\n  ): Promise<CapacitorUserManager> {\n    assertRuntime();\n    const platform = currentPlatform();\n    const resolved =\n      'redirect_uri' in configuration\n        ? resolveLegacyNativeConfiguration(configuration, nativeOptions, platform)\n        : resolveConfiguration(configuration, platform);\n\n    const manager = await platformUserManagerFactory(resolved);\n    await manager.initialize();\n    return manager;\n  }\n}\n\ntype PlatformUserManagerFactory = (\n  configuration: ResolvedUserManagerConfiguration,\n) => CapacitorUserManager | Promise<CapacitorUserManager>;\n\nlet platformUserManagerFactory: PlatformUserManagerFactory;\n\nexport function setPlatformUserManagerFactory(factory: PlatformUserManagerFactory): void {\n  platformUserManagerFactory = factory;\n}\n\nfunction currentPlatform(): RuntimePlatform {\n  const platform = Capacitor.getPlatform();\n  return platform === 'ios' || platform === 'android' ? platform : 'web';\n}\n\nfunction assertRuntime(): void {\n  if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');\n  }\n}\n"]}

package/dist/esm/configuration.d.ts

@@ -0,0 +1,14 @@
+import type { UserManagerSettings } from 'oidc-client-ts';
+import type { CapacitorOidcNativeOptions, CapacitorSigninArgs, CapacitorSignoutArgs, CapacitorUserManagerConfiguration, CapacitorUserManagerSettings } from './definitions.js';
+export type RuntimePlatform = 'android' | 'ios' | 'web';
+export interface ResolvedUserManagerConfiguration {
+    platform: RuntimePlatform;
+    settings: UserManagerSettings;
+    nativeOptions?: CapacitorOidcNativeOptions;
+    signinMode: 'popup' | 'redirect';
+    signoutMode: 'popup' | 'redirect';
+    signinArgs: CapacitorSigninArgs;
+    signoutArgs: CapacitorSignoutArgs;
+}
+export declare function resolveConfiguration(configuration: CapacitorUserManagerConfiguration, platform: RuntimePlatform): ResolvedUserManagerConfiguration;
+export declare function resolveLegacyNativeConfiguration(settings: CapacitorUserManagerSettings, nativeOptions: CapacitorOidcNativeOptions, platform: RuntimePlatform): ResolvedUserManagerConfiguration;