docpouch-client 0.9.1 → 1.0.1

package/dist/index.js

@@ -25,6 +25,14 @@ export default class docPouchClient {
          * @type {string | null}
          */
         this.authToken = null;
+        this.oidcConfig = null;
+        this.oidcAccessToken = null;
+        this.oidcRefreshToken = null;
+        this.oidcIdToken = null;
+        this.oidcTokenExpiry = 0;
+        this.codeVerifier = null;
+        this.oidcState = null;
+        this.authMethod = 'none';
         /**
          * Flag indicating whether a connection attempt is in progress.
          *
@@ -66,7 +74,7 @@ export default class docPouchClient {
             return;
         }
         this.realTimeSync = newRealTimeSync;
-        if (newRealTimeSync && this.authToken) {
+        if (newRealTimeSync && (this.authToken || this.oidcAccessToken)) {
             console.log("Activating realtime updates");
             // Ensure we're not in the middle of another connection attempt
             if (this.connectionInProgress) {
@@ -96,6 +104,7 @@ export default class docPouchClient {
         const response = await this.request('/users/login', 'POST', credentials, false);
         if (response.token) {
             this.authToken = response.token;
+            this.authMethod = 'jwt';
             // Reconnect websocket with new token if realtime sync is enabled
             if (this.realTimeSync) {
                 this.initWebSocket();
@@ -236,8 +245,11 @@ export default class docPouchClient {
      */
     setToken(token) {
         console.log("Setting token to:", token ? "***token***" : "null");
+        this.authMethod = token ? 'jwt' : 'none';
         const tokenChanged = this.authToken !== token;
         this.authToken = token;
+        if (!token)
+            this.clearOidcTokens();
         if (!tokenChanged) {
             console.log("Token unchanged, no need to reconnect");
             return;
@@ -279,17 +291,208 @@ export default class docPouchClient {
         console.log("Socket connection debug info:");
         console.log("- Connected:", this.socket.connected);
         console.log("- Socket ID:", this.socket.id);
-        console.log("- Auth token present:", !!this.authToken);
+        console.log("- Auth token present:", !!this.authToken, "(method:", this.authMethod + ")");
+        console.log("- OIDC access token present:", !!this.oidcAccessToken);
         console.log("- Connection in progress:", this.connectionInProgress);
         console.log("- Realtime sync enabled:", this.realTimeSync);
         console.log("- Socket options:", this.socket.io.opts);
+        const activeToken = this.authMethod === 'oidc' ? this.oidcAccessToken : this.authToken;
         // Try to force reconnection
-        if (!this.socket.connected && this.authToken && this.realTimeSync) {
+        if (!this.socket.connected && activeToken && this.realTimeSync) {
             console.log("Attempting to force reconnection...");
-            this.socket.auth = { token: this.authToken };
+            this.socket.auth = { token: activeToken };
             this.socket.connect();
         }
     }
+    // OIDC Authentication Methods
+    /**
+     * Initiates the OIDC authentication flow by redirecting to the authorization endpoint.
+     *
+     * @param {I_OidcConfig} config - OIDC provider configuration.
+     * @returns {Promise<void>}
+     */
+    async loginWithOidc(config) {
+        this.oidcConfig = config;
+        const response = await fetch(`${config.issuer}/.well-known/openid-configuration`);
+        const discovery = await response.json();
+        this.codeVerifier = this.generateCodeVerifier();
+        this.oidcState = this.generateState();
+        const codeChallenge = await this.generateCodeChallenge(this.codeVerifier);
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: config.clientId,
+            redirect_uri: config.redirectUri,
+            scope: config.scopes?.join(' ') || 'openid profile',
+            state: this.oidcState,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256'
+        });
+        window.location.href = `${discovery.authorization_endpoint}?${params.toString()}`;
+    }
+    /**
+     * Handles the OIDC callback by exchanging the authorization code for tokens.
+     *
+     * @returns {Promise<boolean>} True if the callback was handled successfully.
+     */
+    async handleOidcCallback() {
+        const params = new URLSearchParams(window.location.search);
+        const code = params.get('code');
+        const state = params.get('state');
+        const error = params.get('error');
+        if (error)
+            throw new Error(`OAuth error: ${error}`);
+        if (!code || !state)
+            return false;
+        if (state !== this.oidcState)
+            throw new Error('State mismatch');
+        const discovery = await this.discoverOidc();
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: this.oidcConfig.redirectUri,
+            client_id: this.oidcConfig.clientId,
+            code_verifier: this.codeVerifier || ''
+        });
+        const response = await fetch(discovery.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString()
+        });
+        if (!response.ok)
+            throw new Error('Token exchange failed');
+        const raw = await response.json();
+        const tokens = {
+            accessToken: raw.access_token,
+            refreshToken: raw.refresh_token,
+            idToken: raw.id_token,
+            expiresIn: raw.expires_in,
+            tokenType: raw.token_type,
+            scope: raw.scope
+        };
+        this.setOidcTokens(tokens);
+        if (this.realTimeSync)
+            this.initWebSocket();
+        return true;
+    }
+    restoreOidcSession() {
+        if (typeof window === 'undefined' || !window.localStorage)
+            return false;
+        const stored = localStorage.getItem('docpouch_oidc_session');
+        if (!stored)
+            return false;
+        try {
+            const session = JSON.parse(stored);
+            if (!session.accessToken || Date.now() >= session.expiry) {
+                this.clearPersistedOidcSession();
+                return false;
+            }
+            this.authMethod = 'oidc';
+            this.oidcAccessToken = session.accessToken;
+            this.oidcRefreshToken = session.refreshToken || null;
+            this.oidcIdToken = session.idToken || null;
+            this.oidcTokenExpiry = session.expiry;
+            return true;
+        }
+        catch {
+            this.clearPersistedOidcSession();
+            return false;
+        }
+    }
+    /**
+     * Ensures the OIDC access token is valid, refreshing it if necessary.
+     */
+    async ensureValidOidcToken() {
+        if (this.authMethod !== 'oidc' || !this.oidcAccessToken)
+            throw new Error('Not authenticated via OIDC');
+        if (Date.now() >= this.oidcTokenExpiry - 60000) {
+            await this.refreshOidcToken();
+        }
+        return this.oidcAccessToken;
+    }
+    /**
+     * Returns the current authentication method.
+     *
+     * @returns {'jwt' | 'oidc' | 'none'} The active auth method.
+     */
+    getAuthMethod() {
+        return this.authMethod;
+    }
+    /**
+     * Checks whether the client is currently authenticated.
+     *
+     * @returns {boolean} True if authenticated.
+     */
+    isAuthenticated() {
+        return this.authMethod !== 'none' && (this.authMethod === 'jwt'
+            ? !!this.authToken
+            : (this.oidcAccessToken !== null && Date.now() < this.oidcTokenExpiry));
+    }
+    /**
+     * Returns the current active token, regardless of auth method.
+     *
+     * @returns {string | null} The active token or null.
+     */
+    getToken() {
+        return this.authMethod === 'oidc' ? this.oidcAccessToken : this.authToken;
+    }
+    /**
+     * Logs out the client, clearing all tokens and disconnecting WebSocket.
+     *
+     * @returns {Promise<void>}
+     */
+    async logout() {
+        this.authToken = null;
+        this.clearOidcTokens();
+        this.authMethod = 'none';
+        if (this.socket.connected)
+            this.socket.disconnect();
+        if (typeof window !== 'undefined' && window.location &&
+            (window.location.search.includes('code=') || window.location.search.includes('state='))) {
+            window.history.replaceState({}, '', window.location.pathname);
+        }
+    }
+    // OIDC Dynamic Client Registration Methods
+    /**
+     * Registers a new OIDC client with the server (dynamic client registration).
+     *
+     * @param {I_OidcClientRegistration} registration - Client metadata for registration.
+     * @param {string} [registrationToken] - Initial registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The registered client details.
+     */
+    async registerOidcClient(registration, registrationToken) {
+        return await this.request('/oidc/reg', 'POST', registration, true, registrationToken);
+    }
+    /**
+     * Retrieves the registration state of an existing OIDC client.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The client details.
+     */
+    async getOidcClient(clientId, registrationToken) {
+        return await this.request(`/oidc/reg/${clientId}`, 'GET', undefined, true, registrationToken);
+    }
+    /**
+     * Updates the registration of an existing OIDC client.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {I_OidcClientRegistration} registration - Updated client metadata.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The updated client details.
+     */
+    async updateOidcClient(clientId, registration, registrationToken) {
+        return await this.request(`/oidc/reg/${clientId}`, 'PUT', registration, true, registrationToken);
+    }
+    /**
+     * Deletes an OIDC client registration.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<void>}
+     */
+    async deleteOidcClient(clientId, registrationToken) {
+        await this.request(`/oidc/reg/${clientId}`, 'DELETE', undefined, true, registrationToken);
+    }
     /**
      * Sets up permanent socket listeners for the client.
      *
@@ -320,8 +523,9 @@ export default class docPouchClient {
      * @private
      */
     initWebSocket() {
-        console.log("initWebSocket called. Auth token present:", !!this.authToken, "Connection in progress:", this.connectionInProgress, "Socket connected:", this.socket.connected);
-        if (!this.authToken) {
+        const token = this.authMethod === 'oidc' ? this.oidcAccessToken : this.authToken;
+        console.log("initWebSocket called. Auth token present:", !!this.authToken, "Connection in progress:", this.connectionInProgress, "Socket connected:", this.socket.connected, "Auth method:", this.authMethod);
+        if (!token) {
             console.log("Skipping WebSocket initialization: No auth token");
             return;
         }
@@ -337,7 +541,7 @@ export default class docPouchClient {
         try {
             console.log("Setting up WebSocket connection with token");
             // Update the auth token
-            this.socket.auth = { token: this.authToken };
+            this.socket.auth = { token };
             // Remove any dynamic event listeners that might have been added
             this.socket.offAny();
             // Set up event handler for application events
@@ -383,12 +587,15 @@ export default class docPouchClient {
      * @returns {Promise<T>} Parsed JSON response body.
      * @private
      */
-    async request(endpoint, method, body, requiresAuth = true) {
+    async request(endpoint, method, body, requiresAuth = true, authTokenOverride) {
         const headers = {
             'Content-Type': 'application/json',
         };
-        if (requiresAuth && this.authToken)
-            headers['Authorization'] = `Bearer ${this.authToken}`;
+        const authToken = authTokenOverride ?? (this.authMethod === 'oidc'
+            ? await this.ensureValidOidcToken().catch(() => null)
+            : this.authToken);
+        if (requiresAuth && authToken)
+            headers['Authorization'] = `Bearer ${authToken}`;
         if (this.socket.id)
             headers['X-Socket-ID'] = this.socket.id;
         const options = {
@@ -406,6 +613,97 @@ export default class docPouchClient {
             }
             throw new Error(`API error: ${response.status} ${response.statusText}`);
         }
+        if (response.status === 204)
+            return undefined;
         return await response.json();
     }
+    // OIDC Private Helpers
+    async discoverOidc() {
+        const response = await fetch(`${this.oidcConfig.issuer}/.well-known/openid-configuration`);
+        return response.json();
+    }
+    setOidcTokens(tokens) {
+        this.authMethod = 'oidc';
+        this.oidcAccessToken = tokens.accessToken;
+        this.oidcRefreshToken = tokens.refreshToken || this.oidcRefreshToken;
+        this.oidcIdToken = tokens.idToken || null;
+        this.oidcTokenExpiry = Date.now() + (tokens.expiresIn * 1000);
+        this.persistOidcSession();
+    }
+    clearOidcTokens() {
+        this.oidcAccessToken = null;
+        this.oidcRefreshToken = null;
+        this.oidcIdToken = null;
+        this.oidcTokenExpiry = 0;
+        this.codeVerifier = null;
+        this.oidcState = null;
+        if (this.authMethod === 'oidc')
+            this.authMethod = 'none';
+        this.clearPersistedOidcSession();
+    }
+    persistOidcSession() {
+        if (typeof window !== 'undefined' && window.localStorage) {
+            const session = {
+                accessToken: this.oidcAccessToken,
+                refreshToken: this.oidcRefreshToken,
+                idToken: this.oidcIdToken,
+                expiry: this.oidcTokenExpiry
+            };
+            localStorage.setItem('docpouch_oidc_session', JSON.stringify(session));
+        }
+    }
+    clearPersistedOidcSession() {
+        if (typeof window !== 'undefined' && window.localStorage) {
+            localStorage.removeItem('docpouch_oidc_session');
+        }
+    }
+    async refreshOidcToken() {
+        if (!this.oidcRefreshToken)
+            throw new Error('No refresh token available');
+        const discovery = await this.discoverOidc();
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: this.oidcRefreshToken,
+            client_id: this.oidcConfig.clientId
+        });
+        const response = await fetch(discovery.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString()
+        });
+        if (!response.ok) {
+            this.clearOidcTokens();
+            throw new Error('Token refresh failed');
+        }
+        const raw = await response.json();
+        const tokens = {
+            accessToken: raw.access_token,
+            refreshToken: raw.refresh_token,
+            idToken: raw.id_token,
+            expiresIn: raw.expires_in,
+            tokenType: raw.token_type,
+            scope: raw.scope
+        };
+        this.setOidcTokens(tokens);
+    }
+    generateCodeVerifier() {
+        const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+        const array = new Uint8Array(64);
+        crypto.getRandomValues(array);
+        return Array.from(array, byte => charset[byte % charset.length]).join('');
+    }
+    async generateCodeChallenge(verifier) {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(verifier);
+        const digest = await crypto.subtle.digest('SHA-256', data);
+        return btoa(String.fromCharCode(...new Uint8Array(digest)))
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=+$/, '');
+    }
+    generateState() {
+        const array = new Uint8Array(32);
+        crypto.getRandomValues(array);
+        return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
+    }
 }

package/{jest.config.js → jest.config.cjs}

@@ -11,7 +11,7 @@ module.exports = {
   },
   extensionsToTreatAsEsm: ['.ts'],
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
-  testMatch: ['**/__tests__/**/*.ts?(x)', '**/?(*.)+(spec|test).ts?(x)'],
+  testMatch: ['**/__tests__/**/*.ts?(x)', '**/?(*.)+(spec|test).ts?(x)', 'tests/**/*.test.ts'],
   collectCoverage: true,
   coverageDirectory: 'coverage',
   coverageReporters: ['text', 'lcov'],

package/package.json

@@ -1,38 +1,41 @@
-{
-  "name": "docpouch-client",
-  "version": "0.9.1",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "import": "./dist/index.js",
-      "require": "./dist/index.js"
-    }
-  },
-  "type": "module",
-  "scripts": {
-    "build": "tsc",
-    "test": "jest"
-  },
-  "keywords": [
-    "docPouch",
-    "API"
-  ],
-  "author": "Jan Frecè",
-  "license": "MIT",
-  "description": "A small class to more easily access the docPouch API",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/BFH-JTF/docpouch-client"
-  },
-  "devDependencies": {
-    "@types/jest": "^30.0.0",
-    "@types/node": "^24.12.0",
-    "jest": "^30.3.0",
-    "ts-jest": "^29.4.9",
-    "typescript": "^5.9.3"
-  },
-  "dependencies": {
-    "socket.io-client": "^4.8.3"
-  }
-}
+{
+  "name": "docpouch-client",
+  "version": "1.0.1",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "node --experimental-vm-modules --no-warnings ./node_modules/jest/bin/jest.js --forceExit --silent"
+  },
+  "keywords": [
+    "docPouch",
+    "API"
+  ],
+  "author": "Jan Frecè",
+  "license": "MIT",
+  "description": "Client SDK for DocPouch API - supports JWT and OIDC authentication",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BFH-JTF/docpouch-client"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^25.7.0",
+    "express": "^5.2.1",
+    "jest": "^30.4.2",
+    "socket.io": "^4.8.3",
+    "ts-jest": "^29.4.9",
+    "typescript": "^6.0.3"
+  },
+  "dependencies": {
+    "socket.io-client": "^4.8.3"
+  }
+}