docpouch-client 0.9.1 → 1.0.3

package/chat-09e440bd-c52c-44b9-bba4-01cebc84bd7b.txt

@@ -0,0 +1,223 @@
+Chat 'ChatTitle(text="I am adding authent…" with OpenCode, isCustom=true)' (09e440bd-c52c-44b9-bba4-01cebc84bd7b)
+Context:
+
+Messages: 18
+=================================================================================================================
+
+==== RestoredMessage #1 ====
+User: 
+I am adding authentication using node-oidcProvider to my app in addition to the already present localStorage solution. To give clients the possibility to register, is it enough to create a call to `this.expressApp.post` and get the necessary information from the client including some kind of secret?
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+this.expressApp.get
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+
+
+kotlin.Unit
+
+==== RestoredMessage #2 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #3 ====
+User: 
+Yes, good idea
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+
+
+kotlin.Unit
+
+==== RestoredMessage #4 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #5 ====
+User: 
+1. I want a controlled registration. I changed initialAccessToken to `process.env.OIDC_REGISTRATION_TOKEN`.
+2. I don't even know what JWKS is, let alone have anything set up for it.
+Yes, please proceed
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+process.env.OIDC_REGISTRATION_TOKEN
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+
+
+kotlin.Unit
+
+==== RestoredMessage #6 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #7 ====
+User: 
+Let's go with a static JWKS for starters. Yes, I would like the clients to have their choice, whether they want to use the localStorage or the OIDC approach for authentication. For both, the clients are expected to build their own login masks.
+If the registration token is not just a random string, I need help, yes. 
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+process.env.OIDC_REGISTRATION_TOKEN
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+
+
+kotlin.Unit
+
+==== RestoredMessage #8 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #9 ====
+User: 
+I am unsure,now. If I give clients these options for auth, is it easier for them, than having to build their own login mask?
+1. The old approach using the token in localStorage.
+2. OIDC and they can use a login mask provided by docPouch.
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+process.env.OIDC_REGISTRATION_TOKEN
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+JWT_SECRET=your-secure-jwt-secret-here
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+NODE_ENV
+
+
+kotlin.Unit
+
+==== RestoredMessage #10 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #11 ====
+User: 
+I want to offer both choices and build a server-side login page.
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+process.env.OIDC_REGISTRATION_TOKEN
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+validate
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+JWT_SECRET=your-secure-jwt-secret-here
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+NODE_ENV
+
+
+kotlin.Unit
+
+==== RestoredMessage #12 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #13 ====
+User: 
+Do I need to update the express routes, so that they are able to validate users using both approaches?
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+JWT_SECRET=your-secure-jwt-secret-here
+
+
+kotlin.Unit
+
+==== RestoredMessage #14 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== RestoredMessage #15 ====
+User: 
+I am importing interfaces from the docPouch client I have written. I assume I will have to update some of those, as well, when I update the docPouch client, correct?
+Attachments:
+Attachment Name: Console Selection
+Attachments Kind: Visible
+Attachments Source: Other / RestoredChatAttachment
+Attachments Text:
+JWT_SECRET=your-secure-jwt-secret-here
+
+
+kotlin.Unit
+
+==== RestoredMessage #16 ====
+Assistant: 
+
+
+kotlin.Unit
+
+==== UserMessageImpl #17 ====
+User: 
+Yes, I would like to go for Option A and the client should offer different methods for the different auth methods and thus explicitly choose. Please make a detailed plan for yourself, so when I load up my docpouch-client project and give you this instruction, you know exactly what to do.
+
+kotlin.Unit
+
+==== AgentMessage #18 ====
+Assistant: 
+
+
+Tool use list:
+
+
+kotlin.Unit
+

package/dist/index.d.ts

@@ -34,6 +34,14 @@ export default class docPouchClient {
      * @type {string | null}
      */
     private authToken;
+    private oidcConfig;
+    private oidcAccessToken;
+    private oidcRefreshToken;
+    private oidcIdToken;
+    private oidcTokenExpiry;
+    private codeVerifier;
+    private oidcState;
+    private authMethod;
     /**
      * Flag indicating whether a connection attempt is in progress.
      *
@@ -171,6 +179,90 @@ export default class docPouchClient {
      * @returns {void}
      */
     debugSocketConnection(): void;
+    /**
+     * Sets the OIDC configuration to use for the callback and token exchange.
+     * Call this before {@link handleOidcCallback} if the client was freshly
+     * instantiated after a page reload (the config is otherwise only set
+     * internally by {@link loginWithOidc} before the redirect).
+     *
+     * @param {I_OidcConfig} config - OIDC provider configuration.
+     */
+    setOidcConfig(config: I_OidcConfig): void;
+    /**
+     * Initiates the OIDC authentication flow by redirecting to the authorization endpoint.
+     *
+     * @param {I_OidcConfig} config - OIDC provider configuration.
+     * @returns {Promise<void>}
+     */
+    loginWithOidc(config: I_OidcConfig): Promise<void>;
+    /**
+     * Handles the OIDC callback by exchanging the authorization code for tokens.
+     *
+     * @returns {Promise<boolean>} True if the callback was handled successfully.
+     */
+    handleOidcCallback(): Promise<boolean>;
+    restoreOidcSession(): boolean;
+    /**
+     * Ensures the OIDC access token is valid, refreshing it if necessary.
+     */
+    ensureValidOidcToken(): Promise<string>;
+    /**
+     * Returns the current authentication method.
+     *
+     * @returns {'jwt' | 'oidc' | 'none'} The active auth method.
+     */
+    getAuthMethod(): 'jwt' | 'oidc' | 'none';
+    /**
+     * Checks whether the client is currently authenticated.
+     *
+     * @returns {boolean} True if authenticated.
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Returns the current active token, regardless of auth method.
+     *
+     * @returns {string | null} The active token or null.
+     */
+    getToken(): string | null;
+    /**
+     * Logs out the client, clearing all tokens and disconnecting WebSocket.
+     *
+     * @returns {Promise<void>}
+     */
+    logout(): Promise<void>;
+    /**
+     * Registers a new OIDC client with the server (dynamic client registration).
+     *
+     * @param {I_OidcClientRegistration} registration - Client metadata for registration.
+     * @param {string} [registrationToken] - Initial registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The registered client details.
+     */
+    registerOidcClient(registration: I_OidcClientRegistration, registrationToken?: string): Promise<I_OidcClientResponse>;
+    /**
+     * Retrieves the registration state of an existing OIDC client.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The client details.
+     */
+    getOidcClient(clientId: string, registrationToken?: string): Promise<I_OidcClientResponse>;
+    /**
+     * Updates the registration of an existing OIDC client.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {I_OidcClientRegistration} registration - Updated client metadata.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<I_OidcClientResponse>} The updated client details.
+     */
+    updateOidcClient(clientId: string, registration: I_OidcClientRegistration, registrationToken?: string): Promise<I_OidcClientResponse>;
+    /**
+     * Deletes an OIDC client registration.
+     *
+     * @param {string} clientId - The client identifier.
+     * @param {string} [registrationToken] - The registration access token. If not provided, the current auth token is used.
+     * @returns {Promise<void>}
+     */
+    deleteOidcClient(clientId: string, registrationToken?: string): Promise<void>;
     /**
      * Sets up permanent socket listeners for the client.
      *
@@ -195,6 +287,15 @@ export default class docPouchClient {
      * @private
      */
     private request;
+    private discoverOidc;
+    private setOidcTokens;
+    private clearOidcTokens;
+    private persistOidcSession;
+    private clearPersistedOidcSession;
+    private refreshOidcToken;
+    private generateCodeVerifier;
+    private generateCodeChallenge;
+    private generateState;
 }
 export interface I_UserEntry extends I_UserCreation {
     _id: string;
@@ -229,10 +330,64 @@ export interface I_UserDisplay {
 }
 export interface I_LoginResponse {
     _id: string;
-    token: string;
+    token?: string;
     isAdmin: boolean;
     userName: string;
+    expiresIn?: number;
+}
+export interface I_OidcConfig {
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+    scope?: string;
+    scopes?: string[];
+    clientSecret?: string;
+}
+export interface I_OidcTokenResponse {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
     expiresIn: number;
+    tokenType: string;
+    scope: string;
+}
+export interface I_OidcUserInfo {
+    sub: string;
+    name?: string;
+    email?: string;
+}
+export interface I_OidcClientRegistration {
+    client_name: string;
+    redirect_uris: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    scope?: string;
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    application_type?: 'web' | 'native';
+    logo_uri?: string;
+    client_uri?: string;
+    policy_uri?: string;
+    tos_uri?: string;
+}
+export interface I_OidcClientResponse {
+    client_id: string;
+    client_secret?: string;
+    client_secret_expires_at?: number;
+    client_id_issued_at?: number;
+    registration_access_token?: string;
+    registration_client_uri?: string;
+    client_name?: string;
+    redirect_uris?: string[];
+    grant_types?: string[];
+    response_types?: string[];
+    scope?: string;
+    token_endpoint_auth_method?: string;
+}
+export interface I_AuthState {
+    method: 'jwt' | 'oidc' | 'none';
+    token: string | null;
+    isAdmin: boolean;
+    userName: string;
 }
 export interface I_DocumentEntry extends I_DocumentCreationOwned {
     _id: string;
@@ -281,16 +436,12 @@ export interface I_StructureField {
 export interface I_StructureCreation {
     name: string;
     description?: string;
-    type: number;
-    subType: number;
     fields: I_StructureField[];
 }
 export interface I_StructureUpdate {
     _id?: string;
     name?: string;
     description?: string;
-    type?: number;
-    subType?: number;
     fields?: I_StructureField[];
 }
 export type I_EventString = 'heartbeatPong' | "heartbeatPing" | "newDocument" | "newStructure" | "newUser" | "newType" | "removedID" | "changedDocument" | "changedStructure" | "changedUser" | "changedType" | "removedUser" | "removedStructure" | "removedDocument" | "removedType";