hivesigner 3.3.5 → 4.1.0

package/lib/index.js

@@ -2,80 +2,20 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var crossFetch = require('cross-fetch');
 var hiveUri = require('hive-uri');
 
-function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
+const API_URL = 'https://hivesigner.com';
 
-var crossFetch__default = /*#__PURE__*/_interopDefaultLegacy(crossFetch);
+const BASE_URL = 'https://hivesigner.com';
 
-/*! *****************************************************************************
-Copyright (c) Microsoft Corporation.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
-***************************************************************************** */
-
-function __awaiter(thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-}
-
-function __generator(thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-}
-
-var API_URL = 'https://hivesigner.com';
-
-var BASE_URL = 'https://hivesigner.com';
-
-var BETA_URL = 'https://hivesigner.com';
+const BETA_URL = 'https://hivesigner.com';
 
 function isBrowser() {
     return typeof window !== 'undefined' && !!window;
 }
 
-// Bind fetch to avoid "Illegal invocation" errors in browsers
-var fetch = crossFetch__default['default'].bind(typeof globalThis !== 'undefined' ? globalThis : undefined);
-var Client = /** @class */ (function () {
-    function Client(config) {
+class Client {
+    constructor(config) {
         this.apiURL = config.apiURL || API_URL;
         this.app = config.app;
         this.callbackURL = config.callbackURL;
@@ -83,203 +23,196 @@ var Client = /** @class */ (function () {
         this.scope = config.scope;
         this.responseType = config.responseType;
     }
-    Client.prototype.setBaseURL = function () {
+    setBaseURL() {
         console.warn('The function "setBaseUrl" is deprecated, the base URL is always "https://hivesigner.com", you can only change the API URL with "setApiURL"');
         return this;
-    };
-    Client.prototype.setApiURL = function (url) {
+    }
+    setApiURL(url) {
         this.apiURL = url;
         return this;
-    };
-    Client.prototype.setApp = function (app) {
+    }
+    setApp(app) {
         this.app = app;
         return this;
-    };
-    Client.prototype.setCallbackURL = function (url) {
+    }
+    setCallbackURL(url) {
         this.callbackURL = url;
         return this;
-    };
-    Client.prototype.setAccessToken = function (accessToken) {
+    }
+    setAccessToken(accessToken) {
         this.accessToken = accessToken;
         return this;
-    };
-    Client.prototype.removeAccessToken = function () {
+    }
+    removeAccessToken() {
         delete this.accessToken;
         return this;
-    };
-    Client.prototype.setScope = function (scope) {
+    }
+    setScope(scope) {
         this.scope = scope;
         return this;
-    };
-    Client.prototype.getLoginURL = function (state, account) {
-        var redirectUri = encodeURIComponent(this.callbackURL);
-        var loginURL = BASE_URL + "/oauth2/authorize?client_id=" + this.app + "&redirect_uri=" + redirectUri;
+    }
+    /**
+     * The authorize URL. Pass `options.codeChallenge` (from createPkcePair) to
+     * protect a code flow sign-in with PKCE, which a native app needs for a
+     * custom scheme callback such as `myapp://callback`.
+     */
+    getLoginURL(state, account, options = {}) {
+        const redirectUri = encodeURIComponent(this.callbackURL);
+        let loginURL = `${BASE_URL}/oauth2/authorize?client_id=${this.app}&redirect_uri=${redirectUri}`;
         if (this.responseType === 'code') {
-            loginURL += "&response_type=" + this.responseType;
+            loginURL += `&response_type=${this.responseType}`;
         }
         if (this.scope) {
-            loginURL += "&scope=" + this.scope.join(',');
+            loginURL += `&scope=${this.scope.join(',')}`;
         }
         if (state) {
-            loginURL += "&state=" + encodeURIComponent(state);
+            loginURL += `&state=${encodeURIComponent(state)}`;
         }
         if (account) {
-            loginURL += "&account=" + encodeURIComponent(account);
+            loginURL += `&account=${encodeURIComponent(account)}`;
+        }
+        // PKCE protects a code: the token flow has none, and Hivesigner ignores it there.
+        if (options.codeChallenge && this.responseType === 'code') {
+            loginURL += `&code_challenge=${encodeURIComponent(options.codeChallenge)}&code_challenge_method=S256`;
         }
         return loginURL;
-    };
-    Client.prototype.login = function (options) {
+    }
+    login(options) {
         if (isBrowser()) {
             // @ts-ignore
-            window.location = this.getLoginURL(options.state);
+            window.location = this.getLoginURL(options.state, undefined, { codeChallenge: options.codeChallenge });
         }
-    };
-    Client.prototype.me = function (cb) {
+    }
+    /**
+     * Exchange a code for tokens at /api/oauth2/token. With PKCE send the
+     * verifier; a native app sends no secret and gets no refresh token. A
+     * server may pass its client secret as well.
+     *
+     * Sent WITHOUT the Authorization header: the API reads that header before
+     * the body, so a token this client already holds would be read instead of
+     * the code.
+     */
+    async exchangeCode(code, codeVerifier, clientSecret) {
+        const body = { code };
+        if (codeVerifier)
+            body.code_verifier = codeVerifier;
+        if (clientSecret)
+            body.client_secret = clientSecret;
+        return (await this.makeRequest(`${this.apiURL}/api/oauth2/token`, 'POST', body, false));
+    }
+    me(cb) {
         return this.send('me', 'POST', {}, cb);
-    };
-    Client.prototype.decode = function (memo, cb) {
+    }
+    decode(memo, cb) {
         return this.send('decode', 'POST', { memo: memo }, cb);
-    };
-    Client.prototype.vote = function (voter, author, permlink, weight, cb) {
-        var params = {
-            voter: voter,
-            author: author,
-            permlink: permlink,
-            weight: weight
+    }
+    vote(voter, author, permlink, weight, cb) {
+        const params = {
+            voter,
+            author,
+            permlink,
+            weight
         };
         return this.broadcast([['vote', params]], cb);
-    };
-    Client.prototype.comment = function (parentAuthor, parentPermlink, author, permlink, title, body, jsonMetadata, cb) {
-        var json = jsonMetadata;
+    }
+    comment(parentAuthor, parentPermlink, author, permlink, title, body, jsonMetadata, cb) {
+        let json = jsonMetadata;
         if (typeof jsonMetadata !== 'string') {
             json = JSON.stringify(jsonMetadata);
         }
-        var params = {
+        const params = {
             parent_author: parentAuthor,
             parent_permlink: parentPermlink,
-            author: author,
-            permlink: permlink,
-            title: title,
-            body: body,
+            author,
+            permlink,
+            title,
+            body,
             json_metadata: json
         };
         return this.broadcast([['comment', params]], cb);
-    };
-    Client.prototype.deleteComment = function (author, permlink, cb) {
-        var params = {
-            author: author,
-            permlink: permlink
+    }
+    deleteComment(author, permlink, cb) {
+        const params = {
+            author,
+            permlink
         };
         return this.broadcast([['delete_comment', params]], cb);
-    };
-    Client.prototype.customJson = function (requiredAuths, requiredPostingAuths, id, json, cb) {
-        var params = {
+    }
+    customJson(requiredAuths, requiredPostingAuths, id, json, cb) {
+        const params = {
             required_auths: requiredAuths,
             required_posting_auths: requiredPostingAuths,
-            id: id,
-            json: json
+            id,
+            json
         };
         return this.broadcast([['custom_json', params]], cb);
-    };
-    Client.prototype.reblog = function (account, author, permlink, cb) {
-        var json = ['reblog', { account: account, author: author, permlink: permlink }];
+    }
+    reblog(account, author, permlink, cb) {
+        const json = ['reblog', { account, author, permlink }];
         return this.customJson([], [account], 'follow', JSON.stringify(json), cb);
-    };
-    Client.prototype.follow = function (follower, following, cb) {
-        var json = ['follow', { follower: follower, following: following, what: ['blog'] }];
+    }
+    follow(follower, following, cb) {
+        const json = ['follow', { follower, following, what: ['blog'] }];
         return this.customJson([], [follower], 'follow', JSON.stringify(json), cb);
-    };
-    Client.prototype.unfollow = function (unfollower, unfollowing, cb) {
-        var json = ['follow', { follower: unfollower, following: unfollowing, what: [] }];
+    }
+    unfollow(unfollower, unfollowing, cb) {
+        const json = ['follow', { follower: unfollower, following: unfollowing, what: [] }];
         return this.customJson([], [unfollower], 'follow', JSON.stringify(json), cb);
-    };
-    Client.prototype.ignore = function (follower, following, cb) {
-        var json = ['follow', { follower: follower, following: following, what: ['ignore'] }];
+    }
+    ignore(follower, following, cb) {
+        const json = ['follow', { follower, following, what: ['ignore'] }];
         return this.customJson([], [follower], 'follow', JSON.stringify(json), cb);
-    };
-    Client.prototype.claimRewardBalance = function (account, rewardHive, rewardHbd, rewardVests, cb) {
-        var params = {
-            account: account,
+    }
+    claimRewardBalance(account, rewardHive, rewardHbd, rewardVests, cb) {
+        const params = {
+            account,
             reward_hive: rewardHive,
             reward_hbd: rewardHbd,
             reward_vests: rewardVests
         };
         return this.broadcast([['claim_reward_balance', params]], cb);
-    };
-    Client.prototype.revokeToken = function (cb) {
-        return __awaiter(this, void 0, Promise, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.send('oauth2/token/revoke', 'POST', { token: this.accessToken }, cb)];
-                    case 1:
-                        _a.sent();
-                        return [2 /*return*/, this.removeAccessToken()];
-                }
-            });
-        });
-    };
-    Client.prototype.updateUserMetadata = function (metadata, cb) {
-        if (metadata === void 0) { metadata = {}; }
+    }
+    async revokeToken(cb) {
+        await this.send('oauth2/token/revoke', 'POST', { token: this.accessToken }, cb);
+        return this.removeAccessToken();
+    }
+    updateUserMetadata(metadata = {}, cb) {
         console.warn('The function "updateUserMetadata" is deprecated.');
         return this.send('me', 'PUT', { user_metadata: metadata }, cb);
-    };
-    Client.prototype.send = function (route, method, body, cb) {
-        return __awaiter(this, void 0, Promise, function () {
-            var url, json, failureResponse_1;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        url = this.apiURL + "/api/" + route;
-                        if (!cb) {
-                            return [2 /*return*/, this.makeRequest(url, method, body)];
-                        }
-                        _a.label = 1;
-                    case 1:
-                        _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.makeRequest(url, method, body)];
-                    case 2:
-                        json = _a.sent();
-                        return [2 /*return*/, cb(null, json)];
-                    case 3:
-                        failureResponse_1 = _a.sent();
-                        return [2 /*return*/, cb(failureResponse_1, null)];
-                    case 4: return [2 /*return*/];
-                }
-            });
-        });
-    };
-    Client.prototype.broadcast = function (operations, cb) {
-        return this.send('broadcast', 'POST', { operations: operations }, cb);
-    };
-    Client.prototype.makeRequest = function (url, method, body) {
-        return __awaiter(this, void 0, Promise, function () {
-            var response, json;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, fetch(url, {
-                            method: method,
-                            headers: {
-                                Accept: 'application/json, text/plain, */*',
-                                'Content-Type': 'application/json',
-                                Authorization: this.accessToken,
-                            },
-                            body: JSON.stringify(body),
-                        })];
-                    case 1:
-                        response = _a.sent();
-                        return [4 /*yield*/, response.json()];
-                    case 2:
-                        json = _a.sent();
-                        if (response.status !== 200 || json.error) {
-                            throw json;
-                        }
-                        return [2 /*return*/, json];
-                }
-            });
+    }
+    async send(route, method, body, cb) {
+        const url = `${this.apiURL}/api/${route}`;
+        if (!cb) {
+            return this.makeRequest(url, method, body);
+        }
+        try {
+            const json = await this.makeRequest(url, method, body);
+            return cb(null, json);
+        }
+        catch (failureResponse) {
+            return cb(failureResponse, null);
+        }
+    }
+    broadcast(operations, cb) {
+        return this.send('broadcast', 'POST', { operations }, cb);
+    }
+    async makeRequest(url, method, body, withToken = true) {
+        if (typeof globalThis.fetch !== 'function') {
+            throw new Error('hivesigner: fetch is not available. Node.js 18+ or a modern browser is required. ' +
+                'If you are in an older environment, provide a global fetch polyfill.');
+        }
+        const response = await globalThis.fetch(url, {
+            method,
+            headers: Object.assign({ Accept: 'application/json, text/plain, */*', 'Content-Type': 'application/json' }, (withToken ? { Authorization: this.accessToken } : {})),
+            body: JSON.stringify(body),
         });
-    };
-    return Client;
-}());
+        const json = await response.json();
+        if (response.status !== 200 || json.error) {
+            throw json;
+        }
+        return json;
+    }
+}
 
 function sign(name, params, redirectUri) {
     console.warn('The function "sign" is deprecated.');
@@ -289,39 +222,39 @@ function sign(name, params, redirectUri) {
             error_description: 'Request has an invalid format'
         };
     }
-    var url = BASE_URL + "/sign/" + name + "?";
+    let url = `${BASE_URL}/sign/${name}?`;
     url += Object.keys(params)
-        .map(function (key) { return key + "=" + encodeURIComponent(params[key]); })
+        .map(key => `${key}=${encodeURIComponent(params[key])}`)
         .join('&');
-    url += redirectUri ? "&redirect_uri=" + encodeURIComponent(redirectUri) : '';
+    url += redirectUri ? `&redirect_uri=${encodeURIComponent(redirectUri)}` : '';
     return url;
 }
 
 function sendOperation(op, params, cb) {
-    var uri = hiveUri.encodeOp(op, params);
-    var webUrl = uri.replace('hive://', BETA_URL + "/");
+    const uri = hiveUri.encodeOp(op, params);
+    const webUrl = uri.replace('hive://', `${BETA_URL}/`);
     if (cb && isBrowser()) {
-        var win = window.open(webUrl, '_blank');
+        const win = window.open(webUrl, '_blank');
         return win.focus();
     }
     return webUrl;
 }
 
 function sendOperations(ops, params, cb) {
-    var uri = hiveUri.encodeOps(ops, params);
-    var webUrl = uri.replace('hive://', BETA_URL + "/");
+    const uri = hiveUri.encodeOps(ops, params);
+    const webUrl = uri.replace('hive://', `${BETA_URL}/`);
     if (cb && isBrowser()) {
-        var win = window.open(webUrl, '_blank');
+        const win = window.open(webUrl, '_blank');
         return win.focus();
     }
     return webUrl;
 }
 
 function sendTransaction(tx, params, cb) {
-    var uri = hiveUri.encodeTx(tx, params);
-    var webUrl = uri.replace('hive://', BETA_URL + "/");
+    const uri = hiveUri.encodeTx(tx, params);
+    const webUrl = uri.replace('hive://', `${BETA_URL}/`);
     if (cb && isBrowser()) {
-        var win = window.open(webUrl, '_blank');
+        const win = window.open(webUrl, '_blank');
         return win.focus();
     }
     return webUrl;
@@ -332,18 +265,54 @@ function Initialize(config) {
     return new Client(config);
 }
 
+/**
+ * PKCE (RFC 7636) for apps that cannot keep a client secret: a native app makes
+ * a fresh verifier for every sign-in, sends only its S256 challenge to the
+ * authorize page, and proves it holds the verifier when it exchanges the code.
+ * See https://hivesigner.com/docs/pkce
+ */
+function subtleCrypto() {
+    const c = globalThis.crypto;
+    if (!c || !c.subtle || typeof c.getRandomValues !== 'function') {
+        throw new Error('hivesigner: Web Crypto is not available. Node.js 20+ or a modern browser is required for PKCE.');
+    }
+    return c;
+}
+function base64url(bytes) {
+    let binary = '';
+    bytes.forEach((b) => {
+        binary += String.fromCharCode(b);
+    });
+    const b64 = typeof btoa === 'function' ? btoa(binary) : Buffer.from(binary, 'binary').toString('base64');
+    return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** BASE64URL(SHA256(verifier)), the S256 challenge of a verifier. */
+async function pkceChallengeFor(codeVerifier) {
+    const digest = await subtleCrypto().subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
+    return base64url(new Uint8Array(digest));
+}
+/** A new verifier (32 random bytes, 43 characters) and its S256 challenge. */
+async function createPkcePair() {
+    const codeVerifier = base64url(subtleCrypto().getRandomValues(new Uint8Array(32)));
+    return { codeVerifier, codeChallenge: await pkceChallengeFor(codeVerifier) };
+}
+
 var index = {
-    Client: Client,
-    Initialize: Initialize,
-    sendTransaction: sendTransaction,
-    sendOperations: sendOperations,
-    sendOperation: sendOperation,
-    sign: sign
+    Client,
+    Initialize,
+    sendTransaction,
+    sendOperations,
+    sendOperation,
+    sign,
+    createPkcePair,
+    pkceChallengeFor
 };
 
 exports.Client = Client;
 exports.Initialize = Initialize;
-exports.default = index;
+exports.createPkcePair = createPkcePair;
+exports["default"] = index;
+exports.pkceChallengeFor = pkceChallengeFor;
 exports.sendOperation = sendOperation;
 exports.sendOperations = sendOperations;
 exports.sendTransaction = sendTransaction;

package/lib/methods/send-operation.method.d.ts

@@ -1,4 +1,3 @@
 import { Parameters } from 'hive-uri';
-import { CallbackFunction } from '../types';
-import { Operation } from '@hiveio/dhive';
+import { CallbackFunction, Operation } from '../types';
 export declare function sendOperation(op: Operation, params: Parameters, cb: CallbackFunction): string | void;

package/lib/methods/send-operations.method.d.ts

@@ -1,4 +1,3 @@
 import { Parameters } from 'hive-uri';
-import { CallbackFunction } from '../types';
-import { Operation } from '@hiveio/dhive';
+import { CallbackFunction, Operation } from '../types';
 export declare function sendOperations(ops: Operation[], params: Parameters, cb: CallbackFunction): string | void;

package/lib/methods/send-transaction.method.d.ts

@@ -1,4 +1,3 @@
 import { Parameters } from 'hive-uri';
-import { CallbackFunction } from '../types';
-import { Transaction } from '@hiveio/dhive';
+import { CallbackFunction, Transaction } from '../types';
 export declare function sendTransaction(tx: Transaction, params: Parameters, cb: CallbackFunction): string | void;

package/lib/pkce.d.ts

@@ -0,0 +1,16 @@
+/**
+ * PKCE (RFC 7636) for apps that cannot keep a client secret: a native app makes
+ * a fresh verifier for every sign-in, sends only its S256 challenge to the
+ * authorize page, and proves it holds the verifier when it exchanges the code.
+ * See https://hivesigner.com/docs/pkce
+ */
+export interface PkcePair {
+    /** Kept by the app until the exchange. Never put it in a URL. */
+    codeVerifier: string;
+    /** Sent as `code_challenge` with `code_challenge_method=S256`. */
+    codeChallenge: string;
+}
+/** BASE64URL(SHA256(verifier)), the S256 challenge of a verifier. */
+export declare function pkceChallengeFor(codeVerifier: string): Promise<string>;
+/** A new verifier (32 random bytes, 43 characters) and its S256 challenge. */
+export declare function createPkcePair(): Promise<PkcePair>;

package/lib/types/callback-function.type.d.ts

@@ -1 +1 @@
-export declare type CallbackFunction = (error: any, response: any) => any;
+export type CallbackFunction = (error: any, response: any) => any;

package/lib/types/hive.types.d.ts

@@ -0,0 +1,13 @@
+export interface Operation {
+    0: string;
+    1: {
+        [key: string]: any;
+    };
+}
+export interface Transaction {
+    ref_block_num: number;
+    ref_block_prefix: number;
+    expiration: string;
+    operations: Operation[];
+    extensions: any[];
+}

package/lib/types/index.d.ts

@@ -3,3 +3,5 @@ export * from './sign-errors.interface';
 export * from './callback-function.type';
 export * from './login-options.interface';
 export * from './send-response.type';
+export * from './hive.types';
+export * from './token-response.interface';

package/lib/types/login-options.interface.d.ts

@@ -1,3 +1,5 @@
 export interface LoginOptions {
     state: string;
+    /** From createPkcePair: protects a code flow sign-in with PKCE. */
+    codeChallenge?: string;
 }

package/lib/types/send-response.type.d.ts

@@ -1 +1 @@
-export declare type SendResponse = any;
+export type SendResponse = any;

package/lib/types/token-response.interface.d.ts

@@ -0,0 +1,8 @@
+/** What /api/oauth2/token answers. `refresh_token` is absent for a PKCE
+    exchange without a client secret. */
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+    username: string;
+}