nocal-auth-sdk 0.1.9 → 0.2.1

package/dist/index.d.ts

@@ -1,32 +1,23 @@
-import { NocalClientConfig, OAuthLoginReq, User as NocalUser, Session as NocalSession } from "./types";
+import { NocalClientConfig, OAuthLoginReq, NocalUser, NocalSession } from "./types";
 export declare class NocalAuthSDK {
-    private supabase;
     private clientId;
     private redirectUri;
+    private authServerUrl;
+    private currentSession;
+    private currentUser;
     constructor(config: NocalClientConfig);
     /**
-     * Mở Popup UI Đăng nhập/Đăng ký tập trung của Nocal
-     */
-    signInWithNocal(req?: OAuthLoginReq): Promise<NocalUser>;
-    /**
-     * Lấy thông tin User hiện tại
+     * Mở Popup UI Đăng nhập & Ủy quyền chuẩn Supabase Native OAuth 2.0 với PKCE
      */
+    signInWithNocal(req?: OAuthLoginReq): Promise<{
+        user: NocalUser;
+        session: NocalSession;
+    }>;
+    private exchangeCodeForToken;
+    private fetchUserInfo;
     getUser(): Promise<NocalUser | null>;
-    /**
-     * Lấy Session / Access Token hiện tại
-     */
     getSession(): Promise<NocalSession | null>;
-    /**
-     * Đăng xuất khỏi hệ thống
-     */
     signOut(): Promise<void>;
-    /**
-     * Lắng nghe sự kiện đăng nhập / đăng xuất
-     */
-    onAuthStateChange(callback: (event: string, session: NocalSession | null) => void): {
-        data: {
-            subscription: import("@supabase/auth-js").Subscription;
-        };
-    };
 }
+export { NocalAuthSDK as NocalAuth };
 export * from "./types";

package/dist/index.js

@@ -1,109 +1,209 @@
-import { createClient, } from "@supabase/supabase-js";
-const NOCAL_AUTH_SERVER_URL = "https://hldymiruucsqqzicnwdv.supabase.co";
-const NOCAL_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImhsZHltaXJ1dWNzcXF6aWNud2R2Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODk2MTQ2NzAsImV4cCI6MjEwNTE5MDY3MH0.dLaPWdgTV8mRVToNT1XLg1EUjHvyvRRK2qc0DQAu8YI";
+const DEFAULT_AUTH_SERVER_URL = "https://hldymiruucsqqzicnwdv.supabase.co";
+// Helper for PKCE crypto
+function base64URLEncode(buffer) {
+    let binary = "";
+    const bytes = new Uint8Array(buffer);
+    for (let i = 0; i < bytes.byteLength; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return base64URLEncode(new Uint8Array(digest));
+}
+function generateRandomString(length = 32) {
+    const array = new Uint8Array(length);
+    crypto.getRandomValues(array);
+    return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 export class NocalAuthSDK {
     constructor(config) {
+        this.currentSession = null;
+        this.currentUser = null;
         this.clientId = config.clientId;
         this.redirectUri = config.redirectUri;
-        this.supabase = createClient(NOCAL_AUTH_SERVER_URL, NOCAL_ANON_KEY, {
-            auth: {
-                autoRefreshToken: true,
-                persistSession: true,
-                detectSessionInUrl: true,
-            },
-        });
+        this.authServerUrl = config.authServerUrl || DEFAULT_AUTH_SERVER_URL;
+        // Load session from localStorage if available
+        if (typeof window !== "undefined") {
+            try {
+                const stored = localStorage.getItem("nocal_auth_session");
+                if (stored) {
+                    const parsed = JSON.parse(stored);
+                    this.currentSession = parsed.session;
+                    this.currentUser = parsed.user;
+                }
+            }
+            catch (e) {
+                // ignore
+            }
+        }
     }
     /**
-     * Mở Popup UI Đăng nhập/Đăng ký tập trung của Nocal
+     * Mở Popup UI Đăng nhập & Ủy quyền chuẩn Supabase Native OAuth 2.0 với PKCE
      */
     async signInWithNocal(req) {
-        const targetRedirect = req?.redirectTo || this.redirectUri;
-        const provider = (req?.provider || "google");
-        // 1. Gọi Supabase SDK để sinh URL ủy quyền chuẩn OAuth 2.0 / PKCE
-        const { data, error } = await this.supabase.auth.signInWithOAuth({
-            provider,
-            options: {
-                redirectTo: targetRedirect,
-                skipBrowserRedirect: true, // Lấy URL trả về, không nhảy trang tab chính
-                queryParams: {
-                    client_id: this.clientId, // Gắn Client ID để Auth Server nhận diện App
-                },
-            },
-        });
-        if (error)
-            throw error;
-        if (!data?.url)
-            throw new Error("CANNOT_GENERATE_AUTH_URL");
-        // 2. Tính toán kích thước và căn giữa màn hình Popup
+        const state = req?.state || generateRandomString(16);
+        const codeVerifier = generateRandomString(32);
+        const codeChallenge = await generateCodeChallenge(codeVerifier);
+        const authUrl = new URL(`${this.authServerUrl}/auth/v1/oauth/authorize`);
+        authUrl.searchParams.set("client_id", this.clientId);
+        authUrl.searchParams.set("redirect_uri", this.redirectUri);
+        authUrl.searchParams.set("response_type", "code");
+        authUrl.searchParams.set("state", state);
+        authUrl.searchParams.set("code_challenge", codeChallenge);
+        authUrl.searchParams.set("code_challenge_method", "S256");
         const width = 480;
         const height = 680;
-        const left = typeof window !== "undefined"
-            ? window.screenX + (window.outerWidth - width) / 2
-            : 0;
-        const top = typeof window !== "undefined"
-            ? window.screenY + (window.outerHeight - height) / 2
-            : 0;
-        // 3. Mở Cửa sổ Popup chứa UI đăng nhập Nocal
-        const popup = window.open(data.url, "NocalAuthPopup", `width=${width},height=${height},left=${left},top=${top},status=yes,scrollbars=yes`);
+        const left = typeof window !== "undefined" ? window.screenX + (window.outerWidth - width) / 2 : 0;
+        const top = typeof window !== "undefined" ? window.screenY + (window.outerHeight - height) / 2 : 0;
+        const popup = window.open(authUrl.toString(), "NocalAuthPopup", `width=${width},height=${height},left=${left},top=${top},status=yes,scrollbars=yes`);
         if (!popup) {
             throw new Error("POPUP_BLOCKED");
         }
-        // 4. Lắng nghe và kiểm tra khi Popup đóng
         return new Promise((resolve, reject) => {
-            const isPopupClosed = () => {
+            const allowedOrigin = new URL(this.authServerUrl).origin;
+            const messageListener = async (event) => {
+                if (event.origin !== allowedOrigin)
+                    return;
+                const data = event.data;
+                if (!data || (data.type !== "NOCAL_OAUTH_CODE" && data.type !== "NOCAL_OAUTH_ERROR")) {
+                    // Hoặc kiểm tra URL redirect của popup nếu Supabase native redirect trực tiếp
+                    return;
+                }
+                window.removeEventListener("message", messageListener);
+                clearInterval(checkClosedTimer);
+                if (data.type === "NOCAL_OAUTH_ERROR" || data.error) {
+                    popup.close();
+                    reject(new Error(data.error || "OAUTH_ERROR"));
+                    return;
+                }
+                if (data.state && data.state !== state) {
+                    popup.close();
+                    reject(new Error("OAUTH_STATE_MISMATCH"));
+                    return;
+                }
+                const code = data.code;
+                if (!code) {
+                    popup.close();
+                    reject(new Error("MISSING_AUTHORIZATION_CODE"));
+                    return;
+                }
                 try {
-                    return popup.closed;
+                    popup.close();
+                    const session = await this.exchangeCodeForToken(code, codeVerifier);
+                    const user = await this.fetchUserInfo(session.access_token);
+                    this.currentSession = session;
+                    this.currentUser = user;
+                    if (typeof window !== "undefined") {
+                        localStorage.setItem("nocal_auth_session", JSON.stringify({ session, user }));
+                    }
+                    resolve({ user, session });
                 }
-                catch (e) {
-                    return false;
+                catch (err) {
+                    reject(err);
                 }
             };
-            const timer = setInterval(async () => {
-                if (isPopupClosed()) {
-                    clearInterval(timer);
-                    // Sau khi popup đóng, lấy session đã đăng nhập
-                    const { data: sessionData } = await this.supabase.auth.getSession();
-                    if (sessionData?.session?.user) {
-                        resolve(sessionData.session.user);
+            window.addEventListener("message", messageListener);
+            const checkClosedTimer = setInterval(() => {
+                try {
+                    if (popup.closed) {
+                        clearInterval(checkClosedTimer);
+                        window.removeEventListener("message", messageListener);
+                        // Kiểm tra nếu popup đóng và đã có code trong redirect URL (nếu dùng redirect thuần)
+                        reject(new Error("POPUP_CLOSED_BY_USER"));
                     }
                     else {
-                        reject(new Error("LOGIN_CANCELLED_OR_FAILED"));
+                        // Lắng nghe URL thay đổi nếu Supabase redirect trực tiếp về redirectUri
+                        try {
+                            const popupUrl = new URL(popup.location.href);
+                            if (popupUrl.origin === new URL(this.redirectUri).origin) {
+                                const code = popupUrl.searchParams.get("code");
+                                const error = popupUrl.searchParams.get("error");
+                                const returnedState = popupUrl.searchParams.get("state");
+                                if (code || error) {
+                                    clearInterval(checkClosedTimer);
+                                    window.removeEventListener("message", messageListener);
+                                    popup.close();
+                                    if (error) {
+                                        reject(new Error(error));
+                                        return;
+                                    }
+                                    if (code) {
+                                        this.exchangeCodeForToken(code, codeVerifier)
+                                            .then(async (session) => {
+                                            const user = await this.fetchUserInfo(session.access_token);
+                                            this.currentSession = session;
+                                            this.currentUser = user;
+                                            if (typeof window !== "undefined") {
+                                                localStorage.setItem("nocal_auth_session", JSON.stringify({ session, user }));
+                                            }
+                                            resolve({ user, session });
+                                        })
+                                            .catch(reject);
+                                    }
+                                }
+                            }
+                        }
+                        catch (e) {
+                            // Cross-origin check while on Supabase auth domain
+                        }
                     }
                 }
+                catch (e) {
+                    // ignore
+                }
             }, 500);
         });
     }
-    /**
-     * Lấy thông tin User hiện tại
-     */
+    async exchangeCodeForToken(code, codeVerifier) {
+        const res = await fetch(`${this.authServerUrl}/auth/v1/oauth/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "authorization_code",
+                code,
+                client_id: this.clientId,
+                redirect_uri: this.redirectUri,
+                code_verifier: codeVerifier,
+            }),
+        });
+        const data = await res.json();
+        if (!res.ok) {
+            throw new Error(data.error_description || data.error || "FAILED_TO_EXCHANGE_TOKEN");
+        }
+        return data;
+    }
+    async fetchUserInfo(accessToken) {
+        const res = await fetch(`${this.authServerUrl}/auth/v1/oauth/userinfo`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+        });
+        const data = await res.json();
+        if (!res.ok) {
+            throw new Error(data.error_description || data.error || "FAILED_TO_FETCH_USERINFO");
+        }
+        return data;
+    }
     async getUser() {
-        const { data: { user }, error, } = await this.supabase.auth.getUser();
-        if (error)
-            throw error;
-        return user;
+        return this.currentUser;
     }
-    /**
-     * Lấy Session / Access Token hiện tại
-     */
     async getSession() {
-        const { data: { session }, error, } = await this.supabase.auth.getSession();
-        if (error)
-            throw error;
-        return session;
+        return this.currentSession;
     }
-    /**
-     * Đăng xuất khỏi hệ thống
-     */
     async signOut() {
-        const { error } = await this.supabase.auth.signOut();
-        if (error)
-            throw error;
-    }
-    /**
-     * Lắng nghe sự kiện đăng nhập / đăng xuất
-     */
-    onAuthStateChange(callback) {
-        return this.supabase.auth.onAuthStateChange(callback);
+        this.currentSession = null;
+        this.currentUser = null;
+        if (typeof window !== "undefined") {
+            localStorage.removeItem("nocal_auth_session");
+        }
     }
 }
+export { NocalAuthSDK as NocalAuth };
 export * from "./types";

package/dist/types.d.ts

@@ -1,11 +1,23 @@
-import { User, Session } from "@supabase/supabase-js";
 export interface NocalClientConfig {
     clientId: string;
     redirectUri: string;
+    authServerUrl?: string;
 }
-export type NocalOAuthProvider = "google" | "facebook" | "github" | "apple";
 export interface OAuthLoginReq {
-    provider?: NocalOAuthProvider;
-    redirectTo?: string;
+    state?: string;
+}
+export interface NocalUser {
+    sub: string;
+    email?: string;
+    phone?: string;
+    email_confirmed?: boolean;
+    phone_confirmed?: boolean;
+    user_metadata?: Record<string, any>;
+    [key: string]: any;
+}
+export interface NocalSession {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
 }
-export type { User, Session };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nocal-auth-sdk",
-  "version": "0.1.9",
+  "version": "0.2.1",
   "description": "Nocal Auth - client-side SDK for Login with Nocal (popup flow)",
   "type": "module",
   "main": "dist/index.js",