oidc-spa 8.1.10 → 8.1.12

package/esm/tanstack-start/react/accessTokenValidation_rfc9068.js

@@ -0,0 +1,95 @@
+import { createObjectThatThrowsIfAccessed } from "../../tools/createObjectThatThrowsIfAccessed";
+import { assert, is } from "../../tools/tsafe/assert";
+export function createCreateValidateAndGetAccessTokenClaims_rfc9068(params) {
+    const { accessTokenClaimsSchema, accessTokenClaims_mock, expectedAudience: expectedAudienceOrGetter } = params;
+    const createValidateAndGetAccessTokenClaims = ({ paramsOfBootstrap }) => {
+        if (paramsOfBootstrap.implementation === "mock") {
+            return {
+                validateAndGetAccessTokenClaims: async () => {
+                    return {
+                        isValid: true,
+                        accessTokenClaims: (() => {
+                            if (paramsOfBootstrap.accessTokenClaims_mock !== undefined) {
+                                assert(is(paramsOfBootstrap.accessTokenClaims_mock));
+                                return paramsOfBootstrap.accessTokenClaims_mock;
+                            }
+                            if (accessTokenClaims_mock !== undefined) {
+                                return accessTokenClaims_mock;
+                            }
+                            return createObjectThatThrowsIfAccessed({
+                                debugMessage: [
+                                    "oidc-spa: You didn't provide any mock for the accessTokenClaims",
+                                    "Either provide a default one by specifying accessTokenClaims_mock",
+                                    "as parameter of .withAccessTokenValidation() or",
+                                    "specify accessTokenClaims_mock when calling bootstrapOidc()"
+                                ].join(" ")
+                            });
+                        })()
+                    };
+                }
+            };
+        }
+        assert;
+        const prVerifyAndDecodeAccessToken = (async () => {
+            const { createOidcBackend } = await import("../../backend");
+            const { verifyAndDecodeAccessToken } = await createOidcBackend({
+                issuerUri: paramsOfBootstrap.issuerUri,
+                decodedAccessTokenSchema: accessTokenClaimsSchema
+            });
+            return verifyAndDecodeAccessToken;
+        })();
+        const expectedAudience = (() => {
+            if (expectedAudienceOrGetter === undefined) {
+                return undefined;
+            }
+            if (typeof expectedAudienceOrGetter === "function") {
+                return expectedAudienceOrGetter({ paramsOfBootstrap });
+            }
+            return expectedAudienceOrGetter;
+        })();
+        return {
+            validateAndGetAccessTokenClaims: async ({ accessToken }) => {
+                const verifyAndDecodeAccessToken = await prVerifyAndDecodeAccessToken;
+                const { isValid, errorCase, errorMessage, decodedAccessToken, decodedAccessToken_original } = await verifyAndDecodeAccessToken({ accessToken });
+                if (!isValid) {
+                    return {
+                        isValid: false,
+                        errorMessage: `${errorCase}: ${errorMessage}`,
+                        wwwAuthenticateHeaderErrorDescription: (() => {
+                            switch (errorCase) {
+                                case "does not respect schema":
+                                    return "The access token is malformed or missing required claims";
+                                case "expired":
+                                    return "The access token expired";
+                                case "invalid signature":
+                                    return "The access token signature is invalid";
+                            }
+                        })()
+                    };
+                }
+                if (expectedAudience !== undefined) {
+                    const aud_array = typeof decodedAccessToken_original.aud === "string"
+                        ? [decodedAccessToken_original.aud]
+                        : decodedAccessToken_original.aud;
+                    if (!aud_array.includes(expectedAudience)) {
+                        return {
+                            isValid: false,
+                            errorMessage: [
+                                "Access token is not for the expected audience.",
+                                `Got aud claim: ${JSON.stringify(decodedAccessToken_original.aud)}`,
+                                `Expected: ${expectedAudience}`
+                            ].join(" "),
+                            wwwAuthenticateHeaderErrorDescription: "The access token audience is invalid"
+                        };
+                    }
+                }
+                return {
+                    isValid: true,
+                    accessTokenClaims: decodedAccessToken
+                };
+            }
+        };
+    };
+    return { createValidateAndGetAccessTokenClaims };
+}
+//# sourceMappingURL=accessTokenValidation_rfc9068.js.map

package/esm/tanstack-start/react/accessTokenValidation_rfc9068.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessTokenValidation_rfc9068.js","sourceRoot":"","sources":["../../../src/tanstack-start/react/accessTokenValidation_rfc9068.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gCAAgC,EAAE,MAAM,8CAA8C,CAAC;AAChG,OAAO,EAAE,MAAM,EAAe,EAAE,EAAE,MAAM,0BAA0B,CAAC;AAEnE,MAAM,UAAU,mDAAmD,CAEjE,MAQD;IACG,MAAM,EACF,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAAE,wBAAwB,EAC7C,GAAG,MAAM,CAAC;IAEX,MAAM,qCAAqC,GAEvC,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE;QAC1B,IAAI,iBAAiB,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO;gBACH,+BAA+B,EAAE,KAAK,IAAI,EAAE;oBACxC,OAAO;wBACH,OAAO,EAAE,IAAI;wBACb,iBAAiB,EAAE,CAAC,GAAG,EAAE;4BACrB,IAAI,iBAAiB,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;gCACzD,MAAM,CAAC,EAAE,CAAoB,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,CAAC;gCACxE,OAAO,iBAAiB,CAAC,sBAAsB,CAAC;4BACpD,CAAC;4BAED,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;gCACvC,OAAO,sBAAsB,CAAC;4BAClC,CAAC;4BAED,OAAO,gCAAgC,CAAoB;gCACvD,YAAY,EAAE;oCACV,iEAAiE;oCACjE,mEAAmE;oCACnE,iDAAiD;oCACjD,6DAA6D;iCAChE,CAAC,IAAI,CAAC,GAAG,CAAC;6BACd,CAAC,CAAC;wBACP,CAAC,CAAC,EAAE;qBACP,CAAC;gBACN,CAAC;aACJ,CAAC;QACN,CAAC;QACD,MAAoE,CAAC;QAErE,MAAM,4BAA4B,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7C,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAE5D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBAC3D,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,wBAAwB,EAAE,uBAAuB;aACpD,CAAC,CAAC;YAEH,OAAO,0BAA0B,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;QAEL,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE;YAC3B,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBACzC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,OAAO,wBAAwB,KAAK,UAAU,EAAE,CAAC;gBACjD,OAAO,wBAAwB,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,wBAAwB,CAAC;QACpC,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO;YACH,+BAA+B,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBACvD,MAAM,0BAA0B,GAAG,MAAM,4BAA4B,CAAC;gBAEtE,MAAM,EACF,OAAO,EACP,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC9B,GAAG,MAAM,0BAA0B,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;gBAEtD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACX,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,YAAY,EAAE,GAAG,SAAS,KAAK,YAAY,EAAE;wBAC7C,qCAAqC,EAAE,CAAC,GAAG,EAAE;4BACzC,QAAQ,SAAS,EAAE,CAAC;gCAChB,KAAK,yBAAyB;oCAC1B,OAAO,0DAA0D,CAAC;gCACtE,KAAK,SAAS;oCACV,OAAO,0BAA0B,CAAC;gCACtC,KAAK,mBAAmB;oCACpB,OAAO,uCAAuC,CAAC;4BACvD,CAAC;wBACL,CAAC,CAAC,EAAE;qBACP,CAAC;gBACN,CAAC;gBAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,SAAS,GACX,OAAO,2BAA2B,CAAC,GAAG,KAAK,QAAQ;wBAC/C,CAAC,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC;wBACnC,CAAC,CAAC,2BAA2B,CAAC,GAAG,CAAC;oBAE1C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACxC,OAAO;4BACH,OAAO,EAAE,KAAK;4BACd,YAAY,EAAE;gCACV,gDAAgD;gCAChD,kBAAkB,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE;gCACnE,aAAa,gBAAgB,EAAE;6BAClC,CAAC,IAAI,CAAC,GAAG,CAAC;4BACX,qCAAqC,EAAE,sCAAsC;yBAChF,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,iBAAiB,EAAE,kBAAkB;iBACxC,CAAC;YACN,CAAC;SACJ,CAAC;IACN,CAAC,CAAC;IAEF,OAAO,EAAE,qCAAqC,EAAE,CAAC;AACrD,CAAC"}

package/esm/tanstack-start/react/apiBuilder.d.ts

@@ -0,0 +1,27 @@
+import type { OidcSpaApi, CreateValidateAndGetAccessTokenClaims, ParamsOfBootstrap } from "./types";
+import type { Oidc as Oidc_core } from "../../core";
+import type { ZodSchemaLike } from "../../tools/ZodSchemaLike";
+import type { DecodedAccessToken_RFC9068 as AccessTokenClaims_RFC9068 } from "../../backend";
+export type OidcSpaApiBuilder<AutoLogin extends boolean = false, DecodedIdToken extends Record<string, unknown> = Oidc_core.Tokens.DecodedIdToken_OidcCoreSpec, AccessTokenClaims extends Record<string, unknown> | undefined = undefined, ExcludedMethod extends "withAutoLogin" | "withExpectedDecodedIdTokenShape" | "withAccessTokenValidation" | "finalize" = never> = Omit<{
+    withAutoLogin: () => OidcSpaApiBuilder<true, DecodedIdToken, AccessTokenClaims, ExcludedMethod | "withAutoLogin">;
+    withExpectedDecodedIdTokenShape: <DecodedIdToken extends Record<string, unknown>>(params: {
+        decodedIdTokenSchema: ZodSchemaLike<Oidc_core.Tokens.DecodedIdToken_OidcCoreSpec, DecodedIdToken>;
+        decodedIdToken_mock?: NoInfer<DecodedIdToken>;
+    }) => OidcSpaApiBuilder<AutoLogin, DecodedIdToken, AccessTokenClaims, ExcludedMethod | "withExpectedDecodedIdTokenShape">;
+    withAccessTokenValidation: {
+        <AccessTokenClaims extends Record<string, unknown> = AccessTokenClaims_RFC9068>(params: {
+            type: "RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens";
+            accessTokenClaimsSchema?: ZodSchemaLike<AccessTokenClaims_RFC9068, AccessTokenClaims>;
+            accessTokenClaims_mock?: NoInfer<AccessTokenClaims>;
+            expectedAudience?: string | ((params: {
+                paramsOfBootstrap: ParamsOfBootstrap<boolean, Record<string, unknown>, AccessTokenClaims>;
+            }) => string);
+        }): OidcSpaApiBuilder<AutoLogin, DecodedIdToken, AccessTokenClaims, ExcludedMethod | "withAccessTokenValidation">;
+        <AccessTokenClaims extends Record<string, unknown>>(params: {
+            type: "custom";
+            createValidateAndGetAccessTokenClaims: CreateValidateAndGetAccessTokenClaims<AccessTokenClaims>;
+        }): OidcSpaApiBuilder<AutoLogin, DecodedIdToken, AccessTokenClaims, ExcludedMethod | "withAccessTokenValidation">;
+    };
+    finalize: () => OidcSpaApi<AutoLogin, DecodedIdToken, AccessTokenClaims>;
+}, ExcludedMethod>;
+export declare const oidcSpaApiBuilder: OidcSpaApiBuilder<false, Record<string, unknown>, undefined, never>;

package/esm/tanstack-start/react/apiBuilder.js

@@ -0,0 +1,58 @@
+import { assert } from "../../tools/tsafe/assert";
+import { createCreateValidateAndGetAccessTokenClaims_rfc9068 } from "./accessTokenValidation_rfc9068";
+import { createOidcSpaApi } from "./createOidcSpaApi";
+function createOidcSpaApiBuilder(params) {
+    return {
+        withAutoLogin: () => createOidcSpaApiBuilder({
+            autoLogin: true,
+            decodedIdTokenSchema: params.decodedIdTokenSchema,
+            decodedIdToken_mock: params.decodedIdToken_mock,
+            createValidateAndGetAccessTokenClaims: params.createValidateAndGetAccessTokenClaims
+        }),
+        withExpectedDecodedIdTokenShape: ({ decodedIdTokenSchema, decodedIdToken_mock }) => createOidcSpaApiBuilder({
+            autoLogin: params.autoLogin,
+            decodedIdTokenSchema,
+            decodedIdToken_mock: decodedIdToken_mock,
+            createValidateAndGetAccessTokenClaims: params.createValidateAndGetAccessTokenClaims
+        }),
+        withAccessTokenValidation: params_scope => createOidcSpaApiBuilder({
+            autoLogin: params.autoLogin,
+            decodedIdTokenSchema: params.decodedIdTokenSchema,
+            decodedIdToken_mock: params.decodedIdToken_mock,
+            createValidateAndGetAccessTokenClaims: (() => {
+                switch (params_scope.type) {
+                    case "RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens": {
+                        const { accessTokenClaimsSchema, accessTokenClaims_mock, expectedAudience } = params_scope;
+                        const { createValidateAndGetAccessTokenClaims } = createCreateValidateAndGetAccessTokenClaims_rfc9068({
+                            // @ts-expect-error
+                            accessTokenClaims_mock,
+                            // @ts-expect-error
+                            accessTokenClaimsSchema,
+                            expectedAudience
+                        });
+                        return createValidateAndGetAccessTokenClaims;
+                    }
+                    case "custom": {
+                        const { createValidateAndGetAccessTokenClaims } = params_scope;
+                        return createValidateAndGetAccessTokenClaims;
+                    }
+                    default:
+                        assert(false);
+                }
+            })()
+        }),
+        finalize: () => createOidcSpaApi({
+            autoLogin: params.autoLogin,
+            decodedIdTokenSchema: params.decodedIdTokenSchema,
+            decodedIdToken_mock: params.decodedIdToken_mock,
+            createValidateAndGetAccessTokenClaims: params.createValidateAndGetAccessTokenClaims
+        })
+    };
+}
+export const oidcSpaApiBuilder = createOidcSpaApiBuilder({
+    autoLogin: false,
+    createValidateAndGetAccessTokenClaims: undefined,
+    decodedIdToken_mock: undefined,
+    decodedIdTokenSchema: undefined
+});
+//# sourceMappingURL=apiBuilder.js.map

package/esm/tanstack-start/react/apiBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiBuilder.js","sourceRoot":"","sources":["../../../src/tanstack-start/react/apiBuilder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAe,MAAM,0BAA0B,CAAC;AAG/D,OAAO,EAAE,mDAAmD,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAoEtD,SAAS,uBAAuB,CAI9B,MASD;IACG,OAAO;QACH,aAAa,EAAE,GAAG,EAAE,CAChB,uBAAuB,CAAC;YACpB,SAAS,EAAE,IAAI;YACf,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qCAAqC,EAAE,MAAM,CAAC,qCAAqC;SACtF,CAAC;QACN,+BAA+B,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAC/E,uBAAuB,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,oBAAoB;YACpB,mBAAmB,EAAE,mBAAmB;YACxC,qCAAqC,EAAE,MAAM,CAAC,qCAAqC;SACtF,CAAC;QACN,yBAAyB,EAAE,YAAY,CAAC,EAAE,CACtC,uBAAuB,CAAC;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qCAAqC,EAAE,CAAC,GAAQ,EAAE;gBAC9C,QAAQ,YAAY,CAAC,IAAI,EAAE,CAAC;oBACxB,KAAK,oEAAoE,CAAC,CAAC,CAAC;wBACxE,MAAM,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,GACvE,YAAY,CAAC;wBAEjB,MAAM,EAAE,qCAAqC,EAAE,GAC3C,mDAAmD,CAEjD;4BACE,mBAAmB;4BACnB,sBAAsB;4BACtB,mBAAmB;4BACnB,uBAAuB;4BACvB,gBAAgB;yBACnB,CAAC,CAAC;wBACP,OAAO,qCAAqC,CAAC;oBACjD,CAAC;oBACD,KAAK,QAAQ,CAAC,CAAC,CAAC;wBACZ,MAAM,EAAE,qCAAqC,EAAE,GAAG,YAAY,CAAC;wBAC/D,OAAO,qCAAqC,CAAC;oBACjD,CAAC;oBACD;wBACI,MAAM,CAAqC,KAAK,CAAC,CAAC;gBAC1D,CAAC;YACL,CAAC,CAAC,EAAE;SACP,CAAC;QACN,QAAQ,EAAE,GAAG,EAAE,CACX,gBAAgB,CAA+C;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,qCAAqC,EAAE,MAAM,CAAC,qCAAqC;SACtF,CAAC;KACT,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;IACrD,SAAS,EAAE,KAAK;IAChB,qCAAqC,EAAE,SAAS;IAChD,mBAAmB,EAAE,SAAS;IAC9B,oBAAoB,EAAE,SAAS;CAClC,CAAC,CAAC"}

package/esm/tanstack-start/react/createOidcSpaApi.d.ts

@@ -0,0 +1,9 @@
+import type { CreateValidateAndGetAccessTokenClaims, OidcSpaApi } from "./types";
+import type { ZodSchemaLike } from "../../tools/ZodSchemaLike";
+import type { Oidc as Oidc_core } from "../../core";
+export declare function createOidcSpaApi<AutoLogin extends boolean, DecodedIdToken extends Record<string, unknown>, AccessTokenClaims extends Record<string, unknown> | undefined>(params: {
+    autoLogin: AutoLogin;
+    decodedIdTokenSchema: ZodSchemaLike<Oidc_core.Tokens.DecodedIdToken_OidcCoreSpec, DecodedIdToken> | undefined;
+    decodedIdToken_mock: DecodedIdToken | undefined;
+    createValidateAndGetAccessTokenClaims: CreateValidateAndGetAccessTokenClaims<AccessTokenClaims> | undefined;
+}): OidcSpaApi<AutoLogin, DecodedIdToken, AccessTokenClaims>;