tenneo-auth-plugin 0.1.8 → 0.1.9

package/README.md

@@ -129,8 +129,7 @@ function App() {
 - Pluggable storage adapters (session, cookie, memory)
 - Authentication event system for observability
 - Strict TypeScript definitions throughout
-- Runtime configuration override support
-- Window-based configuration injection
+- Host-driven configuration (props / `setConfig()`)
 - Clean layered architecture
 - Tree-shakeable ESM and CJS builds
 - React 18+ compatibility
@@ -140,6 +139,9 @@ function App() {
 | Prop | Type | Required | Default | Description |
 |------|------|----------|---------|-------------|
 | `tenantCode` | `string` | No | - | Tenant code for configuration resolution |
+| `apiBaseUrl` | `string` | Yes | - | Tenant resolution service base URL |
+| `authServerUrl` | `string` | Yes | - | Authorization server base URL (OIDC authorize) |
+| `callbackUrl` | `string` | Yes | - | Full callback/redirect URL |
 | `appId` | `string` | No | `''` | Application identifier for storage namespacing |
 | `autoInit` | `boolean` | No | `true` | Automatically initialize authentication on mount |
 | `storageAdapter` | `StorageAdapter` | No | `null` | Custom storage adapter instance |
@@ -276,62 +278,39 @@ const token = await engine.getAccessToken();
 
 ## Configuration
 
-### Environment Variables
+### Host app configuration (required)
 
-Configure the plugin using environment variables. For Vite applications, use the `VITE_` prefix.
+This SDK does **not** read `.env` or `window.__AUTH_CONFIG__`. Provide configuration from your host app:
 
-```env
-# OAuth Server URL
-VITE_AUTH_SERVER_URL=https://auth.example.com
-
-# API Base URLs
-VITE_API_TENANT_RESOLUTION_BASE_URL=https://api.example.com/api/v1
-VITE_API_AUTH_BASE_URL=https://auth.example.com
-
-# Default Configuration
-VITE_CLIENT_ID=your-client-id
-VITE_TENANT_ID=your-tenant-id
-VITE_CLIENTCODE=your-tenant-code
-```
-
-### Window Runtime Configuration
-
-Inject configuration at runtime without rebuilding the application.
+```tsx
+import { AuthProvider } from 'tenneo-auth-plugin';
 
-```html
-<script>
-  window.__AUTH_CONFIG__ = {
-    clientId: 'runtime-client-id',
-    tenantId: 'runtime-tenant-id',
-    basePath: '/app',
-  };
-</script>
+<AuthProvider
+  tenantCode="your-tenant-code"
+  apiBaseUrl="https://tenant-service.example.com"
+  authServerUrl="https://auth.example.com"
+  callbackUrl="https://app.example.com/callback"
+  appId="myapp"
+>
+  <App />
+</AuthProvider>
 ```
 
-### Configuration Priority
-
-Configuration is resolved in the following order (highest priority first):
-
-1. Props passed to AuthProvider
-2. Window configuration (`window.__AUTH_CONFIG__`)
-3. Environment variables
-4. Built-in defaults
-
 ### Programmatic Configuration
 
 ```tsx
 import { setConfig, Config } from 'tenneo-auth-plugin';
 
-// Override configuration
+// Override configuration (host-driven)
 setConfig({
-  clientId: 'custom-client-id',
-  tenantId: 'custom-tenant-id',
-  basePath: '/my-app',
+  tenantCode: 'your-tenant-code',
+  apiBaseUrl: 'https://tenant-service.example.com',
+  authServerUrl: 'https://auth.example.com',
+  callbackUrl: 'https://app.example.com/callback',
 });
 
 // Access resolved configuration
 const authServerUrl = Config.getAuthServerUrl();
-const clientId = Config.getClientId();
 const allConfig = Config.getAll();
 ```
 
@@ -420,13 +399,11 @@ import type {
   TokenResponse,
   AuthState,
   AuthContextValue,
-  EnvConfig,
   AuthTokens,
   StorageAdapter,
   AuthEngine,
   AuthEngineState,
   SDKConfig,
-  RuntimeConfigOverrides,
 } from 'tenneo-auth-plugin';
 ```
 

package/dist/index.d.mts

@@ -215,6 +215,12 @@ interface AuthProviderProps {
     autoInit?: boolean;
     /** Tenant code from host app (used to resolve tenant via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}). */
     tenantCode?: string;
+    /** Tenant resolution base URL (host app). */
+    apiBaseUrl?: string;
+    /** Authorization server URL (host app). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (host app). */
+    callbackUrl?: string;
     /** App id for storage namespacing (auth_${tenantId}_${appId}_*). */
     appId?: string;
     /** Optional storage adapter; default is SecureSessionStorageAdapter with namespacing. */
@@ -223,7 +229,7 @@ interface AuthProviderProps {
 /**
  * AuthProvider – UI-facing auth state only
  */
-declare function AuthProvider({ children, autoInit, tenantCode, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider({ children, autoInit, tenantCode, apiBaseUrl, authServerUrl, callbackUrl, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
 
 interface AuthCallbackProps {
     loginPath?: string;
@@ -296,10 +302,7 @@ interface ConfigProvider {
     getApiBaseUrl(): string;
     getAuthServerUrl(): string;
     getRedirectUri(): string;
-    getClientId(): string;
-    getTenantId(): string;
     getClientCode(): string;
-    getBasePath(): string;
 }
 /** Tenant resolution – replaces direct tenant API usage in core. */
 interface TenantResolver {
@@ -414,50 +417,36 @@ declare function resolveTenant(tenantKey: string): Promise<TenantConfig | null>;
 
 /**
  * Configuration types.
- * Internal: non-overridable (from .env). Runtime: overridable (env + window + setConfig).
  *
- * BASE URL SEPARATION (mandatory — do not mix):
- * - API_TENANT_RESOLUTION_BASE_URL: Tenant resolution only.
- * - API_AUTH_BASE_URL: Token operations only (exchange, refresh, logout).
- * - AUTH_SERVER_URL: OpenID Connect authorization redirect only.
- */
-interface InternalConfig {
-    API_TENANT_RESOLUTION_BASE_URL: string;
-    API_AUTH_BASE_URL: string;
-    AUTH_SERVER_URL: string;
-    DEFAULT_DOMAIN: string;
-}
-/** Single source of truth: .env (VITE_CLIENT_ID, VITE_TENANT_ID, VITE_CLIENTCODE). */
-interface RuntimeConfig {
-    CLIENT_ID: string;
-    TENANT_ID: string;
-    CLIENTCODE: string;
-}
-type ResolvedConfig = InternalConfig & RuntimeConfig;
-type SDKConfig = ResolvedConfig;
-interface RuntimeConfigOverrides {
-    basePath?: string;
-    redirectUri?: string;
-}
-type HostConfigOverride = Partial<RuntimeConfig> & Partial<RuntimeConfigOverrides>;
-/** Window __APP_CONFIG__ / __AUTH_CONFIG__ shape (clientId, tenantId, clientcode only). */
-interface HostRuntimeConfig {
+ * There is no "internal vs runtime" config anymore.
+ * Everything is provided by the host app via `AuthProvider` props / `setConfig()`.
+ */
+interface SDKConfig {
+    /** Tenant resolution service base URL. */
+    apiBaseUrl?: string;
+    /** Auth API base URL (token exchange/refresh/logout). */
+    apiAuthBaseUrl?: string;
+    /** Authorization server base URL (OIDC authorize endpoint). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (full URL). */
+    callbackUrl?: string;
+    /** Optional tenant code/key (used for tenant resolution). */
+    tenantCode?: string;
+    /** Optional runtime identifiers (may be returned from tenant API). */
     clientId?: string;
     tenantId?: string;
-    clientcode?: string;
+    clientCode?: string;
+    /** Optional UI/runtime overrides. */
+    basePath?: string;
 }
-/** Full resolved config output (internal URLs + runtime + derived redirectUri, basePath). */
-interface ResolvedHostConfig {
-    apiTenantResolutionBaseUrl: string;
-    apiAuthBaseUrl: string;
+type HostConfigOverride = SDKConfig;
+interface ResolvedConfig {
+    apiBaseUrl: string;
     authServerUrl: string;
-    defaultDomain: string;
-    clientId: string;
-    tenantId: string;
+    callbackUrl: string;
     clientCode: string;
-    redirectUri: string;
-    basePath: string;
 }
+type ResolvedHostConfig = ResolvedConfig;
 
 /**
  * OAuth constants and storage keys. No config resolution — pure constants.
@@ -483,39 +472,22 @@ declare const STORAGE_KEYS: {
 };
 
 /**
- * Config: resolver + public Config facade.
- * Resolution order: runtime overrides > window > env > defaults.
- * Single source of truth: .env (see .env.example).
+ * Config: minimal host-driven config store + facade.
+ *
+ * No "internal" or "runtime" config separation.
+ * Everything comes from the host app via `setConfig()` / `AuthProvider` props.
  */
 
-declare global {
-    interface Window {
-        __APP_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-        __AUTH_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-    }
-}
-declare function resolveConfig(overrides?: HostConfigOverride): InternalConfig & RuntimeConfig;
-declare function getConfig(): InternalConfig & RuntimeConfig;
+declare function resolveConfig(overrides?: HostConfigOverride): ResolvedConfig;
+declare function getConfig(): ResolvedConfig;
 declare function setConfig(overrides: HostConfigOverride): void;
 declare const Config: {
-    readonly getApiTenantResolutionBaseUrl: () => string;
-    readonly getApiAuthBaseUrl: () => string;
+    readonly getApiBaseUrl: () => string;
     readonly getAuthServerUrl: () => string;
-    readonly getDefaultDomain: () => string;
-    readonly getClientId: () => string;
-    readonly getTenantId: () => string;
     readonly getClientCode: () => string;
     readonly getRedirectUri: () => string;
-    readonly getBasePath: () => string;
-    readonly hasRuntimeConfig: () => boolean;
     readonly getAll: () => ResolvedHostConfig;
 };
-declare function getEnvConfig(): Promise<EnvConfig | null>;
-declare function hasEnvFallback(): boolean;
 
 /**
  * Security and error utilities for authentication.
@@ -565,4 +537,4 @@ type AuthEventHandler = (payload?: AuthEventPayload) => void;
 declare function emitAuthEvent(event: AuthEventName, payload?: AuthEventPayload): void;
 declare function subscribeAuthEvent(event: AuthEventName | '*', handler: AuthEventHandler): () => void;
 
-export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type InternalConfig, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type RuntimeConfigOverrides, type SDKConfig, type RuntimeConfig as SDKRuntimeConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type SDKConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };

package/dist/index.d.ts

@@ -215,6 +215,12 @@ interface AuthProviderProps {
     autoInit?: boolean;
     /** Tenant code from host app (used to resolve tenant via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}). */
     tenantCode?: string;
+    /** Tenant resolution base URL (host app). */
+    apiBaseUrl?: string;
+    /** Authorization server URL (host app). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (host app). */
+    callbackUrl?: string;
     /** App id for storage namespacing (auth_${tenantId}_${appId}_*). */
     appId?: string;
     /** Optional storage adapter; default is SecureSessionStorageAdapter with namespacing. */
@@ -223,7 +229,7 @@ interface AuthProviderProps {
 /**
  * AuthProvider – UI-facing auth state only
  */
-declare function AuthProvider({ children, autoInit, tenantCode, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider({ children, autoInit, tenantCode, apiBaseUrl, authServerUrl, callbackUrl, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
 
 interface AuthCallbackProps {
     loginPath?: string;
@@ -296,10 +302,7 @@ interface ConfigProvider {
     getApiBaseUrl(): string;
     getAuthServerUrl(): string;
     getRedirectUri(): string;
-    getClientId(): string;
-    getTenantId(): string;
     getClientCode(): string;
-    getBasePath(): string;
 }
 /** Tenant resolution – replaces direct tenant API usage in core. */
 interface TenantResolver {
@@ -414,50 +417,36 @@ declare function resolveTenant(tenantKey: string): Promise<TenantConfig | null>;
 
 /**
  * Configuration types.
- * Internal: non-overridable (from .env). Runtime: overridable (env + window + setConfig).
  *
- * BASE URL SEPARATION (mandatory — do not mix):
- * - API_TENANT_RESOLUTION_BASE_URL: Tenant resolution only.
- * - API_AUTH_BASE_URL: Token operations only (exchange, refresh, logout).
- * - AUTH_SERVER_URL: OpenID Connect authorization redirect only.
- */
-interface InternalConfig {
-    API_TENANT_RESOLUTION_BASE_URL: string;
-    API_AUTH_BASE_URL: string;
-    AUTH_SERVER_URL: string;
-    DEFAULT_DOMAIN: string;
-}
-/** Single source of truth: .env (VITE_CLIENT_ID, VITE_TENANT_ID, VITE_CLIENTCODE). */
-interface RuntimeConfig {
-    CLIENT_ID: string;
-    TENANT_ID: string;
-    CLIENTCODE: string;
-}
-type ResolvedConfig = InternalConfig & RuntimeConfig;
-type SDKConfig = ResolvedConfig;
-interface RuntimeConfigOverrides {
-    basePath?: string;
-    redirectUri?: string;
-}
-type HostConfigOverride = Partial<RuntimeConfig> & Partial<RuntimeConfigOverrides>;
-/** Window __APP_CONFIG__ / __AUTH_CONFIG__ shape (clientId, tenantId, clientcode only). */
-interface HostRuntimeConfig {
+ * There is no "internal vs runtime" config anymore.
+ * Everything is provided by the host app via `AuthProvider` props / `setConfig()`.
+ */
+interface SDKConfig {
+    /** Tenant resolution service base URL. */
+    apiBaseUrl?: string;
+    /** Auth API base URL (token exchange/refresh/logout). */
+    apiAuthBaseUrl?: string;
+    /** Authorization server base URL (OIDC authorize endpoint). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (full URL). */
+    callbackUrl?: string;
+    /** Optional tenant code/key (used for tenant resolution). */
+    tenantCode?: string;
+    /** Optional runtime identifiers (may be returned from tenant API). */
     clientId?: string;
     tenantId?: string;
-    clientcode?: string;
+    clientCode?: string;
+    /** Optional UI/runtime overrides. */
+    basePath?: string;
 }
-/** Full resolved config output (internal URLs + runtime + derived redirectUri, basePath). */
-interface ResolvedHostConfig {
-    apiTenantResolutionBaseUrl: string;
-    apiAuthBaseUrl: string;
+type HostConfigOverride = SDKConfig;
+interface ResolvedConfig {
+    apiBaseUrl: string;
     authServerUrl: string;
-    defaultDomain: string;
-    clientId: string;
-    tenantId: string;
+    callbackUrl: string;
     clientCode: string;
-    redirectUri: string;
-    basePath: string;
 }
+type ResolvedHostConfig = ResolvedConfig;
 
 /**
  * OAuth constants and storage keys. No config resolution — pure constants.
@@ -483,39 +472,22 @@ declare const STORAGE_KEYS: {
 };
 
 /**
- * Config: resolver + public Config facade.
- * Resolution order: runtime overrides > window > env > defaults.
- * Single source of truth: .env (see .env.example).
+ * Config: minimal host-driven config store + facade.
+ *
+ * No "internal" or "runtime" config separation.
+ * Everything comes from the host app via `setConfig()` / `AuthProvider` props.
  */
 
-declare global {
-    interface Window {
-        __APP_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-        __AUTH_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-    }
-}
-declare function resolveConfig(overrides?: HostConfigOverride): InternalConfig & RuntimeConfig;
-declare function getConfig(): InternalConfig & RuntimeConfig;
+declare function resolveConfig(overrides?: HostConfigOverride): ResolvedConfig;
+declare function getConfig(): ResolvedConfig;
 declare function setConfig(overrides: HostConfigOverride): void;
 declare const Config: {
-    readonly getApiTenantResolutionBaseUrl: () => string;
-    readonly getApiAuthBaseUrl: () => string;
+    readonly getApiBaseUrl: () => string;
     readonly getAuthServerUrl: () => string;
-    readonly getDefaultDomain: () => string;
-    readonly getClientId: () => string;
-    readonly getTenantId: () => string;
     readonly getClientCode: () => string;
     readonly getRedirectUri: () => string;
-    readonly getBasePath: () => string;
-    readonly hasRuntimeConfig: () => boolean;
     readonly getAll: () => ResolvedHostConfig;
 };
-declare function getEnvConfig(): Promise<EnvConfig | null>;
-declare function hasEnvFallback(): boolean;
 
 /**
  * Security and error utilities for authentication.
@@ -565,4 +537,4 @@ type AuthEventHandler = (payload?: AuthEventPayload) => void;
 declare function emitAuthEvent(event: AuthEventName, payload?: AuthEventPayload): void;
 declare function subscribeAuthEvent(event: AuthEventName | '*', handler: AuthEventHandler): () => void;
 
-export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type InternalConfig, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type RuntimeConfigOverrides, type SDKConfig, type RuntimeConfig as SDKRuntimeConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type SDKConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };