zudoku 0.0.0-ff3bc72 → 0.0.0-firebase-fixes.777fd2c0

package/dist/lib/authentication/providers/firebase.js

@@ -0,0 +1,222 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { initializeApp } from "firebase/app";
+import { createUserWithEmailAndPassword, getAuth, signInWithEmailAndPassword, signInWithPopup, signOut, } from "firebase/auth";
+import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import { SignOut } from "../components/SignOut.js";
+import { AuthorizationError } from "../errors.js";
+import { useAuthState } from "../state.js";
+import { ZudokuSignInUi, ZudokuSignUpUi } from "../ui/ZudokuAuthUi.js";
+class FirebaseAuthenticationProvider extends CoreAuthenticationPlugin {
+    app;
+    auth;
+    providers;
+    enableUsernamePassword;
+    constructor(config) {
+        super();
+        this.app = initializeApp({
+            apiKey: config.apiKey,
+            authDomain: config.authDomain,
+            projectId: config.projectId,
+            storageBucket: config.storageBucket,
+            messagingSenderId: config.messagingSenderId,
+            appId: config.appId,
+            measurementId: config.measurementId,
+        });
+        this.auth = getAuth(this.app);
+        this.providers = config.providers?.filter((p) => p !== "password") ?? [];
+        this.enableUsernamePassword =
+            config.providers?.includes("password") ?? false;
+    }
+    async signRequest(request) {
+        const accessToken = await this.auth.currentUser?.getIdToken();
+        if (!accessToken) {
+            throw new AuthorizationError("User is not authenticated");
+        }
+        request.headers.set("Authorization", `Bearer ${accessToken}`);
+        return request;
+    }
+    signUp = async ({ navigate }, { redirectTo }) => {
+        void navigate(redirectTo
+            ? `/signup?redirectTo=${encodeURIComponent(redirectTo)}`
+            : `/signup`);
+    };
+    signIn = async ({ navigate }, { redirectTo }) => {
+        void navigate(redirectTo
+            ? `/signin?redirectTo=${encodeURIComponent(redirectTo)}`
+            : `/signin`);
+    };
+    getRoutes = () => {
+        return [
+            {
+                path: "/signin",
+                element: (_jsx(ZudokuSignInUi, { providers: this.providers, enableUsernamePassword: this.enableUsernamePassword, onOAuthSignIn: async (providerId) => {
+                        useAuthState.setState({ isPending: true });
+                        const provider = await getProviderForId(providerId);
+                        if (!provider) {
+                            throw new AuthorizationError(`Provider ${providerId} not found`);
+                        }
+                        const result = await signInWithPopup(this.auth, provider);
+                        useAuthState.setState({ isPending: false });
+                        useAuthState.getState().setLoggedIn({
+                            providerData: { user: result.user },
+                            profile: {
+                                sub: result.user.uid,
+                                email: result.user.email ?? undefined,
+                                name: result.user.displayName ?? undefined,
+                                emailVerified: result.user.emailVerified,
+                                pictureUrl: result.user.photoURL ?? undefined,
+                            },
+                        });
+                    }, onUsernamePasswordSignIn: async (email, password) => {
+                        try {
+                            useAuthState.setState({ isPending: false });
+                            const result = await signInWithEmailAndPassword(this.auth, email, password);
+                            await this.setUserLoggedIn(result.user);
+                        }
+                        catch (error) {
+                            throw Error(getFirebaseErrorMessage(error), { cause: error });
+                        }
+                    } })),
+            },
+            {
+                path: "/signup",
+                element: (_jsx(ZudokuSignUpUi, { providers: this.providers, enableUsernamePassword: this.enableUsernamePassword, onOAuthSignUp: async (providerId) => {
+                        const provider = await getProviderForId(providerId);
+                        if (!provider) {
+                            throw new AuthorizationError(`Provider ${providerId} not found`);
+                        }
+                        await signInWithPopup(this.auth, provider);
+                    }, onUsernamePasswordSignUp: async (email, password) => {
+                        useAuthState.setState({ isPending: true });
+                        const createUser = await createUserWithEmailAndPassword(this.auth, email, password);
+                        await this.setUserLoggedIn(createUser.user);
+                    } })),
+            },
+            {
+                path: "/signout",
+                element: _jsx(SignOut, {}),
+            },
+        ];
+    };
+    signOut = async () => {
+        await signOut(this.auth);
+        useAuthState.setState({
+            isAuthenticated: false,
+            isPending: false,
+            profile: undefined,
+            providerData: undefined,
+        });
+    };
+    onPageLoad = async () => {
+        const user = this.auth.currentUser;
+        if (user) {
+            await this.setUserLoggedIn(user);
+        }
+        else {
+            useAuthState.setState({ isPending: false });
+        }
+    };
+    async setUserLoggedIn(user) {
+        useAuthState.getState().setLoggedIn({
+            profile: {
+                sub: user.uid,
+                email: user.email ?? undefined,
+                name: user.displayName ?? undefined,
+                emailVerified: user.emailVerified,
+                pictureUrl: user.photoURL ?? undefined,
+            },
+            providerData: { user },
+        });
+    }
+}
+const supabaseAuth = (options) => new FirebaseAuthenticationProvider(options);
+export default supabaseAuth;
+const getProviderForId = async (providerId) => {
+    switch (providerId) {
+        case "google": {
+            const { GoogleAuthProvider } = await import("firebase/auth");
+            return new GoogleAuthProvider();
+        }
+        case "github": {
+            const { GithubAuthProvider } = await import("firebase/auth");
+            return new GithubAuthProvider();
+        }
+        case "facebook": {
+            const { FacebookAuthProvider } = await import("firebase/auth");
+            return new FacebookAuthProvider();
+        }
+        case "twitter": {
+            const { TwitterAuthProvider } = await import("firebase/auth");
+            return new TwitterAuthProvider();
+        }
+        case "microsoft": {
+            const { OAuthProvider } = await import("firebase/auth");
+            return new OAuthProvider("microsoft.com");
+        }
+        case "apple": {
+            const { OAuthProvider } = await import("firebase/auth");
+            return new OAuthProvider("apple.com");
+        }
+        case "yahoo": {
+            const { OAuthProvider } = await import("firebase/auth");
+            return new OAuthProvider("yahoo.com");
+        }
+    }
+    throw new AuthorizationError(`Provider ${providerId} not found`);
+};
+const getFirebaseErrorMessage = (error) => {
+    if (!(error instanceof Error)) {
+        return "An unexpected error occurred. Please try again.";
+    }
+    const errorCode = error.code;
+    switch (errorCode) {
+        case "auth/email-already-in-use":
+            return "The email address is already used by another account.";
+        case "auth/invalid-email":
+            return "That email address isn't correct.";
+        case "auth/operation-not-allowed":
+            return "This sign-in method is not enabled. Please contact support.";
+        case "auth/weak-password":
+            return "The password must be at least 6 characters long.";
+        case "auth/user-disabled":
+            return "This account has been disabled. Please contact support.";
+        case "auth/user-not-found":
+            return "That email address doesn't match an existing account.";
+        case "auth/wrong-password":
+            return "The email and password you entered don't match.";
+        case "auth/too-many-requests":
+            return "You have entered an incorrect password too many times. Please try again in a few minutes.";
+        case "auth/popup-blocked":
+            return "The sign-in popup was blocked by your browser. Please allow popups and try again.";
+        case "auth/popup-closed-by-user":
+            return "The sign-in popup was closed before completing. Please try again.";
+        case "auth/network-request-failed":
+            return "A network error has occurred. Please check your connection and try again.";
+        case "auth/requires-recent-login":
+            return "Please login again to perform this operation.";
+        case "auth/invalid-credential":
+            return "The credential is invalid or has expired. Please try again.";
+        case "auth/account-exists-with-different-credential":
+            return "An account already exists with the same email address but different sign-in credentials.";
+        case "auth/credential-already-in-use":
+            return "This credential is already associated with a different user account.";
+        case "auth/invalid-verification-code":
+            return "Wrong code. Try again.";
+        case "auth/invalid-verification-id":
+            return "The verification ID is invalid.";
+        case "auth/missing-verification-code":
+            return "Please enter the verification code.";
+        case "auth/user-cancelled":
+            return "Please authorize the required permissions to sign in.";
+        case "auth/expired-action-code":
+            return "This code has expired.";
+        case "auth/invalid-action-code":
+            return "The action code is invalid. This can happen if the code is malformed or has already been used.";
+        case "auth/unauthorized-domain":
+            return "This domain is not authorized for OAuth operations.";
+        default:
+            return (error.message ||
+                "An error occurred during authentication. Please try again.");
+    }
+};
+//# sourceMappingURL=firebase.js.map

package/dist/lib/authentication/providers/firebase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase.js","sourceRoot":"","sources":["../../../../src/lib/authentication/providers/firebase.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAoB,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAEL,8BAA8B,EAC9B,OAAO,EACP,0BAA0B,EAC1B,eAAe,EACf,OAAO,GAER,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAOtE,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,MAAM,8BACJ,SAAQ,wBAAwB;IAGf,GAAG,CAAc;IACjB,IAAI,CAAO;IACX,SAAS,CAAW;IACpB,sBAAsB,CAAU;IAEjD,YAAY,MAAoC;QAC9C,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,CAAC,sBAAsB;YACzB,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgB;QAChC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC;QAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,KAAK,EACZ,EAAE,QAAQ,EAAqB,EAC/B,EAAE,UAAU,EAAqB,EACjC,EAAE;QACF,KAAK,QAAQ,CACX,UAAU;YACR,CAAC,CAAC,sBAAsB,kBAAkB,CAAC,UAAU,CAAC,EAAE;YACxD,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,GAAG,KAAK,EACZ,EAAE,QAAQ,EAAqB,EAC/B,EAAE,UAAU,EAAqB,EACjC,EAAE;QACF,KAAK,QAAQ,CACX,UAAU;YACR,CAAC,CAAC,sBAAsB,kBAAkB,CAAC,UAAU,CAAC,EAAE;YACxD,CAAC,CAAC,SAAS,CACd,CAAC;IACJ,CAAC,CAAC;IAEF,SAAS,GAAG,GAAG,EAAE;QACf,OAAO;YACL;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,CACP,KAAC,cAAc,IACb,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,EACnD,aAAa,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;wBAC1C,YAAY,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC3C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,IAAI,kBAAkB,CAC1B,YAAY,UAAU,YAAY,CACnC,CAAC;wBACJ,CAAC;wBACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;wBAC1D,YAAY,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;wBAC5C,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;4BAClC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;4BACnC,OAAO,EAAE;gCACP,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;gCACpB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS;gCACrC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS;gCAC1C,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;gCACxC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS;6BAC9C;yBACF,CAAC,CAAC;oBACL,CAAC,EACD,wBAAwB,EAAE,KAAK,EAC7B,KAAa,EACb,QAAgB,EAChB,EAAE;wBACF,IAAI,CAAC;4BACH,YAAY,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;4BAC5C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,IAAI,CAAC,IAAI,EACT,KAAK,EACL,QAAQ,CACT,CAAC;4BACF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBAC1C,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,MAAM,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;wBAChE,CAAC;oBACH,CAAC,GACD,CACH;aACF;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,CACP,KAAC,cAAc,IACb,SAAS,EAAE,IAAI,CAAC,SAAS,EACzB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,EACnD,aAAa,EAAE,KAAK,EAAE,UAAkB,EAAE,EAAE;wBAC1C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;wBACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,MAAM,IAAI,kBAAkB,CAC1B,YAAY,UAAU,YAAY,CACnC,CAAC;wBACJ,CAAC;wBACD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAC7C,CAAC,EACD,wBAAwB,EAAE,KAAK,EAC7B,KAAa,EACb,QAAgB,EAChB,EAAE;wBACF,YAAY,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC3C,MAAM,UAAU,GAAG,MAAM,8BAA8B,CACrD,IAAI,CAAC,IAAI,EACT,KAAK,EACL,QAAQ,CACT,CAAC;wBACF,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC9C,CAAC,GACD,CACH;aACF;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,KAAC,OAAO,KAAG;aACrB;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,GAAG,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzB,YAAY,CAAC,QAAQ,CAAC;YACpB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,SAAS;YAClB,YAAY,EAAE,SAAS;SACxB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,UAAU,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAEnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,YAAY,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;YAClC,OAAO,EAAE;gBACP,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;gBAC9B,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;gBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;aACvC;YACD,YAAY,EAAE,EAAE,IAAI,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,YAAY,GAEd,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,8BAA8B,CAAC,OAAO,CAAC,CAAC;AAE7D,eAAe,YAAY,CAAC;AAE5B,MAAM,gBAAgB,GAAG,KAAK,EAAE,UAAkB,EAAE,EAAE;IACpD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7D,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7D,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC9D,OAAO,IAAI,mBAAmB,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YACxD,OAAO,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YACxD,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YACxD,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,kBAAkB,CAAC,YAAY,UAAU,YAAY,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAU,EAAE;IACzD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,iDAAiD,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAI,KAA2B,CAAC,IAAI,CAAC;IAEpD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,2BAA2B;YAC9B,OAAO,uDAAuD,CAAC;QACjE,KAAK,oBAAoB;YACvB,OAAO,mCAAmC,CAAC;QAC7C,KAAK,4BAA4B;YAC/B,OAAO,6DAA6D,CAAC;QACvE,KAAK,oBAAoB;YACvB,OAAO,kDAAkD,CAAC;QAC5D,KAAK,oBAAoB;YACvB,OAAO,yDAAyD,CAAC;QACnE,KAAK,qBAAqB;YACxB,OAAO,uDAAuD,CAAC;QACjE,KAAK,qBAAqB;YACxB,OAAO,iDAAiD,CAAC;QAC3D,KAAK,wBAAwB;YAC3B,OAAO,2FAA2F,CAAC;QACrG,KAAK,oBAAoB;YACvB,OAAO,mFAAmF,CAAC;QAC7F,KAAK,2BAA2B;YAC9B,OAAO,mEAAmE,CAAC;QAC7E,KAAK,6BAA6B;YAChC,OAAO,2EAA2E,CAAC;QACrF,KAAK,4BAA4B;YAC/B,OAAO,+CAA+C,CAAC;QACzD,KAAK,yBAAyB;YAC5B,OAAO,6DAA6D,CAAC;QACvE,KAAK,+CAA+C;YAClD,OAAO,0FAA0F,CAAC;QACpG,KAAK,gCAAgC;YACnC,OAAO,sEAAsE,CAAC;QAChF,KAAK,gCAAgC;YACnC,OAAO,wBAAwB,CAAC;QAClC,KAAK,8BAA8B;YACjC,OAAO,iCAAiC,CAAC;QAC3C,KAAK,gCAAgC;YACnC,OAAO,qCAAqC,CAAC;QAC/C,KAAK,qBAAqB;YACxB,OAAO,uDAAuD,CAAC;QACjE,KAAK,0BAA0B;YAC7B,OAAO,wBAAwB,CAAC;QAClC,KAAK,0BAA0B;YAC7B,OAAO,gGAAgG,CAAC;QAC1G,KAAK,0BAA0B;YAC7B,OAAO,qDAAqD,CAAC;QAC/D;YACE,OAAO,CACL,KAAK,CAAC,OAAO;gBACb,4DAA4D,CAC7D,CAAC;IACN,CAAC;AACH,CAAC,CAAC"}

package/dist/lib/authentication/providers/openid.d.ts

@@ -1,49 +1,54 @@
 import * as oauth from "oauth4webapi";
-import { OpenIDAuthenticationConfig } from "../../../config/config.js";
-import { AuthenticationProvider, AuthenticationProviderInitializer } from "../authentication.js";
-import { AuthenticationPlugin } from "../AuthenticationPlugin.js";
-declare class OpenIdAuthPlugin extends AuthenticationPlugin {
-    private callbackUrlPath;
-    private handleCallback;
-    constructor(callbackUrlPath: string, handleCallback: () => Promise<string>);
-    getRoutes(): {
-        path: string;
-        element: import("react/jsx-runtime").JSX.Element;
-    }[];
+import type { NavigateFunction } from "react-router";
+import type { OpenIDAuthenticationConfig } from "../../../config/config.js";
+import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import type { AuthActionContext, AuthActionOptions, AuthenticationPlugin, AuthenticationProviderInitializer } from "../authentication.js";
+export interface OpenIdProviderData {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    expiresOn: Date;
+    tokenType: string;
 }
-export declare class OpenIDAuthenticationProvider implements AuthenticationProvider {
+export declare const OPENID_CALLBACK_PATH = "/oauth/callback";
+export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlugin implements AuthenticationPlugin {
     protected client: oauth.Client;
     protected issuer: string;
     protected authorizationServer: oauth.AuthorizationServer | undefined;
     protected callbackUrlPath: string;
-    protected logoutRedirectUrlPath: string;
     protected onAuthorizationUrl?: (authorizationUrl: URL, options: {
         isSignIn: boolean;
         isSignUp: boolean;
     }) => void;
-    private readonly redirectToAfterSignUp;
-    private readonly redirectToAfterSignIn;
-    private readonly redirectToAfterSignOut;
+    protected readonly redirectToAfterSignUp: string | undefined;
+    protected readonly redirectToAfterSignIn: string | undefined;
+    protected readonly redirectToAfterSignOut: string;
     private readonly audience?;
-    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut, }: OpenIDAuthenticationConfig);
+    private readonly scopes;
+    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut, basePath, scopes, }: OpenIDAuthenticationConfig);
     protected getAuthServer(): Promise<oauth.AuthorizationServer>;
     /**
      * Sets the tokens from various OAuth responses
      * @param response
      */
     protected setTokensFromResponse(response: oauth.TokenEndpointResponse | oauth.OAuth2Error): void;
-    signUp({ redirectTo }?: {
-        redirectTo?: string;
-    }): Promise<void>;
-    signIn({ redirectTo }?: {
+    signUp(_: {
+        navigate: NavigateFunction;
+    }, { redirectTo, replace, }?: {
         redirectTo?: string;
+        replace?: boolean;
     }): Promise<void>;
+    signIn(_: AuthActionContext, { redirectTo, replace }: AuthActionOptions): Promise<void>;
     private authorize;
     getAccessToken(): Promise<string>;
-    signOut: () => Promise<void>;
+    signRequest: (request: Request) => Promise<Request>;
+    signOut: (_: AuthActionContext) => Promise<void>;
+    onPageLoad: () => Promise<void>;
     handleCallback: () => Promise<string>;
-    pageLoad(): void;
-    getAuthenticationPlugin(): OpenIdAuthPlugin;
+    getRoutes(): {
+        path: string;
+        element: import("react/jsx-runtime").JSX.Element;
+    }[];
 }
 declare const openIDAuth: AuthenticationProviderInitializer<OpenIDAuthenticationConfig>;
 export default openIDAuth;

package/dist/lib/authentication/providers/openid.js

@@ -1,50 +1,42 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import logger from "loglevel";
 import * as oauth from "oauth4webapi";
-import { AuthenticationPlugin } from "../AuthenticationPlugin.js";
+import { ErrorBoundary } from "react-error-boundary";
+import { ClientOnly } from "../../components/ClientOnly.js";
+import { joinUrl } from "../../util/joinUrl.js";
+import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
 import { CallbackHandler } from "../components/CallbackHandler.js";
+import { OAuthErrorPage } from "../components/OAuthErrorPage.js";
 import { AuthorizationError, OAuthAuthorizationError } from "../errors.js";
 import { useAuthState } from "../state.js";
 const CODE_VERIFIER_KEY = "code-verifier";
-class OpenIdAuthPlugin extends AuthenticationPlugin {
-    callbackUrlPath;
-    handleCallback;
-    constructor(callbackUrlPath, handleCallback) {
-        super();
-        this.callbackUrlPath = callbackUrlPath;
-        this.handleCallback = handleCallback;
-    }
-    getRoutes() {
-        return [
-            ...super.getRoutes(),
-            {
-                path: this.callbackUrlPath,
-                element: _jsx(CallbackHandler, { handleCallback: this.handleCallback }),
-            },
-        ];
-    }
-}
-export class OpenIDAuthenticationProvider {
+const STATE_KEY = "oauth-state";
+export const OPENID_CALLBACK_PATH = "/oauth/callback";
+export class OpenIDAuthenticationProvider extends CoreAuthenticationPlugin {
     client;
     issuer;
     authorizationServer;
-    callbackUrlPath = "/oauth/callback";
-    logoutRedirectUrlPath = "/";
+    callbackUrlPath;
     onAuthorizationUrl;
     redirectToAfterSignUp;
     redirectToAfterSignIn;
     redirectToAfterSignOut;
     audience;
-    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut, }) {
+    scopes;
+    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut = "/", basePath, scopes, }) {
+        super();
         this.client = {
             client_id: clientId,
             token_endpoint_auth_method: "none",
         };
         this.audience = audience;
         this.issuer = issuer;
-        this.redirectToAfterSignUp = redirectToAfterSignUp ?? "/";
-        this.redirectToAfterSignIn = redirectToAfterSignIn ?? "/";
-        this.redirectToAfterSignOut = redirectToAfterSignOut ?? "/";
+        // This is the callback URL for the OAuth provider. So it needs the base path.
+        this.callbackUrlPath = joinUrl(basePath, OPENID_CALLBACK_PATH);
+        this.scopes = scopes ?? ["openid", "profile", "email"];
+        this.redirectToAfterSignUp = redirectToAfterSignUp;
+        this.redirectToAfterSignIn = redirectToAfterSignIn;
+        this.redirectToAfterSignOut = redirectToAfterSignOut;
     }
     async getAuthServer() {
         if (!this.authorizationServer) {
@@ -69,23 +61,28 @@ export class OpenIDAuthenticationProvider {
         const tokens = {
             accessToken: response.access_token,
             refreshToken: response.refresh_token,
+            idToken: response.id_token,
             expiresOn: new Date(Date.now() + response.expires_in * 1000),
             tokenType: response.token_type,
         };
-        sessionStorage.setItem("token-state", JSON.stringify(tokens));
+        useAuthState.setState({
+            providerData: tokens,
+        });
     }
-    async signUp({ redirectTo } = {}) {
+    async signUp(_, { redirectTo, replace = false, } = {}) {
         return this.authorize({
-            redirectTo: redirectTo ?? this.redirectToAfterSignUp,
+            redirectTo: this.redirectToAfterSignUp ?? redirectTo ?? "/",
+            replace,
             isSignUp: true,
         });
     }
-    async signIn({ redirectTo } = {}) {
+    async signIn(_, { redirectTo, replace = false }) {
         return this.authorize({
-            redirectTo: redirectTo ?? this.redirectToAfterSignIn,
+            redirectTo: this.redirectToAfterSignIn ?? redirectTo ?? "/",
+            replace,
         });
     }
-    async authorize({ redirectTo, isSignUp = false, }) {
+    async authorize({ redirectTo, isSignUp = false, replace = false, }) {
         const code_challenge_method = "S256";
         const authorizationServer = await this.getAuthServer();
         if (!authorizationServer.authorization_endpoint) {
@@ -105,10 +102,11 @@ export class OpenIDAuthenticationProvider {
         const redirectUrl = new URL(window.location.origin);
         redirectUrl.pathname = this.callbackUrlPath;
         redirectUrl.search = "";
+        redirectUrl.hash = "";
         authorizationUrl.searchParams.set("client_id", this.client.client_id);
         authorizationUrl.searchParams.set("redirect_uri", redirectUrl.toString());
         authorizationUrl.searchParams.set("response_type", "code");
-        authorizationUrl.searchParams.set("scope", "openid profile email");
+        authorizationUrl.searchParams.set("scope", this.scopes.join(" "));
         authorizationUrl.searchParams.set("code_challenge", codeChallenge);
         authorizationUrl.searchParams.set("code_challenge_method", code_challenge_method);
         if (this.audience) {
@@ -119,30 +117,37 @@ export class OpenIDAuthenticationProvider {
             isSignUp,
         });
         /**
-         * We cannot be sure the AS supports PKCE so we're going to use state too. Use of PKCE is
-         * backwards compatible even if the AS doesn't support it which is why we're using it regardless.
+         * The state parameter is used to prevent CSRF attacks and should be used in all authorization requests.
+         * It is independent of PKCE and should be used regardless of PKCE support.
          */
-        if (authorizationServer.code_challenge_methods_supported?.includes("S256") !==
-            true) {
-            const state = oauth.generateRandomState();
-            authorizationUrl.searchParams.set("state", state);
+        const state = oauth.generateRandomState();
+        sessionStorage.setItem(STATE_KEY, state);
+        authorizationUrl.searchParams.set("state", state);
+        if (replace) {
+            location.replace(authorizationUrl.href);
+        }
+        else {
+            location.href = authorizationUrl.href;
         }
-        // now redirect the user to authorizationUrl.href
-        location.href = authorizationUrl.href;
     }
     async getAccessToken() {
         const as = await this.getAuthServer();
-        const tokenState = sessionStorage.getItem("token-state");
-        if (!tokenState) {
+        const { providerData } = useAuthState.getState();
+        if (!providerData) {
             throw new AuthorizationError("User is not authenticated");
         }
-        const state = JSON.parse(tokenState);
-        if (state.expiresOn < new Date()) {
-            if (!state.refreshToken) {
-                await this.signIn();
+        const tokenState = providerData;
+        if (new Date(tokenState.expiresOn) < new Date()) {
+            if (!tokenState.refreshToken) {
+                useAuthState.setState({
+                    isAuthenticated: false,
+                    isPending: false,
+                    profile: null,
+                    providerData: null,
+                });
                 return "";
             }
-            const request = await oauth.refreshTokenGrantRequest(as, this.client, state.refreshToken);
+            const request = await oauth.refreshTokenGrantRequest(as, this.client, tokenState.refreshToken);
             const response = await oauth.processRefreshTokenResponse(as, this.client, request);
             if (!response.access_token) {
                 throw new AuthorizationError("No access token in response");
@@ -151,19 +156,24 @@ export class OpenIDAuthenticationProvider {
             return response.access_token.toString();
         }
         else {
-            return state.accessToken;
+            return tokenState.accessToken;
         }
     }
-    signOut = async () => {
+    signRequest = async (request) => {
+        const accessToken = await this.getAccessToken();
+        request.headers.set("Authorization", `Bearer ${accessToken}`);
+        return request;
+    };
+    signOut = async (_) => {
         useAuthState.setState({
             isAuthenticated: false,
             isPending: false,
             profile: undefined,
+            providerData: undefined,
         });
-        sessionStorage.clear();
         const as = await this.getAuthServer();
         const redirectUrl = new URL(window.location.origin + this.redirectToAfterSignOut);
-        redirectUrl.pathname = this.logoutRedirectUrlPath;
+        redirectUrl.pathname = this.callbackUrlPath;
         let logoutUrl;
         // The endSessionEndpoint is set, the IdP supports some form of logout,
         // so we use the IdP logout. Otherwise, just redirect the user to home
@@ -180,9 +190,52 @@ export class OpenIDAuthenticationProvider {
             logoutUrl = redirectUrl;
         }
     };
+    onPageLoad = async () => {
+        const { providerData } = useAuthState.getState();
+        if (!providerData) {
+            useAuthState.setState({ isPending: false });
+            return;
+        }
+        const tokenState = providerData;
+        if (new Date(tokenState.expiresOn) < new Date()) {
+            if (!tokenState.refreshToken) {
+                useAuthState.setState({
+                    isAuthenticated: false,
+                    isPending: false,
+                    profile: null,
+                    providerData: null,
+                });
+                return;
+            }
+            try {
+                const as = await this.getAuthServer();
+                const request = await oauth.refreshTokenGrantRequest(as, this.client, tokenState.refreshToken);
+                const response = await oauth.processRefreshTokenResponse(as, this.client, request);
+                if (!response.access_token) {
+                    throw new AuthorizationError("No access token in response");
+                }
+                this.setTokensFromResponse(response);
+            }
+            catch {
+                useAuthState.setState({
+                    isAuthenticated: false,
+                    isPending: false,
+                    profile: null,
+                    providerData: null,
+                });
+                return;
+            }
+        }
+        useAuthState.setState({ isPending: false });
+    };
     handleCallback = async () => {
         const url = new URL(window.location.href);
         const state = url.searchParams.get("state");
+        const storedState = sessionStorage.getItem(STATE_KEY);
+        sessionStorage.removeItem(STATE_KEY);
+        if (state !== storedState) {
+            throw new AuthorizationError("Invalid state parameter");
+        }
         // one eternity later, the user lands back on the redirect_uri
         // Authorization Code Grant Request & Response
         const codeVerifier = sessionStorage.getItem(CODE_VERIFIER_KEY);
@@ -197,8 +250,9 @@ export class OpenIDAuthenticationProvider {
             throw new OAuthAuthorizationError("Error validating OAuth response", params);
         }
         const redirectUrl = new URL(url);
-        redirectUrl.pathname = this.redirectToAfterSignIn;
+        redirectUrl.pathname = this.callbackUrlPath;
         redirectUrl.search = "";
+        redirectUrl.hash = "";
         const response = await oauth.authorizationCodeGrantRequest(authServer, this.client, params, redirectUrl.toString(), codeVerifier);
         // TODO: do we need to do these
         // const challenges = oauth.parseWwwAuthenticateChallenges(response);
@@ -225,31 +279,18 @@ export class OpenIDAuthenticationProvider {
             isPending: false,
             profile,
         });
-        sessionStorage.setItem("profile-state", JSON.stringify(useAuthState.getState().profile));
         const redirectTo = sessionStorage.getItem("redirect-to") ?? "/";
         sessionStorage.removeItem("redirect-to");
         return redirectTo;
     };
-    pageLoad() {
-        const profileState = sessionStorage.getItem("profile-state");
-        if (profileState) {
-            try {
-                const profile = JSON.parse(profileState);
-                useAuthState.setState({
-                    isAuthenticated: true,
-                    isPending: false,
-                    profile,
-                });
-            }
-            catch (err) {
-                logger.error("Error parsing auth state", err);
-            }
-        }
-    }
-    getAuthenticationPlugin() {
-        // TODO: This API is a bit messy, we need to refactor auth plugins/providers
-        // to remove the extra layers of abstraction.
-        return new OpenIdAuthPlugin(this.callbackUrlPath, this.handleCallback);
+    getRoutes() {
+        return [
+            ...super.getRoutes(),
+            {
+                path: OPENID_CALLBACK_PATH,
+                element: (_jsx(ClientOnly, { children: _jsx(ErrorBoundary, { fallbackRender: ({ error }) => _jsx(OAuthErrorPage, { error: error }), children: _jsx(CallbackHandler, { handleCallback: this.handleCallback }) }) })),
+            },
+        ];
     }
 }
 const openIDAuth = (options) => new OpenIDAuthenticationProvider(options);