{"version":3,"sources":["../src/lite.ts"],"names":["$jwtClientConfig","OAuthError","zJwt","$err","$verifyJwt","zMethods","$fmtError","$mapAndFilter","$getExpiry","TIME_SKEW","$ok"],"mappings":";;;;;AAYO,IAAM,eAAN,MAAmB;AAAA,EACP,KAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjB,YAAY,aAAA,EAA2B;AACrC,IAAA,MAAM,MAAA,GAASA,mCAAiB,aAAa,CAAA;AAC7C,IAAA,IAAI,OAAO,KAAA,EAAO,MAAM,IAAIC,4BAAA,CAAW,OAAO,KAAK,CAAA;AAEnD,IAAA,IAAA,CAAK,QAAQ,MAAA,CAAO,KAAA;AACpB,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,UAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,QAAA,EAAwF;AACvG,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,OAAM,GAAIC,sBAAA,CAAK,UAAU,QAAQ,CAAA;AACtD,IAAA,IAAI,KAAA,EAAO,OAAOC,sBAAA,CAAK,EAAE,GAAA,EAAK,gBAAgB,IAAA,EAAM,0BAAA,EAA4B,MAAA,EAAQ,GAAA,EAAK,CAAA;AAC7F,IAAA,OAAO,MAAMC,4BAAA,CAAW,EAAE,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,UAAA,EAAY,IAAA,CAAK,UAAA,EAAY,CAAA;AAAA,EAC7F;AAAA,EAgBA,MAAM,eACJ,MAAA,EACmE;AACnE,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,CAAM,WAAW,CAAC,IAAA,CAAK,MAAM,GAAA,EAAK;AAC1C,MAAA,OAAOD,sBAAA,CAAK,EAAE,GAAA,EAAK,uBAAA,EAAyB,MAAM,6BAAA,EAA+B,MAAA,EAAQ,KAAK,CAAA;AAAA,IAChG;AAEA,IAAA,MAAM,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,aAAY,GAAIE,0BAAA,CAAS,cAAA,CAAe,SAAA,CAAU,MAAM,CAAA;AAC3F,IAAA,IAAI,WAAA,EAAa,OAAOF,sBAAA,CAAK,EAAE,GAAA,EAAK,kBAAkB,IAAA,EAAMG,2BAAA,CAAU,WAAW,CAAA,EAAG,CAAA;AAEpF,IAAA,MAAM,OAAO,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC,GAAA,KAAQ,KAAK,KAAA,CAAM,OAAA,EAAS,GAAA,CAAI,GAAG,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,GAAA,KAAQ,CAAC,CAAC,GAAG,CAAA;AAC/F,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,GAAG,OAAOH,sBAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,mBAAA,EAAqB,MAAA,EAAQ,KAAK,CAAA;AAE7G,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAMI,+BAAA,CAAc,IAAA,EAAM,OAAO,GAAA,KAAQ;AACvD,QAAA,IAAI,IAAI,KAAA,IAAS,GAAA,CAAI,MAAM,IAAA,CAAK,GAAA,KAAQ,GAAA,EAAM;AAC5C,UAAA,OAAO;AAAA,YACL,QAAA,EAAU,KAAK,KAAA,CAAM,QAAA;AAAA,YACrB,SAAS,GAAA,CAAI,OAAA;AAAA,YACb,OAAO,GAAA,CAAI,GAAA;AAAA,YACX,OAAO,GAAA,CAAI,KAAA;AAAA,YACX,cAAc,GAAA,CAAI,YAAA;AAAA,YAClB,QAAA,EAAU,IAAA;AAAA,YACV,WAAW,GAAA,CAAI;AAAA,WACjB;AAAA,QACF;AAEA,QAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,KAAA,CAAM,KAAK,8BAAA,CAA+B;AAAA,UACxE,MAAA,EAAQ,CAAC,GAAA,CAAI,KAAK,CAAA;AAAA,UAClB,SAAA,EAAW;AAAA,SACZ,CAAA;AACD,QAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,QAAA,MAAM,EAAE,UAAU,GAAA,EAAK,KAAA,EAAO,UAAS,GAAIC,4BAAA,CAAW,aAAa,WAAW,CAAA;AAC9E,QAAA,IAAI,UAAU,OAAO,IAAA;AAErB,QAAA,IAAA,CAAK,KAAA,CAAM,OAAA,EAAS,GAAA,CAAI,GAAA,CAAI,OAAA,EAAS;AAAA,UACnC,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,OAAO,GAAA,CAAI,KAAA;AAAA,UACX,OAAO,YAAA,CAAa,WAAA;AAAA,UACpB,KAAK,GAAA,GAAMC,2BAAA;AAAA,UACX,GAAA,EAAK,QAAA;AAAA,UACL;AAAA,SACgB,CAAA;AAElB,QAAA,OAAO;AAAA,UACL,QAAA,EAAU,KAAK,KAAA,CAAM,QAAA;AAAA,UACrB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,KAAA,EAAO,QAAA;AAAA,UACP,OAAO,YAAA,CAAa,WAAA;AAAA,UACpB,YAAA;AAAA,UACA,QAAA,EAAU,KAAA;AAAA,UACV,SAAA,EAAW;AAAA,SACb;AAAA,MACF,CAAC,CAAA;AAED,MAAA,IAAI,CAAC,OAAA,IAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACpC,QAAA,OAAON,uBAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,2BAA2B,CAAA;AAAA,MACxE;AAEA,MAAA,OAAOO,qBAAA,CAAI,KAAA,IAAS,MAAA,GAAS,EAAE,MAAA,EAAQ,OAAA,CAAQ,CAAC,CAAA,EAAe,GAAI,EAAE,OAAA,EAAS,CAAA;AAAA,IAChF,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiBT,4BAAA,EAAY,OAAOE,sBAAA,CAAK,KAAK,CAAA;AAClD,MAAA,OAAOA,sBAAA,CAAK,EAAE,GAAA,EAAK,gBAAA,EAAkB,IAAA,EAAM,4BAA4BG,2BAAA,CAAU,KAAK,CAAC,CAAA,CAAA,EAAI,CAAA;AAAA,IAC7F;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { JwksClient } from 'jwks-rsa';\r\nimport { $err, $fmtError, $ok, OAuthError, type Result } from './error';\r\nimport type { B2BApp, B2BResult, JwtPayload, LiteConfig, Metadata, MinimalAzure } from './types';\r\nimport { $jwtClientConfig } from './utils/config';\r\nimport { $mapAndFilter, TIME_SKEW } from './utils/helpers';\r\nimport { $getExpiry, $verifyJwt } from './utils/jwt';\r\nimport { zJwt, zMethods } from './utils/zod';\r\n\r\n/**\r\n * Lightweight provider for verifying JWTs and obtaining B2B app tokens.\r\n * Does not support PKCE, refresh tokens, encrypted state/cookies, or OBO flow.\r\n */\r\nexport class LiteProvider {\r\n private readonly azure: MinimalAzure;\r\n private readonly jwksClient: JwksClient;\r\n\r\n /**\r\n * @param configuration The OAuth configuration object:\r\n * - `azure`: clientId, tenantId, and optional clientSecret with B2B apps.\r\n * @throws {OAuthError} if the config fails validation or has duplicate service names\r\n */\r\n constructor(configuration: LiteConfig) {\r\n const result = $jwtClientConfig(configuration);\r\n if (result.error) throw new OAuthError(result.error);\r\n\r\n this.azure = result.azure;\r\n this.jwksClient = result.jwksClient;\r\n }\r\n\r\n /**\r\n * Verifies a JWT token and extracts its payload and metadata.\r\n * @param jwtToken - Microsoft Entra ID Access Token (JWT).\r\n * @returns A result containing the JWT payload and metadata.\r\n */\r\n async $verifyJwt(jwtToken: string | undefined): Promise> {\r\n const { data: token, error } = zJwt.safeParse(jwtToken);\r\n if (error) return $err({ msg: 'Unauthorized', desc: 'Access token is required', status: 401 });\r\n return await $verifyJwt({ jwtToken: token, azure: this.azure, jwksClient: this.jwksClient });\r\n }\r\n\r\n /**\r\n * Acquire client-credential tokens for one or multiple B2B apps.\r\n * Caches tokens for better performance.\r\n *\r\n * @overload\r\n * @param params.appName - The name of the B2B app to get the token for.\r\n * @returns A result containing the B2B app token and metadata.\r\n *\r\n * @overload\r\n * @param params.appsNames - An array of B2B app names to get tokens for.\r\n * @returns Results containing an array of B2B app tokens and metadata.\r\n */\r\n async tryGetB2BToken(params: { app: string }): Promise>;\r\n async tryGetB2BToken(params: { apps: string[] }): Promise>;\r\n async tryGetB2BToken(\r\n params: { app: string } | { apps: string[] },\r\n ): Promise> {\r\n if (!this.azure.b2bApps || !this.azure.cca) {\r\n return $err({ msg: 'Invalid configuration', desc: 'B2B apps are not configured', status: 500 });\r\n }\r\n\r\n const { data: parsedParams, error: paramsError } = zMethods.tryGetB2BToken.safeParse(params);\r\n if (paramsError) return $err({ msg: 'Invalid Params', desc: $fmtError(paramsError) });\r\n\r\n const apps = parsedParams.apps.map((app) => this.azure.b2bApps?.get(app)).filter((app) => !!app);\r\n if (!apps || apps.length === 0) return $err({ msg: 'Invalid Params', desc: 'B2B app not found', status: 400 });\r\n\r\n try {\r\n const results = await $mapAndFilter(apps, async (app) => {\r\n if (app.token && app.exp > Date.now() / 1000) {\r\n return {\r\n clientId: this.azure.clientId,\r\n appName: app.appName,\r\n appId: app.aud,\r\n token: app.token,\r\n msalResponse: app.msalResponse,\r\n isCached: true,\r\n expiresAt: app.exp,\r\n } satisfies B2BResult;\r\n }\r\n\r\n const msalResponse = await this.azure.cca?.acquireTokenByClientCredential({\r\n scopes: [app.scope],\r\n skipCache: true,\r\n });\r\n if (!msalResponse) return null;\r\n\r\n const { clientId, exp, error: audError } = $getExpiry(msalResponse.accessToken);\r\n if (audError) return null;\r\n\r\n this.azure.b2bApps?.set(app.appName, {\r\n appName: app.appName,\r\n scope: app.scope,\r\n token: msalResponse.accessToken,\r\n exp: exp - TIME_SKEW,\r\n aud: clientId,\r\n msalResponse: msalResponse,\r\n } satisfies B2BApp);\r\n\r\n return {\r\n clientId: this.azure.clientId,\r\n appName: app.appName,\r\n appId: clientId,\r\n token: msalResponse.accessToken,\r\n msalResponse: msalResponse,\r\n isCached: false,\r\n expiresAt: 0,\r\n } satisfies B2BResult;\r\n });\r\n\r\n if (!results || results.length === 0) {\r\n return $err({ msg: 'Invalid Params', desc: 'Failed to get B2B token' });\r\n }\r\n\r\n return $ok('app' in params ? { result: results[0] as B2BResult } : { results });\r\n } catch (error) {\r\n if (error instanceof OAuthError) return $err(error);\r\n return $err({ msg: 'Invalid Params', desc: `Failed to get B2B token: ${$fmtError(error)}` });\r\n }\r\n }\r\n}\r\n"]}