5de4e911e3Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).
30 lines
1 KiB
TypeScript
30 lines
1 KiB
TypeScript
import type { OAuthStorage } from "../storage.js";
|
|
import { isJwtExpired } from "./jwt.js";
|
|
import { idpOAuthStorageKey, normalizeIdpIssuer } from "./storage.js";
|
|
|
|
export type EmaIdpLoginState = "none" | "logged_in" | "expired";
|
|
|
|
export { normalizeIdpIssuer };
|
|
|
|
/** Whether a cached IdP OIDC session exists for the configured issuer. */
|
|
export async function getEmaIdpLoginState(
|
|
storage: OAuthStorage,
|
|
issuer: string,
|
|
): Promise<EmaIdpLoginState> {
|
|
const normalized = normalizeIdpIssuer(issuer);
|
|
if (!normalized) return "none";
|
|
|
|
const session = await storage.getIdpSession(normalized);
|
|
if (!session?.idToken) return "none";
|
|
if (!isJwtExpired(session.idToken)) return "logged_in";
|
|
if (session.refreshToken) return "logged_in";
|
|
return "expired";
|
|
}
|
|
|
|
export function clearEmaIdpSession(storage: OAuthStorage, issuer: string): void {
|
|
const normalized = normalizeIdpIssuer(issuer);
|
|
if (!normalized) return;
|
|
storage.clearIdpSession(normalized);
|
|
storage.clear(idpOAuthStorageKey(normalized));
|
|
storage.clearEnterpriseManagedResourceServers();
|
|
}
|