1import { CreateURLOptions } from 'expo-linking';
2import { WebBrowserOpenOptions, WebBrowserWindowFeatures } from 'expo-web-browser';
3
4// @needsAudit
5export enum CodeChallengeMethod {
6  /**
7   * The default and recommended method for transforming the code verifier.
8   * - Convert the code verifier to ASCII.
9   * - Create a digest of the string using crypto method SHA256.
10   * - Convert the digest to Base64 and URL encode it.
11   */
12  S256 = 'S256',
13  /**
14   * This should not be used. When used, the code verifier will be sent to the server as-is.
15   */
16  Plain = 'plain',
17}
18
19// @needsAudit
20/**
21 * The client informs the authorization server of the desired grant type by using the response type.
22 *
23 * @see [Section 3.1.1](https://tools.ietf.org/html/rfc6749#section-3.1.1).
24 */
25export enum ResponseType {
26  /**
27   * For requesting an authorization code as described by [Section 4.1.1](https://tools.ietf.org/html/rfc6749#section-4.1.1).
28   */
29  Code = 'code',
30  /**
31   * For requesting an access token (implicit grant) as described by [Section 4.2.1](https://tools.ietf.org/html/rfc6749#section-4.2.1).
32   */
33  Token = 'token',
34  /**
35   * A custom registered type for getting an `id_token` from Google OAuth.
36   */
37  IdToken = 'id_token',
38}
39
40// @needsAudit
41/**
42 * Informs the server if the user should be prompted to login or consent again.
43 * This can be used to present a dialog for switching accounts after the user has already been logged in.
44 * You should use this in favor of clearing cookies (which is mostly not possible on iOS).
45 *
46 * @see [Section 3.1.2.1](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationRequest).
47 */
48export enum Prompt {
49  /**
50   * Server must not display any auth or consent UI. Can be used to check for existing auth or consent.
51   * An error is returned if a user isn't already authenticated or the client doesn't have pre-configured consent for the requested claims, or does not fulfill other conditions for processing the request.
52   * The error code will typically be `login_required`, `interaction_required`, or another code defined in [Section 3.1.2.6](https://openid.net/specs/openid-connect-core-1_0.html#AuthError).
53   */
54  None = 'none',
55  /**
56   * The server should prompt the user to reauthenticate.
57   * If it cannot reauthenticate the End-User, it must return an error, typically `login_required`.
58   */
59  Login = 'login',
60  /**
61   * Server should prompt the user for consent before returning information to the client.
62   * If it cannot obtain consent, it must return an error, typically `consent_required`.
63   */
64  Consent = 'consent',
65  /**
66   * Server should prompt the user to select an account. Can be used to switch accounts.
67   * If it can't obtain an account selection choice made by the user, it must return an error, typically `account_selection_required`.
68   */
69  SelectAccount = 'select_account',
70}
71
72// @needsAudit
73/**
74 * Options passed to the `promptAsync()` method of `AuthRequest`s.
75 * This can be used to configure how the web browser should look and behave.
76 */
77export type AuthRequestPromptOptions = Omit<WebBrowserOpenOptions, 'windowFeatures'> & {
78  /**
79   * URL to open when prompting the user. This usually should be defined internally and left `undefined` in most cases.
80   */
81  url?: string;
82  /**
83   * Should the authentication request use the Expo proxy service `auth.expo.io`.
84   * @default false
85   * @deprecated This option will be removed in a future release, for more information check [the migration guide](https://expo.fyi/auth-proxy-migration).
86   */
87  useProxy?: boolean;
88  /**
89   * Project name to use for the `auth.expo.io` proxy when `useProxy` is `true`.
90   */
91  projectNameForProxy?: string;
92  /**
93   * URL options to be used when creating the redirect URL for the auth proxy.
94   */
95  proxyOptions?: Omit<CreateURLOptions, 'queryParams'> & { path?: string };
96  /**
97   * Features to use with `window.open()`.
98   * @platform web
99   */
100  windowFeatures?: WebBrowserWindowFeatures;
101};
102
103// @needsAudit
104/**
105 * Represents an OAuth authorization request as JSON.
106 */
107export interface AuthRequestConfig {
108  /**
109   * Specifies what is returned from the authorization server.
110   *
111   * [Section 3.1.1](https://tools.ietf.org/html/rfc6749#section-3.1.1)
112   *
113   * @default ResponseType.Code
114   */
115  responseType?: ResponseType | string;
116  /**
117   * A unique string representing the registration information provided by the client.
118   * The client identifier is not a secret; it is exposed to the resource owner and shouldn't be used
119   * alone for client authentication.
120   *
121   * The client identifier is unique to the authorization server.
122   *
123   * [Section 2.2](https://tools.ietf.org/html/rfc6749#section-2.2)
124   */
125  clientId: string;
126  /**
127   * After completing an interaction with a resource owner the
128   * server will redirect to this URI. Learn more about [linking in Expo](/guides/linking/).
129   *
130   * [Section 3.1.2](https://tools.ietf.org/html/rfc6749#section-3.1.2)
131   */
132  redirectUri: string;
133  /**
134   * List of strings to request access to.
135   *
136   * [Section 3.3](https://tools.ietf.org/html/rfc6749#section-3.3)
137   */
138  scopes?: string[];
139  /**
140   * Client secret supplied by an auth provider.
141   * There is no secure way to store this on the client.
142   *
143   * [Section 2.3.1](https://tools.ietf.org/html/rfc6749#section-2.3.1)
144   */
145  clientSecret?: string;
146  /**
147   * Method used to generate the code challenge. You should never use `Plain` as it's not good enough for secure verification.
148   * @default CodeChallengeMethod.S256
149   */
150  codeChallengeMethod?: CodeChallengeMethod;
151  /**
152   * Derived from the code verifier by using the `CodeChallengeMethod`.
153   *
154   * [Section 4.2](https://tools.ietf.org/html/rfc7636#section-4.2)
155   */
156  codeChallenge?: string;
157  /**
158   * Informs the server if the user should be prompted to login or consent again.
159   * This can be used to present a dialog for switching accounts after the user has already been logged in.
160   *
161   * [Section 3.1.2.1](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationRequest)
162   */
163  prompt?: Prompt;
164  /**
165   * Used for protection against [Cross-Site Request Forgery](https://tools.ietf.org/html/rfc6749#section-10.12).
166   */
167  state?: string;
168  /**
169   * Extra query params that'll be added to the query string.
170   */
171  extraParams?: Record<string, string>;
172  /**
173   * Should use [Proof Key for Code Exchange](https://oauth.net/2/pkce/).
174   * @default true
175   */
176  usePKCE?: boolean;
177}
178