1import { CreateURLOptions } from 'expo-linking';
2import { WebBrowserOpenOptions, WebBrowserWindowFeatures } from 'expo-web-browser';
3
4export enum CodeChallengeMethod {
5  /**
6   * The default and recommended method for transforming the code verifier.
7   * 1. Convert the code verifier to ASCII.
8   * 2. Create a digest of the string using crypto method SHA256.
9   * 3. Convert the digest to Base64 and URL encode it.
10   */
11  S256 = 'S256',
12  /**
13   * This should not be used.
14   * When used, the code verifier will be sent to the server as-is.
15   */
16  Plain = 'plain',
17}
18
19/**
20 * The client informs the authorization server of the
21 * desired grant type by using the a response type.
22 *
23 * [Section 3.1.1](https://tools.ietf.org/html/rfc6749#section-3.1.1)
24 */
25export enum ResponseType {
26  /**
27   * For requesting an authorization code as described by [Section 4.1.1](https://tools.ietf.org/html/rfc6749#section-4.1.1).
28   */
29  Code = 'code',
30  /**
31   * For requesting an access token (implicit grant) as described by [Section 4.2.1](https://tools.ietf.org/html/rfc6749#section-4.2.1).
32   */
33  Token = 'token',
34  /**
35   * A custom registered type for getting an `id_token` from Google OAuth.
36   */
37  IdToken = 'id_token',
38}
39
40/**
41 * Should the user be prompted to login or consent again.
42 * This can be used to present a dialog for switching accounts after the user has already been logged in.
43 *
44 * [Section 3.1.2.1](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationRequest)
45 */
46export enum Prompt {
47  /**
48   * Server must not display any auth or consent UI. Can be used to check for existing auth or consent.
49   * An error is returned if a user isn't already authenticated or the client doesn't have pre-configured consent for the requested claims, or does not fulfill other conditions for processing the request.
50   * The error code will typically be `login_required`, `interaction_required`, or another code defined in [Section 3.1.2.6](https://openid.net/specs/openid-connect-core-1_0.html#AuthError).
51   */
52  None = 'none',
53  /**
54   * The server should prompt the user to reauthenticate.
55   * If it cannot reauthenticate the End-User, it must return an error, typically `login_required`.
56   */
57  Login = 'login',
58  /**
59   * Server should prompt the user for consent before returning information to the client.
60   * If it cannot obtain consent, it must return an error, typically `consent_required`.
61   */
62  Consent = 'consent',
63  /**
64   * Server should prompt the user to select an account. Can be used to switch accounts.
65   * If it can't obtain an account selection choice made by the user, it must return an error, typically `account_selection_required`.
66   */
67  SelectAccount = 'select_account',
68}
69
70/**
71 * Options for the prompt window / web browser.
72 * This can be used to configure how the web browser should look and behave.
73 */
74export type AuthRequestPromptOptions = Omit<WebBrowserOpenOptions, 'windowFeatures'> & {
75  /**
76   * URL to open when prompting the user. This should be defined internally.
77   */
78  url?: string;
79  /**
80   * Should the authentication request use the Expo proxy service `auth.expo.io`.
81   * Default: `false`.
82   */
83  useProxy?: boolean;
84  /**
85   * URL options to be used when creating the redirect URL for the auth proxy.
86   */
87  proxyOptions?: Omit<CreateURLOptions, 'queryParams'> & { path?: string };
88  /**
89   * **Web:** features to use with `window.open()`
90   */
91  windowFeatures?: WebBrowserWindowFeatures;
92};
93
94/**
95 * Represents an OAuth authorization request as JSON.
96 */
97export interface AuthRequestConfig {
98  /**
99   * Specifies what is returned from the authorization server.
100   *
101   * [Section 3.1.1](https://tools.ietf.org/html/rfc6749#section-3.1.1)
102   *
103   * @default ResponseType.Code
104   */
105  responseType?: ResponseType | string;
106  /**
107   * A unique string representing the registration information provided by the client.
108   * The client identifier is not a secret; it is exposed to the resource owner and shouldn't be used
109   * alone for client authentication.
110   *
111   * The client identifier is unique to the authorization server.
112   *
113   * [Section 2.2](https://tools.ietf.org/html/rfc6749#section-2.2)
114   */
115  clientId: string;
116  /**
117   * After completing an interaction with a resource owner the
118   * server will redirect to this URI. Learn more about [linking in Expo](https://docs.expo.io/versions/latest/workflow/linking/).
119   *
120   * [Section 3.1.2](https://tools.ietf.org/html/rfc6749#section-3.1.2)
121   */
122  redirectUri: string;
123  /**
124   * List of strings to request access to.
125   *
126   * [Section 3.3](https://tools.ietf.org/html/rfc6749#section-3.3)
127   */
128  scopes?: string[];
129  /**
130   * Client secret supplied by an auth provider.
131   * There is no secure way to store this on the client.
132   *
133   * [Section 2.3.1](https://tools.ietf.org/html/rfc6749#section-2.3.1)
134   */
135  clientSecret?: string;
136  /**
137   * Method used to generate the code challenge.
138   * Defaults to `S256`. You should never use `Plain` as it's not good enough for secure verification.
139   */
140  codeChallengeMethod?: CodeChallengeMethod;
141  /**
142   * Derived from the code verifier by using the `CodeChallengeMethod`.
143   *
144   * [Section 4.2](https://tools.ietf.org/html/rfc7636#section-4.2)
145   */
146  codeChallenge?: string;
147  /**
148   * Informs the server if the user should be prompted to login or consent again.
149   * This can be used to present a dialog for switching accounts after the user has already been logged in.
150   *
151   * [Section 3.1.2.1](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationRequest)
152   */
153  prompt?: Prompt;
154  /**
155   * Used for protection against [Cross-Site Request Forgery](https://tools.ietf.org/html/rfc6749#section-10.12).
156   */
157  state?: string;
158  /**
159   * Extra query params that'll be added to the query string.
160   */
161  extraParams?: Record<string, string>;
162  /**
163   * Should use [Proof Key for Code Exchange](https://oauth.net/2/pkce/).
164   * Defaults to true.
165   */
166  usePKCE?: boolean;
167}
168