openvibe-sdk/auth/browser

function createCodeVerifier

export declare function createCodeVerifier(length?: number): string;

function pkceChallenge

export declare function pkceChallenge(verifier: string): Promise<string>;

function createPkcePair

export declare function createPkcePair(length?: number): Promise<{ codeVerifier: string; codeChallenge: string; codeChallengeMethod: 'S256' }>;

function createState

export declare function createState(): string;

interface AuthorizeOptions

export interface AuthorizeOptions {
    network?: string;
    authorizeUrl?: string;
    clientId: string;
    redirectUri: string;
    /** Default 'profile theme' only when no audience is given. Developer apps: capability ids. */
    scope?: string | string[];
    /** Developer apps: the audience (openvibe.<service>) the code is for; exchange with the same one. */
    audience?: string;
    state?: string;
    codeChallenge?: string;
    codeChallengeMethod?: 'S256';
    /** 'none' = silent SSO; the callback carries error=login_required when there is no session. Refused for developer apps (interaction_required). */
    prompt?: 'none';
}

function buildAuthorizeUrl

export declare function buildAuthorizeUrl(opts: AuthorizeOptions): string;

function startAuthorization

export declare function startAuthorization(opts: Omit<AuthorizeOptions, 'codeChallenge' | 'codeChallengeMethod'> & { verifierLength?: number }): Promise<{ url: string; state: string; codeVerifier: string; codeChallenge: string }>;

function readCallback

export declare function readCallback(location: string | URL, opts?: { expectedState?: string }): { code: string; state: string };

function base64url

export declare function base64url(bytes: Uint8Array): string;

function decodeUnverified

Header and claims of a JWT decoded WITHOUT verification (display and diagnostics only), or null.

export declare function decodeUnverified(token: string): { header: Record<string, unknown>; claims: Record<string, any> } | null;

function unverifiedClaims

The claims of a JWT decoded WITHOUT verification, or null. Never authorize with them.

export declare function unverifiedClaims(token: string): Record<string, any> | null;