Class: BackstageAuth

@ticketlayer/backstage

@ticketlayer/backstage / BackstageAuth

Defined in: auth/index.ts:383

Constructors#

Constructor#

new BackstageAuth(config: AuthConfig): BackstageAuth;

Defined in: auth/index.ts:392

Parameters#

Returns#

BackstageAuth

Methods#

createClient()#

createClient(options: SessionOptions): BackstageClient;

Defined in: auth/index.ts:720

A bearer-mode BackstageClient for the API (options.baseUrl) whose token provider refreshes through refresh on its own: ahead of expiry, and on a 401. Replaces the old refreshEndpoint default. Use createSession to also switch organisation or read the tokens.

Parameters#

Returns#

BackstageClient

createSession()#

createSession(options: SessionOptions): AuthSession;

Defined in: auth/index.ts:710

A signed-in session: a bearer-mode client that refreshes through refresh by itself.

Parameters#

Returns#

AuthSession

emailCode()#

emailCode(input: {
  authSession: string;
  code: string;
}): Promise<StepResult>;

Defined in: auth/index.ts:475

The emailed code, as the first factor.

Parameters#

Returns#

Promise<StepResult>

exchange()#

exchange(input: ExchangeInput): Promise<TokenSet>;

Defined in: auth/index.ts:573

Redeem the code for tokens (authorization_code with PKCE; DPoP-bound when dpop is given).

Parameters#

Returns#

Promise<TokenSet>

mfa()#

mfa(input: {
  authSession: string;
  code: string;
}): Promise<StepResult>;

Defined in: auth/index.ts:481

The second factor (a TOTP, or the emailed code), after mfa_required.

Parameters#

Returns#

Promise<StepResult>

password()#

password(input: {
  authSession: string;
  password: string;
}): Promise<StepResult>;

Defined in: auth/index.ts:461

The password, as the first factor.

Parameters#

Returns#

Promise<StepResult>

refresh()#

refresh(input: RefreshInput): Promise<TokenSet>;

Defined in: auth/index.ts:580

The refresh grant. The refresh token rotates: keep the one this answers.

Parameters#

Returns#

Promise<TokenSet>

revoke()#

revoke(input: RevokeInput): Promise<void>;

Defined in: auth/index.ts:652

Revoke a token (RFC 7009) at the issuer's revocation endpoint. Revoking a refresh token ends its whole family: every refresh token rotated from the same sign-in is refused from then on, and a later sign-in starts a new one. Resolves once the issuer has answered 200, which it does for a token it no longer knows as well (RFC 7009 2.2), so revoking twice is safe.

A public client names itself with clientId; the shell's server authenticates with clientSecret (SERVER USE ONLY, as for exchange). No DPoP proof is needed, even for a bound token.

Parameters#

Returns#

Promise<void>

selectOrganisation()#

selectOrganisation(input: SelectOrganisationInput): Promise<TokenSet>;

Defined in: auth/index.ts:591

Switch organisation: RFC 8693 token exchange at the token endpoint, for first-party clients. A refresh token subject is consumed; the answer is a new pair pinned to slug. Bound tokens need the same dpop key.

Parameters#

Returns#

Promise<TokenSet>

sendEmailCode()#

sendEmailCode(input: {
  authSession: string;
}): Promise<{
  status: "code_sent";
}>;

Defined in: auth/index.ts:466

Ask for a sign-in code by email. Answers code_sent whether or not the address has an account.

Parameters#

Returns#

Promise<{ status: "code_sent"; }>

start()#

start(input: StartInput): Promise<StartResult>;

Defined in: auth/index.ts:439

Begin: answers the method and the handle. The answer is the same whether or not the address has an account.

Parameters#

Returns#

Promise<StartResult>

Properties#

createDpopKey()#

createDpopKey: (options: {
  keyPair?: CryptoKeyPair;
}) => Promise<DpopKey>;

Defined in: auth/index.ts:430

A non-extractable ECDSA P-256 DPoP key, or a kept keyPair wrapped as one.

A DPoP key: a new non-extractable P-256 pair, or keyPair (one this function made earlier and the host kept).

Parameters#

Returns#

Promise<DpopKey>

dpopProof()#

dpopProof: (input: DpopProofInput & {
  key: Pick<DpopKey, "keyPair" | "publicJwk">;
}) => Promise<string>;

Defined in: auth/index.ts:432

One DPoP proof (htm, htu, iat, jti, and ath / nonce when given).

A DPoP proof JWT: header { typ: 'dpop+jwt', alg: 'ES256', jwk }, payload { jti, htm, htu, iat }, plus ath (the access token's SHA-256) when a token is presented with it and nonce when the server asked for one. A proof is for one request: a new jti every call.

Parameters#

Returns#

Promise<string>

invitation#

readonly invitation: {
  accept: (input: NewPersonInput) => Promise<StepResult>;
  start: (input: InvitationStartInput) => Promise<InvitationStartResult>;
};

Defined in: auth/index.ts:523

Accept an invitation without a session. start takes the code from the invitation email and says whose address it is for, which organisation, and how to continue: sign in as that address with the handle (password, emailCode, mfa), or, when the address has no account, accept with a password and a name. Either way the last step accepts the invitation and answers a code whose tokens are pinned to the organisation. Signed in already? session.acceptInvitation(code).

accept()#

accept: (input: NewPersonInput) => Promise<StepResult>;

Parameters

Returns

Promise<StepResult>

start()#

start: (input: InvitationStartInput) => Promise<InvitationStartResult>;

Parameters

Returns

Promise<InvitationStartResult>

issuerUrl#

readonly issuerUrl: string;

Defined in: auth/index.ts:384

pkce()#

pkce: () => Promise<PkcePair>;

Defined in: auth/index.ts:426

A PKCE verifier and its S256 challenge.

A fresh verifier (32 random bytes, 43 characters base64url) and its S256 challenge, from WebCrypto in the browser and in Node alike.

Returns#

Promise<PkcePair>

pkceChallenge()#

pkceChallenge: (verifier: string) => Promise<string>;

Defined in: auth/index.ts:428

The S256 challenge for a verifier.

The S256 challenge for a verifier: BASE64URL(SHA-256(ASCII(verifier))).

Parameters#

Returns#

Promise<string>

revocationEndpoint#

readonly revocationEndpoint: string;

Defined in: auth/index.ts:386

signup#

readonly signup: {
  start: (input: SignupStartInput) => Promise<SignupStartResult>;
  verify: (input: SignupVerifyInput) => Promise<StepResult>;
};

Defined in: auth/index.ts:497

Create an account. start emails a code to the address and answers the handle, the same whether or not the address already has an account (one that does gets a note to sign in instead, and no code). verify takes the code, a password and a name, creates the person and answers a one-time code for exchange: its tokens name no organisation, and a session on them makes the person's first with createOrganisation.

start()#

start: (input: SignupStartInput) => Promise<SignupStartResult>;

Parameters

Returns

Promise<SignupStartResult>

verify()#

verify: (input: SignupVerifyInput) => Promise<StepResult>;

Parameters

Returns

Promise<StepResult>

tokenEndpoint#

readonly tokenEndpoint: string;

Defined in: auth/index.ts:385