@agglabs-one/gate

OpenID Connect client for AGG One Gate (gate.one.agglabs.com) — the AGG One identity provider. Add "Sign in with AGG" to your app: build the login redirect, exchange the code for tokens, and verify the ID token offline.

The Gate is the OpenID Provider (the token iss, discovery and JWKS host). The login and consent screens are served by the One frontend — /authorize redirects the browser there, and after the user confirms you get a code back at your redirect URI.

npm install @agglabs-one/gate

Usage

import { Gate } from '@agglabs-one/gate';

const gate = new Gate({
  clientId: process.env.AGG_CLIENT_ID!,
  clientSecret: process.env.AGG_CLIENT_SECRET, // omit for public/PKCE clients
  redirectUri: 'https://loop-id.agglabs.com/callback',
});

// 1. Start login. Redirect the browser to `req.url`; the Gate shows the consent
//    page. Persist state/nonce/codeVerifier (e.g. in a signed cookie/session).
const req = await gate.createAuthorizationUrl();
res.cookie('oidc', { state: req.state, nonce: req.nonce, codeVerifier: req.codeVerifier });
res.redirect(req.url);

// 2. In your callback, after confirming `state` matches what you stored:
const tokens = await gate.exchangeCode({ code, codeVerifier });
const claims = await gate.verifyIdToken(tokens.id_token!, { nonce });
// claims.sub, claims.email, claims.preferred_username …

// 3. Later: refresh, look up the user, or log out.
const fresh = await gate.refresh(tokens.refresh_token!);
const user  = await gate.userInfo(tokens.access_token);
const out   = await gate.endSessionUrl({ idTokenHint: tokens.id_token, postLogoutRedirectUri: 'https://loop-id.agglabs.com' });
await gate.revoke(tokens.refresh_token!);

API

| Method | Purpose | | --- | --- | | discover() | Fetch/cache .well-known/openid-configuration. | | createAuthorizationUrl(params?) | Build the login redirect (PKCE + state + nonce). | | exchangeCode({ code, codeVerifier, redirectUri? }) | Authorization-code → tokens. | | refresh(refreshToken) | Rotate a refresh token for a fresh token set. | | verifyIdToken(idToken, { nonce?, audience?, clockToleranceSeconds? }) | Verify signature + claims offline against the JWKS. | | userInfo(accessToken) | Fetch claims from /userinfo. | | revoke(refreshToken) | Revoke a refresh token. | | endSessionUrl({ idTokenHint?, postLogoutRedirectUri?, state? }) | Build the logout URL. |

All failures throw a typed AggError (re-exported here); verifyIdToken throws TokenValidationError on a bad signature or claim.