@ilex.com.py/identidad-py-sdk-oidc

Interactive OIDC Authorization Code + PKCE client for JS/TS applications using Identidad.

This package is the browser/client-side layer on top of @ilex.com.py/identidad-py-sdk. It handles:

• discovery from /.well-known/openid-configuration
• PKCE code_verifier / code_challenge
• state and nonce
• authorization URL construction
• callback validation
• token exchange against Identidad's JSON token contract
• validation of the returned id_token and access_token

Install

npm i @ilex.com.py/identidad-py-sdk-oidc

Usage

import { createIdentidadOidcClient } from '@ilex.com.py/identidad-py-sdk-oidc';

const client = createIdentidadOidcClient({
  issuer: 'https://identidad.com.py',
  clientId: 'web-client',
  redirectUri: 'https://app.example.com/auth/callback'
});

const { session, authorizationUrl } = await client.createAuthorizationRequest({
  acrValues: 'aal2',
  ial: 'ial1'
});

// Persist `session` somewhere tied to the browser journey, then redirect.
window.location.assign(authorizationUrl.toString());

// Later, on the callback route:
const tokens = await client.exchangeAuthorizationCallback({
  session,
  callbackUrl: window.location.href
});

console.log(tokens.idTokenClaims.sub, tokens.accessTokenClaims.acr);

Redirect flow helper

For browser apps, the package includes a small session-store abstraction:

import {
  createIdentidadOidcClient,
  createStorageOidcSessionStore
} from '@ilex.com.py/identidad-py-sdk-oidc';

const client = createIdentidadOidcClient({
  issuer: 'https://identidad.com.py',
  clientId: 'web-client',
  redirectUri: 'https://app.example.com/auth/callback'
});

const store = createStorageOidcSessionStore(window.sessionStorage);

const { authorizationUrl } = await client.beginAuthorization({
  store,
  acrValues: 'aal2'
});

window.location.assign(authorizationUrl.toString());

// On the callback route:
const tokens = await client.completeAuthorization({
  store,
  callbackUrl: window.location.href
});

Redirect URI guidance

Your redirectUri must exactly match the URI registered in the Identidad client configuration.

Common examples:

• https://app.example.com/auth/callback
• http://localhost:3000/auth/callback

Supported features

• Authorization Code + PKCE
• OIDC discovery
• state validation
• nonce validation
• id_token verification
• access_token verification
• confidential-client support through clientSecretPost and clientSecretBasic

Current limitations

• no popup helper or framework router integration
• no refresh-token helper
• no logout helper
• no QR or device-flow support