@ottili/foundation-auth

Auth redirect, PKCE code exchange, session state machine, refresh, expiry and account switch (SoT §8.6, §12).

Install

npm install @ottili/foundation-auth

This package is part of the Ottili Foundation Framework. See docs/OTTILI_FOUNDATION_FRAMEWORK_SOURCE_OF_TRUTH.md for the canonical spec.

Public API

• PKCE helpers: createPkceChallenge, buildAuthorizationUrl, generateState, parseCallback, sanitizeReturnTo.
• Session state machine: sessionReducer, INITIAL_SESSION_STATE, canRead, canWrite, isExpired, millisUntilRefresh.
• Enterprise auth utilities for planning returns, draft recovery, and account-switch flows.

Usage

import {
  createPkceChallenge,
  buildAuthorizationUrl,
  generateState,
  parseCallback,
} from "@ottili/foundation-auth";

const state = generateState();
const challenge = await createPkceChallenge();
const url = buildAuthorizationUrl({
  clientId: "my-product",
  redirectUri: "http://localhost/callback",
  state,
  challenge,
});

window.location.href = url;

const result = parseCallback(callbackUrl, state);
if (result.ok) {
  // send result.code to your BFF for exchange
}