',title:"",trigger:"hover focus"},fs={allowList:"object",animation:"boolean",boundary:"(string|element)",container:"(string|element|boolean)",customClass:"(string|function)",delay:"(number|object)",fallbackPlacements:"array",html:"boolean",offset:"(array|string|function)",placement:"(string|function)",popperConfig:"(null|object|function)",sanitize:"boolean",sanitizeFn:"(null|function)",selector:"(string|boolean)",template:"string",title:"(string|element|function)",trigger:"string"};class ps extends B{constructor(t,e){if(void 0===Ai)throw new TypeError("Bootstrap's tooltips require Popper (https://popper.js.org/docs/v2/)");super(t,e),this._isEnabled=!0,this._timeout=0,this._isHovered=null,this._activeTrigger={},this._popper=null,this._templateFactory=null,this._newContent=null,this.tip=null,this._setListeners(),this._config.selector||this._fixTitle()}static get Default(){return us}static get DefaultType(){return fs}static get NAME(){return"tooltip"}enable(){this._isEnabled=!0}disable(){this._isEnabled=!1}toggleEnabled(){this._isEnabled=!this._isEnabled}toggle(){this._isEnabled&&(this._isShown()?this._leave():this._enter())}dispose(){clearTimeout(this._timeout),P.off(this._element.closest(rs),as,this._hideModalHandler),this._element.getAttribute("data-bs-original-title")&&this._element.setAttribute("title",this._element.getAttribute("data-bs-original-title")),this._disposePopper(),super.dispose()}show(){if("none"===this._element.style.display)throw new Error("Please use show on visible elements");if(!this._isWithContent()||!this._isEnabled)return;const t=P.trigger(this._element,this.constructor.eventName("show")),e=(h(this._element)||this._element.ownerDocument.documentElement).contains(this._element);if(t.defaultPrevented||!e)return;this._disposePopper();const i=this._getTipElement();this._element.setAttribute("aria-describedby",i.getAttribute("id"));const{container:n}=this._config;if(this._element.ownerDocument.documentElement.contains(this.tip)||(n.append(i),P.trigger(this._element,this.constructor.eventName("inserted"))),this._popper=this._createPopper(i),i.classList.add(ss),"ontouchstart"in document.documentElement)for(const t of[].concat(...document.body.children))P.on(t,"mouseover",d);this._queueCallback(()=>{P.trigger(this._element,this.constructor.eventName("shown")),!1===this._isHovered&&this._leave(),this._isHovered=!1},this.tip,this._isAnimated())}hide(){if(this._isShown()&&!P.trigger(this._element,this.constructor.eventName("hide")).defaultPrevented){if(this._getTipElement().classList.remove(ss),"ontouchstart"in document.documentElement)for(const t of[].concat(...document.body.children))P.off(t,"mouseover",d);this._activeTrigger[hs]=!1,this._activeTrigger[cs]=!1,this._activeTrigger[ls]=!1,this._isHovered=null,this._queueCallback(()=>{this._isWithActiveTrigger()||(this._isHovered||this._disposePopper(),this._element.removeAttribute("aria-describedby"),P.trigger(this._element,this.constructor.eventName("hidden")))},this.tip,this._isAnimated())}}update(){this._popper&&this._popper.update()}_isWithContent(){return Boolean(this._getTitle())}_getTipElement(){return this.tip||(this.tip=this._createTipElement(this._newContent||this._getContentForTemplate())),this.tip}_createTipElement(t){const e=this._getTemplateFactory(t).toHtml();if(!e)return null;e.classList.remove(ns,ss),e.classList.add(`bs-${this.constructor.NAME}-auto`);const i=(t=>{do{t+=Math.floor(1e6*Math.random())}while(document.getElementById(t));return t})(this.constructor.NAME).toString();return e.setAttribute("id",i),this._isAnimated()&&e.classList.add(ns),e}setContent(t){this._newContent=t,this._isShown()&&(this._disposePopper(),this.show())}_getTemplateFactory(t){return this._templateFactory?this._templateFactory.changeContent(t):this._templateFactory=new es({...this._config,content:t,extraClass:this._resolvePossibleFunction(this._config.customClass)}),this._templateFactory}_getContentForTemplate(){return{[os]:this._getTitle()}}_getTitle(){return this._resolvePossibleFunction(this._config.title)||this._element.getAttribute("data-bs-original-title")}_initializeOnDelegatedTarget(t){return this.constructor.getOrCreateInstance(t.delegateTarget,this._getDelegateConfig())}_isAnimated(){return this._config.animation||this.tip&&this.tip.classList.contains(ns)}_isShown(){return this.tip&&this.tip.classList.contains(ss)}_createPopper(t){const e=_(this._config.placement,[this,t,this._element]),i=ds[e.toUpperCase()];return wi(this._element,t,this._getPopperConfig(i))}_getOffset(){const{offset:t}=this._config;return"string"==typeof t?t.split(",").map(t=>Number.parseInt(t,10)):"function"==typeof t?e=>t(e,this._element):t}_resolvePossibleFunction(t){return _(t,[this._element,this._element])}_getPopperConfig(t){const e={placement:t,modifiers:[{name:"flip",options:{fallbackPlacements:this._config.fallbackPlacements}},{name:"offset",options:{offset:this._getOffset()}},{name:"preventOverflow",options:{boundary:this._config.boundary}},{name:"arrow",options:{element:`.${this.constructor.NAME}-arrow`}},{name:"preSetPlacement",enabled:!0,phase:"beforeMain",fn:t=>{this._getTipElement().setAttribute("data-popper-placement",t.state.placement)}}]};return{...e,..._(this._config.popperConfig,[void 0,e])}}_setListeners(){const t=this._config.trigger.split(" ");for(const e of t)if("click"===e)P.on(this._element,this.constructor.eventName("click"),this._config.selector,t=>{const e=this._initializeOnDelegatedTarget(t);e._activeTrigger[hs]=!(e._isShown()&&e._activeTrigger[hs]),e.toggle()});else if("manual"!==e){const t=e===ls?this.constructor.eventName("mouseenter"):this.constructor.eventName("focusin"),i=e===ls?this.constructor.eventName("mouseleave"):this.constructor.eventName("focusout");P.on(this._element,t,this._config.selector,t=>{const e=this._initializeOnDelegatedTarget(t);e._activeTrigger["focusin"===t.type?cs:ls]=!0,e._enter()}),P.on(this._element,i,this._config.selector,t=>{const e=this._initializeOnDelegatedTarget(t);e._activeTrigger["focusout"===t.type?cs:ls]=e._element.contains(t.relatedTarget),e._leave()})}this._hideModalHandler=()=>{this._element&&this.hide()},P.on(this._element.closest(rs),as,this._hideModalHandler)}_fixTitle(){const t=this._element.getAttribute("title");t&&(this._element.getAttribute("aria-label")||this._element.textContent.trim()||this._element.setAttribute("aria-label",t),this._element.setAttribute("data-bs-original-title",t),this._element.removeAttribute("title"))}_enter(){this._isShown()||this._isHovered?this._isHovered=!0:(this._isHovered=!0,this._setTimeout(()=>{this._isHovered&&this.show()},this._config.delay.show))}_leave(){this._isWithActiveTrigger()||(this._isHovered=!1,this._setTimeout(()=>{this._isHovered||this.hide()},this._config.delay.hide))}_setTimeout(t,e){clearTimeout(this._timeout),this._timeout=setTimeout(t,e)}_isWithActiveTrigger(){return Object.values(this._activeTrigger).includes(!0)}_getConfig(t){const e=H.getDataAttributes(this._element);for(const t of Object.keys(e))is.has(t)&&delete e[t];return t={...e,..."object"==typeof t&&t?t:{}},t=this._mergeConfigObj(t),t=this._configAfterMerge(t),this._typeCheckConfig(t),t}_configAfterMerge(t){return t.container=!1===t.container?document.body:a(t.container),"number"==typeof t.delay&&(t.delay={show:t.delay,hide:t.delay}),"number"==typeof t.title&&(t.title=t.title.toString()),"number"==typeof t.content&&(t.content=t.content.toString()),t}_getDelegateConfig(){const t={};for(const[e,i]of Object.entries(this._config))this.constructor.Default[e]!==i&&(t[e]=i);return t.selector=!1,t.trigger="manual",t}_disposePopper(){this._popper&&(this._popper.destroy(),this._popper=null),this.tip&&(this.tip.remove(),this.tip=null)}static jQueryInterface(t){return this.each(function(){const e=ps.getOrCreateInstance(this,t);if("string"==typeof t){if(void 0===e[t])throw new TypeError(`No method named "${t}"`);e[t]()}})}}g(ps);const ms=".popover-header",gs=".popover-body",_s={...ps.Default,content:"",offset:[0,8],placement:"right",template:'
',trigger:"click"},bs={...ps.DefaultType,content:"(null|string|element|function)"};class vs extends ps{static get Default(){return _s}static get DefaultType(){return bs}static get NAME(){return"popover"}_isWithContent(){return this._getTitle()||this._getContent()}_getContentForTemplate(){return{[ms]:this._getTitle(),[gs]:this._getContent()}}_getContent(){return this._resolvePossibleFunction(this._config.content)}static jQueryInterface(t){return this.each(function(){const e=vs.getOrCreateInstance(this,t);if("string"==typeof t){if(void 0===e[t])throw new TypeError(`No method named "${t}"`);e[t]()}})}}g(vs);const ys=".bs.scrollspy",ws=`activate${ys}`,As=`click${ys}`,Es=`load${ys}.data-api`,Ts="active",Cs="[href]",Os=".nav-link",xs=`${Os}, .nav-item > ${Os}, .list-group-item`,ks={offset:null,rootMargin:"0px 0px -25%",smoothScroll:!1,target:null,threshold:[.1,.5,1]},Ls={offset:"(number|null)",rootMargin:"string",smoothScroll:"boolean",target:"element",threshold:"array"};class Ss extends B{constructor(t,e){super(t,e),this._targetLinks=new Map,this._observableSections=new Map,this._rootElement="visible"===getComputedStyle(this._element).overflowY?null:this._element,this._activeTarget=null,this._observer=null,this._previousScrollData={visibleEntryTop:0,parentScrollTop:0},this.refresh()}static get Default(){return ks}static get DefaultType(){return Ls}static get NAME(){return"scrollspy"}refresh(){this._initializeTargetsAndObservables(),this._maybeEnableSmoothScroll(),this._observer?this._observer.disconnect():this._observer=this._getNewObserver();for(const t of this._observableSections.values())this._observer.observe(t)}dispose(){this._observer.disconnect(),super.dispose()}_configAfterMerge(t){return t.target=a(t.target)||document.body,t.rootMargin=t.offset?`${t.offset}px 0px -30%`:t.rootMargin,"string"==typeof t.threshold&&(t.threshold=t.threshold.split(",").map(t=>Number.parseFloat(t))),t}_maybeEnableSmoothScroll(){this._config.smoothScroll&&(P.off(this._config.target,As),P.on(this._config.target,As,Cs,t=>{const e=this._observableSections.get(t.target.hash);if(e){t.preventDefault();const i=this._rootElement||window,n=e.offsetTop-this._element.offsetTop;if(i.scrollTo)return void i.scrollTo({top:n,behavior:"smooth"});i.scrollTop=n}}))}_getNewObserver(){const t={root:this._rootElement,threshold:this._config.threshold,rootMargin:this._config.rootMargin};return new IntersectionObserver(t=>this._observerCallback(t),t)}_observerCallback(t){const e=t=>this._targetLinks.get(`#${t.target.id}`),i=t=>{this._previousScrollData.visibleEntryTop=t.target.offsetTop,this._process(e(t))},n=(this._rootElement||document.documentElement).scrollTop,s=n>=this._previousScrollData.parentScrollTop;this._previousScrollData.parentScrollTop=n;for(const o of t){if(!o.isIntersecting){this._activeTarget=null,this._clearActiveClass(e(o));continue}const t=o.target.offsetTop>=this._previousScrollData.visibleEntryTop;if(s&&t){if(i(o),!n)return}else s||t||i(o)}}_initializeTargetsAndObservables(){this._targetLinks=new Map,this._observableSections=new Map;const t=R.find(Cs,this._config.target);for(const e of t){if(!e.hash||c(e))continue;const t=R.findOne(decodeURI(e.hash),this._element);l(t)&&(this._targetLinks.set(decodeURI(e.hash),e),this._observableSections.set(e.hash,t))}}_process(t){this._activeTarget!==t&&(this._clearActiveClass(this._config.target),this._activeTarget=t,t.classList.add(Ts),this._activateParents(t),P.trigger(this._element,ws,{relatedTarget:t}))}_activateParents(t){if(t.classList.contains("dropdown-item"))R.findOne(".dropdown-toggle",t.closest(".dropdown")).classList.add(Ts);else for(const e of R.parents(t,".nav, .list-group"))for(const t of R.prev(e,xs))t.classList.add(Ts)}_clearActiveClass(t){t.classList.remove(Ts);const e=R.find(`${Cs}.${Ts}`,t);for(const t of e)t.classList.remove(Ts)}static jQueryInterface(t){return this.each(function(){const e=Ss.getOrCreateInstance(this,t);if("string"==typeof t){if(void 0===e[t]||t.startsWith("_")||"constructor"===t)throw new TypeError(`No method named "${t}"`);e[t]()}})}}P.on(window,Es,()=>{for(const t of R.find('[data-bs-spy="scroll"]'))Ss.getOrCreateInstance(t)}),g(Ss);const Ds=".bs.tab",$s=`hide${Ds}`,Is=`hidden${Ds}`,Ns=`show${Ds}`,Ps=`shown${Ds}`,js=`click${Ds}`,Ms=`keydown${Ds}`,Fs=`load${Ds}`,Hs="ArrowLeft",Ws="ArrowRight",Bs="ArrowUp",zs="ArrowDown",Rs="Home",qs="End",Vs="active",Ks="fade",Qs="show",Xs=".dropdown-toggle",Ys=`:not(${Xs})`,Us='[data-bs-toggle="tab"], [data-bs-toggle="pill"], [data-bs-toggle="list"]',Gs=`.nav-link${Ys}, .list-group-item${Ys}, [role="tab"]${Ys}, ${Us}`,Js=`.${Vs}[data-bs-toggle="tab"], .${Vs}[data-bs-toggle="pill"], .${Vs}[data-bs-toggle="list"]`;class Zs extends B{constructor(t){super(t),this._parent=this._element.closest('.list-group, .nav, [role="tablist"]'),this._parent&&(this._setInitialAttributes(this._parent,this._getChildren()),P.on(this._element,Ms,t=>this._keydown(t)))}static get NAME(){return"tab"}show(){const t=this._element;if(this._elemIsActive(t))return;const e=this._getActiveElem(),i=e?P.trigger(e,$s,{relatedTarget:t}):null;P.trigger(t,Ns,{relatedTarget:e}).defaultPrevented||i&&i.defaultPrevented||(this._deactivate(e,t),this._activate(t,e))}_activate(t,e){t&&(t.classList.add(Vs),this._activate(R.getElementFromSelector(t)),this._queueCallback(()=>{"tab"===t.getAttribute("role")?(t.removeAttribute("tabindex"),t.setAttribute("aria-selected",!0),this._toggleDropDown(t,!0),P.trigger(t,Ps,{relatedTarget:e})):t.classList.add(Qs)},t,t.classList.contains(Ks)))}_deactivate(t,e){t&&(t.classList.remove(Vs),t.blur(),this._deactivate(R.getElementFromSelector(t)),this._queueCallback(()=>{"tab"===t.getAttribute("role")?(t.setAttribute("aria-selected",!1),t.setAttribute("tabindex","-1"),this._toggleDropDown(t,!1),P.trigger(t,Is,{relatedTarget:e})):t.classList.remove(Qs)},t,t.classList.contains(Ks)))}_keydown(t){if(![Hs,Ws,Bs,zs,Rs,qs].includes(t.key))return;t.stopPropagation(),t.preventDefault();const e=this._getChildren().filter(t=>!c(t));let i;if([Rs,qs].includes(t.key))i=e[t.key===Rs?0:e.length-1];else{const n=[Ws,zs].includes(t.key);i=v(e,t.target,n,!0)}i&&(i.focus({preventScroll:!0}),Zs.getOrCreateInstance(i).show())}_getChildren(){return R.find(Gs,this._parent)}_getActiveElem(){return this._getChildren().find(t=>this._elemIsActive(t))||null}_setInitialAttributes(t,e){this._setAttributeIfNotExists(t,"role","tablist");for(const t of e)this._setInitialAttributesOnChild(t)}_setInitialAttributesOnChild(t){t=this._getInnerElement(t);const e=this._elemIsActive(t),i=this._getOuterElement(t);t.setAttribute("aria-selected",e),i!==t&&this._setAttributeIfNotExists(i,"role","presentation"),e||t.setAttribute("tabindex","-1"),this._setAttributeIfNotExists(t,"role","tab"),this._setInitialAttributesOnTargetPanel(t)}_setInitialAttributesOnTargetPanel(t){const e=R.getElementFromSelector(t);e&&(this._setAttributeIfNotExists(e,"role","tabpanel"),t.id&&this._setAttributeIfNotExists(e,"aria-labelledby",`${t.id}`))}_toggleDropDown(t,e){const i=this._getOuterElement(t);if(!i.classList.contains("dropdown"))return;const n=(t,n)=>{const s=R.findOne(t,i);s&&s.classList.toggle(n,e)};n(Xs,Vs),n(".dropdown-menu",Qs),i.setAttribute("aria-expanded",e)}_setAttributeIfNotExists(t,e,i){t.hasAttribute(e)||t.setAttribute(e,i)}_elemIsActive(t){return t.classList.contains(Vs)}_getInnerElement(t){return t.matches(Gs)?t:R.findOne(Gs,t)}_getOuterElement(t){return t.closest(".nav-item, .list-group-item")||t}static jQueryInterface(t){return this.each(function(){const e=Zs.getOrCreateInstance(this);if("string"==typeof t){if(void 0===e[t]||t.startsWith("_")||"constructor"===t)throw new TypeError(`No method named "${t}"`);e[t]()}})}}P.on(document,js,Us,function(t){["A","AREA"].includes(this.tagName)&&t.preventDefault(),c(this)||Zs.getOrCreateInstance(this).show()}),P.on(window,Fs,()=>{for(const t of R.find(Js))Zs.getOrCreateInstance(t)}),g(Zs);const to=".bs.toast",eo=`mouseover${to}`,io=`mouseout${to}`,no=`focusin${to}`,so=`focusout${to}`,oo=`hide${to}`,ro=`hidden${to}`,ao=`show${to}`,lo=`shown${to}`,co="hide",ho="show",uo="showing",fo={animation:"boolean",autohide:"boolean",delay:"number"},po={animation:!0,autohide:!0,delay:5e3};class mo extends B{constructor(t,e){super(t,e),this._timeout=null,this._hasMouseInteraction=!1,this._hasKeyboardInteraction=!1,this._setListeners()}static get Default(){return po}static get DefaultType(){return fo}static get NAME(){return"toast"}show(){P.trigger(this._element,ao).defaultPrevented||(this._clearTimeout(),this._config.animation&&this._element.classList.add("fade"),this._element.classList.remove(co),u(this._element),this._element.classList.add(ho,uo),this._queueCallback(()=>{this._element.classList.remove(uo),P.trigger(this._element,lo),this._maybeScheduleHide()},this._element,this._config.animation))}hide(){this.isShown()&&(P.trigger(this._element,oo).defaultPrevented||(this._element.classList.add(uo),this._queueCallback(()=>{this._element.classList.add(co),this._element.classList.remove(uo,ho),P.trigger(this._element,ro)},this._element,this._config.animation)))}dispose(){this._clearTimeout(),this.isShown()&&this._element.classList.remove(ho),super.dispose()}isShown(){return this._element.classList.contains(ho)}_maybeScheduleHide(){this._config.autohide&&(this._hasMouseInteraction||this._hasKeyboardInteraction||(this._timeout=setTimeout(()=>{this.hide()},this._config.delay)))}_onInteraction(t,e){switch(t.type){case"mouseover":case"mouseout":this._hasMouseInteraction=e;break;case"focusin":case"focusout":this._hasKeyboardInteraction=e}if(e)return void this._clearTimeout();const i=t.relatedTarget;this._element===i||this._element.contains(i)||this._maybeScheduleHide()}_setListeners(){P.on(this._element,eo,t=>this._onInteraction(t,!0)),P.on(this._element,io,t=>this._onInteraction(t,!1)),P.on(this._element,no,t=>this._onInteraction(t,!0)),P.on(this._element,so,t=>this._onInteraction(t,!1))}_clearTimeout(){clearTimeout(this._timeout),this._timeout=null}static jQueryInterface(t){return this.each(function(){const e=mo.getOrCreateInstance(this,t);if("string"==typeof t){if(void 0===e[t])throw new TypeError(`No method named "${t}"`);e[t](this)}})}}return q(mo),g(mo),{Alert:X,Button:U,Carousel:St,Collapse:qt,Dropdown:Qi,Modal:Ln,Offcanvas:Qn,Popover:vs,ScrollSpy:Ss,Tab:Zs,Toast:mo,Tooltip:ps}});
+//# sourceMappingURL=bootstrap.bundle.min.js.map
diff --git a/example/public/js/errors.js b/example/public/js/errors.js
index 95220bb..8041475 100644
--- a/example/public/js/errors.js
+++ b/example/public/js/errors.js
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2020-2024 Estonian Information System Authority
+ * Copyright (c) 2020-2025 Estonian Information System Authority
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -32,10 +32,9 @@ export function hideErrorMessage() {
alertUi.alert.style.display = "none";
}
-export function showErrorMessage(error) {
- const message = "Authentication failed";
+export function showErrorMessage(error, message = "Authentication failed") {
const details =
- `[Code]\n${error.code}` +
+ `[Code]\n${error.code ?? "UNKNOWN_ERROR"}` +
`\n\n[Message]\n${error.message}` +
(error.response ? `\n\n[response]\n${JSON.stringify(error.response, null, " ")}` : "");
@@ -56,4 +55,4 @@ export async function checkHttpError(response) {
error.code = response.status;
throw error;
}
-}
\ No newline at end of file
+}
diff --git a/example/public/js/payload.js b/example/public/js/payload.js
new file mode 100644
index 0000000..4035e6c
--- /dev/null
+++ b/example/public/js/payload.js
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2020-2025 Estonian Information System Authority
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+export function parsePayload(context) {
+ const fragment = window.location.hash.slice(1);
+
+ if (!fragment) {
+ throw new Error(`Missing ${context} response payload`);
+ }
+
+ let payload;
+ try {
+ payload = JSON.parse(atob(fragment));
+ } catch (e) {
+ console.error(e);
+ throw new Error(`Failed to parse the ${context} response`);
+ }
+
+ if (payload.error) {
+ const error = new Error(payload.message ?? `${context} failed`);
+ error.code = payload.code;
+ throw error;
+ }
+
+ return payload;
+}
diff --git a/example/public/js/web-eid.js b/example/public/js/web-eid.js
index e8b4dd5..520fa88 100644
--- a/example/public/js/web-eid.js
+++ b/example/public/js/web-eid.js
@@ -1,7 +1,7 @@
/**
* MIT License
*
- * Copyright (c) 2020-2021 Estonian Information System Authority
+ * Copyright (c) 2020-2023 Estonian Information System Authority
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -48,20 +48,12 @@ var ErrorCode;
(function (ErrorCode) {
ErrorCode["ERR_WEBEID_ACTION_TIMEOUT"] = "ERR_WEBEID_ACTION_TIMEOUT";
ErrorCode["ERR_WEBEID_USER_TIMEOUT"] = "ERR_WEBEID_USER_TIMEOUT";
- ErrorCode["ERR_WEBEID_SERVER_TIMEOUT"] = "ERR_WEBEID_SERVER_TIMEOUT";
ErrorCode["ERR_WEBEID_VERSION_MISMATCH"] = "ERR_WEBEID_VERSION_MISMATCH";
ErrorCode["ERR_WEBEID_VERSION_INVALID"] = "ERR_WEBEID_VERSION_INVALID";
ErrorCode["ERR_WEBEID_EXTENSION_UNAVAILABLE"] = "ERR_WEBEID_EXTENSION_UNAVAILABLE";
ErrorCode["ERR_WEBEID_NATIVE_UNAVAILABLE"] = "ERR_WEBEID_NATIVE_UNAVAILABLE";
ErrorCode["ERR_WEBEID_UNKNOWN_ERROR"] = "ERR_WEBEID_UNKNOWN_ERROR";
ErrorCode["ERR_WEBEID_CONTEXT_INSECURE"] = "ERR_WEBEID_CONTEXT_INSECURE";
- ErrorCode["ERR_WEBEID_PROTOCOL_INSECURE"] = "ERR_WEBEID_PROTOCOL_INSECURE";
- ErrorCode["ERR_WEBEID_TLS_CONNECTION_BROKEN"] = "ERR_WEBEID_TLS_CONNECTION_BROKEN";
- ErrorCode["ERR_WEBEID_TLS_CONNECTION_INSECURE"] = "ERR_WEBEID_TLS_CONNECTION_INSECURE";
- ErrorCode["ERR_WEBEID_TLS_CONNECTION_WEAK"] = "ERR_WEBEID_TLS_CONNECTION_WEAK";
- ErrorCode["ERR_WEBEID_CERTIFICATE_CHANGED"] = "ERR_WEBEID_CERTIFICATE_CHANGED";
- ErrorCode["ERR_WEBEID_ORIGIN_MISMATCH"] = "ERR_WEBEID_ORIGIN_MISMATCH";
- ErrorCode["ERR_WEBEID_SERVER_REJECTED"] = "ERR_WEBEID_SERVER_REJECTED";
ErrorCode["ERR_WEBEID_USER_CANCELLED"] = "ERR_WEBEID_USER_CANCELLED";
ErrorCode["ERR_WEBEID_NATIVE_INVALID_ARGUMENT"] = "ERR_WEBEID_NATIVE_INVALID_ARGUMENT";
ErrorCode["ERR_WEBEID_NATIVE_FATAL"] = "ERR_WEBEID_NATIVE_FATAL";
@@ -112,7 +104,7 @@ class ExtensionUnavailableError extends Error {
}
var config = Object.freeze({
- VERSION: "2.0.1",
+ VERSION: "2.0.2",
EXTENSION_HANDSHAKE_TIMEOUT: 1000,
NATIVE_APP_HANDSHAKE_TIMEOUT: 5 * 1000,
DEFAULT_USER_INTERACTION_TIMEOUT: 2 * 60 * 1000,
@@ -251,7 +243,7 @@ class WebExtensionService {
(_d = message.warnings) === null || _d === void 0 ? void 0 : _d.forEach((warning) => {
if (!this.loggedWarnings.includes(warning)) {
this.loggedWarnings.push(warning);
- console.warn(warning);
+ console.warn(warning.replace(/\n|\r/g, ""));
}
});
}
diff --git a/example/src/Auth.php b/example/src/Auth.php
index 160262e..9eda75d 100644
--- a/example/src/Auth.php
+++ b/example/src/Auth.php
@@ -1,71 +1,20 @@
config = $config;
- }
-
- public function trustedIntermediateCACertificates(): array
- {
- $directory = __DIR__ . "/../certificates/";
- $certificates = glob($directory . "*.der.crt");
- return CertificateLoader::loadCertificatesFromResources(...$certificates);
- }
-
- public function generator(): ChallengeNonceGenerator
- {
- return (new ChallengeNonceGeneratorBuilder())
- ->withNonceTtl(300)
- ->build();
- }
-
- public function tokenValidator(): AuthTokenValidator
- {
- $logger = new Logger();
-
- return (new AuthTokenValidatorBuilder($logger))
- // Change the URL when you run the example in your own machine.
- ->withSiteOrigin(new Uri($this->config->get('origin_url')))
- ->withTrustedCertificateAuthorities(...self::trustedIntermediateCACertificates())
- ->build();
+ $this->ctx = new AuthContext($config);
+ $this->mobile = new MobileAuth($this->ctx);
}
/**
@@ -77,26 +26,15 @@ public function getNonce()
{
try {
header("Content-Type: application/json; charset=utf-8");
- $challengeNonce = $this->generator()->generateAndStoreNonce();
+ $challengeNonce = $this->ctx->nonceGenerator()->generateAndStoreNonce();
$responseArr = ["nonce" => $challengeNonce->getBase64EncodedNonce()];
echo json_encode($responseArr);
} catch (Exception $e) {
- header("HTTP/1.0 500 Internal Server Error");
+ http_response_code(500);
echo "Nonce generation failed";
}
}
- private function getPrincipalNameFromCertificate(X509 $userCertificate): string
- {
- $givenName = CertificateData::getSubjectGivenName($userCertificate);
- $surname = CertificateData::getSubjectSurname($userCertificate);
- if ($givenName && $surname) {
- return $givenName . " " . $surname;
- } else {
- return CertificateData::getSubjectCN($userCertificate);
- }
- }
-
/**
* Authenticate
*
@@ -104,15 +42,7 @@ private function getPrincipalNameFromCertificate(X509 $userCertificate): string
*/
public function validate()
{
- // Header names must be treated as case-insensitive (according to RFC2616) so we convert them to lowercase
- $headers = array_change_key_case(getallheaders(), CASE_LOWER);
-
- if (!isset($headers["x-csrf-token"]) || ($headers["x-csrf-token"] != $_SESSION["csrf-token"])) {
- header("HTTP/1.0 405 Method Not Allowed");
- echo "CSRF token missing, unable to process your request";
- return;
- }
-
+ $this->ctx->assertCsrf();
$authToken = file_get_contents("php://input");
try {
@@ -120,31 +50,42 @@ public function validate()
/* Get and remove nonce from store */
$challengeNonce = (new ChallengeNonceStore())->getAndRemove();
- try {
-
- // Validate token
- $cert = $this->tokenValidator()->validate(new WebEidAuthToken($authToken), $challengeNonce->getBase64EncodedNonce());
-
- session_regenerate_id();
+ $subjectName = $this->ctx->authenticate(
+ $authToken,
+ $challengeNonce->getBase64EncodedNonce()
+ );
- $subjectName = $this->getPrincipalNameFromCertificate($cert);
- $result = [
- "sub" => $subjectName
- ];
-
- $_SESSION["auth-user"] = $subjectName;
-
- echo json_encode($result);
- } catch (Exception $e) {
- header("HTTP/1.0 400 Bad Request");
- echo "Validation failed";
- }
- } catch (ChallengeNonceExpiredException $e) {
- header("HTTP/1.0 400 Bad Request");
+ echo json_encode([
+ "sub" => $subjectName
+ ]);
+ } catch (ChallengeNonceExpiredException) {
+ http_response_code(400);
echo "Challenge nonce not found or expired";
+ } catch (ChallengeNonceNotFoundException) {
+ http_response_code(400);
+ echo "Challenge nonce not found";
+ } catch (AuthTokenParseException) {
+ http_response_code(400);
+ echo "Invalid authentication token";
}
}
+ /**
+ * Mobile init (delegated)
+ */
+ public function mobileInit()
+ {
+ $this->mobile->init();
+ }
+
+ /**
+ * Mobile login (delegated)
+ */
+ public function mobileLogin()
+ {
+ $this->mobile->login();
+ }
+
/**
* Logout
*
diff --git a/example/src/AuthContext.php b/example/src/AuthContext.php
new file mode 100644
index 0000000..4c11c0c
--- /dev/null
+++ b/example/src/AuthContext.php
@@ -0,0 +1,104 @@
+config->get('origin_url'), '/');
+ }
+
+ public function mobileBaseUrl(): string
+ {
+ return rtrim($this->config->get('mobile_base_url'), '/');
+ }
+
+ /**
+ * @throws AuthTokenParseException
+ */
+ public function authenticate(
+ string $authTokenJson,
+ string $base64ChallengeNonce
+ ): string
+ {
+ $cert = $this->tokenValidator()->validate(
+ new WebEidAuthToken($authTokenJson),
+ $base64ChallengeNonce
+ );
+
+ session_regenerate_id();
+
+ $subjectName = $this->getPrincipalNameFromCertificate($cert);
+ $_SESSION["auth-user"] = $subjectName;
+
+ return $subjectName;
+ }
+
+ public function assertCsrf(bool $jsonError = true): void
+ {
+ $headers = array_change_key_case(getallheaders());
+
+ if (
+ !isset($headers["x-csrf-token"], $_SESSION["csrf-token"]) ||
+ !hash_equals($_SESSION["csrf-token"], $headers["x-csrf-token"])
+ ) {
+ http_response_code(405);
+
+ if ($jsonError) {
+ echo json_encode(["error" => "CSRF token missing or invalid"]);
+ } else {
+ echo "CSRF token missing, unable to process your request";
+ }
+
+ exit;
+ }
+ }
+
+ public function trustedIntermediateCACertificates(): array
+ {
+ $directory = __DIR__ . "/../certificates/";
+ $certificates = glob($directory . "*.der.crt");
+ return CertificateLoader::loadCertificatesFromResources(...$certificates);
+ }
+
+ public function nonceGenerator(): ChallengeNonceGenerator
+ {
+ return (new ChallengeNonceGeneratorBuilder())
+ ->withNonceTtl(300)
+ ->build();
+ }
+
+ public function tokenValidator(): AuthTokenValidator
+ {
+ $logger = new Logger();
+
+ return (new AuthTokenValidatorBuilder($logger))
+ ->withSiteOrigin(new Uri($this->config->get('origin_url')))
+ ->withTrustedCertificateAuthorities(...$this->trustedIntermediateCACertificates())
+ ->withoutUserCertificateRevocationCheckWithOcsp() // TODO TEST CARDS
+ ->build();
+ }
+
+ public function getPrincipalNameFromCertificate(X509 $cert): string
+ {
+ $givenName = CertificateData::getSubjectGivenName($cert);
+ $surname = CertificateData::getSubjectSurname($cert);
+ return ($givenName && $surname)
+ ? "$givenName $surname"
+ : CertificateData::getSubjectCN($cert);
+ }
+}
diff --git a/example/src/MobileAuth.php b/example/src/MobileAuth.php
new file mode 100644
index 0000000..da1f306
--- /dev/null
+++ b/example/src/MobileAuth.php
@@ -0,0 +1,59 @@
+ctx->nonceGenerator()->generateAndStoreNonce();
+
+ $payload = [
+ "challenge" => $challenge->getBase64EncodedNonce(),
+ "login_uri" => $this->ctx->originUrl() . "/auth/mobile/login",
+ "get_signing_certificate" => true
+ ];
+
+ $authUri =
+ $this->ctx->mobileBaseUrl() .
+ "//auth#" .
+ base64_encode(json_encode($payload));
+
+ echo json_encode(["auth_uri" => $authUri]);
+ }
+
+ public function login(): void
+ {
+ $this->ctx->assertCsrf();
+
+ $json = json_decode(file_get_contents("php://input"), true);
+ if (!isset($json["auth_token"])) {
+ http_response_code(400);
+ echo json_encode(["error" => "Missing auth_token"]);
+ return;
+ }
+
+ try {
+ $nonce = (new ChallengeNonceStore())->getAndRemove();
+
+ $this->ctx->authenticate(
+ json_encode($json["auth_token"]),
+ $nonce->getBase64EncodedNonce()
+ );
+
+ echo json_encode(["redirect" => "/welcome"]);
+ } catch (Exception $e) {
+ http_response_code(400);
+ echo json_encode(["error" => "Validation failed"]);
+ }
+ }
+}
diff --git a/example/src/Pages.php b/example/src/Pages.php
index 87d27a5..dfa306b 100644
--- a/example/src/Pages.php
+++ b/example/src/Pages.php
@@ -1,7 +1,7 @@
data = [
- "content" => $this->template->getHtml(__DIR__ . '/../tpl/login.phtml')
+ "content" => $this->template->getHtml(__DIR__ . '/../tpl/index.phtml')
+ ];
+ }
+
+ public function mobileLoginView()
+ {
+ $this->data = [
+ "content" => $this->template->getHtml(__DIR__ . '/../tpl/webeid-login.phtml'),
];
}
diff --git a/example/src/Router.php b/example/src/Router.php
index ef6fe23..364f779 100644
--- a/example/src/Router.php
+++ b/example/src/Router.php
@@ -1,7 +1,7 @@
map("GET", "/nonce", ["controller" => "Auth", "method" => "getNonce"]);
$router->map("POST", "/validate", ["controller" => "Auth", "method" => "validate"]);
+ $router->map("POST", "/auth/mobile/init", ["controller" => "Auth", "method" => "mobileInit"]);
+ $router->map("GET", "/auth/mobile/login", ["controller" => "Pages", "method" => "mobileLoginView"]);
+ $router->map("POST", "/auth/mobile/login", ["controller" => "Auth", "method" => "mobileLogin"]);
// Allow route only for authenticated users
if (isset($_SESSION["auth-user"])) {
diff --git a/example/src/app.conf.php b/example/src/app.conf.php
index b8798af..28c88a1 100644
--- a/example/src/app.conf.php
+++ b/example/src/app.conf.php
@@ -1,5 +1,7 @@
'https://localhost',
+ 'origin_url' => 'https://157937465d58.ngrok-free.app',
+ 'mobile_base_url' => 'web-eid-mobile://',
+ 'mobile_request_signing_cert' => false
];
\ No newline at end of file
diff --git a/example/tpl/index.phtml b/example/tpl/index.phtml
new file mode 100644
index 0000000..b8dc85d
--- /dev/null
+++ b/example/tpl/index.phtml
@@ -0,0 +1,626 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Web eID: electronic ID smart cards on the Web
++ The Web eID project enables usage of European Union electronic identity (eID) smart cards for + secure authentication and digital signing of documents on the web using public-key cryptography. +
++ Estonian, Finnish, Latvian, Lithuanian, Belgian and Croatian eID cards are supported in the + first phase, but only Estonian eID card support is currently enabled in the test application + below. +
++ Please get in touch by email at help@ria.ee in case you need support with adding Web eID to your + project or want to add support for a new eID card to Web eID. +
++ The privacy policy of the test service is available + here. +
+ ++
Web eID plugin status
+
+ ⏳
+ Web eID plugin installed
+
+
+ ⏳
+ Accessed with a mobile device
+
+
+ +
Table of contents
+-
+
- + Usage with Web eID plugin + + +
-
+ Usage without Web eID plugin
+
-
+
- Documentation +
+
+
Usage with Web eID plugin
++ The recommended way of installing Web eID is by installing + the latest Open-EID ID-software package. In case you do not need or want to install the Open-EID package, install the latest Web eID + packages in Firefox, Chrome, Edge or Safari according to the following instructions: +
+-
+
-
+ Download and run the Web eID native app and browser extension installer:
+
-
+
-
+ on Ubuntu Linux, for Firefox and Chrome, download and execute the
+install-web-eid.sh+ script from the console with
+wget -O - https:///scripts/install-web-eid.sh | + bash
+ Note: as of the 2.5 version, Web eID supports Firefox installed via Snap. +
+ - + on macOS 13 or later, for Firefox and Chrome from + here, + +
- + on macOS 13 or later, for Safari, install the extension from + App Store, + +
- + on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, Windows + Server 2025 for Firefox, Chrome and Edge from + here. + +
+ -
+ on Ubuntu Linux, for Firefox and Chrome, download and execute the
- + The installer will install the browser extension for all supported browsers automatically. + The extension must be manually enabled from either the extension installation pop-up that + appears in the browser or from the browser extensions management page and may need browser + restart under certain circumstances. + +
Testing:
+-
+
- Attach a smart card reader to the computer and insert the eID card into the reader. +
- Click Authenticate below. +
+ +
+ ++
+
+
+
+
+ + + +
+
+
+
+
+ + The uninstaller will remove the browser extension from all supported browsers + automatically. +
+ +Ubuntu Linux
+
+ Uninstall the Web eID software either using the Ubuntu Software Center or from
+ the console with
+ sudo apt purge web-eid
+
macOS
+To uninstall the Web eID software, do the following:
+-
+
- + download the Web eID native app and browser extension installer as + instructed above, + +
- open the downloaded file, +
- open Terminal, +
-
+ drag and drop
uninstall.shfrom the downloaded file to the + Terminal window, +
+ - press Enter and Y, +
- enter your password. +
Windows
+Uninstall the Web eID software using Add or remove programs.
+
+
+ + + +
+
+
+
+
+ -
+
- + To debug the extension, open the extension page and select + Inspect to open browser developer tools in extension mode. You can + examine extension logs in the Console tab, put breakpoints in + extension code in the Debugger tab and inspect extension network + communication in the Network tab. + +
-
+ To enable logging in the extension companion native app,
+
-
+
-
+ in Linux, run the following command in the console:
+echo 'logging=true' > ~/.config/RIA/web-eid.conf+
+ -
+ in macOS, run the following command in the console:
+defaults write \
+"$HOME/Library/Containers/eu.web-eid.web-eid/Data/Library/Preferences/eu.web-eid.web-eid.plist" + \
+logging true
+defaults write + "$HOME/Library/Containers/eu.web-eid.web-eid-safari/Data/Library/Preferences/eu.web-eid.web-eid-safari.plist" + \
+logging true
+
+ -
+ in Windows, add the following registry key:
+[HKEY_CURRENT_USER\SOFTWARE\RIA\web-eid]
+"logging"="true"+
+
+ -
+ in Linux, run the following command in the console:
-
+ The native app logs are stored in
+
-
+
~/.local/share/RIA/web-eid/web-eid.login Linux
+ -
+
~/Library/Containers/eu.web-eid.web-eid/Data/Library/Application\ + Support/RIA/web-eid/web-eid.log+ in macOS +
+ -
+
~/Library/Containers/eu.web-eid.web-eid-safari/Data/Library/Application\ + Support/RIA/web-eid-safari/web-eid-safari.log+ of Safari in macOS +
+ -
+
C:/Users/<USER>/AppData/Local/RIA/web-eid/web-eid.log+ in Windows. +
+
+ -
+ You can verify if debugging works by executing the native application
+
web-eid+ manually, there will be an informative message in the logs. +
+
+
+ + +
+
+
+
+
+ + Technical overview of the solution is available in the project + system architecture document. Overview of authentication token validation implementation in the back end is + available in the web-eid-authtoken-validation-java Java library + README. +
++ Security analysis of the solution is available + in this document. +
+
+
+ + +
+
+
+
+
+ + Currently the Web eID back-end libraries are available for Java, .NET and PHP + web applications. +
++ To implement authentication and digital signing with Web eID in a Java, .NET or + PHP web application, you need to +
+-
+
- + use the web-eid.js JavaScript library in the front end of the web + application according to the instructions + here, + +
-
+ for authentication
+
-
+
- + in Java use the web-eid-authtoken-validation-java library in + the back end of the web application according to the instructions + here, + +
- + in .NET/C# use the + web-eid-authtoken-validation-dotnet library according to the + instructions + here + +
- + in PHP use the web-eid-authtoken-validation-php library + according to the instructions + here + +
+ - + for digital signing + + +
+ The full source code of an example Spring Boot web application that uses Web eID + for authentication and digital signing is available + here. The .NET/C# version of the example is available + here. The + PHP version of the example is available + here. +
++
Usage without Web eID plugin
++ The Web eID solution can also be used without installing the Web eID native app and browser + extension. This includes devices like mobile phones, tablets, and some Chromebooks, where the + Web eID plugin cannot currently be installed. +
++ +
+ ++
+
+
+
+ + +
+
+
+
+
+ + Technical overview of the solution is available in the project + system architecture document. Overview of authentication token validation implementation in the back end is + available in the web-eid-authtoken-validation-java Java library + README. +
+
+ 
+
+
+
+
+
+
+
diff --git a/example/tpl/login.phtml b/example/tpl/login.phtml
deleted file mode 100644
index 98a70c7..0000000
--- a/example/tpl/login.phtml
+++ /dev/null
@@ -1,74 +0,0 @@
-
+Authenticate with Web eID
- - -
-
-
-
-
-
\ No newline at end of file
diff --git a/example/tpl/webeid-login.phtml b/example/tpl/webeid-login.phtml
new file mode 100644
index 0000000..94af1d7
--- /dev/null
+++ b/example/tpl/webeid-login.phtml
@@ -0,0 +1,44 @@
+
+
+
+
+