@aglyn/plugins-outreach 1.0.0-beta.143

package/src/lib/mailboxes/mailbox-transport.js

@@ -0,0 +1,94 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { SecretBoxError } from "@aglyn/shared-util-tools/secret-box";
+import { createGmailClient } from "../transport/gmail-client.js";
+import { mailboxCredentialsRef, mailboxRef, openMailboxRefreshToken, readMailboxCredentials, sealMailboxRefreshToken } from "./mailbox-credentials.js";
+import { readOutreachGoogleConfig } from "./outreach-config.js";
+export async function openOutreachMailboxClient(firestore, input, deps = {}) {
+    var _deps_readConfig;
+    const config = ((_deps_readConfig = deps.readConfig) != null ? _deps_readConfig : readOutreachGoogleConfig)();
+    if (!config.configured) return {
+        ok: false,
+        reason: 'not-configured'
+    };
+    const snapshot = await mailboxCredentialsRef(firestore, input.mailboxId).get();
+    const credential = readMailboxCredentials(snapshot.exists ? snapshot.data() : null);
+    if (!credential || credential.mailboxId !== input.mailboxId) {
+        return {
+            ok: false,
+            reason: 'no-credential'
+        };
+    }
+    let opened;
+    try {
+        opened = openMailboxRefreshToken(credential, config.config.keyring);
+    } catch (error) {
+        if (error instanceof SecretBoxError) return {
+            ok: false,
+            reason: 'sealed-token-unreadable'
+        };
+        throw error;
+    }
+    if (opened.needsReseal) {
+        await resealMailboxRefreshToken(firestore, credential, opened.refreshToken, config.config.keyring, deps.now);
+    }
+    const client = createGmailClient(_extends({}, deps, {
+        clientId: config.config.clientId,
+        clientSecret: config.config.clientSecret,
+        refreshToken: opened.refreshToken
+    }));
+    return {
+        ok: true,
+        client,
+        credential
+    };
+}
+/**
+ * Seals a token again under the current key, only if the stored value is
+ * still the one that was opened: a reconnect that landed in between wrote a
+ * newer grant, and that one wins. Best-effort — a failure leaves the old
+ * seal, which still opens.
+ */ async function resealMailboxRefreshToken(firestore, credential, refreshToken, keyring, now) {
+    const ref = mailboxCredentialsRef(firestore, credential.mailboxId);
+    try {
+        await firestore.runTransaction(async (tx)=>{
+            const current = await tx.get(ref);
+            if (current.get('sealedRefreshToken') !== credential.sealedRefreshToken) return;
+            tx.update(ref, _extends({}, sealMailboxRefreshToken(refreshToken, credential.mailboxId, keyring), {
+                updatedAtMs: (now != null ? now : Date.now)()
+            }));
+        });
+    } catch (error) {
+        console.error('[outreach] resealing a mailbox token failed', error);
+    }
+}
+/**
+ * Marks a mailbox as needing a reconnect: the provider refused its grant, or
+ * its stored token cannot be opened. Nothing sends from it until the member
+ * connects it again, which returns it to where it was.
+ */ export async function markOutreachMailboxReconnectRequired(firestore, input) {
+    await mailboxRef(firestore, input.orgId, input.mailboxId).update({
+        status: 'reconnect_required',
+        'health.lastErrorAtMs': input.nowMs,
+        'health.lastErrorCode': input.errorCode,
+        updatedAtMs: input.nowMs
+    }).catch((error)=>{
+        console.error('[outreach] marking a mailbox reconnect_required failed', error);
+    });
+}
+
+//# sourceMappingURL=mailbox-transport.js.map

package/src/lib/mailboxes/mailbox-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/mailbox-transport.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { SecretBoxError } from '@aglyn/shared-util-tools/secret-box'\nimport { createGmailClient, type GmailClient } from '../transport/gmail-client'\nimport type { TransportDeps } from '../transport/http'\nimport {\n  mailboxCredentialsRef,\n  mailboxRef,\n  openMailboxRefreshToken,\n  readMailboxCredentials,\n  sealMailboxRefreshToken,\n  type OutreachGoogleMailboxCredentials,\n} from './mailbox-credentials'\nimport {\n  readOutreachGoogleConfig,\n  type OutreachGoogleConfigResult,\n} from './outreach-config'\n\n/**\n * A CONNECTED MAILBOX, OPENED FOR SENDING (AGL-2978).\n *\n * The door the send and sync runtime, and the panel's test send, reach a\n * mailbox's Gmail through: the stored credential read, its refresh token\n * opened with the deployment's key, and a transport client built on it. The\n * token never leaves this function except inside the client.\n *\n * A token opened under an older key of the keyring is sealed again under the\n * current one on the way through, so a key rotation completes itself as\n * mailboxes are used rather than needing a migration.\n */\n\nexport type OpenedOutreachMailbox =\n  | { ok: true; client: GmailClient; credential: OutreachGoogleMailboxCredentials }\n  | {\n      ok: false\n      /**\n       * - `not-configured` — this deployment has no Outreach client or key.\n       * - `no-credential` — nothing is stored for the mailbox.\n       * - `sealed-token-unreadable` — the stored token does not open with\n       *   this deployment's key (rotated away, or altered). The mailbox needs\n       *   connecting again.\n       */\n      reason: 'not-configured' | 'no-credential' | 'sealed-token-unreadable'\n    }\n\nexport interface OpenMailboxDeps extends TransportDeps {\n  readConfig?: () => OutreachGoogleConfigResult\n}\n\nexport async function openOutreachMailboxClient(\n  firestore: FirebaseFirestore.Firestore,\n  input: { mailboxId: string },\n  deps: OpenMailboxDeps = {},\n): Promise<OpenedOutreachMailbox> {\n  const config = (deps.readConfig ?? readOutreachGoogleConfig)()\n  if (!config.configured) return { ok: false, reason: 'not-configured' }\n  const snapshot = await mailboxCredentialsRef(firestore, input.mailboxId).get()\n  const credential = readMailboxCredentials(snapshot.exists ? snapshot.data() : null)\n  if (!credential || credential.mailboxId !== input.mailboxId) {\n    return { ok: false, reason: 'no-credential' }\n  }\n  let opened: { refreshToken: string; needsReseal: boolean }\n  try {\n    opened = openMailboxRefreshToken(credential, config.config.keyring)\n  } catch (error) {\n    if (error instanceof SecretBoxError) return { ok: false, reason: 'sealed-token-unreadable' }\n    throw error\n  }\n  if (opened.needsReseal) {\n    await resealMailboxRefreshToken(firestore, credential, opened.refreshToken, config.config.keyring, deps.now)\n  }\n  const client = createGmailClient({\n    ...deps,\n    clientId: config.config.clientId,\n    clientSecret: config.config.clientSecret,\n    refreshToken: opened.refreshToken,\n  })\n  return { ok: true, client, credential }\n}\n\n/**\n * Seals a token again under the current key, only if the stored value is\n * still the one that was opened: a reconnect that landed in between wrote a\n * newer grant, and that one wins. Best-effort — a failure leaves the old\n * seal, which still opens.\n */\nasync function resealMailboxRefreshToken(\n  firestore: FirebaseFirestore.Firestore,\n  credential: OutreachGoogleMailboxCredentials,\n  refreshToken: string,\n  keyring: Parameters<typeof sealMailboxRefreshToken>[2],\n  now: (() => number) | undefined,\n): Promise<void> {\n  const ref = mailboxCredentialsRef(firestore, credential.mailboxId)\n  try {\n    await firestore.runTransaction(async (tx) => {\n      const current = await tx.get(ref)\n      if (current.get('sealedRefreshToken') !== credential.sealedRefreshToken) return\n      tx.update(ref, {\n        ...sealMailboxRefreshToken(refreshToken, credential.mailboxId, keyring),\n        updatedAtMs: (now ?? Date.now)(),\n      })\n    })\n  } catch (error) {\n    console.error('[outreach] resealing a mailbox token failed', error)\n  }\n}\n\n/**\n * Marks a mailbox as needing a reconnect: the provider refused its grant, or\n * its stored token cannot be opened. Nothing sends from it until the member\n * connects it again, which returns it to where it was.\n */\nexport async function markOutreachMailboxReconnectRequired(\n  firestore: FirebaseFirestore.Firestore,\n  input: { orgId: string; mailboxId: string; errorCode: string; nowMs: number },\n): Promise<void> {\n  await mailboxRef(firestore, input.orgId, input.mailboxId)\n    .update({\n      status: 'reconnect_required',\n      'health.lastErrorAtMs': input.nowMs,\n      'health.lastErrorCode': input.errorCode,\n      updatedAtMs: input.nowMs,\n    })\n    .catch((error: unknown) => {\n      console.error('[outreach] marking a mailbox reconnect_required failed', error)\n    })\n}\n"],"names":["SecretBoxError","createGmailClient","mailboxCredentialsRef","mailboxRef","openMailboxRefreshToken","readMailboxCredentials","sealMailboxRefreshToken","readOutreachGoogleConfig","openOutreachMailboxClient","firestore","input","deps","config","readConfig","configured","ok","reason","snapshot","mailboxId","get","credential","exists","data","opened","keyring","error","needsReseal","resealMailboxRefreshToken","refreshToken","now","client","clientId","clientSecret","ref","runTransaction","tx","current","sealedRefreshToken","update","updatedAtMs","Date","console","markOutreachMailboxReconnectRequired","orgId","status","nowMs","errorCode","catch"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,cAAc,QAAQ,sCAAqC;AACpE,SAASC,iBAAiB,QAA0B,+BAA2B;AAE/E,SACEC,qBAAqB,EACrBC,UAAU,EACVC,uBAAuB,EACvBC,sBAAsB,EACtBC,uBAAuB,QAElB,2BAAuB;AAC9B,SACEC,wBAAwB,QAEnB,uBAAmB;AAiC1B,OAAO,eAAeC,0BACpBC,SAAsC,EACtCC,KAA4B,EAC5BC,OAAwB,CAAC,CAAC;QAEVA;IAAhB,MAAMC,SAAS,EAACD,mBAAAA,KAAKE,UAAU,YAAfF,mBAAmBJ;IACnC,IAAI,CAACK,OAAOE,UAAU,EAAE,OAAO;QAAEC,IAAI;QAAOC,QAAQ;IAAiB;IACrE,MAAMC,WAAW,MAAMf,sBAAsBO,WAAWC,MAAMQ,SAAS,EAAEC,GAAG;IAC5E,MAAMC,aAAaf,uBAAuBY,SAASI,MAAM,GAAGJ,SAASK,IAAI,KAAK;IAC9E,IAAI,CAACF,cAAcA,WAAWF,SAAS,KAAKR,MAAMQ,SAAS,EAAE;QAC3D,OAAO;YAAEH,IAAI;YAAOC,QAAQ;QAAgB;IAC9C;IACA,IAAIO;IACJ,IAAI;QACFA,SAASnB,wBAAwBgB,YAAYR,OAAOA,MAAM,CAACY,OAAO;IACpE,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBzB,gBAAgB,OAAO;YAAEe,IAAI;YAAOC,QAAQ;QAA0B;QAC3F,MAAMS;IACR;IACA,IAAIF,OAAOG,WAAW,EAAE;QACtB,MAAMC,0BAA0BlB,WAAWW,YAAYG,OAAOK,YAAY,EAAEhB,OAAOA,MAAM,CAACY,OAAO,EAAEb,KAAKkB,GAAG;IAC7G;IACA,MAAMC,SAAS7B,kBAAkB,aAC5BU;QACHoB,UAAUnB,OAAOA,MAAM,CAACmB,QAAQ;QAChCC,cAAcpB,OAAOA,MAAM,CAACoB,YAAY;QACxCJ,cAAcL,OAAOK,YAAY;;IAEnC,OAAO;QAAEb,IAAI;QAAMe;QAAQV;IAAW;AACxC;AAEA;;;;;CAKC,GACD,eAAeO,0BACblB,SAAsC,EACtCW,UAA4C,EAC5CQ,YAAoB,EACpBJ,OAAsD,EACtDK,GAA+B;IAE/B,MAAMI,MAAM/B,sBAAsBO,WAAWW,WAAWF,SAAS;IACjE,IAAI;QACF,MAAMT,UAAUyB,cAAc,CAAC,OAAOC;YACpC,MAAMC,UAAU,MAAMD,GAAGhB,GAAG,CAACc;YAC7B,IAAIG,QAAQjB,GAAG,CAAC,0BAA0BC,WAAWiB,kBAAkB,EAAE;YACzEF,GAAGG,MAAM,CAACL,KAAK,aACV3B,wBAAwBsB,cAAcR,WAAWF,SAAS,EAAEM;gBAC/De,aAAa,CAACV,cAAAA,MAAOW,KAAKX,GAAG;;QAEjC;IACF,EAAE,OAAOJ,OAAO;QACdgB,QAAQhB,KAAK,CAAC,+CAA+CA;IAC/D;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeiB,qCACpBjC,SAAsC,EACtCC,KAA6E;IAE7E,MAAMP,WAAWM,WAAWC,MAAMiC,KAAK,EAAEjC,MAAMQ,SAAS,EACrDoB,MAAM,CAAC;QACNM,QAAQ;QACR,wBAAwBlC,MAAMmC,KAAK;QACnC,wBAAwBnC,MAAMoC,SAAS;QACvCP,aAAa7B,MAAMmC,KAAK;IAC1B,GACCE,KAAK,CAAC,CAACtB;QACNgB,QAAQhB,KAAK,CAAC,0DAA0DA;IAC1E;AACJ"}

package/src/lib/mailboxes/oauth-redirect.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * WHERE GOOGLE SENDS A REP BACK TO (AGL-2978).
+ *
+ * Google redirects only to an address registered on the OAuth client, matched
+ * exactly, so the redirect cannot follow whichever host a rep happened to open
+ * the console on: it is the deployment's canonical console origin,
+ * `NEXT_PUBLIC_CONSOLE_URL`, plus the callback route. That is the one address
+ * an operator registers.
+ *
+ * Local development is the one exception, and never in production: a request
+ * from `http://localhost` or `127.0.0.1` is sent back to itself, so a developer
+ * registering their local address on a test client is not bounced to the
+ * deployed console after consenting. Anything else a request claims about its
+ * origin is ignored — the host Google redirects to is where the authorization
+ * code arrives, and a request header does not get to choose it.
+ */
+/** The callback's path on the console. */
+export declare const OUTREACH_OAUTH_CALLBACK_PATH: string;
+/** The canonical console origin, or `null` when it is unset or not http(s). */
+export declare function canonicalConsoleOrigin(): string | null;
+/**
+ * The redirect address for a connect started by `requestUrl`, or `null` when
+ * the deployment names no console origin to register.
+ */
+export declare function outreachOAuthRedirectUri(requestUrl: string): string | null;

package/src/lib/mailboxes/oauth-redirect.js

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { OUTREACH_API_ROUTES } from "../constants/api-routes.js";
+/**
+ * WHERE GOOGLE SENDS A REP BACK TO (AGL-2978).
+ *
+ * Google redirects only to an address registered on the OAuth client, matched
+ * exactly, so the redirect cannot follow whichever host a rep happened to open
+ * the console on: it is the deployment's canonical console origin,
+ * `NEXT_PUBLIC_CONSOLE_URL`, plus the callback route. That is the one address
+ * an operator registers.
+ *
+ * Local development is the one exception, and never in production: a request
+ * from `http://localhost` or `127.0.0.1` is sent back to itself, so a developer
+ * registering their local address on a test client is not bounced to the
+ * deployed console after consenting. Anything else a request claims about its
+ * origin is ignored — the host Google redirects to is where the authorization
+ * code arrives, and a request header does not get to choose it.
+ */ /** The callback's path on the console. */ export const OUTREACH_OAUTH_CALLBACK_PATH = `/api/${OUTREACH_API_ROUTES.mailboxesOAuthCallback}`;
+const stripTrailingSlash = (value)=>value.replace(/\/+$/, '');
+/** The canonical console origin, or `null` when it is unset or not http(s). */ export function canonicalConsoleOrigin() {
+    var _process_env_NEXT_PUBLIC_CONSOLE_URL;
+    const raw = stripTrailingSlash(String((_process_env_NEXT_PUBLIC_CONSOLE_URL = process.env.NEXT_PUBLIC_CONSOLE_URL) != null ? _process_env_NEXT_PUBLIC_CONSOLE_URL : '').trim());
+    if (!raw) return null;
+    try {
+        const url = new URL(raw);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : null;
+    } catch (unused) {
+        return null;
+    }
+}
+/**
+ * The redirect address for a connect started by `requestUrl`, or `null` when
+ * the deployment names no console origin to register.
+ */ export function outreachOAuthRedirectUri(requestUrl) {
+    if (process.env['NODE_ENV'] !== 'production') {
+        try {
+            const url = new URL(requestUrl);
+            if (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')) {
+                return `${url.origin}${OUTREACH_OAUTH_CALLBACK_PATH}`;
+            }
+        } catch (unused) {
+        // Not a URL: fall through to the canonical origin.
+        }
+    }
+    const origin = canonicalConsoleOrigin();
+    return origin ? `${origin}${OUTREACH_OAUTH_CALLBACK_PATH}` : null;
+}
+
+//# sourceMappingURL=oauth-redirect.js.map

package/src/lib/mailboxes/oauth-redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/oauth-redirect.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { OUTREACH_API_ROUTES } from '../constants/api-routes'\n\n/**\n * WHERE GOOGLE SENDS A REP BACK TO (AGL-2978).\n *\n * Google redirects only to an address registered on the OAuth client, matched\n * exactly, so the redirect cannot follow whichever host a rep happened to open\n * the console on: it is the deployment's canonical console origin,\n * `NEXT_PUBLIC_CONSOLE_URL`, plus the callback route. That is the one address\n * an operator registers.\n *\n * Local development is the one exception, and never in production: a request\n * from `http://localhost` or `127.0.0.1` is sent back to itself, so a developer\n * registering their local address on a test client is not bounced to the\n * deployed console after consenting. Anything else a request claims about its\n * origin is ignored — the host Google redirects to is where the authorization\n * code arrives, and a request header does not get to choose it.\n */\n\n/** The callback's path on the console. */\nexport const OUTREACH_OAUTH_CALLBACK_PATH = `/api/${OUTREACH_API_ROUTES.mailboxesOAuthCallback}`\n\nconst stripTrailingSlash = (value: string) => value.replace(/\\/+$/, '')\n\n/** The canonical console origin, or `null` when it is unset or not http(s). */\nexport function canonicalConsoleOrigin(): string | null {\n  const raw = stripTrailingSlash(String(process.env.NEXT_PUBLIC_CONSOLE_URL ?? '').trim())\n  if (!raw) return null\n  try {\n    const url = new URL(raw)\n    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * The redirect address for a connect started by `requestUrl`, or `null` when\n * the deployment names no console origin to register.\n */\nexport function outreachOAuthRedirectUri(requestUrl: string): string | null {\n  if (process.env['NODE_ENV'] !== 'production') {\n    try {\n      const url = new URL(requestUrl)\n      if (url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1')) {\n        return `${url.origin}${OUTREACH_OAUTH_CALLBACK_PATH}`\n      }\n    } catch {\n      // Not a URL: fall through to the canonical origin.\n    }\n  }\n  const origin = canonicalConsoleOrigin()\n  return origin ? `${origin}${OUTREACH_OAUTH_CALLBACK_PATH}` : null\n}\n"],"names":["OUTREACH_API_ROUTES","OUTREACH_OAUTH_CALLBACK_PATH","mailboxesOAuthCallback","stripTrailingSlash","value","replace","canonicalConsoleOrigin","process","raw","String","env","NEXT_PUBLIC_CONSOLE_URL","trim","url","URL","protocol","origin","outreachOAuthRedirectUri","requestUrl","hostname"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,mBAAmB,QAAQ,6BAAyB;AAE7D;;;;;;;;;;;;;;;CAeC,GAED,wCAAwC,GACxC,OAAO,MAAMC,+BAA+B,CAAC,KAAK,EAAED,oBAAoBE,sBAAsB,EAAE,CAAA;AAEhG,MAAMC,qBAAqB,CAACC,QAAkBA,MAAMC,OAAO,CAAC,QAAQ;AAEpE,6EAA6E,GAC7E,OAAO,SAASC;QACwBC;IAAtC,MAAMC,MAAML,mBAAmBM,QAAOF,uCAAAA,QAAQG,GAAG,CAACC,uBAAuB,YAAnCJ,uCAAuC,IAAIK,IAAI;IACrF,IAAI,CAACJ,KAAK,OAAO;IACjB,IAAI;QACF,MAAMK,MAAM,IAAIC,IAAIN;QACpB,OAAOK,IAAIE,QAAQ,KAAK,YAAYF,IAAIE,QAAQ,KAAK,UAAUF,IAAIG,MAAM,GAAG;IAC9E,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,OAAO,SAASC,yBAAyBC,UAAkB;IACzD,IAAIX,QAAQG,GAAG,CAAC,WAAW,KAAK,cAAc;QAC5C,IAAI;YACF,MAAMG,MAAM,IAAIC,IAAII;YACpB,IAAIL,IAAIE,QAAQ,KAAK,WAAYF,CAAAA,IAAIM,QAAQ,KAAK,eAAeN,IAAIM,QAAQ,KAAK,WAAU,GAAI;gBAC9F,OAAO,GAAGN,IAAIG,MAAM,GAAGf,8BAA8B;YACvD;QACF,EAAE,eAAM;QACN,mDAAmD;QACrD;IACF;IACA,MAAMe,SAASV;IACf,OAAOU,SAAS,GAAGA,SAASf,8BAA8B,GAAG;AAC/D"}

package/src/lib/mailboxes/oauth-state.d.ts

@@ -0,0 +1,152 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE OAUTH `state` FOR A MAILBOX CONNECT (AGL-2978): signed, short-lived,
+ * single-use, and bound to one member of one organization.
+ *
+ * ## Signed
+ *
+ * `os1.<payload>.<signature>`, the payload `{ o: orgId, u: uid, n: nonce,
+ * e: expiry }` and the signature an HMAC under the shared, fail-closed
+ * `TOKEN_SIGNING_SECRET` with its own `outreach-oauth-state:` context — the
+ * construction every other signed token here uses, and domain-separated from
+ * all of them. Google hands the state back verbatim, so a state that verifies
+ * names the org and the member it was minted for. The console dispatcher
+ * reads exactly that to ask its release gate about the right organization on
+ * a redirect that carries no bearer token.
+ *
+ * ## Single-use
+ *
+ * A signature proves who minted a state, not that it is fresh. Each connect
+ * also writes ONE pending record per member per organization, at
+ * `orgs/{orgId}/outreachOAuthStates/{sha256(orgId, uid)}`, holding the
+ * SHA-256 of the state's nonce, its expiry and the redirect address the code
+ * was issued for. Finishing a connect consumes that record in a transaction
+ * (`consumeOnce`), so a second use of the same state finds nothing, and
+ * starting another connect replaces the record, retiring every earlier state.
+ *
+ * ## Under the organization
+ *
+ * The record is the organization's, so it lives in the organization's tree:
+ * the workspace erasure's recursive delete and the workspace export's walk
+ * reach it with no sweep of their own, and nothing outside this plugin names
+ * the collection. No Firestore rule names it either, and the org block has no
+ * catch-all, so every client is refused it — a client that could write one
+ * could re-arm a consumed state, and one that could read one would learn
+ * which members have a connect open.
+ *
+ * ## Derived, not stored
+ *
+ * The PKCE verifier and the OpenID `nonce` are HMACs of the state's nonce
+ * under the same secret, each with its own context. Nothing secret is stored
+ * for them, and only this server can recompute either — a state copied off a
+ * redirect is not enough to redeem its code.
+ */
+export declare const OUTREACH_OAUTH_STATES_COLLECTION = "outreachOAuthStates";
+/** How long a rep has to finish Google's consent screen. */
+export declare const OUTREACH_OAUTH_STATE_TTL_MS: number;
+export interface OutreachOAuthStateClaims {
+    orgId: string;
+    uid: string;
+    nonce: string;
+    /** Expiry, epoch ms. */
+    exp: number;
+}
+/**
+ * Mints a state for a member's connect. Throws when `TOKEN_SIGNING_SECRET` is
+ * not configured; the route answers that as a deployment that cannot connect.
+ */
+export declare function mintOutreachOAuthState(input: {
+    orgId: string;
+    uid: string;
+    nowMs: number;
+    /** Test seam; a random 32 bytes otherwise. */
+    nonce?: string;
+}): {
+    state: string;
+    claims: OutreachOAuthStateClaims;
+};
+export type OutreachOAuthStateRead = {
+    ok: true;
+    claims: OutreachOAuthStateClaims;
+}
+/** Authentic and past its expiry — the claims can still say whose it was. */
+ | {
+    ok: false;
+    refusal: 'state-expired';
+    claims: OutreachOAuthStateClaims;
+}
+/** Tampered, truncated, another version, or no secret to check it with. */
+ | {
+    ok: false;
+    refusal: 'state-invalid';
+};
+/** Verifies a state's signature and expiry. Never throws. */
+export declare function readOutreachOAuthState(state: unknown, nowMs: number): OutreachOAuthStateRead;
+/** The PKCE `code_verifier` for a state's nonce: 43 base64url characters. */
+export declare function outreachPkceVerifier(nonce: string): string;
+/** The OpenID `nonce` Google must echo in the ID token for this connect. */
+export declare function outreachOidcNonce(nonce: string): string;
+/** The pending record's id: one per member per organization. */
+export declare function outreachOAuthStateDocId(orgId: string, uid: string): string;
+/** `orgs/{orgId}/outreachOAuthStates/{id}` for a member's pending connect. */
+export declare function outreachOAuthStateRef(firestore: FirebaseFirestore.Firestore, orgId: string, uid: string): FirebaseFirestore.DocumentReference;
+/** `orgs/{orgId}/outreachOAuthStates/{id}` — see the module comment. */
+export interface OutreachOAuthStateRecord {
+    orgId: string;
+    uid: string;
+    /** SHA-256 of the state's nonce; the nonce itself is never stored. */
+    nonceDigest: string;
+    /** The redirect address the authorization code was issued for. */
+    redirectUri: string;
+    expiresAtMs: number;
+    createdAtMs: number;
+}
+/**
+ * Writes the pending record for a freshly minted state, replacing any earlier
+ * one for the same member and organization.
+ */
+export declare function recordOutreachOAuthState(firestore: FirebaseFirestore.Firestore, input: {
+    claims: OutreachOAuthStateClaims;
+    redirectUri: string;
+    nowMs: number;
+}): Promise<void>;
+export type OutreachOAuthStateConsumed = {
+    ok: true;
+    redirectUri: string;
+}
+/** No pending record: this state was already used, or never recorded. */
+ | {
+    ok: false;
+    refusal: 'state-replayed';
+}
+/** A later connect by the same member replaced this state. */
+ | {
+    ok: false;
+    refusal: 'state-superseded';
+} | {
+    ok: false;
+    refusal: 'state-expired';
+};
+/**
+ * Consumes the pending record a verified state names — once. A superseded
+ * state leaves the newer record standing for the connect that owns it.
+ */
+export declare function consumeOutreachOAuthState(firestore: FirebaseFirestore.Firestore, input: {
+    claims: OutreachOAuthStateClaims;
+    nowMs: number;
+}): Promise<OutreachOAuthStateConsumed>;

package/src/lib/mailboxes/oauth-state.js

@@ -0,0 +1,212 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { consumeOnce } from "@aglyn/tenant-data-admin/server/consume-once";
+import { tokenSigningSecret } from "@aglyn/tenant-data-admin/server/media-signing";
+import { safeEqual } from "@aglyn/tenant-data-admin/server/safe-equal";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+/**
+ * THE OAUTH `state` FOR A MAILBOX CONNECT (AGL-2978): signed, short-lived,
+ * single-use, and bound to one member of one organization.
+ *
+ * ## Signed
+ *
+ * `os1.<payload>.<signature>`, the payload `{ o: orgId, u: uid, n: nonce,
+ * e: expiry }` and the signature an HMAC under the shared, fail-closed
+ * `TOKEN_SIGNING_SECRET` with its own `outreach-oauth-state:` context — the
+ * construction every other signed token here uses, and domain-separated from
+ * all of them. Google hands the state back verbatim, so a state that verifies
+ * names the org and the member it was minted for. The console dispatcher
+ * reads exactly that to ask its release gate about the right organization on
+ * a redirect that carries no bearer token.
+ *
+ * ## Single-use
+ *
+ * A signature proves who minted a state, not that it is fresh. Each connect
+ * also writes ONE pending record per member per organization, at
+ * `orgs/{orgId}/outreachOAuthStates/{sha256(orgId, uid)}`, holding the
+ * SHA-256 of the state's nonce, its expiry and the redirect address the code
+ * was issued for. Finishing a connect consumes that record in a transaction
+ * (`consumeOnce`), so a second use of the same state finds nothing, and
+ * starting another connect replaces the record, retiring every earlier state.
+ *
+ * ## Under the organization
+ *
+ * The record is the organization's, so it lives in the organization's tree:
+ * the workspace erasure's recursive delete and the workspace export's walk
+ * reach it with no sweep of their own, and nothing outside this plugin names
+ * the collection. No Firestore rule names it either, and the org block has no
+ * catch-all, so every client is refused it — a client that could write one
+ * could re-arm a consumed state, and one that could read one would learn
+ * which members have a connect open.
+ *
+ * ## Derived, not stored
+ *
+ * The PKCE verifier and the OpenID `nonce` are HMACs of the state's nonce
+ * under the same secret, each with its own context. Nothing secret is stored
+ * for them, and only this server can recompute either — a state copied off a
+ * redirect is not enough to redeem its code.
+ */ export const OUTREACH_OAUTH_STATES_COLLECTION = 'outreachOAuthStates';
+/** How long a rep has to finish Google's consent screen. */ export const OUTREACH_OAUTH_STATE_TTL_MS = 10 * 60 * 1000;
+const STATE_VERSION = 'os1';
+const STATE_CONTEXT = 'outreach-oauth-state:v1';
+const PKCE_CONTEXT = 'outreach-oauth-pkce:v1';
+const OIDC_NONCE_CONTEXT = 'outreach-oauth-oidc-nonce:v1';
+const STATE_MAX_CHARS = 1024;
+const hmac = (context, value)=>createHmac('sha256', tokenSigningSecret()).update(`${context}:${value}`).digest('base64url');
+/**
+ * Mints a state for a member's connect. Throws when `TOKEN_SIGNING_SECRET` is
+ * not configured; the route answers that as a deployment that cannot connect.
+ */ export function mintOutreachOAuthState(input) {
+    var _input_nonce;
+    const claims = {
+        orgId: input.orgId,
+        uid: input.uid,
+        nonce: (_input_nonce = input.nonce) != null ? _input_nonce : randomBytes(32).toString('base64url'),
+        exp: input.nowMs + OUTREACH_OAUTH_STATE_TTL_MS
+    };
+    const wire = {
+        o: claims.orgId,
+        u: claims.uid,
+        n: claims.nonce,
+        e: claims.exp
+    };
+    const payload = Buffer.from(JSON.stringify(wire), 'utf8').toString('base64url');
+    return {
+        state: `${STATE_VERSION}.${payload}.${hmac(STATE_CONTEXT, payload)}`,
+        claims
+    };
+}
+/** Verifies a state's signature and expiry. Never throws. */ export function readOutreachOAuthState(state, nowMs) {
+    const invalid = {
+        ok: false,
+        refusal: 'state-invalid'
+    };
+    if (typeof state !== 'string' || !state || state.length > STATE_MAX_CHARS) return invalid;
+    const parts = state.split('.');
+    if (parts.length !== 3 || parts[0] !== STATE_VERSION) return invalid;
+    const [, payload, signature] = parts;
+    let expected;
+    try {
+        expected = hmac(STATE_CONTEXT, payload);
+    } catch (unused) {
+        return invalid;
+    }
+    if (!safeEqual(signature, expected)) return invalid;
+    let wire;
+    try {
+        wire = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    } catch (unused) {
+        return invalid;
+    }
+    const claims = {
+        orgId: typeof (wire == null ? void 0 : wire.o) === 'string' ? wire.o : '',
+        uid: typeof (wire == null ? void 0 : wire.u) === 'string' ? wire.u : '',
+        nonce: typeof (wire == null ? void 0 : wire.n) === 'string' ? wire.n : '',
+        exp: Number(wire == null ? void 0 : wire.e)
+    };
+    if (!claims.orgId || !claims.uid || !claims.nonce || !Number.isFinite(claims.exp)) return invalid;
+    if (claims.exp <= nowMs) return {
+        ok: false,
+        refusal: 'state-expired',
+        claims
+    };
+    return {
+        ok: true,
+        claims
+    };
+}
+/** The PKCE `code_verifier` for a state's nonce: 43 base64url characters. */ export function outreachPkceVerifier(nonce) {
+    return hmac(PKCE_CONTEXT, nonce);
+}
+/** The OpenID `nonce` Google must echo in the ID token for this connect. */ export function outreachOidcNonce(nonce) {
+    return hmac(OIDC_NONCE_CONTEXT, nonce);
+}
+/** The pending record's id: one per member per organization. */ export function outreachOAuthStateDocId(orgId, uid) {
+    return createHash('sha256').update(`${orgId}\n${uid}`).digest('hex');
+}
+/** `orgs/{orgId}/outreachOAuthStates/{id}` for a member's pending connect. */ export function outreachOAuthStateRef(firestore, orgId, uid) {
+    return firestore.collection('orgs').doc(orgId).collection(OUTREACH_OAUTH_STATES_COLLECTION).doc(outreachOAuthStateDocId(orgId, uid));
+}
+const digest = (nonce)=>createHash('sha256').update(nonce).digest('base64url');
+/**
+ * Writes the pending record for a freshly minted state, replacing any earlier
+ * one for the same member and organization.
+ */ export async function recordOutreachOAuthState(firestore, input) {
+    const { claims } = input;
+    const record = {
+        orgId: claims.orgId,
+        uid: claims.uid,
+        nonceDigest: digest(claims.nonce),
+        redirectUri: input.redirectUri,
+        expiresAtMs: claims.exp,
+        createdAtMs: input.nowMs
+    };
+    await outreachOAuthStateRef(firestore, claims.orgId, claims.uid).set(record);
+}
+/**
+ * Consumes the pending record a verified state names — once. A superseded
+ * state leaves the newer record standing for the connect that owns it.
+ */ export async function consumeOutreachOAuthState(firestore, input) {
+    const { claims } = input;
+    const ref = outreachOAuthStateRef(firestore, claims.orgId, claims.uid);
+    const result = await consumeOnce(firestore, ref, (data)=>{
+        var _data_nonceDigest, _data_redirectUri;
+        if (data['orgId'] !== claims.orgId || data['uid'] !== claims.uid) {
+            return {
+                accept: false,
+                reason: 'state-superseded'
+            };
+        }
+        if (!safeEqual(String((_data_nonceDigest = data['nonceDigest']) != null ? _data_nonceDigest : ''), digest(claims.nonce))) {
+            return {
+                accept: false,
+                reason: 'state-superseded'
+            };
+        }
+        if (Number(data['expiresAtMs']) <= input.nowMs) {
+            // Nobody can accept an expired record, so removing it destroys nothing
+            // a concurrent consume could have used.
+            return {
+                accept: false,
+                reason: 'state-expired',
+                remove: true
+            };
+        }
+        return {
+            accept: true,
+            value: String((_data_redirectUri = data['redirectUri']) != null ? _data_redirectUri : ''),
+            remove: true
+        };
+    });
+    if (result.ok && result.value) return {
+        ok: true,
+        redirectUri: result.value
+    };
+    if (result.reason === 'state-superseded') return {
+        ok: false,
+        refusal: 'state-superseded'
+    };
+    if (result.reason === 'state-expired') return {
+        ok: false,
+        refusal: 'state-expired'
+    };
+    return {
+        ok: false,
+        refusal: 'state-replayed'
+    };
+}
+
+//# sourceMappingURL=oauth-state.js.map

package/src/lib/mailboxes/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/outreach/src/lib/mailboxes/oauth-state.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { consumeOnce } from '@aglyn/tenant-data-admin/server/consume-once'\nimport { tokenSigningSecret } from '@aglyn/tenant-data-admin/server/media-signing'\nimport { safeEqual } from '@aglyn/tenant-data-admin/server/safe-equal'\nimport { createHash, createHmac, randomBytes } from 'node:crypto'\n\n/**\n * THE OAUTH `state` FOR A MAILBOX CONNECT (AGL-2978): signed, short-lived,\n * single-use, and bound to one member of one organization.\n *\n * ## Signed\n *\n * `os1.<payload>.<signature>`, the payload `{ o: orgId, u: uid, n: nonce,\n * e: expiry }` and the signature an HMAC under the shared, fail-closed\n * `TOKEN_SIGNING_SECRET` with its own `outreach-oauth-state:` context — the\n * construction every other signed token here uses, and domain-separated from\n * all of them. Google hands the state back verbatim, so a state that verifies\n * names the org and the member it was minted for. The console dispatcher\n * reads exactly that to ask its release gate about the right organization on\n * a redirect that carries no bearer token.\n *\n * ## Single-use\n *\n * A signature proves who minted a state, not that it is fresh. Each connect\n * also writes ONE pending record per member per organization, at\n * `orgs/{orgId}/outreachOAuthStates/{sha256(orgId, uid)}`, holding the\n * SHA-256 of the state's nonce, its expiry and the redirect address the code\n * was issued for. Finishing a connect consumes that record in a transaction\n * (`consumeOnce`), so a second use of the same state finds nothing, and\n * starting another connect replaces the record, retiring every earlier state.\n *\n * ## Under the organization\n *\n * The record is the organization's, so it lives in the organization's tree:\n * the workspace erasure's recursive delete and the workspace export's walk\n * reach it with no sweep of their own, and nothing outside this plugin names\n * the collection. No Firestore rule names it either, and the org block has no\n * catch-all, so every client is refused it — a client that could write one\n * could re-arm a consumed state, and one that could read one would learn\n * which members have a connect open.\n *\n * ## Derived, not stored\n *\n * The PKCE verifier and the OpenID `nonce` are HMACs of the state's nonce\n * under the same secret, each with its own context. Nothing secret is stored\n * for them, and only this server can recompute either — a state copied off a\n * redirect is not enough to redeem its code.\n */\n\nexport const OUTREACH_OAUTH_STATES_COLLECTION = 'outreachOAuthStates'\n\n/** How long a rep has to finish Google's consent screen. */\nexport const OUTREACH_OAUTH_STATE_TTL_MS = 10 * 60 * 1000\n\nconst STATE_VERSION = 'os1'\nconst STATE_CONTEXT = 'outreach-oauth-state:v1'\nconst PKCE_CONTEXT = 'outreach-oauth-pkce:v1'\nconst OIDC_NONCE_CONTEXT = 'outreach-oauth-oidc-nonce:v1'\nconst STATE_MAX_CHARS = 1024\n\nexport interface OutreachOAuthStateClaims {\n  orgId: string\n  uid: string\n  nonce: string\n  /** Expiry, epoch ms. */\n  exp: number\n}\n\ninterface WireClaims {\n  o: string\n  u: string\n  n: string\n  e: number\n}\n\nconst hmac = (context: string, value: string): string =>\n  createHmac('sha256', tokenSigningSecret()).update(`${context}:${value}`).digest('base64url')\n\n/**\n * Mints a state for a member's connect. Throws when `TOKEN_SIGNING_SECRET` is\n * not configured; the route answers that as a deployment that cannot connect.\n */\nexport function mintOutreachOAuthState(input: {\n  orgId: string\n  uid: string\n  nowMs: number\n  /** Test seam; a random 32 bytes otherwise. */\n  nonce?: string\n}): { state: string; claims: OutreachOAuthStateClaims } {\n  const claims: OutreachOAuthStateClaims = {\n    orgId: input.orgId,\n    uid: input.uid,\n    nonce: input.nonce ?? randomBytes(32).toString('base64url'),\n    exp: input.nowMs + OUTREACH_OAUTH_STATE_TTL_MS,\n  }\n  const wire: WireClaims = { o: claims.orgId, u: claims.uid, n: claims.nonce, e: claims.exp }\n  const payload = Buffer.from(JSON.stringify(wire), 'utf8').toString('base64url')\n  return { state: `${STATE_VERSION}.${payload}.${hmac(STATE_CONTEXT, payload)}`, claims }\n}\n\nexport type OutreachOAuthStateRead =\n  | { ok: true; claims: OutreachOAuthStateClaims }\n  /** Authentic and past its expiry — the claims can still say whose it was. */\n  | { ok: false; refusal: 'state-expired'; claims: OutreachOAuthStateClaims }\n  /** Tampered, truncated, another version, or no secret to check it with. */\n  | { ok: false; refusal: 'state-invalid' }\n\n/** Verifies a state's signature and expiry. Never throws. */\nexport function readOutreachOAuthState(state: unknown, nowMs: number): OutreachOAuthStateRead {\n  const invalid = { ok: false, refusal: 'state-invalid' } as const\n  if (typeof state !== 'string' || !state || state.length > STATE_MAX_CHARS) return invalid\n  const parts = state.split('.')\n  if (parts.length !== 3 || parts[0] !== STATE_VERSION) return invalid\n  const [, payload, signature] = parts\n  let expected: string\n  try {\n    expected = hmac(STATE_CONTEXT, payload)\n  } catch {\n    return invalid\n  }\n  if (!safeEqual(signature, expected)) return invalid\n  let wire: Partial<WireClaims>\n  try {\n    wire = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Partial<WireClaims>\n  } catch {\n    return invalid\n  }\n  const claims: OutreachOAuthStateClaims = {\n    orgId: typeof wire?.o === 'string' ? wire.o : '',\n    uid: typeof wire?.u === 'string' ? wire.u : '',\n    nonce: typeof wire?.n === 'string' ? wire.n : '',\n    exp: Number(wire?.e),\n  }\n  if (!claims.orgId || !claims.uid || !claims.nonce || !Number.isFinite(claims.exp)) return invalid\n  if (claims.exp <= nowMs) return { ok: false, refusal: 'state-expired', claims }\n  return { ok: true, claims }\n}\n\n/** The PKCE `code_verifier` for a state's nonce: 43 base64url characters. */\nexport function outreachPkceVerifier(nonce: string): string {\n  return hmac(PKCE_CONTEXT, nonce)\n}\n\n/** The OpenID `nonce` Google must echo in the ID token for this connect. */\nexport function outreachOidcNonce(nonce: string): string {\n  return hmac(OIDC_NONCE_CONTEXT, nonce)\n}\n\n/** The pending record's id: one per member per organization. */\nexport function outreachOAuthStateDocId(orgId: string, uid: string): string {\n  return createHash('sha256').update(`${orgId}\\n${uid}`).digest('hex')\n}\n\n/** `orgs/{orgId}/outreachOAuthStates/{id}` for a member's pending connect. */\nexport function outreachOAuthStateRef(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  uid: string,\n): FirebaseFirestore.DocumentReference {\n  return firestore\n    .collection('orgs')\n    .doc(orgId)\n    .collection(OUTREACH_OAUTH_STATES_COLLECTION)\n    .doc(outreachOAuthStateDocId(orgId, uid))\n}\n\nconst digest = (nonce: string) => createHash('sha256').update(nonce).digest('base64url')\n\n/** `orgs/{orgId}/outreachOAuthStates/{id}` — see the module comment. */\nexport interface OutreachOAuthStateRecord {\n  orgId: string\n  uid: string\n  /** SHA-256 of the state's nonce; the nonce itself is never stored. */\n  nonceDigest: string\n  /** The redirect address the authorization code was issued for. */\n  redirectUri: string\n  expiresAtMs: number\n  createdAtMs: number\n}\n\n/**\n * Writes the pending record for a freshly minted state, replacing any earlier\n * one for the same member and organization.\n */\nexport async function recordOutreachOAuthState(\n  firestore: FirebaseFirestore.Firestore,\n  input: { claims: OutreachOAuthStateClaims; redirectUri: string; nowMs: number },\n): Promise<void> {\n  const { claims } = input\n  const record: OutreachOAuthStateRecord = {\n    orgId: claims.orgId,\n    uid: claims.uid,\n    nonceDigest: digest(claims.nonce),\n    redirectUri: input.redirectUri,\n    expiresAtMs: claims.exp,\n    createdAtMs: input.nowMs,\n  }\n  await outreachOAuthStateRef(firestore, claims.orgId, claims.uid).set(record)\n}\n\nexport type OutreachOAuthStateConsumed =\n  | { ok: true; redirectUri: string }\n  /** No pending record: this state was already used, or never recorded. */\n  | { ok: false; refusal: 'state-replayed' }\n  /** A later connect by the same member replaced this state. */\n  | { ok: false; refusal: 'state-superseded' }\n  | { ok: false; refusal: 'state-expired' }\n\n/**\n * Consumes the pending record a verified state names — once. A superseded\n * state leaves the newer record standing for the connect that owns it.\n */\nexport async function consumeOutreachOAuthState(\n  firestore: FirebaseFirestore.Firestore,\n  input: { claims: OutreachOAuthStateClaims; nowMs: number },\n): Promise<OutreachOAuthStateConsumed> {\n  const { claims } = input\n  const ref = outreachOAuthStateRef(firestore, claims.orgId, claims.uid)\n  const result = await consumeOnce<string>(firestore, ref, (data) => {\n    if (data['orgId'] !== claims.orgId || data['uid'] !== claims.uid) {\n      return { accept: false, reason: 'state-superseded' }\n    }\n    if (!safeEqual(String(data['nonceDigest'] ?? ''), digest(claims.nonce))) {\n      return { accept: false, reason: 'state-superseded' }\n    }\n    if (Number(data['expiresAtMs']) <= input.nowMs) {\n      // Nobody can accept an expired record, so removing it destroys nothing\n      // a concurrent consume could have used.\n      return { accept: false, reason: 'state-expired', remove: true }\n    }\n    return { accept: true, value: String(data['redirectUri'] ?? ''), remove: true }\n  })\n  if (result.ok && result.value) return { ok: true, redirectUri: result.value }\n  if (result.reason === 'state-superseded') return { ok: false, refusal: 'state-superseded' }\n  if (result.reason === 'state-expired') return { ok: false, refusal: 'state-expired' }\n  return { ok: false, refusal: 'state-replayed' }\n}\n"],"names":["consumeOnce","tokenSigningSecret","safeEqual","createHash","createHmac","randomBytes","OUTREACH_OAUTH_STATES_COLLECTION","OUTREACH_OAUTH_STATE_TTL_MS","STATE_VERSION","STATE_CONTEXT","PKCE_CONTEXT","OIDC_NONCE_CONTEXT","STATE_MAX_CHARS","hmac","context","value","update","digest","mintOutreachOAuthState","input","claims","orgId","uid","nonce","toString","exp","nowMs","wire","o","u","n","e","payload","Buffer","from","JSON","stringify","state","readOutreachOAuthState","invalid","ok","refusal","length","parts","split","signature","expected","parse","Number","isFinite","outreachPkceVerifier","outreachOidcNonce","outreachOAuthStateDocId","outreachOAuthStateRef","firestore","collection","doc","recordOutreachOAuthState","record","nonceDigest","redirectUri","expiresAtMs","createdAtMs","set","consumeOutreachOAuthState","ref","result","data","accept","reason","String","remove"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,WAAW,QAAQ,+CAA8C;AAC1E,SAASC,kBAAkB,QAAQ,gDAA+C;AAClF,SAASC,SAAS,QAAQ,6CAA4C;AACtE,SAASC,UAAU,EAAEC,UAAU,EAAEC,WAAW,QAAQ,cAAa;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCC,GAED,OAAO,MAAMC,mCAAmC,sBAAqB;AAErE,0DAA0D,GAC1D,OAAO,MAAMC,8BAA8B,KAAK,KAAK,KAAI;AAEzD,MAAMC,gBAAgB;AACtB,MAAMC,gBAAgB;AACtB,MAAMC,eAAe;AACrB,MAAMC,qBAAqB;AAC3B,MAAMC,kBAAkB;AAiBxB,MAAMC,OAAO,CAACC,SAAiBC,QAC7BX,WAAW,UAAUH,sBAAsBe,MAAM,CAAC,GAAGF,QAAQ,CAAC,EAAEC,OAAO,EAAEE,MAAM,CAAC;AAElF;;;CAGC,GACD,OAAO,SAASC,uBAAuBC,KAMtC;QAIUA;IAHT,MAAMC,SAAmC;QACvCC,OAAOF,MAAME,KAAK;QAClBC,KAAKH,MAAMG,GAAG;QACdC,KAAK,GAAEJ,eAAAA,MAAMI,KAAK,YAAXJ,eAAed,YAAY,IAAImB,QAAQ,CAAC;QAC/CC,KAAKN,MAAMO,KAAK,GAAGnB;IACrB;IACA,MAAMoB,OAAmB;QAAEC,GAAGR,OAAOC,KAAK;QAAEQ,GAAGT,OAAOE,GAAG;QAAEQ,GAAGV,OAAOG,KAAK;QAAEQ,GAAGX,OAAOK,GAAG;IAAC;IAC1F,MAAMO,UAAUC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACT,OAAO,QAAQH,QAAQ,CAAC;IACnE,OAAO;QAAEa,OAAO,GAAG7B,cAAc,CAAC,EAAEwB,QAAQ,CAAC,EAAEnB,KAAKJ,eAAeuB,UAAU;QAAEZ;IAAO;AACxF;AASA,2DAA2D,GAC3D,OAAO,SAASkB,uBAAuBD,KAAc,EAAEX,KAAa;IAClE,MAAMa,UAAU;QAAEC,IAAI;QAAOC,SAAS;IAAgB;IACtD,IAAI,OAAOJ,UAAU,YAAY,CAACA,SAASA,MAAMK,MAAM,GAAG9B,iBAAiB,OAAO2B;IAClF,MAAMI,QAAQN,MAAMO,KAAK,CAAC;IAC1B,IAAID,MAAMD,MAAM,KAAK,KAAKC,KAAK,CAAC,EAAE,KAAKnC,eAAe,OAAO+B;IAC7D,MAAM,GAAGP,SAASa,UAAU,GAAGF;IAC/B,IAAIG;IACJ,IAAI;QACFA,WAAWjC,KAAKJ,eAAeuB;IACjC,EAAE,eAAM;QACN,OAAOO;IACT;IACA,IAAI,CAACrC,UAAU2C,WAAWC,WAAW,OAAOP;IAC5C,IAAIZ;IACJ,IAAI;QACFA,OAAOQ,KAAKY,KAAK,CAACd,OAAOC,IAAI,CAACF,SAAS,aAAaR,QAAQ,CAAC;IAC/D,EAAE,eAAM;QACN,OAAOe;IACT;IACA,MAAMnB,SAAmC;QACvCC,OAAO,QAAOM,wBAAAA,KAAMC,CAAC,MAAK,WAAWD,KAAKC,CAAC,GAAG;QAC9CN,KAAK,QAAOK,wBAAAA,KAAME,CAAC,MAAK,WAAWF,KAAKE,CAAC,GAAG;QAC5CN,OAAO,QAAOI,wBAAAA,KAAMG,CAAC,MAAK,WAAWH,KAAKG,CAAC,GAAG;QAC9CL,KAAKuB,OAAOrB,wBAAAA,KAAMI,CAAC;IACrB;IACA,IAAI,CAACX,OAAOC,KAAK,IAAI,CAACD,OAAOE,GAAG,IAAI,CAACF,OAAOG,KAAK,IAAI,CAACyB,OAAOC,QAAQ,CAAC7B,OAAOK,GAAG,GAAG,OAAOc;IAC1F,IAAInB,OAAOK,GAAG,IAAIC,OAAO,OAAO;QAAEc,IAAI;QAAOC,SAAS;QAAiBrB;IAAO;IAC9E,OAAO;QAAEoB,IAAI;QAAMpB;IAAO;AAC5B;AAEA,2EAA2E,GAC3E,OAAO,SAAS8B,qBAAqB3B,KAAa;IAChD,OAAOV,KAAKH,cAAca;AAC5B;AAEA,0EAA0E,GAC1E,OAAO,SAAS4B,kBAAkB5B,KAAa;IAC7C,OAAOV,KAAKF,oBAAoBY;AAClC;AAEA,8DAA8D,GAC9D,OAAO,SAAS6B,wBAAwB/B,KAAa,EAAEC,GAAW;IAChE,OAAOnB,WAAW,UAAUa,MAAM,CAAC,GAAGK,MAAM,EAAE,EAAEC,KAAK,EAAEL,MAAM,CAAC;AAChE;AAEA,4EAA4E,GAC5E,OAAO,SAASoC,sBACdC,SAAsC,EACtCjC,KAAa,EACbC,GAAW;IAEX,OAAOgC,UACJC,UAAU,CAAC,QACXC,GAAG,CAACnC,OACJkC,UAAU,CAACjD,kCACXkD,GAAG,CAACJ,wBAAwB/B,OAAOC;AACxC;AAEA,MAAML,SAAS,CAACM,QAAkBpB,WAAW,UAAUa,MAAM,CAACO,OAAON,MAAM,CAAC;AAc5E;;;CAGC,GACD,OAAO,eAAewC,yBACpBH,SAAsC,EACtCnC,KAA+E;IAE/E,MAAM,EAAEC,MAAM,EAAE,GAAGD;IACnB,MAAMuC,SAAmC;QACvCrC,OAAOD,OAAOC,KAAK;QACnBC,KAAKF,OAAOE,GAAG;QACfqC,aAAa1C,OAAOG,OAAOG,KAAK;QAChCqC,aAAazC,MAAMyC,WAAW;QAC9BC,aAAazC,OAAOK,GAAG;QACvBqC,aAAa3C,MAAMO,KAAK;IAC1B;IACA,MAAM2B,sBAAsBC,WAAWlC,OAAOC,KAAK,EAAED,OAAOE,GAAG,EAAEyC,GAAG,CAACL;AACvE;AAUA;;;CAGC,GACD,OAAO,eAAeM,0BACpBV,SAAsC,EACtCnC,KAA0D;IAE1D,MAAM,EAAEC,MAAM,EAAE,GAAGD;IACnB,MAAM8C,MAAMZ,sBAAsBC,WAAWlC,OAAOC,KAAK,EAAED,OAAOE,GAAG;IACrE,MAAM4C,SAAS,MAAMlE,YAAoBsD,WAAWW,KAAK,CAACE;YAIlCA,mBAQeA;QAXrC,IAAIA,IAAI,CAAC,QAAQ,KAAK/C,OAAOC,KAAK,IAAI8C,IAAI,CAAC,MAAM,KAAK/C,OAAOE,GAAG,EAAE;YAChE,OAAO;gBAAE8C,QAAQ;gBAAOC,QAAQ;YAAmB;QACrD;QACA,IAAI,CAACnE,UAAUoE,QAAOH,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB,KAAKlD,OAAOG,OAAOG,KAAK,IAAI;YACvE,OAAO;gBAAE6C,QAAQ;gBAAOC,QAAQ;YAAmB;QACrD;QACA,IAAIrB,OAAOmB,IAAI,CAAC,cAAc,KAAKhD,MAAMO,KAAK,EAAE;YAC9C,uEAAuE;YACvE,wCAAwC;YACxC,OAAO;gBAAE0C,QAAQ;gBAAOC,QAAQ;gBAAiBE,QAAQ;YAAK;QAChE;QACA,OAAO;YAAEH,QAAQ;YAAMrD,OAAOuD,QAAOH,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB;YAAKI,QAAQ;QAAK;IAChF;IACA,IAAIL,OAAO1B,EAAE,IAAI0B,OAAOnD,KAAK,EAAE,OAAO;QAAEyB,IAAI;QAAMoB,aAAaM,OAAOnD,KAAK;IAAC;IAC5E,IAAImD,OAAOG,MAAM,KAAK,oBAAoB,OAAO;QAAE7B,IAAI;QAAOC,SAAS;IAAmB;IAC1F,IAAIyB,OAAOG,MAAM,KAAK,iBAAiB,OAAO;QAAE7B,IAAI;QAAOC,SAAS;IAAgB;IACpF,OAAO;QAAED,IAAI;QAAOC,SAAS;IAAiB;AAChD"}