@alagoni97/cli 0.72.1

package/dist/codegen/generators/typescript/channels/protocols/http/index.d.ts

@@ -0,0 +1,8 @@
+import { TypeScriptChannelRenderedFunctionType, TypeScriptChannelsGeneratorContext } from '../../types';
+import { ChannelInterface } from '@asyncapi/parser';
+import { renderHttpCommonTypes } from './common-types';
+import { renderHttpFetchClient } from './client';
+export { renderHttpCommonTypes, renderHttpFetchClient };
+export { analyzeSecuritySchemes, escapeStringForCodeGen, getApiKeyDefaults, renderOAuth2Helpers, renderOAuth2Stubs, renderSecurityTypes, type AuthTypeRequirements } from './security';
+export type { SecuritySchemeOptions } from '../../types';
+export declare function generatehttpChannels(context: TypeScriptChannelsGeneratorContext, channel: ChannelInterface, protocolCodeFunctions: Record<string, string[]>, externalProtocolFunctionInformation: Record<string, TypeScriptChannelRenderedFunctionType[]>, dependencies: string[]): Promise<void>;

package/dist/codegen/generators/typescript/channels/protocols/http/index.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatehttpChannels = exports.renderSecurityTypes = exports.renderOAuth2Stubs = exports.renderOAuth2Helpers = exports.getApiKeyDefaults = exports.escapeStringForCodeGen = exports.analyzeSecuritySchemes = exports.renderHttpFetchClient = exports.renderHttpCommonTypes = void 0;
+/* eslint-disable security/detect-object-injection */
+const types_1 = require("../../types");
+const utils_1 = require("../../../../../utils");
+const utils_2 = require("../../utils");
+const asyncapi_1 = require("../../asyncapi");
+const common_types_1 = require("./common-types");
+Object.defineProperty(exports, "renderHttpCommonTypes", { enumerable: true, get: function () { return common_types_1.renderHttpCommonTypes; } });
+const client_1 = require("./client");
+Object.defineProperty(exports, "renderHttpFetchClient", { enumerable: true, get: function () { return client_1.renderHttpFetchClient; } });
+// Re-export security utilities for external use
+var security_1 = require("./security");
+Object.defineProperty(exports, "analyzeSecuritySchemes", { enumerable: true, get: function () { return security_1.analyzeSecuritySchemes; } });
+Object.defineProperty(exports, "escapeStringForCodeGen", { enumerable: true, get: function () { return security_1.escapeStringForCodeGen; } });
+Object.defineProperty(exports, "getApiKeyDefaults", { enumerable: true, get: function () { return security_1.getApiKeyDefaults; } });
+Object.defineProperty(exports, "renderOAuth2Helpers", { enumerable: true, get: function () { return security_1.renderOAuth2Helpers; } });
+Object.defineProperty(exports, "renderOAuth2Stubs", { enumerable: true, get: function () { return security_1.renderOAuth2Stubs; } });
+Object.defineProperty(exports, "renderSecurityTypes", { enumerable: true, get: function () { return security_1.renderSecurityTypes; } });
+async function generatehttpChannels(context, channel, protocolCodeFunctions, externalProtocolFunctionInformation, dependencies) {
+    const { generator, parameter, topic } = context;
+    const ignoreOperation = !generator.asyncapiGenerateForOperations;
+    let renders = [];
+    const operations = channel.operations().all();
+    if (operations.length > 0 && !ignoreOperation) {
+        renders = generateForOperations(context, channel, topic, parameter);
+    }
+    // Generate common types once for the HTTP protocol (stateless check)
+    if (protocolCodeFunctions['http_client'].length === 0 && renders.length > 0) {
+        const commonTypesCode = (0, common_types_1.renderHttpCommonTypes)();
+        // Prepend common types to the beginning of the protocol code
+        protocolCodeFunctions['http_client'].unshift(commonTypesCode);
+    }
+    addRendersToExternal(renders, protocolCodeFunctions, externalProtocolFunctionInformation, dependencies, parameter);
+}
+exports.generatehttpChannels = generatehttpChannels;
+function addRendersToExternal(renders, protocolCodeFunctions, externalProtocolFunctionInformation, dependencies, parameter) {
+    protocolCodeFunctions['http_client'].push(...renders.map((value) => value.code));
+    externalProtocolFunctionInformation['http_client'].push(...renders.map((value) => ({
+        functionType: value.functionType,
+        functionName: value.functionName,
+        messageType: value.messageType,
+        replyType: value.replyType,
+        parameterType: parameter?.type
+    })));
+    const renderedDependencies = renders
+        .map((value) => value.dependencies)
+        .flat(Infinity);
+    dependencies.push(...new Set(renderedDependencies));
+}
+// eslint-disable-next-line sonarjs/cognitive-complexity
+function generateForOperations(context, channel, topic, parameters) {
+    const renders = [];
+    const { generator, payloads } = context;
+    const functionTypeMapping = generator.functionTypeMapping?.[channel.id()];
+    for (const operation of channel.operations().all()) {
+        const updatedFunctionTypeMapping = (0, asyncapi_1.getFunctionTypeMappingFromAsyncAPI)(operation) ?? functionTypeMapping;
+        const action = operation.action();
+        if ((0, asyncapi_1.shouldRenderFunctionType)(updatedFunctionTypeMapping, types_1.ChannelFunctionTypes.HTTP_CLIENT, action, generator.asyncapiReverseOperations)) {
+            const httpMethod = operation.bindings().get('http')?.json()['method'] ?? 'GET';
+            const payloadId = (0, utils_1.findOperationId)(operation, channel);
+            const payload = payloads.operationModels[payloadId];
+            const methodsWithBody = ['POST', 'PUT', 'PATCH'];
+            const hasBody = methodsWithBody.includes(httpMethod.toUpperCase());
+            const { messageModule, messageType } = (0, utils_2.getMessageTypeAndModule)(payload);
+            const reply = operation.reply();
+            if (reply) {
+                const replyId = (0, utils_1.findReplyId)(operation, reply, channel);
+                const replyMessageModel = payloads.operationModels[replyId];
+                if (!replyMessageModel) {
+                    throw new Error(`Could not find payload for reply ${replyId} for channel typescript generator for HTTP`);
+                }
+                const { messageModule: replyMessageModule, messageType: replyMessageType, includesStatusCodes: replyIncludesStatusCodes } = (0, utils_2.getMessageTypeAndModule)(replyMessageModel);
+                if (replyMessageType === undefined) {
+                    throw new Error(`Could not find reply message type for channel typescript generator for HTTP`);
+                }
+                const { description, deprecated } = (0, utils_1.getOperationMetadata)(operation);
+                renders.push((0, client_1.renderHttpFetchClient)({
+                    subName: (0, utils_1.findNameFromOperation)(operation, channel),
+                    requestMessageModule: hasBody ? messageModule : undefined,
+                    requestMessageType: hasBody ? messageType : undefined,
+                    replyMessageModule,
+                    replyMessageType,
+                    requestTopic: topic,
+                    method: httpMethod.toUpperCase(),
+                    channelParameters: parameters !== undefined ? parameters : undefined,
+                    includesStatusCodes: replyIncludesStatusCodes,
+                    description,
+                    deprecated
+                }));
+            }
+        }
+    }
+    return renders;
+}

package/dist/codegen/generators/typescript/channels/protocols/http/security.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Security type generation for HTTP client.
+ * Analyzes OpenAPI security schemes and generates TypeScript auth interfaces.
+ */
+import { SecuritySchemeOptions } from '../../types';
+/**
+ * Escapes special characters in strings that will be interpolated into generated code.
+ * Prevents syntax errors when OpenAPI spec values contain quotes, backticks, or template expressions.
+ */
+export declare function escapeStringForCodeGen(value: string | undefined): string;
+/**
+ * Determines which auth types are needed based on security schemes.
+ */
+export interface AuthTypeRequirements {
+    bearer: boolean;
+    basic: boolean;
+    apiKey: boolean;
+    oauth2: boolean;
+    apiKeySchemes: SecuritySchemeOptions[];
+    oauth2Schemes: SecuritySchemeOptions[];
+}
+/**
+ * Analyzes security schemes to determine which auth types are needed.
+ */
+export declare function analyzeSecuritySchemes(schemes: SecuritySchemeOptions[] | undefined): AuthTypeRequirements;
+/**
+ * Extracts API key defaults from schemes.
+ * If there's exactly one apiKey scheme, use its values; otherwise use standard defaults.
+ */
+export declare function getApiKeyDefaults(apiKeySchemes: SecuritySchemeOptions[]): {
+    name: string;
+    in: string;
+};
+/**
+ * Generates the security configuration types based on extracted security schemes.
+ */
+export declare function renderSecurityTypes(schemes: SecuritySchemeOptions[] | undefined, requirements?: AuthTypeRequirements): string;
+/**
+ * Generate OAuth2 stub functions when OAuth2 is not available.
+ * These stubs ensure TypeScript compilation succeeds when generated code
+ * references OAuth2 functions, but the runtime guards prevent them from being called.
+ */
+export declare function renderOAuth2Stubs(): string;
+/**
+ * Generates OAuth2-specific helper functions.
+ * Only included when OAuth2 auth is needed.
+ */
+export declare function renderOAuth2Helpers(): string;

package/dist/codegen/generators/typescript/channels/protocols/http/security.js

@@ -0,0 +1,491 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderOAuth2Helpers = exports.renderOAuth2Stubs = exports.renderSecurityTypes = exports.getApiKeyDefaults = exports.analyzeSecuritySchemes = exports.escapeStringForCodeGen = void 0;
+/**
+ * Escapes special characters in strings that will be interpolated into generated code.
+ * Prevents syntax errors when OpenAPI spec values contain quotes, backticks, or template expressions.
+ */
+function escapeStringForCodeGen(value) {
+    if (!value) {
+        return '';
+    }
+    return value
+        .replace(/\\/g, '\\\\') // Escape backslashes first
+        .replace(/\n/g, '\\n') // Escape newlines
+        .replace(/\r/g, '\\r') // Escape carriage returns
+        .replace(/'/g, "\\'") // Escape single quotes
+        .replace(/`/g, '\\`') // Escape backticks
+        .replace(/\$/g, '\\$') // Escape dollar signs (prevents ${} template evaluation)
+        .replace(/\*\//g, '*\\/'); // Escape */ to prevent JSDoc comment injection
+}
+exports.escapeStringForCodeGen = escapeStringForCodeGen;
+/**
+ * Analyzes security schemes to determine which auth types are needed.
+ */
+function analyzeSecuritySchemes(schemes) {
+    // undefined or empty array = backward compatibility mode, generate all types
+    // This allows users to manually configure auth even if no schemes are defined
+    if (!schemes || schemes.length === 0) {
+        return {
+            bearer: true,
+            basic: true,
+            apiKey: true,
+            oauth2: true,
+            apiKeySchemes: [],
+            oauth2Schemes: []
+        };
+    }
+    const requirements = {
+        bearer: false,
+        basic: false,
+        apiKey: false,
+        oauth2: false,
+        apiKeySchemes: [],
+        oauth2Schemes: []
+    };
+    for (const scheme of schemes) {
+        switch (scheme.type) {
+            case 'apiKey':
+                requirements.apiKey = true;
+                requirements.apiKeySchemes.push(scheme);
+                break;
+            case 'http':
+                if (scheme.httpScheme === 'bearer') {
+                    requirements.bearer = true;
+                }
+                else if (scheme.httpScheme === 'basic') {
+                    requirements.basic = true;
+                }
+                break;
+            case 'oauth2':
+            case 'openIdConnect':
+                requirements.oauth2 = true;
+                requirements.oauth2Schemes.push(scheme);
+                break;
+        }
+    }
+    return requirements;
+}
+exports.analyzeSecuritySchemes = analyzeSecuritySchemes;
+/**
+ * Generates the BearerAuth interface.
+ */
+function renderBearerAuthInterface() {
+    return `/**
+ * Bearer token authentication configuration
+ */
+export interface BearerAuth {
+  type: 'bearer';
+  token: string;
+}`;
+}
+/**
+ * Generates the BasicAuth interface.
+ */
+function renderBasicAuthInterface() {
+    return `/**
+ * Basic authentication configuration (username/password)
+ */
+export interface BasicAuth {
+  type: 'basic';
+  username: string;
+  password: string;
+}`;
+}
+/**
+ * Extracts API key defaults from schemes.
+ * If there's exactly one apiKey scheme, use its values; otherwise use standard defaults.
+ */
+function getApiKeyDefaults(apiKeySchemes) {
+    if (apiKeySchemes.length === 1) {
+        return {
+            name: apiKeySchemes[0].apiKeyName || 'X-API-Key',
+            in: apiKeySchemes[0].apiKeyIn || 'header'
+        };
+    }
+    return {
+        name: 'X-API-Key',
+        in: 'header'
+    };
+}
+exports.getApiKeyDefaults = getApiKeyDefaults;
+/**
+ * Generates the ApiKeyAuth interface with optional pre-populated defaults from spec.
+ */
+function renderApiKeyAuthInterface(apiKeySchemes) {
+    const defaults = getApiKeyDefaults(apiKeySchemes);
+    // For cookie support
+    const inType = apiKeySchemes.some((s) => s.apiKeyIn === 'cookie')
+        ? "'header' | 'query' | 'cookie'"
+        : "'header' | 'query'";
+    // Escape spec values for safe interpolation into generated code
+    const escapedDefaultName = escapeStringForCodeGen(defaults.name);
+    const escapedDefaultIn = escapeStringForCodeGen(defaults.in);
+    return `/**
+ * API key authentication configuration
+ */
+export interface ApiKeyAuth {
+  type: 'apiKey';
+  key: string;
+  name?: string;        // Name of the API key parameter (default: '${escapedDefaultName}')
+  in?: ${inType}; // Where to place the API key (default: '${escapedDefaultIn}')
+}`;
+}
+/**
+ * Extracts the tokenUrl from OAuth2 flows.
+ */
+function extractTokenUrl(flows) {
+    return (flows.clientCredentials?.tokenUrl ||
+        flows.password?.tokenUrl ||
+        flows.authorizationCode?.tokenUrl);
+}
+/**
+ * Extracts the authorizationUrl from OAuth2 flows.
+ */
+function extractAuthorizationUrl(flows) {
+    return (flows.implicit?.authorizationUrl ||
+        flows.authorizationCode?.authorizationUrl);
+}
+/**
+ * Collects all scopes from OAuth2 flows.
+ */
+function collectScopes(flows) {
+    const allScopes = new Set();
+    const flowTypes = [
+        flows.implicit,
+        flows.password,
+        flows.clientCredentials,
+        flows.authorizationCode
+    ];
+    for (const flow of flowTypes) {
+        if (flow?.scopes) {
+            Object.keys(flow.scopes).forEach((s) => allScopes.add(s));
+        }
+    }
+    return allScopes;
+}
+/**
+ * Formats scopes into a documentation comment.
+ */
+function formatScopesComment(scopes) {
+    if (scopes.size === 0) {
+        return '';
+    }
+    const scopeList = Array.from(scopes)
+        .slice(0, 3)
+        .map((scope) => escapeStringForCodeGen(scope))
+        .join(', ');
+    const suffix = scopes.size > 3 ? '...' : '';
+    return ` Available: ${scopeList}${suffix}`;
+}
+/**
+ * Extracts documentation comments from a single OAuth2 scheme.
+ */
+function extractSchemeComments(scheme, existing) {
+    if (scheme.openIdConnectUrl) {
+        return {
+            ...existing,
+            tokenUrlComment: `OpenID Connect URL: '${escapeStringForCodeGen(scheme.openIdConnectUrl)}'`
+        };
+    }
+    if (!scheme.oauth2Flows) {
+        return existing;
+    }
+    const tokenUrl = extractTokenUrl(scheme.oauth2Flows);
+    const authUrl = extractAuthorizationUrl(scheme.oauth2Flows);
+    const allScopes = collectScopes(scheme.oauth2Flows);
+    return {
+        tokenUrlComment: tokenUrl
+            ? `default: '${escapeStringForCodeGen(tokenUrl)}'`
+            : existing.tokenUrlComment,
+        authorizationUrlComment: authUrl
+            ? ` Authorization URL: '${escapeStringForCodeGen(authUrl)}'`
+            : existing.authorizationUrlComment,
+        scopesComment: formatScopesComment(allScopes) || existing.scopesComment
+    };
+}
+/**
+ * Extracts documentation comments from OAuth2 schemes.
+ */
+function extractOAuth2DocComments(oauth2Schemes) {
+    const initial = {
+        tokenUrlComment: 'required for client_credentials/password flows and token refresh',
+        authorizationUrlComment: '',
+        scopesComment: ''
+    };
+    return oauth2Schemes.reduce((acc, scheme) => extractSchemeComments(scheme, acc), initial);
+}
+/**
+ * Generates the OAuth2Auth interface with optional pre-populated values from spec.
+ */
+function renderOAuth2AuthInterface(oauth2Schemes) {
+    const { tokenUrlComment, authorizationUrlComment, scopesComment } = extractOAuth2DocComments(oauth2Schemes);
+    const flowsInfo = authorizationUrlComment
+        ? `\n *${authorizationUrlComment}`
+        : '';
+    return `/**
+ * OAuth2 authentication configuration
+ *
+ * Supports server-side flows only:
+ * - client_credentials: Server-to-server authentication
+ * - password: Resource owner password credentials (legacy, not recommended)
+ * - Pre-obtained accessToken: For tokens obtained via browser-based flows
+ *
+ * For browser-based flows (implicit, authorization_code), obtain the token
+ * separately and pass it as accessToken.${flowsInfo}
+ */
+export interface OAuth2Auth {
+  type: 'oauth2';
+  /** Pre-obtained access token (required if not using a server-side flow) */
+  accessToken?: string;
+  /** Refresh token for automatic token renewal on 401 */
+  refreshToken?: string;
+  /** Token endpoint URL (${tokenUrlComment}) */
+  tokenUrl?: string;
+  /** Client ID (required for flows and token refresh) */
+  clientId?: string;
+  /** Client secret (optional, depends on OAuth provider) */
+  clientSecret?: string;
+  /** Requested scopes${scopesComment} */
+  scopes?: string[];
+  /** Server-side flow type */
+  flow?: 'password' | 'client_credentials';
+  /** Username for password flow */
+  username?: string;
+  /** Password for password flow */
+  password?: string;
+  /** Callback when tokens are refreshed (for caching/persistence) */
+  onTokenRefresh?: (newTokens: TokenResponse) => void;
+}`;
+}
+/**
+ * Generates the AuthConfig union type based on which auth types are needed.
+ */
+function renderAuthConfigType(requirements) {
+    const types = [];
+    if (requirements.bearer) {
+        types.push('BearerAuth');
+    }
+    if (requirements.basic) {
+        types.push('BasicAuth');
+    }
+    if (requirements.apiKey) {
+        types.push('ApiKeyAuth');
+    }
+    if (requirements.oauth2) {
+        types.push('OAuth2Auth');
+    }
+    // If no types are needed (e.g., no recognized security schemes), don't generate AuthConfig
+    // The auth field in HttpClientContext is optional, so this is safe
+    if (types.length === 0) {
+        return '// No authentication types needed for this API\nexport type AuthConfig = never;';
+    }
+    return `/**
+ * Union type for all authentication methods - provides autocomplete support
+ */
+export type AuthConfig = ${types.join(' | ')};`;
+}
+/**
+ * Generates the security configuration types based on extracted security schemes.
+ */
+function renderSecurityTypes(schemes, requirements) {
+    const authRequirements = requirements ?? analyzeSecuritySchemes(schemes);
+    const bearerSection = authRequirements.bearer
+        ? `${renderBearerAuthInterface()}\n\n`
+        : '';
+    const basicSection = authRequirements.basic
+        ? `${renderBasicAuthInterface()}\n\n`
+        : '';
+    const apiKeySection = authRequirements.apiKey
+        ? `${renderApiKeyAuthInterface(authRequirements.apiKeySchemes)}\n\n`
+        : '';
+    const oauth2Section = authRequirements.oauth2
+        ? `${renderOAuth2AuthInterface(authRequirements.oauth2Schemes)}\n\n`
+        : '';
+    return `// ============================================================================
+// Security Configuration Types - Grouped for better autocomplete
+// ============================================================================
+
+${bearerSection}${basicSection}${apiKeySection}${oauth2Section}${renderAuthConfigType(authRequirements)}`;
+}
+exports.renderSecurityTypes = renderSecurityTypes;
+/**
+ * Generate OAuth2 stub functions when OAuth2 is not available.
+ * These stubs ensure TypeScript compilation succeeds when generated code
+ * references OAuth2 functions, but the runtime guards prevent them from being called.
+ */
+function renderOAuth2Stubs() {
+    return `
+// OAuth2 helpers not needed for this API - provide type-safe stubs
+// These are never called due to AUTH_FEATURES.oauth2 runtime guards
+type OAuth2Auth = never;
+function validateOAuth2Config(_auth: OAuth2Auth): void {}
+async function handleOAuth2TokenFlow(
+  _auth: OAuth2Auth,
+  _originalParams: HttpRequestParams,
+  _makeRequest: (params: HttpRequestParams) => Promise<HttpResponse>,
+  _retryConfig?: RetryConfig
+): Promise<HttpResponse | null> { return null; }
+async function handleTokenRefresh(
+  _auth: OAuth2Auth,
+  _originalParams: HttpRequestParams,
+  _makeRequest: (params: HttpRequestParams) => Promise<HttpResponse>,
+  _retryConfig?: RetryConfig
+): Promise<HttpResponse | null> { return null; }`;
+}
+exports.renderOAuth2Stubs = renderOAuth2Stubs;
+/**
+ * Generates OAuth2-specific helper functions.
+ * Only included when OAuth2 auth is needed.
+ */
+function renderOAuth2Helpers() {
+    return `
+/**
+ * Validate OAuth2 configuration based on flow type
+ */
+function validateOAuth2Config(auth: OAuth2Auth): void {
+  // If using a flow, validate required fields
+  switch (auth.flow) {
+    case 'client_credentials':
+      if (!auth.tokenUrl) throw new Error('OAuth2 Client Credentials flow requires tokenUrl');
+      if (!auth.clientId) throw new Error('OAuth2 Client Credentials flow requires clientId');
+      break;
+
+    case 'password':
+      if (!auth.tokenUrl) throw new Error('OAuth2 Password flow requires tokenUrl');
+      if (!auth.clientId) throw new Error('OAuth2 Password flow requires clientId');
+      if (!auth.username) throw new Error('OAuth2 Password flow requires username');
+      if (!auth.password) throw new Error('OAuth2 Password flow requires password');
+      break;
+
+    default:
+      // No flow specified - must have accessToken for OAuth2 to work
+      if (!auth.accessToken && !auth.flow) {
+        // This is fine - token refresh can still work if refreshToken is provided
+        // Or the request will just be made without auth
+      }
+      break;
+  }
+}
+
+/**
+ * Handle OAuth2 token flows (client_credentials, password)
+ */
+async function handleOAuth2TokenFlow(
+  auth: OAuth2Auth,
+  originalParams: HttpRequestParams,
+  makeRequest: (params: HttpRequestParams) => Promise<HttpResponse>,
+  retryConfig?: RetryConfig
+): Promise<HttpResponse | null> {
+  if (!auth.flow || !auth.tokenUrl) return null;
+
+  const params = new URLSearchParams();
+
+  if (auth.flow === 'client_credentials') {
+    params.append('grant_type', 'client_credentials');
+    params.append('client_id', auth.clientId!);
+  } else if (auth.flow === 'password') {
+    params.append('grant_type', 'password');
+    params.append('username', auth.username || '');
+    params.append('password', auth.password || '');
+    params.append('client_id', auth.clientId!);
+  } else {
+    return null;
+  }
+
+  if (auth.clientSecret) {
+    params.append('client_secret', auth.clientSecret);
+  }
+  if (auth.scopes && auth.scopes.length > 0) {
+    params.append('scope', auth.scopes.join(' '));
+  }
+
+  const authHeaders: Record<string, string> = {
+    'Content-Type': 'application/x-www-form-urlencoded'
+  };
+
+  // Use basic auth for client credentials if both client ID and secret are provided
+  if (auth.flow === 'client_credentials' && auth.clientId && auth.clientSecret) {
+    const credentials = Buffer.from(\`\${auth.clientId}:\${auth.clientSecret}\`).toString('base64');
+    authHeaders['Authorization'] = \`Basic \${credentials}\`;
+    params.delete('client_id');
+    params.delete('client_secret');
+  }
+
+  const tokenResponse = await NodeFetch.default(auth.tokenUrl, {
+    method: 'POST',
+    headers: authHeaders,
+    body: params.toString()
+  });
+
+  if (!tokenResponse.ok) {
+    throw new Error(\`OAuth2 token request failed: \${tokenResponse.statusText}\`);
+  }
+
+  const tokenData = await tokenResponse.json();
+  const tokens: TokenResponse = {
+    accessToken: tokenData.access_token,
+    refreshToken: tokenData.refresh_token,
+    expiresIn: tokenData.expires_in
+  };
+
+  // Notify the client about the tokens
+  if (auth.onTokenRefresh) {
+    auth.onTokenRefresh(tokens);
+  }
+
+  // Retry the original request with the new token
+  const updatedHeaders = { ...originalParams.headers };
+  updatedHeaders['Authorization'] = \`Bearer \${tokens.accessToken}\`;
+
+  return executeWithRetry({ ...originalParams, headers: updatedHeaders }, makeRequest, retryConfig);
+}
+
+/**
+ * Handle OAuth2 token refresh on 401 response
+ */
+async function handleTokenRefresh(
+  auth: OAuth2Auth,
+  originalParams: HttpRequestParams,
+  makeRequest: (params: HttpRequestParams) => Promise<HttpResponse>,
+  retryConfig?: RetryConfig
+): Promise<HttpResponse | null> {
+  if (!auth.refreshToken || !auth.tokenUrl || !auth.clientId) return null;
+
+  const refreshResponse = await NodeFetch.default(auth.tokenUrl, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: auth.refreshToken,
+      client_id: auth.clientId,
+      ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {})
+    }).toString()
+  });
+
+  if (!refreshResponse.ok) {
+    throw new Error('Unauthorized');
+  }
+
+  const tokenData = await refreshResponse.json();
+  const newTokens: TokenResponse = {
+    accessToken: tokenData.access_token,
+    refreshToken: tokenData.refresh_token || auth.refreshToken,
+    expiresIn: tokenData.expires_in
+  };
+
+  // Notify the client about the refreshed tokens
+  if (auth.onTokenRefresh) {
+    auth.onTokenRefresh(newTokens);
+  }
+
+  // Retry the original request with the new token
+  const updatedHeaders = { ...originalParams.headers };
+  updatedHeaders['Authorization'] = \`Bearer \${newTokens.accessToken}\`;
+
+  return executeWithRetry({ ...originalParams, headers: updatedHeaders }, makeRequest, retryConfig);
+}`;
+}
+exports.renderOAuth2Helpers = renderOAuth2Helpers;

package/dist/codegen/generators/typescript/channels/protocols/kafka/index.d.ts

@@ -0,0 +1,6 @@
+import { TypeScriptChannelRenderedFunctionType, TypeScriptChannelsGeneratorContext } from '../../types';
+import { renderPublish } from './publish';
+import { renderSubscribe } from './subscribe';
+import { ChannelInterface } from '@asyncapi/parser';
+export { renderPublish, renderSubscribe };
+export declare function generateKafkaChannels(context: TypeScriptChannelsGeneratorContext, channel: ChannelInterface, protocolCodeFunctions: Record<string, string[]>, externalProtocolFunctionInformation: Record<string, TypeScriptChannelRenderedFunctionType[]>, dependencies: string[]): Promise<void>;