@almadar/integrations 2.37.0 → 2.39.0

package/dist/runtime/index.d.ts

@@ -1,5 +1,5 @@
 import { g as IntegrationParams, I as IntegrationCallContext, d as IntegrationFactory } from '../BaseIntegration-CWdas-N_.js';
-import { o as IntegrationName, m as IntegrationActionName, n as IntegrationContracts, e as CredentialStore } from '../store-RNvxZO-q.js';
+import { o as IntegrationName, m as IntegrationActionName, n as IntegrationContracts, e as CredentialStore } from '../store-DG5OGiuQ.js';
 import '@almadar/core';
 
 /**

package/dist/runtime/index.js

@@ -133,8 +133,8 @@ var serviceCredentials = {
     { envVar: "REDIS_URL", required: true, description: "Redis connection URL" }
   ],
   oauth: [
-    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OIDC client ID" },
-    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OIDC client secret" },
+    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OAuth/OIDC client ID" },
+    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OAuth/OIDC client secret" },
     { envVar: "OAUTH_REDIRECT_URI", required: false, description: "OIDC redirect URI (default per-call param)" },
     { envVar: "OIDC_ISSUER_URL", required: false, description: "OIDC issuer URL (default https://accounts.google.com)" }
   ],
@@ -3547,6 +3547,31 @@ var PROVIDER_AUTH_URLS = {
 var PROVIDER_ISSUERS = {
   google: "https://accounts.google.com"
 };
+var PROVIDER_SERVER_METADATA = {
+  github: {
+    issuer: "https://github.com",
+    authorization_endpoint: "https://github.com/login/oauth/authorize",
+    token_endpoint: "https://github.com/login/oauth/access_token"
+  }
+};
+var OAuthGrantNotFoundError = class extends Error {
+  constructor(state) {
+    super(`Invalid or expired state token: ${state}`);
+    this.name = "OAuthGrantNotFoundError";
+  }
+};
+var OAuthSubjectMismatchError = class extends Error {
+  constructor() {
+    super("OAuth completion refused: the completing subject is not the one that started the authorization");
+    this.name = "OAuthSubjectMismatchError";
+  }
+};
+function assertSubject(bound, completer) {
+  if (bound !== completer) throw new OAuthSubjectMismatchError();
+}
+function grantedScopes(scope) {
+  return (scope ?? "").split(/[\s,]+/).filter((s) => s.length > 0);
+}
 var PENDING_GRANT_TTL_MS = 10 * 60 * 1e3;
 var InMemoryPendingGrantStore = class {
   constructor() {
@@ -3571,7 +3596,7 @@ var InMemoryPendingGrantStore = class {
 var OAuthIntegration = class extends BaseIntegration {
   constructor(config) {
     super(config);
-    /** Maps state token -> provider for pending MOCK authorization flows */
+    /** Maps state token -> pending MOCK authorization */
     this.states = /* @__PURE__ */ new Map();
     /** Maps access token -> token set (mock backend) */
     this.tokens = /* @__PURE__ */ new Map();
@@ -3600,12 +3625,25 @@ var OAuthIntegration = class extends BaseIntegration {
     try {
       let data;
       switch (action) {
-        case "authorize":
-          data = await this.executeWithRetry(() => this.real ? this.oidcAuthorize(params) : this.authorize(params));
+        case "authorize": {
+          const input = {
+            provider: params.provider,
+            scopes: params.scopes,
+            redirectUri: params.redirectUri,
+            ...params.subject === void 0 ? {} : { subject: params.subject }
+          };
+          data = await this.executeWithRetry(() => this.startAuthorization(input));
           break;
-        case "token":
-          data = await this.executeWithRetry(() => this.real ? this.oidcToken(params) : this.token(params));
+        }
+        case "token": {
+          const input = {
+            code: params.code,
+            state: params.state,
+            ...params.subject === void 0 ? {} : { subject: params.subject }
+          };
+          data = await this.executeWithRetry(() => this.completeAuthorization(input));
           break;
+        }
         case "refresh":
           data = await this.executeWithRetry(() => this.real ? this.oidcRefresh(params) : this.refresh(params));
           break;
@@ -3627,6 +3665,14 @@ var OAuthIntegration = class extends BaseIntegration {
       return this.handleError(action, error);
     }
   }
+  /** Build the provider authorization URL and hold the pending grant (PKCE verifier, subject) under `state`. */
+  async startAuthorization(input) {
+    return this.real ? this.oidcAuthorize(input) : this.authorize(input);
+  }
+  /** Consume the pending grant once and exchange the code; throws on an unknown, replayed or expired `state`. */
+  async completeAuthorization(input) {
+    return this.real ? this.oidcToken(input) : this.token(input);
+  }
   // ---------------------------------------------------------------------------
   // OIDC backend (openid-client)
   // ---------------------------------------------------------------------------
@@ -3642,6 +3688,19 @@ var OAuthIntegration = class extends BaseIntegration {
     return issuer;
   }
   async configurationFor(provider) {
+    const metadata = PROVIDER_SERVER_METADATA[provider];
+    if (metadata && !this.config.env.OIDC_ISSUER_URL) {
+      const cached2 = this.discovered.get(metadata.issuer);
+      if (cached2) return cached2;
+      const configuration2 = new oidc.Configuration(
+        metadata,
+        this.config.env.OAUTH_CLIENT_ID,
+        this.config.env.OAUTH_CLIENT_SECRET,
+        oidc.ClientSecretPost(this.config.env.OAUTH_CLIENT_SECRET)
+      );
+      this.discovered.set(metadata.issuer, configuration2);
+      return configuration2;
+    }
     const issuer = this.issuerFor(provider);
     const cached = this.discovered.get(issuer);
     if (cached) return cached;
@@ -3653,10 +3712,9 @@ var OAuthIntegration = class extends BaseIntegration {
     this.discovered.set(issuer, configuration);
     return configuration;
   }
-  async oidcAuthorize(params) {
-    const provider = params.provider;
-    const scopes = params.scopes;
-    const redirectUri = params.redirectUri || this.config.env.OAUTH_REDIRECT_URI;
+  async oidcAuthorize(input) {
+    const { provider, scopes, subject } = input;
+    const redirectUri = input.redirectUri || this.config.env.OAUTH_REDIRECT_URI;
     const configuration = await this.configurationFor(provider);
     const state = oidc.randomState();
     const pkceVerifier = oidc.randomPKCECodeVerifier();
@@ -3673,17 +3731,21 @@ var OAuthIntegration = class extends BaseIntegration {
       parameters.prompt = "consent";
     }
     const authUrl = oidc.buildAuthorizationUrl(configuration, parameters);
-    await this.pendingStore().put(state, { provider, redirectUri, pkceVerifier }, PENDING_GRANT_TTL_MS);
+    await this.pendingStore().put(
+      state,
+      { provider, redirectUri, pkceVerifier, ...subject === void 0 ? {} : { subject } },
+      PENDING_GRANT_TTL_MS
+    );
     void this.pendingStore().sweep();
     return { authUrl: authUrl.toString(), state };
   }
-  async oidcToken(params) {
-    const code = params.code;
-    const state = params.state;
+  async oidcToken(input) {
+    const { code, state } = input;
     const pendingAuth = await this.pendingStore().take(state);
     if (!pendingAuth) {
-      throw new Error(`Invalid or expired state token: ${state}`);
+      throw new OAuthGrantNotFoundError(state);
     }
+    assertSubject(pendingAuth.subject, input.subject);
     const configuration = await this.configurationFor(pendingAuth.provider);
     const callbackUrl = new URL(pendingAuth.redirectUri);
     callbackUrl.searchParams.set("code", code);
@@ -3700,7 +3762,9 @@ var OAuthIntegration = class extends BaseIntegration {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? "",
       expiresIn: tokens.expires_in ?? 3600,
-      tokenType: "bearer"
+      tokenType: "bearer",
+      scope: grantedScopes(tokens.scope),
+      ...pendingAuth.subject === void 0 ? {} : { subject: pendingAuth.subject }
     };
   }
   async oidcRefresh(params) {
@@ -3763,13 +3827,11 @@ var OAuthIntegration = class extends BaseIntegration {
   // ---------------------------------------------------------------------------
   // Mock backend actions
   // ---------------------------------------------------------------------------
-  async authorize(params) {
-    const provider = params.provider;
-    const scopes = params.scopes;
-    const redirectUri = params.redirectUri;
+  async authorize(input) {
+    const { provider, scopes, redirectUri, subject } = input;
     this.logger.debug("OAuth AUTHORIZE", { provider, scopes: scopes.join(", "), redirectUri });
     const state = this.generateToken(16);
-    this.states.set(state, provider);
+    this.states.set(state, { provider, scopes, ...subject === void 0 ? {} : { subject } });
     const baseUrl = PROVIDER_AUTH_URLS[provider];
     const queryParams = new URLSearchParams({
       response_type: "code",
@@ -3781,17 +3843,15 @@ var OAuthIntegration = class extends BaseIntegration {
     const authUrl = `${baseUrl}?${queryParams.toString()}`;
     return { authUrl, state };
   }
-  async token(params) {
-    const code = params.code;
-    const state = params.state;
+  async token(input) {
+    const { code, state } = input;
     this.logger.debug("OAuth TOKEN", { code, state });
-    const provider = this.states.get(state);
-    if (!provider) {
-      throw new Error(
-        `Invalid or expired state token: ${state}`
-      );
+    const pending = this.states.get(state);
+    if (!pending) {
+      throw new OAuthGrantNotFoundError(state);
     }
     this.states.delete(state);
+    assertSubject(pending.subject, input.subject);
     const accessToken = this.generateToken(32);
     const refreshToken = this.generateToken(32);
     const expiresIn = 3600;
@@ -3803,8 +3863,15 @@ var OAuthIntegration = class extends BaseIntegration {
     this.tokens.set(accessToken, tokenSet);
     this.refreshIndex.set(refreshToken, accessToken);
     const sub = this.generateToken(8);
-    this.sessions.set(accessToken, this.generateMockUser(provider, sub));
-    return { accessToken, refreshToken, expiresIn, tokenType: "bearer" };
+    this.sessions.set(accessToken, this.generateMockUser(pending.provider, sub));
+    return {
+      accessToken,
+      refreshToken,
+      expiresIn,
+      tokenType: "bearer",
+      scope: pending.scopes,
+      ...pending.subject === void 0 ? {} : { subject: pending.subject }
+    };
   }
   async refresh(params) {
     const refreshToken = params.refreshToken;