@ameshkin/ticket-mate 0.1.20

package/public/server/jira/jiraClient.js

@@ -0,0 +1,330 @@
+/**
+ * Standardized Jira Client Factory
+ *
+ * Single source of truth for all Jira API calls.
+ * Defaults to DB-backed OAuth for web/API routes.
+ * PAT fallback only for CLI/superadmin with explicit opt-in.
+ */
+import { logger } from "@/utils/logger";
+import { refreshJiraTokenIfNeeded } from "./tokens";
+/**
+ * Request memoization fallback for non-React/CLI environments
+ */
+const cache = (fn) => fn;
+import { JiraOAuthRevokedError, JiraCredentialMissingError, JiraTokenExpiredError, JiraPatNotAllowedError, } from "./errors";
+/**
+ * Create Jira client from OAuth token
+ */
+export function createJiraOAuthClient({ baseUrl, accessToken, }) {
+    const apiBase = baseUrl.endsWith("/")
+        ? `${baseUrl}rest/api/3/`
+        : `${baseUrl}/rest/api/3/`;
+    async function request(method, path, body) {
+        // FIX: Guard against absolute paths or duplicated segments
+        if (path.startsWith("http") ||
+            path.startsWith("/ex/jira") ||
+            path.includes("/rest/api/")) {
+            throw new Error(`[jiraClient] Malformed path: "${path}". Pass ONLY the relative resource path (e.g. "issue" or "user/search"). Base URL already contains /rest/api/3/.`);
+        }
+        // Ensure no leading slash and strip redundant API base path
+        let cleanPath = path.startsWith("/") ? path.slice(1) : path;
+        if (cleanPath.startsWith("rest/api/3/")) {
+            cleanPath = cleanPath.slice("rest/api/3/".length);
+        }
+        const url = new URL(cleanPath, apiBase);
+        // Log only in dev or if error
+        if (process.env.NODE_ENV === "development") {
+            console.log("[jiraClient] OAuth request:", {
+                method,
+                url: url.toString(),
+            });
+        }
+        const res = await fetch(url.toString(), {
+            method,
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            // Handle known Atlassian errors
+            if (res.status === 401 && text.includes("scope does not match")) {
+                console.warn("[ticket-mate] 401 Scope Mismatch. User needs to reconnect Jira.");
+                throw new Error("Jira connected in read-only mode. Reconnect with write access.");
+            }
+            logger.error("[ticket-mate] Jira API error", {
+                status: res.status,
+                url: url.toString(),
+                method,
+                body: text.slice(0, 500),
+            });
+            // Check for OAuth revocation
+            if (res.status === 401) {
+                try {
+                    const errorData = JSON.parse(text);
+                    if (errorData.error === "invalid_grant" ||
+                        errorData.error === "unauthorized") {
+                        throw new JiraOAuthRevokedError();
+                    }
+                }
+                catch (parseError) {
+                    // If we already threw JiraOAuthRevokedError, re-throw it
+                    if (parseError instanceof JiraOAuthRevokedError) {
+                        throw parseError;
+                    }
+                    // Not JSON or different error, continue with generic error
+                }
+            }
+            throw new Error(`Jira API error ${res.status}: ${text.slice(0, 200)}`);
+        }
+        return res.json();
+    }
+    return {
+        get: (path, params) => {
+            let fullPath = path;
+            if (params && params.toString()) {
+                fullPath = `${path}?${params.toString()}`;
+            }
+            return request("GET", fullPath);
+        },
+        post: (path, body) => {
+            return request("POST", path, body);
+        },
+        put: (path, body) => {
+            return request("PUT", path, body);
+        },
+        delete: (path) => {
+            return request("DELETE", path);
+        },
+        getBaseUrl: () => apiBase,
+        getAuthHeaders: () => ({
+            Authorization: `Bearer ${accessToken}`,
+            Accept: "application/json",
+            "Content-Type": "application/json",
+        }),
+        getAuthMode: () => "OAUTH",
+        getCloudId: () => {
+            // Extract from baseUrl: https://api.atlassian.com/ex/jira/{cloudId}
+            const match = apiBase.match(/ex\/jira\/([^/]+)/);
+            return match ? match[1] : undefined;
+        },
+        upload: (path, formData) => {
+            const url = new URL(path, apiBase);
+            return fetch(url.toString(), {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    Accept: "application/json",
+                    "X-Atlassian-Token": "no-check",
+                },
+                body: formData,
+            }).then(async (res) => {
+                if (!res.ok) {
+                    const text = await res.text().catch(() => "");
+                    throw new Error(`Jira Upload error ${res.status}: ${text.slice(0, 200)}`);
+                }
+                return res.json();
+            });
+        },
+    };
+}
+/**
+ * Create Jira client from PAT (Basic Auth)
+ */
+export function createJiraPatClient({ baseUrl, email, apiToken, }) {
+    const apiBase = new URL("/rest/api/3/", baseUrl).toString();
+    const authHeader = "Basic " + Buffer.from(`${email}:${apiToken}`).toString("base64");
+    async function request(method, path, body) {
+        const url = new URL(path, apiBase);
+        const res = await fetch(url.toString(), {
+            method,
+            headers: {
+                Authorization: authHeader,
+                Accept: "application/json",
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            logger.error("[ticket-mate] Jira API error (PAT)", {
+                status: res.status,
+                url: url.toString(),
+                method,
+                body: text.slice(0, 2000),
+            });
+            throw new Error(`Jira API error ${res.status} for ${url.toString()}: ${text.slice(0, 200)}`);
+        }
+        if (res.status === 204) {
+            return {};
+        }
+        const text = await res.text();
+        try {
+            return text ? JSON.parse(text) : {};
+        }
+        catch (e) {
+            // If JSON parse fails but response was ok, fallback
+            if (res.ok)
+                return {};
+            throw e;
+        }
+    }
+    return {
+        get: (path, params) => {
+            let fullPath = path;
+            if (params && params.toString()) {
+                fullPath = `${path}?${params.toString()}`;
+            }
+            return request("GET", fullPath);
+        },
+        post: (path, body) => {
+            return request("POST", path, body);
+        },
+        put: (path, body) => {
+            return request("PUT", path, body);
+        },
+        delete: (path) => {
+            return request("DELETE", path);
+        },
+        getBaseUrl: () => apiBase,
+        getAuthHeaders: () => ({
+            Authorization: authHeader,
+            Accept: "application/json",
+            "Content-Type": "application/json",
+        }),
+        getAuthMode: () => "PAT",
+        getCloudId: () => process.env.ATLASSIAN_CLOUD_ID,
+        upload: (path, formData) => {
+            const url = new URL(path, apiBase);
+            return fetch(url.toString(), {
+                method: "POST",
+                headers: {
+                    Authorization: authHeader,
+                    Accept: "application/json",
+                    "X-Atlassian-Token": "no-check",
+                },
+                body: formData,
+            }).then(async (res) => {
+                if (!res.ok) {
+                    const text = await res.text().catch(() => "");
+                    throw new Error(`Jira Upload error ${res.status}: ${text.slice(0, 200)}`);
+                }
+                return res.json();
+            });
+        },
+    };
+}
+/**
+ * Get PAT credentials from environment
+ */
+function getPatCredentialsFromEnv() {
+    const baseUrl = process.env.ATLASSIAN_BASE_URL;
+    const email = process.env.ATLASSIAN_EMAIL;
+    const apiToken = process.env.ATLASSIAN_API_KEY || process.env.ATLASSIAN_API_TOKEN;
+    if (!baseUrl || !email || !apiToken) {
+        return null;
+    }
+    return { baseUrl, email, apiToken };
+}
+/**
+ * Get Jira client - single entry point for all Jira API calls
+ *
+ * Priority:
+ * 1. JiraCredential OAuth (per-user, one credential per user)
+ * 2. PAT fallback (only if usePatFallback=true and superadmin/dev)
+ *
+ * @throws JiraCredentialMissingError if no OAuth credentials found and PAT not allowed
+ * @throws JiraOAuthRevokedError if OAuth token is revoked
+ * @throws JiraTokenExpiredError if token expired and refresh failed
+ */
+/**
+ * Get Jira client - single entry point for all Jira API calls
+ * Cached per-request to ensure idempotency
+ */
+export const getJiraClient = cache(async (ctx) => {
+    return _createJiraClient(ctx);
+});
+/**
+ * Internal factory logic (uncached)
+ */
+async function _createJiraClient(ctx) {
+    const { accountId, userId, usePatFallback = false, cloudId } = ctx;
+    // For web/API routes, accountId is required
+    // For CLI with OAuth, accountId is optional (only userId needed)
+    if (!accountId && !usePatFallback && !userId) {
+        throw new JiraCredentialMissingError("accountId or userId is required. Use usePatFallback=true only for CLI/superadmin with PAT.");
+    }
+    // 1) Try JiraCredential OAuth (one credential per user)
+    if (userId) {
+        try {
+            const credential = await refreshJiraTokenIfNeeded(userId);
+            const baseUrl = `https://api.atlassian.com/ex/jira/${credential.cloudId}`;
+            console.log("[jiraClient] Creating OAuth client:", {
+                cloudId: credential.cloudId,
+                baseUrl,
+                jiraBaseUrl: credential.jiraBaseUrl,
+                scope: credential.scope,
+                expiresAt: credential.expiresAt,
+            });
+            logger.debug("Using JiraCredential OAuth (legacy)", {
+                credentialId: credential.id,
+                cloudId: credential.cloudId,
+                userId,
+                accountId,
+            });
+            return createJiraOAuthClient({
+                baseUrl,
+                accessToken: credential.accessToken,
+            });
+        }
+        catch (error) {
+            // If explicit fallback requested, or if we are locally developing and have env vars, allow fallback
+            // This solves the 'Localhost Auth' issue where dev users expect env vars to just work
+            const shouldTryFallback = usePatFallback ||
+                (process.env.NODE_ENV === "development" && getPatCredentialsFromEnv());
+            if (!shouldTryFallback) {
+                if (error instanceof JiraOAuthRevokedError ||
+                    error instanceof JiraTokenExpiredError) {
+                    throw error;
+                }
+                logger.debug("JiraCredential not available", {
+                    userId,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+            // If we are falling through to PAT, we just continue execution
+        }
+    }
+    // 3) PAT fallback
+    // Check if we should fallback (explicit or automatic dev)
+    const isDevWithCreds = process.env.NODE_ENV === "development" && getPatCredentialsFromEnv();
+    if (!usePatFallback && !isDevWithCreds) {
+        throw new JiraCredentialMissingError();
+    }
+    const patCreds = getPatCredentialsFromEnv();
+    if (!patCreds) {
+        throw new JiraPatNotAllowedError("Missing PAT credentials. Required: ATLASSIAN_BASE_URL, ATLASSIAN_EMAIL, ATLASSIAN_API_KEY. " +
+            "Note: PAT is for CLI/superadmin/test only. Normal tenants should use OAuth credentials from DB.");
+    }
+    // Log warning for PAT usage (only in production, suppress in development)
+    if (process.env.NODE_ENV === "production") {
+        logger.warn("[ticket-mate] WARN Using ENV-based PAT credentials (fallback). This should be used only for CLI/superadmin/test.", {
+            userId,
+            accountId,
+            usePatFallback,
+        });
+    }
+    else {
+        // In development, use debug level to reduce noise
+        logger.debug("[ticket-mate] Using ENV-based PAT credentials (fallback) - development mode", {
+            userId,
+            accountId,
+            usePatFallback,
+        });
+    }
+    return createJiraPatClient(patCreds);
+}
+//# sourceMappingURL=jiraClient.js.map

package/public/server/jira/jiraClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jiraClient.js","sourceRoot":"","sources":["../../../src/server/jira/jiraClient.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAyB,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAE3E;;GAEG;AACH,MAAM,KAAK,GAAG,CAAoC,EAAK,EAAK,EAAE,CAAC,EAAE,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAyDlB;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,OAAO,EACP,WAAW,GAIZ;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,GAAG,OAAO,aAAa;QACzB,CAAC,CAAC,GAAG,OAAO,cAAc,CAAC;IAE7B,KAAK,UAAU,OAAO,CACpB,MAAyC,EACzC,IAAY,EACZ,IAAc;QAEd,2DAA2D;QAC3D,IACE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,kHAAkH,CACxJ,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,IAAI,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAExC,8BAA8B;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBACzC,MAAM;gBACN,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACtC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAE9C,gCAAgC;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAChE,OAAO,CAAC,IAAI,CACV,iEAAiE,CAClE,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACzB,CAAC,CAAC;YAEH,6BAA6B;YAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAGhC,CAAC;oBACF,IACE,SAAS,CAAC,KAAK,KAAK,eAAe;wBACnC,SAAS,CAAC,KAAK,KAAK,cAAc,EAClC,CAAC;wBACD,MAAM,IAAI,qBAAqB,EAAE,CAAC;oBACpC,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,yDAAyD;oBACzD,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;wBAChD,MAAM,UAAU,CAAC;oBACnB,CAAC;oBACD,2DAA2D;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,MAAwB,EAAc,EAAE;YAC7D,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAChC,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAa,EAAc,EAAE;YACnD,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,EAAE,CAAI,IAAY,EAAE,IAAa,EAAc,EAAE;YAClD,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,CAAI,IAAY,EAAc,EAAE;YACtC,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACzB,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;YACrB,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,WAAW,EAAE,GAAG,EAAE,CAAC,OAAgB;QACnC,UAAU,EAAE,GAAG,EAAE;YACf,oEAAoE;YACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACjD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,MAAM,EAAE,CAAI,IAAY,EAAE,QAAkB,EAAc,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,MAAM,EAAE,kBAAkB;oBAC1B,mBAAmB,EAAE,UAAU;iBAChC;gBACD,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,KAAK,EACL,QAAQ,GAKT;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,MAAM,UAAU,GACd,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,KAAK,UAAU,OAAO,CACpB,MAAyC,EACzC,IAAY,EACZ,IAAc;QAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACtC,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU;gBACzB,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACjD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;gBACnB,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;aAC1B,CAAC,CAAC;YAEH,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,KAAK,CAC/D,CAAC,EACD,GAAG,CACJ,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAO,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAQ,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,oDAAoD;YACpD,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAO,CAAC;YAC3B,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAI,IAAY,EAAE,MAAwB,EAAc,EAAE;YAC7D,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAChC,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAa,EAAc,EAAE;YACnD,OAAO,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,EAAE,CAAI,IAAY,EAAE,IAAa,EAAc,EAAE;YAClD,OAAO,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,CAAI,IAAY,EAAc,EAAE;YACtC,OAAO,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACzB,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;YACrB,aAAa,EAAE,UAAU;YACzB,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,WAAW,EAAE,GAAG,EAAE,CAAC,KAAc;QACjC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAChD,MAAM,EAAE,CAAI,IAAY,EAAE,QAAkB,EAAc,EAAE;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU;oBACzB,MAAM,EAAE,kBAAkB;oBAC1B,mBAAmB,EAAE,UAAU;iBAChC;gBACD,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBACpB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACzD,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB;IAK/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC1C,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAEnE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAChC,KAAK,EAAE,GAAoB,EAAuB,EAAE;IAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAEF;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAoB;IACnD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,GAAG,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAEnE,4CAA4C;IAC5C,iEAAiE;IACjE,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7C,MAAM,IAAI,0BAA0B,CAClC,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,wDAAwD;IAExD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,qCAAqC,UAAU,CAAC,OAAO,EAAE,CAAC;YAE1E,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE;gBACjD,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,OAAO;gBACP,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAClD,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,MAAM;gBACN,SAAS;aACV,CAAC,CAAC;YAEH,OAAO,qBAAqB,CAAC;gBAC3B,OAAO;gBACP,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oGAAoG;YACpG,sFAAsF;YACtF,MAAM,iBAAiB,GACrB,cAAc;gBACd,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,wBAAwB,EAAE,CAAC,CAAC;YAEzE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,IACE,KAAK,YAAY,qBAAqB;oBACtC,KAAK,YAAY,qBAAqB,EACtC,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC3C,MAAM;oBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,0DAA0D;IAC1D,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,wBAAwB,EAAE,CAAC;IACvE,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,0BAA0B,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,6FAA6F;YAC7F,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CACT,kHAAkH,EAClH;YACE,MAAM;YACN,SAAS;YACT,cAAc;SACf,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,kDAAkD;QAClD,MAAM,CAAC,KAAK,CACV,6EAA6E,EAC7E;YACE,MAAM;YACN,SAAS;YACT,cAAc;SACf,CACF,CAAC;IACJ,CAAC;IAED,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC"}

package/public/server/jira/tokens.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Jira OAuth Token Management
+ *
+ * Handles per-user Jira OAuth tokens, including refresh logic
+ */
+export interface JiraCredential {
+    id: string;
+    userId: string;
+    cloudId: string;
+    jiraBaseUrl: string | null;
+    accessToken: string;
+    refreshToken: string;
+    scope: string | null;
+    expiresAt: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * Get Jira credential for a user
+ * Automatically decrypts tokens if they are encrypted
+ * @throws Error if user hasn't connected Jira
+ */
+export declare function getUserJiraCredential(userId: string): Promise<JiraCredential>;
+/**
+ * Refresh Jira token if needed (mutex-protected)
+ * Automatically refreshes if token expires within 1 minute
+ */
+export declare function refreshJiraTokenIfNeeded(userId: string): Promise<JiraCredential>;
+/**
+ * Disconnect Jira for a user
+ */
+export declare function disconnectJira(userId: string): Promise<void>;
+/**
+ * Check if user has connected Jira
+ */
+export declare function isJiraConnected(userId: string): Promise<boolean>;
+//# sourceMappingURL=tokens.d.ts.map

package/public/server/jira/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/server/jira/tokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuCH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,CAAC,CAIzB;AA2GD;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtE"}

package/public/server/jira/tokens.js

@@ -0,0 +1,161 @@
+/**
+ * Jira OAuth Token Management
+ *
+ * Handles per-user Jira OAuth tokens, including refresh logic
+ */
+// Use centralized Prisma client with validation
+import { prisma } from "../../lib/prisma";
+import { decrypt, encrypt } from "../../lib/encryption";
+import { logger } from "../../utils/logger";
+import { tokenMutex } from "../../lib/auth/token-mutex";
+async function getPrisma() {
+    // Use the centralized prisma instance which has DATABASE_URL validation
+    return prisma;
+}
+/**
+ * Check if a string is encrypted (has the format: iv:salt:tag:encryptedData)
+ */
+function isEncrypted(value) {
+    return value.split(":").length === 4;
+}
+/**
+ * Decrypt token if it's encrypted, otherwise return as-is (for backward compatibility)
+ */
+function decryptTokenIfNeeded(encryptedToken) {
+    try {
+        if (isEncrypted(encryptedToken)) {
+            return decrypt(encryptedToken);
+        }
+        // Not encrypted (legacy data or plain text) - return as-is
+        return encryptedToken;
+    }
+    catch (error) {
+        // If decryption fails, assume it's plain text (backward compatibility)
+        logger.warn("Token decryption failed, assuming plain text", { error });
+        return encryptedToken;
+    }
+}
+/**
+ * Get Jira credential for a user
+ * Automatically decrypts tokens if they are encrypted
+ * @throws Error if user hasn't connected Jira
+ */
+export async function getUserJiraCredential(userId) {
+    const prisma = await getPrisma();
+    const credential = await prisma.jiraCredential.findUnique({
+        where: { userId },
+    });
+    if (!credential) {
+        throw new Error("User has not connected Jira. Please connect your Jira account first.");
+    }
+    // Decrypt tokens if they are encrypted
+    return {
+        ...credential,
+        accessToken: decryptTokenIfNeeded(credential.accessToken),
+        refreshToken: decryptTokenIfNeeded(credential.refreshToken),
+    };
+}
+/**
+ * Refresh Jira token if needed (mutex-protected)
+ * Automatically refreshes if token expires within 1 minute
+ */
+export async function refreshJiraTokenIfNeeded(userId) {
+    return tokenMutex.withLock(userId, async () => {
+        return _refreshJiraTokenIfNeeded(userId);
+    });
+}
+/**
+ * Internal refresh logic (do not call directly)
+ */
+async function _refreshJiraTokenIfNeeded(userId) {
+    const credential = await getUserJiraCredential(userId);
+    // Check if token is still valid (with 1 minute buffer)
+    const expiresInMs = credential.expiresAt.getTime() - Date.now();
+    const oneMinute = 60 * 1000;
+    if (expiresInMs > oneMinute) {
+        // Token is still valid
+        return credential;
+    }
+    // Token expired or expiring soon - refresh it
+    const clientId = process.env.ATLASSIAN_CLIENT_ID;
+    const clientSecret = process.env.ATLASSIAN_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+        throw new Error("ATLASSIAN_CLIENT_ID or ATLASSIAN_CLIENT_SECRET not configured");
+    }
+    try {
+        const tokenResponse = await fetch("https://auth.atlassian.com/oauth/token", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                client_id: clientId,
+                client_secret: clientSecret,
+                refresh_token: credential.refreshToken,
+            }),
+        });
+        if (!tokenResponse.ok) {
+            const errorData = await tokenResponse.json().catch(() => ({}));
+            logger.error("Token refresh failed", { errorData, userId });
+            // If refresh token is invalid, delete the credential
+            // User will need to reconnect
+            const prisma = await getPrisma();
+            await prisma.jiraCredential.delete({
+                where: { userId },
+            });
+            throw new Error("Jira token refresh failed. Please reconnect your Jira account.");
+        }
+        const tokens = (await tokenResponse.json());
+        // Calculate new expiry
+        const expiresAt = new Date(Date.now() + tokens.expires_in * 1000);
+        // Encrypt tokens before storing
+        const encryptedAccessToken = encrypt(tokens.access_token);
+        const encryptedRefreshToken = encrypt(tokens.refresh_token || credential.refreshToken);
+        // Update credential in database
+        const prisma = await getPrisma();
+        const updated = await prisma.jiraCredential.update({
+            where: { userId },
+            data: {
+                accessToken: encryptedAccessToken,
+                refreshToken: encryptedRefreshToken,
+                scope: tokens.scope,
+                expiresAt,
+            },
+        });
+        logger.info("Refreshed Jira token successfully", {
+            userId,
+            expiresIn: tokens.expires_in,
+        });
+        // Return decrypted version for use
+        return {
+            ...updated,
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token || credential.refreshToken,
+        };
+    }
+    catch (error) {
+        logger.error("Error refreshing Jira token", { error });
+        throw error;
+    }
+}
+/**
+ * Disconnect Jira for a user
+ */
+export async function disconnectJira(userId) {
+    const prisma = await getPrisma();
+    await prisma.jiraCredential.delete({
+        where: { userId },
+    });
+}
+/**
+ * Check if user has connected Jira
+ */
+export async function isJiraConnected(userId) {
+    const prisma = await getPrisma();
+    const credential = await prisma.jiraCredential.findUnique({
+        where: { userId },
+    });
+    return !!credential;
+}
+//# sourceMappingURL=tokens.js.map

package/public/server/jira/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/server/jira/tokens.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gDAAgD;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,KAAK,UAAU,SAAS;IACtB,wEAAwE;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,cAAsB;IAClD,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;QACjC,CAAC;QACD,2DAA2D;QAC3D,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;QACxD,KAAK,EAAE,EAAE,MAAM,EAAE;KAClB,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,OAAO;QACL,GAAG,UAAU;QACb,WAAW,EAAE,oBAAoB,CAAC,UAAU,CAAC,WAAW,CAAC;QACzD,YAAY,EAAE,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc;IAEd,OAAO,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QAC5C,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,yBAAyB,CACtC,MAAc;IAEd,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEvD,uDAAuD;IACvD,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;IAE5B,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;QAC5B,uBAAuB;QACvB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAEzD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,wCAAwC,EACxC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,aAAa,EAAE,UAAU,CAAC,YAAY;aACvC,CAAC;SACH,CACF,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAE5D,qDAAqD;YACrD,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;gBACjC,KAAK,EAAE,EAAE,MAAM,EAAE;aAClB,CAAC,CAAC;YAEH,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAKzC,CAAC;QAEF,uBAAuB;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAElE,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,qBAAqB,GAAG,OAAO,CACnC,MAAM,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAChD,CAAC;QAEF,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YACjD,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,IAAI,EAAE;gBACJ,WAAW,EAAE,oBAAoB;gBACjC,YAAY,EAAE,qBAAqB;gBACnC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS;aACV;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC/C,MAAM;YACN,SAAS,EAAE,MAAM,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,mCAAmC;QACnC,OAAO;YACL,GAAG,OAAO;YACV,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY;SAC9D,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IACjD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,EAAE,MAAM,EAAE;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;QACxD,KAAK,EAAE,EAAE,MAAM,EAAE;KAClB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,UAAU,CAAC;AACtB,CAAC"}

package/public/server/jira/unified-client.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Unified Jira Client Factory
+ *
+ * Standardizes Jira project lookups to use Cloud API when ATLASSIAN_USE_CLOUD_API=true
+ * and OAuth credentials are available, otherwise falls back to PAT/site URL.
+ */
+import type { AuthMode } from '../../config/jiraConnection';
+export interface UnifiedJiraClient {
+    baseUrl: string;
+    authHeaders: Record<string, string>;
+    authMode: AuthMode;
+    cloudId?: string;
+    jiraSite?: string;
+}
+export interface GetJiraClientOptions {
+    requireCloud?: boolean;
+    userId?: string;
+}
+/**
+ * Get unified Jira client for current context
+ *
+ * Priority:
+ * 1. Cloud API + OAuth (from DB-stored credential) - PRIMARY PATH for tenants
+ * 2. Site API + PAT (fallback for superadmin/test only)
+ *
+ * @param options - Options for client creation
+ * @returns Unified Jira client
+ */
+export declare function getJiraClientForCurrentContext(options?: GetJiraClientOptions): Promise<UnifiedJiraClient>;
+/**
+ * Make a Jira API request using the unified client
+ */
+export declare function makeJiraRequest(path: string, options?: GetJiraClientOptions & {
+    method?: string;
+    body?: unknown;
+}): Promise<Response>;
+/**
+ * Get diagnostic information about the current Jira connection
+ */
+export declare function getJiraConnectionDiagnostics(options?: GetJiraClientOptions): Promise<{
+    authMode: AuthMode;
+    jiraSite?: string;
+    cloudApiBase?: string;
+    cloudId?: string;
+    email?: string;
+    baseUrl: string;
+}>;
+//# sourceMappingURL=unified-client.d.ts.map

package/public/server/jira/unified-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-client.d.ts","sourceRoot":"","sources":["../../../src/server/jira/unified-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAyD5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA8DD;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAiF5B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAoB,GAAG;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACX,GACL,OAAO,CAAC,QAAQ,CAAC,CAcnB;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAWD"}