@betterportal/auth-workos 0.0.1

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/index.js

@@ -0,0 +1,2 @@
+export { title, description, auth, role, cacheHints } from "./route.impl.js";
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/logout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.d.ts

@@ -0,0 +1,27 @@
+import * as av from "anyvali";
+import type { Infer } from "anyvali";
+import { type ApiAuthRequirement, type CacheHints } from "@betterportal/framework";
+export declare const QuerySchema: av.ObjectSchema<{
+    next: av.OptionalSchema<av.StringSchema>;
+    redirect: av.OptionalSchema<av.StringSchema>;
+}>;
+export declare const ResponseSchema: av.ObjectSchema<{
+    status: av.EnumSchema<readonly ["ok"]>;
+    message: av.StringSchema;
+    nextUrl: av.StringSchema;
+}>;
+export type ResponseData = Infer<typeof ResponseSchema>;
+export declare const title = "WorkOS Logout";
+export declare const description = "Clear the stored WorkOS bearer token.";
+export declare const role = "auth.logout";
+export declare const auth: ApiAuthRequirement;
+export declare const cacheHints: CacheHints;
+export declare const handleGet: import("@betterportal/framework").RouteHandler<Record<string, string>, {
+    next?: string | undefined;
+    redirect?: string | undefined;
+}, Record<string, string>, Record<string, unknown>, {
+    status: "ok";
+    message: string;
+    nextUrl: string;
+}, unknown, Record<string, unknown>>;
+//# sourceMappingURL=route.impl.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.impl.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAiB,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAElG,eAAO,MAAM,WAAW;;;EAGI,CAAC;AAE7B,eAAO,MAAM,cAAc;;;;EAIC,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,kBAAkB,CAAC;AACrC,eAAO,MAAM,WAAW,0CAA0C,CAAC;AACnE,eAAO,MAAM,IAAI,gBAAgB,CAAC;AAClC,eAAO,MAAM,IAAI,EAAE,kBAAyD,CAAC;AAC7E,eAAO,MAAM,UAAU,EAAE,UAA0C,CAAC;AASpE,eAAO,MAAM,SAAS;;;;;;;oCAWrB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.js

@@ -0,0 +1,35 @@
+import * as av from "anyvali";
+import { createHandler } from "@betterportal/framework";
+export const QuerySchema = av.object({
+    next: av.optional(av.string()),
+    redirect: av.optional(av.string())
+}, { unknownKeys: "strip" });
+export const ResponseSchema = av.object({
+    status: av.enum_(["ok"]),
+    message: av.string(),
+    nextUrl: av.string()
+}, { unknownKeys: "strip" });
+export const title = "WorkOS Logout";
+export const description = "Clear the stored WorkOS bearer token.";
+export const role = "auth.logout";
+export const auth = { required: false, permissions: [] };
+export const cacheHints = { ttlSeconds: 0, varyBy: [] };
+function normalizeRedirect(raw) {
+    const redirect = raw?.trim();
+    if (!redirect)
+        return "/";
+    if (redirect.startsWith("http://") || redirect.startsWith("https://"))
+        return redirect;
+    return redirect.startsWith("/") ? redirect : `/${redirect}`;
+}
+export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema }, (ctx) => {
+    const query = ctx.query;
+    const nextUrl = normalizeRedirect(query.next ?? query.redirect);
+    ctx.bpHeaders?.remove("Authorization");
+    ctx.bpHeaders?.remove("X-BP-Refresh");
+    ctx.responseHeaders?.set("HX-Location", "/login?action=logout");
+    if (ctx.serviceId)
+        ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
+    return { status: "ok", message: "Signed out.", nextUrl };
+});
+//# sourceMappingURL=route.impl.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.impl.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,aAAa,EAA4C,MAAM,yBAAyB,CAAC;AAElG,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACnC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAU,CAAC;IACjC,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE;CACrB,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,KAAK,GAAG,eAAe,CAAC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,uCAAuC,CAAC;AACnE,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,SAAS,iBAAiB,CAAC,GAAuB;IAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvF,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,CAAC,GAAG,EAAE,EAAE;IACN,MAAM,KAAK,GAAG,GAAG,CAAC,KAAkC,CAAC;IACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,SAAS;QAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,IAAa,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.d.ts

@@ -0,0 +1,3 @@
+export { ResponseSchema, RequestSchema } from "./route.impl.js";
+export { handlePost as default } from "./route.impl.js";
+//# sourceMappingURL=POST.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"POST.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.js

@@ -0,0 +1,3 @@
+export { ResponseSchema, RequestSchema } from "./route.impl.js";
+export { handlePost as default } from "./route.impl.js";
+//# sourceMappingURL=POST.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"POST.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.d.ts

@@ -0,0 +1,2 @@
+export { title, description, auth, role, cacheHints } from "./route.impl.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.js

@@ -0,0 +1,2 @@
+export { title, description, auth, role, cacheHints } from "./route.impl.js";
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.d.ts

@@ -0,0 +1,32 @@
+import * as av from "anyvali";
+import type { Infer } from "anyvali";
+import { type ApiAuthRequirement, type CacheHints } from "@betterportal/framework";
+export declare const HeadersSchema: av.ObjectSchema<{
+    "x-bp-refresh": av.OptionalSchema<av.StringSchema>;
+}>;
+export declare const RequestSchema: av.ObjectSchema<{
+    refreshToken: av.OptionalSchema<av.StringSchema>;
+}>;
+export declare const ResponseSchema: av.ObjectSchema<{
+    status: av.EnumSchema<readonly ["ok", "error"]>;
+    message: av.OptionalSchema<av.StringSchema>;
+    accessToken: av.OptionalSchema<av.StringSchema>;
+    expiresInSeconds: av.OptionalSchema<av.IntSchema>;
+}>;
+export type ResponseData = Infer<typeof ResponseSchema>;
+export declare const title = "WorkOS Refresh";
+export declare const description = "Refresh BetterPortal tokens using the WorkOS refresh token.";
+export declare const role = "auth.refresh";
+export declare const auth: ApiAuthRequirement;
+export declare const cacheHints: CacheHints;
+export declare const handlePost: import("@betterportal/framework").RouteHandler<Record<string, string>, Record<string, unknown>, {
+    "x-bp-refresh"?: string | undefined;
+}, {
+    refreshToken?: string | undefined;
+}, {
+    status: "error" | "ok";
+    message?: string | undefined;
+    accessToken?: string | undefined;
+    expiresInSeconds?: number | undefined;
+}, unknown, Record<string, unknown>>;
+//# sourceMappingURL=route.impl.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.impl.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAQjC,eAAO,MAAM,aAAa;;EAEE,CAAC;AAE7B,eAAO,MAAM,aAAa;;EAEE,CAAC;AAE7B,eAAO,MAAM,cAAc;;;;;EAKC,CAAC;AAC7B,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,mBAAmB,CAAC;AACtC,eAAO,MAAM,WAAW,gEAAgE,CAAC;AACzF,eAAO,MAAM,IAAI,iBAAiB,CAAC;AACnC,eAAO,MAAM,IAAI,EAAE,kBAAyD,CAAC;AAC7E,eAAO,MAAM,UAAU,EAAE,UAA0C,CAAC;AAQpE,eAAO,MAAM,UAAU;;;;;;;;;oCAyDtB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.js

@@ -0,0 +1,78 @@
+import * as av from "anyvali";
+import { createHandler } from "@betterportal/framework";
+import { resolveWorkOSAppConfig, rolesFromWorkOSAccessToken, secondsUntilJwtExpiry } from "../../index.js";
+export const HeadersSchema = av.object({
+    "x-bp-refresh": av.optional(av.string())
+}, { unknownKeys: "strip" });
+export const RequestSchema = av.object({
+    refreshToken: av.optional(av.string().minLength(1))
+}, { unknownKeys: "strip" });
+export const ResponseSchema = av.object({
+    status: av.enum_(["ok", "error"]),
+    message: av.optional(av.string()),
+    accessToken: av.optional(av.string()),
+    expiresInSeconds: av.optional(av.int().min(1))
+}, { unknownKeys: "strip" });
+export const title = "WorkOS Refresh";
+export const description = "Refresh BetterPortal tokens using the WorkOS refresh token.";
+export const role = "auth.refresh";
+export const auth = { required: false, permissions: [] };
+export const cacheHints = { ttlSeconds: 0, varyBy: [] };
+function pluginFrom(ctx) {
+    const plugin = ctx.plugin;
+    if (!plugin)
+        throw new Error("WorkOS plugin not available on handler context");
+    return plugin;
+}
+export const handlePost = createHandler({ response: ResponseSchema, request: RequestSchema, headers: HeadersSchema }, async (ctx) => {
+    const config = resolveWorkOSAppConfig(ctx.config);
+    if (!config) {
+        return { status: "error", message: "WorkOS config is missing clientId or apiKey." };
+    }
+    const body = ctx.request;
+    const headers = ctx.headers;
+    const refreshToken = body.refreshToken ?? headers["x-bp-refresh"];
+    if (!refreshToken?.trim()) {
+        return { status: "error", message: "WorkOS refresh token is required." };
+    }
+    let auth;
+    try {
+        auth = await pluginFrom(ctx).refreshWorkOSToken(config, refreshToken);
+    }
+    catch (error) {
+        ctx.obs?.error(error);
+        return { status: "error", message: "WorkOS refresh token invalid or expired." };
+    }
+    const issued = pluginFrom(ctx).issueTokenPair({
+        sub: auth.user.id,
+        tenantId: ctx.tenant.id,
+        appId: ctx.app.id,
+        roles: rolesFromWorkOSAccessToken(auth.accessToken, config.roleClaimPath ?? "roles"),
+        authProvider: "workos",
+        providerSubject: auth.user.id,
+        provider: {
+            accountId: auth.user.id,
+            scope: auth.organizationId ? `organization:${auth.organizationId}` : undefined
+        },
+        name: auth.user.name ?? undefined,
+        email: auth.user.email,
+        picture: auth.user.profilePictureUrl ?? undefined
+    }, { includeRefreshToken: false });
+    ctx.bpHeaders?.set("Authorization", `Bearer ${issued.accessToken}`, {
+        locked: true,
+        expiresInSeconds: issued.accessTokenExpiresInSeconds,
+        refreshPath: "/refresh",
+        refreshBeforeSeconds: 60
+    });
+    ctx.bpHeaders?.set("X-BP-Refresh", auth.refreshToken, {
+        locked: true,
+        scopeToOwner: true,
+        expiresInSeconds: secondsUntilJwtExpiry(auth.accessToken)
+    });
+    return {
+        status: "ok",
+        accessToken: issued.accessToken,
+        expiresInSeconds: issued.accessTokenExpiresInSeconds
+    };
+});
+//# sourceMappingURL=route.impl.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.impl.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACzC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CACpD,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;IAC1C,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC/C,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,CAAC,MAAM,KAAK,GAAG,gBAAgB,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,6DAA6D,CAAC;AACzF,MAAM,CAAC,MAAM,IAAI,GAAG,cAAc,CAAC;AACnC,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,SAAS,UAAU,CAAC,GAAyB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAA4B,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,EAC5E,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAsC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;QAC5C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACvB,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;QACjB,KAAK,EAAE,0BAA0B,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;QACpF,YAAY,EAAE,QAAQ;QACtB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7B,QAAQ,EAAE;YACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YACvB,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;SAC/E;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;QACjC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;QACtB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS;KAClD,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;QAClE,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;QACpD,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,EAAE;KACzB,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE;QACpD,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,gBAAgB,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC;KAC1D,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;KACrD,CAAC;AACJ,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/index.d.ts

@@ -0,0 +1,166 @@
+import { type BSBServiceConstructor, type Observable } from "@bsb/base";
+import * as av from "anyvali";
+import { BPService, type BPServiceDefinition } from "@betterportal/plugin-bsb";
+import { type AuthenticationResponse } from "@workos-inc/node";
+import { type AppAuthPermissionAction, type ConfigSchemaDescriptor, type JwtClaims, type JwtVerifier, type TenantAppValidation } from "@betterportal/framework";
+declare const PluginConfigSchema: av.ObjectSchema<{
+    host: av.StringSchema;
+    port: av.IntSchema;
+    issuer: av.StringSchema;
+    audience: av.StringSchema;
+    accessTokenSeconds: av.IntSchema;
+    refreshTokenSeconds: av.IntSchema;
+    keyStorePath: av.StringSchema;
+    betterportal: av.OptionalSchema<av.ObjectSchema<{
+        bpConfigPath: av.OptionalSchema<av.StringSchema>;
+        configApiToken: av.OptionalSchema<av.StringSchema>;
+        configEncryptionKey: av.OptionalSchema<av.StringSchema>;
+        controlPlaneUrl: av.OptionalSchema<av.StringSchema>;
+        serviceApiKey: av.OptionalSchema<av.StringSchema>;
+        bootstrapStatePath: av.StringSchema;
+        scopedConfigCachePath: av.StringSchema;
+        trustedProxyHeaders: av.BoolSchema;
+        cfProxy: av.BoolSchema;
+        trustedProxyIps: av.ArraySchema<av.StringSchema>;
+    }>>;
+}>;
+export type WorkOSPluginConfig = av.Infer<typeof PluginConfigSchema>;
+declare const Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+    host: av.StringSchema;
+    port: av.IntSchema;
+    issuer: av.StringSchema;
+    audience: av.StringSchema;
+    accessTokenSeconds: av.IntSchema;
+    refreshTokenSeconds: av.IntSchema;
+    keyStorePath: av.StringSchema;
+    betterportal: av.OptionalSchema<av.ObjectSchema<{
+        bpConfigPath: av.OptionalSchema<av.StringSchema>;
+        configApiToken: av.OptionalSchema<av.StringSchema>;
+        configEncryptionKey: av.OptionalSchema<av.StringSchema>;
+        controlPlaneUrl: av.OptionalSchema<av.StringSchema>;
+        serviceApiKey: av.OptionalSchema<av.StringSchema>;
+        bootstrapStatePath: av.StringSchema;
+        scopedConfigCachePath: av.StringSchema;
+        trustedProxyHeaders: av.BoolSchema;
+        cfProxy: av.BoolSchema;
+        trustedProxyIps: av.ArraySchema<av.StringSchema>;
+    }>>;
+}>>;
+declare const EventSchemas: {
+    readonly emitEvents: {};
+    readonly onEvents: {};
+    readonly emitReturnableEvents: {};
+    readonly onReturnableEvents: {};
+    readonly emitBroadcast: {};
+    readonly onBroadcast: {};
+};
+export interface WorkOSAppConfig {
+    clientId: string;
+    apiKey: string;
+    provider?: string;
+    connectionId?: string;
+    organizationId?: string;
+    domainHint?: string;
+    scopes?: string;
+    loginRedirectPath?: string;
+    logoutRedirectPath?: string;
+    roleClaimPath?: string;
+    webhookSecret?: string;
+}
+export type WorkOSBrowserConfig = Omit<WorkOSAppConfig, "apiKey">;
+export declare function resolveWorkOSAppConfig(raw: Record<string, unknown> | undefined): WorkOSAppConfig | null;
+export declare function resolveWorkOSBrowserConfig(raw: Record<string, unknown> | undefined): WorkOSBrowserConfig | null;
+export declare const WorkOSConfigSchemas: ConfigSchemaDescriptor[];
+export declare class Plugin extends BPService<InstanceType<typeof Config>, typeof EventSchemas> {
+    static Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
+        host: av.StringSchema;
+        port: av.IntSchema;
+        issuer: av.StringSchema;
+        audience: av.StringSchema;
+        accessTokenSeconds: av.IntSchema;
+        refreshTokenSeconds: av.IntSchema;
+        keyStorePath: av.StringSchema;
+        betterportal: av.OptionalSchema<av.ObjectSchema<{
+            bpConfigPath: av.OptionalSchema<av.StringSchema>;
+            configApiToken: av.OptionalSchema<av.StringSchema>;
+            configEncryptionKey: av.OptionalSchema<av.StringSchema>;
+            controlPlaneUrl: av.OptionalSchema<av.StringSchema>;
+            serviceApiKey: av.OptionalSchema<av.StringSchema>;
+            bootstrapStatePath: av.StringSchema;
+            scopedConfigCachePath: av.StringSchema;
+            trustedProxyHeaders: av.BoolSchema;
+            cfProxy: av.BoolSchema;
+            trustedProxyIps: av.ArraySchema<av.StringSchema>;
+        }>>;
+    }>>;
+    static EventSchemas: {
+        readonly emitEvents: {};
+        readonly onEvents: {};
+        readonly emitReturnableEvents: {};
+        readonly onReturnableEvents: {};
+        readonly emitBroadcast: {};
+        readonly onBroadcast: {};
+    };
+    private keyPair;
+    constructor(cfg: BSBServiceConstructor<InstanceType<typeof Config>, typeof EventSchemas>);
+    init(obs: Observable): Promise<void>;
+    protected definition(): BPServiceDefinition;
+    protected onRegistered(): void;
+    protected getJwtVerifier(tenantId: string, appId: string): JwtVerifier | undefined;
+    protected validateTenantApp(tenantId: string, appId: string): Promise<TenantAppValidation>;
+    getWorkOSAppConfig(tenantId: string, appId: string): WorkOSAppConfig | null;
+    getAuthorizationUrl(config: WorkOSAppConfig, input: {
+        redirectUri: string;
+        state: string;
+    }): string;
+    authenticateWithCode(config: WorkOSAppConfig, code: string): Promise<AuthenticationResponse>;
+    refreshWorkOSToken(config: WorkOSAppConfig, refreshToken: string): Promise<AuthenticationResponse>;
+    syncPermissionsToWorkOS(tenantId: string, appId: string): Promise<{
+        created: number;
+        updated: number;
+        deleted: number;
+        deprecated: number;
+        current: number;
+    }>;
+    syncRolesFromWorkOS(tenantId: string, appId: string): Promise<{
+        roles: number;
+        grants: number;
+    }>;
+    issueTokenPair(input: {
+        sub: string;
+        tenantId: string;
+        appId: string;
+        roles: string[];
+        authProvider: string;
+        providerSubject: string;
+        provider?: JwtClaims["provider"];
+        name?: string;
+        email?: string;
+        picture?: string;
+    }, options?: {
+        includeRefreshToken?: boolean;
+    }): import("@betterportal/framework").BpIssuedTokenPair;
+    private getWorkOSRawConfig;
+    private workosConfigReadTicket;
+    private client;
+    private listWorkOSRoles;
+    private bpPermissionCatalog;
+    private toBpRole;
+    private pushRolesToConfigManager;
+    private matchingConfiguredApps;
+    private renderRoleSyncFragment;
+    private handlePermissionSync;
+    private handleRoleSync;
+    private handleWorkOSWebhook;
+    private tokenIssuer;
+}
+export { Config, EventSchemas };
+export declare function rolesFromWorkOSAccessToken(token: string, roleClaimPath?: string): string[];
+export declare function secondsUntilJwtExpiry(token: string): number | undefined;
+export declare function bpPermissionSlug(serviceId: string, viewId: string, action: AppAuthPermissionAction): string;
+export declare function parseBpPermissionSlug(slug: string): {
+    serviceId: string;
+    viewId: string;
+    action: AppAuthPermissionAction;
+} | null;
+//# sourceMappingURL=index.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-workos/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAG1B,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAEL,SAAS,EACT,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAU,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAML,KAAK,uBAAuB,EAK5B,KAAK,sBAAsB,EAE3B,KAAK,SAAS,EACd,KAAK,WAAW,EAGhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAMjC,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;EASI,CAAC;AAC7B,MAAM,MAAM,kBAAkB,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAErE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;GASX,CAAC;AAEF,QAAA,MAAM,YAAY;;;;;;;CAOhB,CAAC;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AAMlE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAiBvG;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAK/G;AAED,eAAO,MAAM,mBAAmB,EAAE,sBAAsB,EAuCvD,CAAC;AAmCF,qBAAa,MAAO,SAAQ,SAAS,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IACrF,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;QAAU;IACvB,MAAM,CAAC,YAAY;;;;;;;MAAgB;IACnC,OAAO,CAAC,OAAO,CAAc;gBAEjB,GAAG,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IAIlF,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1C,SAAS,CAAC,UAAU,IAAI,mBAAmB;IAa3C,SAAS,CAAC,YAAY,IAAI,IAAI;IAO9B,SAAS,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;cAMlE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQhG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAI3E,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAanG,oBAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAO5F,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAO5F,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAyD7J,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IActG,cAAc,CAAC,KAAK,EAAE;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,EAAE,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE;IAI9C,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,sBAAsB;IAgB9B,OAAO,CAAC,MAAM;YAIA,eAAe;IAU7B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,QAAQ;YAqBF,wBAAwB;IAmBtC,OAAO,CAAC,sBAAsB;YAchB,sBAAsB;YAkDtB,oBAAoB;YAcpB,cAAc;YAcd,mBAAmB;IAyBjC,OAAO,CAAC,WAAW;CASpB;AAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAEhC,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,SAAU,GAAG,MAAM,EAAE,CAS3F;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUvE;AA2BD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAE3G;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAAG,IAAI,CAOjI"}