@betterportal/auth-workos 10.1.64 → 10.1.65

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.js

@@ -1,5 +1,149 @@
 export const operationId = "auth.refresh";
-export { title, description, auth, role, cacheHints } from "./route.impl.js";
-export { ResponseSchema, RequestSchema, HeadersSchema } from "./route.impl.js";
-export { handlePost as default } from "./route.impl.js";
+import * as av from "anyvali";
+import { createHandler } from "@betterportal/framework";
+import { resolveWorkOSAppConfig, workOSAccessTokenDetails, WorkOSRefreshContextSchema } from "../../index.js";
+export const HeadersSchema = av.object({
+    "x-bp-refresh": av.optional(av.string())
+});
+export const RequestSchema = av.object({
+    refreshToken: av.optional(av.string().minLength(1))
+});
+export const ResponseSchema = av.object({
+    status: av.enum_(["ok", "error"]),
+    message: av.optional(av.string()),
+    accessToken: av.optional(av.string()),
+    expiresInSeconds: av.optional(av.int().min(1))
+});
+export const title = "WorkOS Refresh";
+export const description = "Refresh BetterPortal tokens using a WorkOS-backed BP refresh token.";
+export const role = "auth.refresh";
+export const auth = { required: false, permissions: [] };
+export const cacheHints = { ttlSeconds: 0, varyBy: [] };
+function pluginFrom(ctx) {
+    const plugin = ctx.plugin;
+    if (!plugin)
+        throw new Error("WorkOS plugin not available on handler context");
+    return plugin;
+}
+function clearAuth(ctx) {
+    ctx.bpHeaders?.remove("Authorization");
+    ctx.bpHeaders?.remove("X-BP-Refresh");
+}
+export default createHandler({ response: ResponseSchema, request: RequestSchema, headers: HeadersSchema }, async (ctx) => {
+    const config = resolveWorkOSAppConfig(ctx.config);
+    if (!config) {
+        ctx.setStatus?.(503);
+        return { status: "error", message: "WorkOS config is missing clientId or apiKey." };
+    }
+    const body = ctx.request;
+    const headers = ctx.headers;
+    const refreshToken = body.refreshToken ?? headers["x-bp-refresh"];
+    if (!refreshToken?.trim()) {
+        ctx.setStatus?.(401);
+        clearAuth(ctx);
+        return { status: "error", message: "Refresh token is required." };
+    }
+    const plugin = pluginFrom(ctx);
+    let claims;
+    try {
+        claims = await plugin.verifyRefreshToken({ refreshToken, tenantId: ctx.tenant.id, appId: ctx.app.id });
+    }
+    catch {
+        ctx.setStatus?.(401);
+        clearAuth(ctx);
+        return { status: "error", message: "Refresh token invalid or expired." };
+    }
+    let refreshContext;
+    try {
+        if (claims.authProvider !== "workos" || claims.providerSubject !== claims.sub)
+            throw new Error("Wrong auth provider");
+        refreshContext = WorkOSRefreshContextSchema.parse(claims.refreshContext);
+    }
+    catch {
+        ctx.setStatus?.(401);
+        clearAuth(ctx);
+        return { status: "error", message: "Refresh token belongs to a different auth provider." };
+    }
+    let state;
+    try {
+        state = await plugin.getWorkOSSessionState(config, {
+            userId: claims.sub,
+            sessionId: refreshContext.sessionId,
+            organizationId: refreshContext.organizationId
+        });
+    }
+    catch (error) {
+        ctx.obs?.error(error);
+        ctx.setStatus?.(502);
+        return { status: "error", message: "WorkOS session lookup failed." };
+    }
+    if (!state.sessionActive || !state.membershipActive) {
+        ctx.setStatus?.(401);
+        clearAuth(ctx);
+        return { status: "error", message: "WorkOS session or organization membership is inactive." };
+    }
+    let workosAuth;
+    try {
+        workosAuth = await plugin.refreshWorkOSToken(config, refreshContext.providerToken, refreshContext.organizationId);
+    }
+    catch (error) {
+        ctx.obs?.error(error);
+        const status = [400, 401, 403, 404, 422].includes(error?.status) ? 401 : 502;
+        ctx.setStatus?.(status);
+        if (status === 401)
+            clearAuth(ctx);
+        return {
+            status: "error",
+            message: status === 401 ? "WorkOS refresh token invalid, expired, or revoked." : "WorkOS token refresh failed."
+        };
+    }
+    const details = workOSAccessTokenDetails(workosAuth.accessToken, config.roleClaimPath ?? "roles");
+    if (!details
+        || workosAuth.user.id !== claims.sub
+        || details.sessionId !== refreshContext.sessionId
+        || (details.organizationId ?? "") !== (refreshContext.organizationId ?? "")
+        || (workosAuth.organizationId ?? details.organizationId ?? "") !== (refreshContext.organizationId ?? "")) {
+        ctx.setStatus?.(401);
+        clearAuth(ctx);
+        return { status: "error", message: "WorkOS refreshed identity does not match the original session." };
+    }
+    const issued = plugin.issueTokenPair({
+        sub: workosAuth.user.id,
+        tenantId: ctx.tenant.id,
+        appId: ctx.app.id,
+        roles: details.roles,
+        authProvider: "workos",
+        refreshContext: {
+            providerToken: workosAuth.refreshToken,
+            sessionId: details.sessionId,
+            ...(details.organizationId ? { organizationId: details.organizationId } : {})
+        },
+        providerSubject: workosAuth.user.id,
+        provider: {
+            accountId: workosAuth.user.id,
+            scope: details.organizationId ? `organization:${details.organizationId}` : undefined
+        },
+        name: workosAuth.user.name ?? undefined,
+        email: workosAuth.user.email,
+        picture: workosAuth.user.profilePictureUrl ?? undefined
+    });
+    if (!issued.refreshToken)
+        throw new Error("Auth token issuer did not return a refresh token");
+    ctx.bpHeaders?.set("Authorization", `Bearer ${issued.accessToken}`, {
+        locked: true,
+        expiresInSeconds: issued.accessTokenExpiresInSeconds,
+        refreshPath: "/refresh",
+        refreshBeforeSeconds: 60
+    });
+    ctx.bpHeaders?.set("X-BP-Refresh", issued.refreshToken, {
+        locked: true,
+        scopeToOwner: true,
+        expiresInSeconds: issued.refreshTokenExpiresInSeconds
+    });
+    return {
+        status: "ok",
+        accessToken: issued.accessToken,
+        expiresInSeconds: issued.accessTokenExpiresInSeconds
+    };
+});
 //# sourceMappingURL=POST.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.js.map

@@ -1 +1 @@
-{"version":3,"file":"POST.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"POST.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/POST.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;IAC1C,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,gBAAgB,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,qEAAqE,CAAC;AACjG,MAAM,CAAC,MAAM,IAAI,GAAG,cAAc,CAAC;AACnC,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,SAAS,UAAU,CAAC,GAAyB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAA4B,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAmD;IACpE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC;AAED,eAAe,aAAa,CAC1B,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,EAC5E,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAsC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,cAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtH,cAAc,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE;YACjD,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,SAAS,EAAE,cAAc,CAAC,SAAS;YACnC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACzG,CAAC;IAED,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;IACpH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,MAAM,KAAK,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,8BAA8B;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO;WACP,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG;WACjC,OAAO,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS;WAC9C,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,IAAI,EAAE,CAAC;WACxE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;QACnC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QACvB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACvB,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;QACD,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QACnC,QAAQ,EAAE;YACR,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YAC7B,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;SACrF;QACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;QACvC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK;QAC5B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAE9F,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;QAClE,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;QACpD,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,EAAE;KACzB,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,gBAAgB,EAAE,MAAM,CAAC,4BAA4B;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;KACrD,CAAC;AACJ,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.d.ts

@@ -1,2 +1,2 @@
-export { title, description } from "./route.impl.js";
+export { title, description } from "./POST.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.js

@@ -1,2 +1,2 @@
-export { title, description } from "./route.impl.js";
+export { title, description } from "./POST.js";
 //# sourceMappingURL=index.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/lib/schemas/service-betterportal-auth-workos.json

@@ -1,7 +1,7 @@
 {
   "pluginName": "org.betterportal.auth.workos",
   "events": {},
-  "version": "10.1.64",
+  "version": "10.1.65",
   "configSchema": {
     "anyvaliVersion": "1.0",
     "schemaVersion": "1.1",

package/lib/schemas/service-betterportal-auth-workos.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "service-betterportal-auth-workos",
   "name": "org.betterportal.auth.workos",
-  "version": "10.1.64",
+  "version": "10.1.65",
   "description": "BetterPortal WorkOS auth service",
   "category": "service",
   "tags": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@betterportal/auth-workos",
-  "version": "10.1.64",
+  "version": "10.1.65",
   "description": "BetterPortal WorkOS auth service for Node.js",
   "main": "lib/index.js",
   "types": "src/index.ts",
@@ -33,9 +33,9 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@betterportal/framework": "10.1.64",
-    "@betterportal/plugin-bsb": "10.1.64",
-    "@bsb/base": "^9.6.61",
+    "@betterportal/framework": "10.1.65",
+    "@betterportal/plugin-bsb": "10.1.65",
+    "@bsb/base": "^9.6.66",
     "@workos-inc/node": "^10.7.0",
     "anyvali": "^1.0.6",
     "jsonwebtoken": "^9.0.2",

package/lib/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.d.ts

@@ -1,62 +0,0 @@
-import * as av from "anyvali";
-import type { Infer } from "anyvali";
-import { type ApiAuthRequirement, type BetterPortalRouteChrome, type CacheHints } from "@betterportal/framework";
-export declare const QuerySchema: av.ObjectSchema<{
-    action: av.OptionalSchema<av.StringSchema>;
-    code: av.OptionalSchema<av.StringSchema>;
-    state: av.OptionalSchema<av.StringSchema>;
-    next: av.OptionalSchema<av.StringSchema>;
-    redirect: av.OptionalSchema<av.StringSchema>;
-    error: av.OptionalSchema<av.StringSchema>;
-    error_description: av.OptionalSchema<av.StringSchema>;
-}>;
-export declare const HeadersSchema: av.ObjectSchema<{}>;
-export declare const ResponseSchema: av.ObjectSchema<{
-    status: av.EnumSchema<readonly ["ok", "error"]>;
-    message: av.OptionalSchema<av.StringSchema>;
-    authorizationUrl: av.OptionalSchema<av.StringSchema>;
-    loginUI: av.EnumSchema<readonly ["default", "clean", "redirect"]>;
-    alreadyLoggedIn: av.OptionalSchema<av.BoolSchema>;
-    loggedOut: av.OptionalSchema<av.BoolSchema>;
-    signedIn: av.OptionalSchema<av.BoolSchema>;
-    nextUrl: av.OptionalSchema<av.StringSchema>;
-    user: av.OptionalSchema<av.ObjectSchema<{
-        id: av.OptionalSchema<av.StringSchema>;
-        name: av.OptionalSchema<av.StringSchema>;
-        email: av.OptionalSchema<av.StringSchema>;
-        picture: av.OptionalSchema<av.StringSchema>;
-    }>>;
-}>;
-export type ResponseData = Infer<typeof ResponseSchema>;
-export declare const title = "WorkOS Login";
-export declare const description = "Authenticate with WorkOS AuthKit and store BetterPortal auth headers.";
-export declare const role = "auth.login";
-export declare const dependencies: string[];
-export declare const chrome: BetterPortalRouteChrome;
-export declare const auth: ApiAuthRequirement;
-export declare const cacheHints: CacheHints;
-export declare const handleGet: import("@betterportal/framework").RouteHandler<Record<string, string>, {
-    action?: string | undefined;
-    code?: string | undefined;
-    state?: string | undefined;
-    next?: string | undefined;
-    redirect?: string | undefined;
-    error?: string | undefined;
-    error_description?: string | undefined;
-}, {}, Record<string, unknown>, {
-    status: "error" | "ok";
-    loginUI: "redirect" | "default" | "clean";
-    message?: string | undefined;
-    authorizationUrl?: string | undefined;
-    alreadyLoggedIn?: boolean | undefined;
-    loggedOut?: boolean | undefined;
-    signedIn?: boolean | undefined;
-    nextUrl?: string | undefined;
-    user?: {
-        id?: string | undefined;
-        name?: string | undefined;
-        email?: string | undefined;
-        picture?: string | undefined;
-    } | undefined;
-}, unknown, Record<string, unknown>>;
-//# sourceMappingURL=route.impl.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAOjC,eAAO,MAAM,WAAW;;;;;;;;EAQtB,CAAC;AAEH,eAAO,MAAM,aAAa,qBAAgB,CAAC;AAE3C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;EAezB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,iBAAiB,CAAC;AACpC,eAAO,MAAM,WAAW,0EAA0E,CAAC;AACnG,eAAO,MAAM,IAAI,eAAe,CAAC;AACjC,eAAO,MAAM,YAAY,UAAkC,CAAC;AAC5D,eAAO,MAAM,MAAM,EAAE,uBAA8C,CAAC;AACpE,eAAO,MAAM,IAAI,EAAE,kBAAyD,CAAC;AAC7E,eAAO,MAAM,UAAU,EAAE,UAA0C,CAAC;AAYpE,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;oCA2HrB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.js

@@ -1,165 +0,0 @@
-import * as av from "anyvali";
-import { createHandler, resolveAppAuthRedirect } from "@betterportal/framework";
-import { resolveWorkOSAppConfig, workOSAccessTokenDetails } from "../../index.js";
-export const QuerySchema = av.object({
-    action: av.optional(av.string()),
-    code: av.optional(av.string()),
-    state: av.optional(av.string()),
-    next: av.optional(av.string()),
-    redirect: av.optional(av.string()),
-    error: av.optional(av.string()),
-    error_description: av.optional(av.string())
-});
-export const HeadersSchema = av.object({});
-export const ResponseSchema = av.object({
-    status: av.enum_(["ok", "error"]),
-    message: av.optional(av.string()),
-    authorizationUrl: av.optional(av.string()),
-    loginUI: av.enum_(["default", "clean", "redirect"]).default("default"),
-    alreadyLoggedIn: av.optional(av.bool()),
-    loggedOut: av.optional(av.bool()),
-    signedIn: av.optional(av.bool()),
-    nextUrl: av.optional(av.string()),
-    user: av.optional(av.object({
-        id: av.optional(av.string()),
-        name: av.optional(av.string()),
-        email: av.optional(av.string()),
-        picture: av.optional(av.string())
-    }))
-});
-export const title = "WorkOS Login";
-export const description = "Authenticate with WorkOS AuthKit and store BetterPortal auth headers.";
-export const role = "auth.login";
-export const dependencies = ["auth.logout", "auth.refresh"];
-export const chrome = { fullScreen: true };
-export const auth = { required: false, permissions: [] };
-export const cacheHints = { ttlSeconds: 0, varyBy: [] };
-function pluginFrom(ctx) {
-    const plugin = ctx.plugin;
-    if (!plugin)
-        throw new Error("WorkOS plugin not available on handler context");
-    return plugin;
-}
-function firstString(...values) {
-    return values.find((value) => typeof value === "string" && value.trim().length > 0)?.trim();
-}
-export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema, headers: HeadersSchema }, async (ctx) => {
-    const query = ctx.query;
-    const config = resolveWorkOSAppConfig(ctx.config);
-    const nextUrl = resolveAppAuthRedirect(ctx, "afterLogin", query.state ?? query.next ?? query.redirect);
-    if (query.action === "logout") {
-        ctx.bpHeaders?.remove("Authorization");
-        ctx.bpHeaders?.remove("X-BP-Refresh");
-        if (ctx.serviceId)
-            ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
-        return {
-            status: "ok",
-            message: "Signed out.",
-            loginUI: config?.loginUI ?? "default",
-            loggedOut: true,
-            nextUrl: resolveAppAuthRedirect(ctx, "afterLogout")
-        };
-    }
-    if (!config) {
-        return { status: "error", message: "WorkOS config is missing clientId or apiKey.", loginUI: "default", nextUrl };
-    }
-    if (query.error) {
-        return {
-            status: "error",
-            message: query.error_description || query.error,
-            loginUI: config.loginUI ?? "default",
-            nextUrl
-        };
-    }
-    if (query.code) {
-        try {
-            const auth = await pluginFrom(ctx).authenticateWithCode(config, query.code);
-            const details = workOSAccessTokenDetails(auth.accessToken, config.roleClaimPath ?? "roles");
-            if (!details)
-                throw new Error("WorkOS access token is missing its session id.");
-            if (auth.organizationId && details.organizationId && auth.organizationId !== details.organizationId) {
-                throw new Error("WorkOS organization does not match the access token.");
-            }
-            const organizationId = auth.organizationId ?? details.organizationId;
-            const issued = pluginFrom(ctx).issueTokenPair({
-                sub: auth.user.id,
-                tenantId: ctx.tenant.id,
-                appId: ctx.app.id,
-                roles: details.roles,
-                authProvider: "workos",
-                refreshContext: {
-                    providerToken: auth.refreshToken,
-                    sessionId: details.sessionId,
-                    ...(organizationId ? { organizationId } : {})
-                },
-                providerSubject: auth.user.id,
-                provider: {
-                    accountId: auth.user.id,
-                    scope: organizationId ? `organization:${organizationId}` : undefined
-                },
-                name: firstString(auth.user.name, [auth.user.firstName, auth.user.lastName].filter(Boolean).join(" ")),
-                email: auth.user.email,
-                picture: auth.user.profilePictureUrl ?? undefined
-            });
-            if (!issued.refreshToken)
-                throw new Error("Auth token issuer did not return a refresh token");
-            ctx.bpHeaders?.set("Authorization", `Bearer ${issued.accessToken}`, {
-                locked: true,
-                expiresInSeconds: issued.accessTokenExpiresInSeconds,
-                refreshPath: "/refresh",
-                refreshBeforeSeconds: 60
-            });
-            ctx.bpHeaders?.set("X-BP-Refresh", issued.refreshToken, {
-                locked: true,
-                scopeToOwner: true,
-                expiresInSeconds: issued.refreshTokenExpiresInSeconds
-            });
-            ctx.responseHeaders?.set("HX-Redirect", nextUrl);
-            if (ctx.serviceId)
-                ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
-            return {
-                status: "ok",
-                message: "Signed in.",
-                loginUI: config.loginUI ?? "default",
-                signedIn: true,
-                nextUrl,
-                user: {
-                    id: auth.user.id,
-                    name: firstString(auth.user.name, [auth.user.firstName, auth.user.lastName].filter(Boolean).join(" ")),
-                    email: auth.user.email,
-                    picture: auth.user.profilePictureUrl ?? undefined
-                }
-            };
-        }
-        catch (error) {
-            ctx.obs?.error(error);
-            return { status: "error", message: `WorkOS sign in failed: ${error.message}`, loginUI: config.loginUI ?? "default", nextUrl };
-        }
-    }
-    if (ctx.user) {
-        return {
-            status: "ok",
-            message: "Already signed in.",
-            loginUI: config.loginUI ?? "default",
-            alreadyLoggedIn: true,
-            nextUrl,
-            user: {
-                id: ctx.user.sub,
-                name: ctx.user.name,
-                email: ctx.user.email,
-                picture: ctx.user.picture
-            }
-        };
-    }
-    const redirectUri = ctx.uiRouteUrl?.("login.index", { absolute: true }) ??
-        ctx.routeUrl?.("login.index", { absolute: true }) ??
-        "/login";
-    return {
-        status: "ok",
-        message: "Continue to WorkOS.",
-        loginUI: config.loginUI ?? "default",
-        authorizationUrl: pluginFrom(ctx).getAuthorizationUrl(config, { redirectUri, state: nextUrl }),
-        nextUrl
-    };
-});
-//# sourceMappingURL=route.impl.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/login/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,aAAa,EACb,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAChC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC/B,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAClC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC/B,iBAAiB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;IAC1C,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC1C,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC/E,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACjC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,cAAc,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,uEAAuE,CAAC;AACnG,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACpE,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,SAAS,UAAU,CAAC,GAAyB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAA4B,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,MAAwC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,KAAK,GAAG,GAAG,CAAC,KAAkC,CAAC;IACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvG,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,aAAa;YACtB,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,SAAS;YACrC,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,OAAO,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC;IACrI,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;YACpC,OAAO;SACR,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;YAC5F,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChF,IAAI,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;gBACpG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC;YACrE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;gBAC5C,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;gBACvB,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;gBACjB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,YAAY,EAAE,QAAQ;gBACtB,cAAc,EAAE;oBACd,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C;gBACD,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC7B,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBACvB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;iBACrE;gBACD,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS;aAClD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAC9F,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;gBAClE,MAAM,EAAE,IAAI;gBACZ,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;gBACpD,WAAW,EAAE,UAAU;gBACvB,oBAAoB,EAAE,EAAE;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;gBACtD,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,gBAAgB,EAAE,MAAM,CAAC,4BAA4B;aACtD,CAAC,CAAC;YACH,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,SAAS;gBAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,OAAO;gBACL,MAAM,EAAE,IAAa;gBACrB,OAAO,EAAE,YAAY;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;gBACpC,QAAQ,EAAE,IAAI;gBACd,OAAO;gBACP,IAAI,EAAE;oBACJ,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;oBAChB,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtG,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;oBACtB,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS;iBAClD;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,0BAA2B,KAAe,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC;QACpJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;YACpC,eAAe,EAAE,IAAI;YACrB,OAAO;YACP,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;gBACrB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO;aAC1B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GACf,GAAG,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnD,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC;IACX,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;QACpC,gBAAgB,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC9F,OAAO;KACR,CAAC;AACJ,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.d.ts

@@ -1,27 +0,0 @@
-import * as av from "anyvali";
-import type { Infer } from "anyvali";
-import { type ApiAuthRequirement, type CacheHints } from "@betterportal/framework";
-export declare const QuerySchema: av.ObjectSchema<{
-    next: av.OptionalSchema<av.StringSchema>;
-    redirect: av.OptionalSchema<av.StringSchema>;
-}>;
-export declare const ResponseSchema: av.ObjectSchema<{
-    status: av.EnumSchema<readonly ["ok"]>;
-    message: av.StringSchema;
-    nextUrl: av.StringSchema;
-}>;
-export type ResponseData = Infer<typeof ResponseSchema>;
-export declare const title = "WorkOS Logout";
-export declare const description = "Clear the stored WorkOS bearer token.";
-export declare const role = "auth.logout";
-export declare const auth: ApiAuthRequirement;
-export declare const cacheHints: CacheHints;
-export declare const handleGet: import("@betterportal/framework").RouteHandler<Record<string, string>, {
-    next?: string | undefined;
-    redirect?: string | undefined;
-}, Record<string, string>, Record<string, unknown>, {
-    status: "ok";
-    message: string;
-    nextUrl: string;
-}, unknown, Record<string, unknown>>;
-//# sourceMappingURL=route.impl.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAyC,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1H,eAAO,MAAM,WAAW;;;EAGtB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;EAIzB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,kBAAkB,CAAC;AACrC,eAAO,MAAM,WAAW,0CAA0C,CAAC;AACnE,eAAO,MAAM,IAAI,gBAAgB,CAAC;AAClC,eAAO,MAAM,IAAI,EAAE,kBAAyD,CAAC;AAC7E,eAAO,MAAM,UAAU,EAAE,UAA0C,CAAC;AAEpE,eAAO,MAAM,SAAS;;;;;;;oCAWrB,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.js

@@ -1,27 +0,0 @@
-import * as av from "anyvali";
-import { createHandler, resolveAppAuthRedirect } from "@betterportal/framework";
-export const QuerySchema = av.object({
-    next: av.optional(av.string()),
-    redirect: av.optional(av.string())
-});
-export const ResponseSchema = av.object({
-    status: av.enum_(["ok"]),
-    message: av.string(),
-    nextUrl: av.string()
-});
-export const title = "WorkOS Logout";
-export const description = "Clear the stored WorkOS bearer token.";
-export const role = "auth.logout";
-export const auth = { required: false, permissions: [] };
-export const cacheHints = { ttlSeconds: 0, varyBy: [] };
-export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema }, (ctx) => {
-    const query = ctx.query;
-    const nextUrl = resolveAppAuthRedirect(ctx, "afterLogout", query.next ?? query.redirect);
-    ctx.bpHeaders?.remove("Authorization");
-    ctx.bpHeaders?.remove("X-BP-Refresh");
-    ctx.responseHeaders?.set("HX-Location", "/login?action=logout");
-    if (ctx.serviceId)
-        ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
-    return { status: "ok", message: "Signed out.", nextUrl };
-});
-//# sourceMappingURL=route.impl.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/logout/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAA4C,MAAM,yBAAyB,CAAC;AAE1H,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IAC9B,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAU,CAAC;IACjC,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,eAAe,CAAC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,uCAAuC,CAAC;AACnE,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,CAAC,GAAG,EAAE,EAAE;IACN,MAAM,KAAK,GAAG,GAAG,CAAC,KAAkC,CAAC;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzF,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,SAAS;QAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,IAAa,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.d.ts

@@ -1,32 +0,0 @@
-import * as av from "anyvali";
-import type { Infer } from "anyvali";
-import { type ApiAuthRequirement, type CacheHints } from "@betterportal/framework";
-export declare const HeadersSchema: av.ObjectSchema<{
-    "x-bp-refresh": av.OptionalSchema<av.StringSchema>;
-}>;
-export declare const RequestSchema: av.ObjectSchema<{
-    refreshToken: av.OptionalSchema<av.StringSchema>;
-}>;
-export declare const ResponseSchema: av.ObjectSchema<{
-    status: av.EnumSchema<readonly ["ok", "error"]>;
-    message: av.OptionalSchema<av.StringSchema>;
-    accessToken: av.OptionalSchema<av.StringSchema>;
-    expiresInSeconds: av.OptionalSchema<av.IntSchema>;
-}>;
-export type ResponseData = Infer<typeof ResponseSchema>;
-export declare const title = "WorkOS Refresh";
-export declare const description = "Refresh BetterPortal tokens using a WorkOS-backed BP refresh token.";
-export declare const role = "auth.refresh";
-export declare const auth: ApiAuthRequirement;
-export declare const cacheHints: CacheHints;
-export declare const handlePost: import("@betterportal/framework").RouteHandler<Record<string, string>, Record<string, unknown>, {
-    "x-bp-refresh"?: string | undefined;
-}, {
-    refreshToken?: string | undefined;
-}, {
-    status: "error" | "ok";
-    message?: string | undefined;
-    accessToken?: string | undefined;
-    expiresInSeconds?: number | undefined;
-}, unknown, Record<string, unknown>>;
-//# sourceMappingURL=route.impl.d.ts.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAQjC,eAAO,MAAM,aAAa;;EAExB,CAAC;AAEH,eAAO,MAAM,aAAa;;EAExB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;EAKzB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,mBAAmB,CAAC;AACtC,eAAO,MAAM,WAAW,wEAAwE,CAAC;AACjG,eAAO,MAAM,IAAI,iBAAiB,CAAC;AACnC,eAAO,MAAM,IAAI,EAAE,kBAAyD,CAAC;AAC7E,eAAO,MAAM,UAAU,EAAE,UAA0C,CAAC;AAapE,eAAO,MAAM,UAAU;;;;;;;;;oCAyHtB,CAAC"}