@betterportal/auth-workos 10.1.64 → 10.1.65

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.js

@@ -1,148 +0,0 @@
-import * as av from "anyvali";
-import { createHandler } from "@betterportal/framework";
-import { resolveWorkOSAppConfig, workOSAccessTokenDetails, WorkOSRefreshContextSchema } from "../../index.js";
-export const HeadersSchema = av.object({
-    "x-bp-refresh": av.optional(av.string())
-});
-export const RequestSchema = av.object({
-    refreshToken: av.optional(av.string().minLength(1))
-});
-export const ResponseSchema = av.object({
-    status: av.enum_(["ok", "error"]),
-    message: av.optional(av.string()),
-    accessToken: av.optional(av.string()),
-    expiresInSeconds: av.optional(av.int().min(1))
-});
-export const title = "WorkOS Refresh";
-export const description = "Refresh BetterPortal tokens using a WorkOS-backed BP refresh token.";
-export const role = "auth.refresh";
-export const auth = { required: false, permissions: [] };
-export const cacheHints = { ttlSeconds: 0, varyBy: [] };
-function pluginFrom(ctx) {
-    const plugin = ctx.plugin;
-    if (!plugin)
-        throw new Error("WorkOS plugin not available on handler context");
-    return plugin;
-}
-function clearAuth(ctx) {
-    ctx.bpHeaders?.remove("Authorization");
-    ctx.bpHeaders?.remove("X-BP-Refresh");
-}
-export const handlePost = createHandler({ response: ResponseSchema, request: RequestSchema, headers: HeadersSchema }, async (ctx) => {
-    const config = resolveWorkOSAppConfig(ctx.config);
-    if (!config) {
-        ctx.setStatus?.(503);
-        return { status: "error", message: "WorkOS config is missing clientId or apiKey." };
-    }
-    const body = ctx.request;
-    const headers = ctx.headers;
-    const refreshToken = body.refreshToken ?? headers["x-bp-refresh"];
-    if (!refreshToken?.trim()) {
-        ctx.setStatus?.(401);
-        clearAuth(ctx);
-        return { status: "error", message: "Refresh token is required." };
-    }
-    const plugin = pluginFrom(ctx);
-    let claims;
-    try {
-        claims = await plugin.verifyRefreshToken({ refreshToken, tenantId: ctx.tenant.id, appId: ctx.app.id });
-    }
-    catch {
-        ctx.setStatus?.(401);
-        clearAuth(ctx);
-        return { status: "error", message: "Refresh token invalid or expired." };
-    }
-    let refreshContext;
-    try {
-        if (claims.authProvider !== "workos" || claims.providerSubject !== claims.sub)
-            throw new Error("Wrong auth provider");
-        refreshContext = WorkOSRefreshContextSchema.parse(claims.refreshContext);
-    }
-    catch {
-        ctx.setStatus?.(401);
-        clearAuth(ctx);
-        return { status: "error", message: "Refresh token belongs to a different auth provider." };
-    }
-    let state;
-    try {
-        state = await plugin.getWorkOSSessionState(config, {
-            userId: claims.sub,
-            sessionId: refreshContext.sessionId,
-            organizationId: refreshContext.organizationId
-        });
-    }
-    catch (error) {
-        ctx.obs?.error(error);
-        ctx.setStatus?.(502);
-        return { status: "error", message: "WorkOS session lookup failed." };
-    }
-    if (!state.sessionActive || !state.membershipActive) {
-        ctx.setStatus?.(401);
-        clearAuth(ctx);
-        return { status: "error", message: "WorkOS session or organization membership is inactive." };
-    }
-    let workosAuth;
-    try {
-        workosAuth = await plugin.refreshWorkOSToken(config, refreshContext.providerToken, refreshContext.organizationId);
-    }
-    catch (error) {
-        ctx.obs?.error(error);
-        const status = [400, 401, 403, 404, 422].includes(error?.status) ? 401 : 502;
-        ctx.setStatus?.(status);
-        if (status === 401)
-            clearAuth(ctx);
-        return {
-            status: "error",
-            message: status === 401 ? "WorkOS refresh token invalid, expired, or revoked." : "WorkOS token refresh failed."
-        };
-    }
-    const details = workOSAccessTokenDetails(workosAuth.accessToken, config.roleClaimPath ?? "roles");
-    if (!details
-        || workosAuth.user.id !== claims.sub
-        || details.sessionId !== refreshContext.sessionId
-        || (details.organizationId ?? "") !== (refreshContext.organizationId ?? "")
-        || (workosAuth.organizationId ?? details.organizationId ?? "") !== (refreshContext.organizationId ?? "")) {
-        ctx.setStatus?.(401);
-        clearAuth(ctx);
-        return { status: "error", message: "WorkOS refreshed identity does not match the original session." };
-    }
-    const issued = plugin.issueTokenPair({
-        sub: workosAuth.user.id,
-        tenantId: ctx.tenant.id,
-        appId: ctx.app.id,
-        roles: details.roles,
-        authProvider: "workos",
-        refreshContext: {
-            providerToken: workosAuth.refreshToken,
-            sessionId: details.sessionId,
-            ...(details.organizationId ? { organizationId: details.organizationId } : {})
-        },
-        providerSubject: workosAuth.user.id,
-        provider: {
-            accountId: workosAuth.user.id,
-            scope: details.organizationId ? `organization:${details.organizationId}` : undefined
-        },
-        name: workosAuth.user.name ?? undefined,
-        email: workosAuth.user.email,
-        picture: workosAuth.user.profilePictureUrl ?? undefined
-    });
-    if (!issued.refreshToken)
-        throw new Error("Auth token issuer did not return a refresh token");
-    ctx.bpHeaders?.set("Authorization", `Bearer ${issued.accessToken}`, {
-        locked: true,
-        expiresInSeconds: issued.accessTokenExpiresInSeconds,
-        refreshPath: "/refresh",
-        refreshBeforeSeconds: 60
-    });
-    ctx.bpHeaders?.set("X-BP-Refresh", issued.refreshToken, {
-        locked: true,
-        scopeToOwner: true,
-        expiresInSeconds: issued.refreshTokenExpiresInSeconds
-    });
-    return {
-        status: "ok",
-        accessToken: issued.accessToken,
-        expiresInSeconds: issued.accessTokenExpiresInSeconds
-    };
-});
-//# sourceMappingURL=route.impl.js.map

package/lib/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.impl.js","sourceRoot":"","sources":["../../../../../src/plugins/service-betterportal-auth-workos/bp-routes/refresh/route.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC;IAC1C,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,gBAAgB,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,qEAAqE,CAAC;AACjG,MAAM,CAAC,MAAM,IAAI,GAAG,cAAc,CAAC;AACnC,MAAM,CAAC,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,SAAS,UAAU,CAAC,GAAyB;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAA4B,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAmD;IACpE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,EAC5E,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAsC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,cAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtH,cAAc,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtG,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE;YACjD,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,SAAS,EAAE,cAAc,CAAC,SAAS;YACnC,cAAc,EAAE,cAAc,CAAC,cAAc;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;IACzG,CAAC;IAED,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC;IACpH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,MAAM,KAAK,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,8BAA8B;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO;WACP,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG;WACjC,OAAO,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS;WAC9C,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,IAAI,EAAE,CAAC;WACxE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3G,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;QACnC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QACvB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACvB,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE;YACd,aAAa,EAAE,UAAU,CAAC,YAAY;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E;QACD,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QACnC,QAAQ,EAAE;YACR,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YAC7B,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;SACrF;QACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;QACvC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK;QAC5B,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,IAAI,SAAS;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAE9F,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;QAClE,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;QACpD,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,EAAE;KACzB,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,gBAAgB,EAAE,MAAM,CAAC,4BAA4B;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;KACrD,CAAC;AACJ,CAAC,CACF,CAAC"}