@caido/server-auth 0.1.0

package/dist/index.cjs

@@ -0,0 +1,400 @@
+let _urql_core = require("@urql/core");
+let graphql_ws = require("graphql-ws");
+let graphql_tag = require("graphql-tag");
+
+//#region src/errors.ts
+/**
+* Base error class for authentication-related errors.
+*/
+var AuthenticationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AuthenticationError";
+	}
+};
+/**
+* Error thrown when the authentication flow fails to start.
+*/
+var AuthenticationFlowError = class extends AuthenticationError {
+	/** Error code from the API */
+	code;
+	constructor(code, message) {
+		super(`${code}: ${message}`);
+		this.name = "AuthenticationFlowError";
+		this.code = code;
+	}
+};
+/**
+* Error thrown when token refresh fails.
+*/
+var TokenRefreshError = class extends AuthenticationError {
+	/** Error code from the API */
+	code;
+	constructor(code, message) {
+		super(`${code}: ${message}`);
+		this.name = "TokenRefreshError";
+		this.code = code;
+	}
+};
+/**
+* Error thrown when device approval fails.
+*/
+var DeviceApprovalError = class extends AuthenticationError {
+	/** HTTP status code if available */
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.name = "DeviceApprovalError";
+		this.statusCode = statusCode;
+	}
+};
+/**
+* Error thrown when fetching device information fails.
+*/
+var DeviceInformationError = class extends AuthenticationError {
+	/** HTTP status code if available */
+	statusCode;
+	constructor(message, statusCode) {
+		super(message);
+		this.name = "DeviceInformationError";
+		this.statusCode = statusCode;
+	}
+};
+
+//#endregion
+//#region src/queries.ts
+const START_AUTHENTICATION_FLOW = graphql_tag.gql`
+  mutation StartAuthenticationFlow {
+    startAuthenticationFlow {
+      request {
+        id
+        userCode
+        verificationUrl
+        expiresAt
+      }
+      error {
+        code
+        message
+      }
+    }
+  }
+`;
+const CREATED_AUTHENTICATION_TOKEN = graphql_tag.gql`
+  subscription CreatedAuthenticationToken($requestId: ID!) {
+    createdAuthenticationToken(requestId: $requestId) {
+      token {
+        accessToken
+        refreshToken
+        expiresAt
+      }
+      error {
+        code
+        message
+      }
+    }
+  }
+`;
+const REFRESH_AUTHENTICATION_TOKEN = graphql_tag.gql`
+  mutation RefreshAuthenticationToken($refreshToken: String!) {
+    refreshAuthenticationToken(refreshToken: $refreshToken) {
+      token {
+        accessToken
+        refreshToken
+        expiresAt
+      }
+      error {
+        code
+        message
+      }
+    }
+  }
+`;
+
+//#endregion
+//#region src/client.ts
+/**
+* Client for authenticating with a Caido instance.
+*
+* @example
+* ```typescript
+* import { CaidoAuth, BrowserApprover } from "@caido/auth";
+*
+* const auth = new CaidoAuth(
+*   "http://localhost:8080",
+*   new BrowserApprover((request) => {
+*     console.log(`Visit ${request.verificationUrl}`);
+*   })
+* );
+*
+* const token = await auth.startAuthenticationFlow();
+* console.log("Access token:", token.accessToken);
+* ```
+*/
+var CaidoAuth = class {
+	instanceUrl;
+	graphqlUrl;
+	websocketUrl;
+	approver;
+	client;
+	/**
+	* Create a new CaidoAuth client.
+	*
+	* @param instanceUrl - Base URL of the Caido instance (e.g., "http://localhost:8080")
+	* @param approver - The approver to use for the authentication flow
+	*/
+	constructor(instanceUrl, approver) {
+		this.instanceUrl = instanceUrl.replace(/\/$/, "");
+		this.graphqlUrl = `${this.instanceUrl}/graphql`;
+		this.websocketUrl = this.getWebsocketUrl();
+		this.approver = approver;
+		this.client = new _urql_core.Client({
+			url: this.graphqlUrl,
+			exchanges: [_urql_core.fetchExchange]
+		});
+	}
+	/**
+	* Convert HTTP(S) URL to WS(S) URL for subscriptions.
+	*/
+	getWebsocketUrl() {
+		const url = new URL(this.graphqlUrl);
+		return `${url.protocol === "https:" ? "wss:" : "ws:"}//${url.host}/ws/graphql`;
+	}
+	/**
+	* Start the device code authentication flow.
+	*
+	* This method:
+	* 1. Initiates the authentication flow via GraphQL mutation
+	* 2. Calls the approver with the authentication request
+	* 3. Waits for the user to authorize via WebSocket subscription
+	* 4. Returns the authentication token once approved
+	*
+	* @returns The authentication token
+	* @throws {AuthenticationFlowError} If the flow fails to start
+	* @throws {AuthenticationError} If token retrieval fails
+	*/
+	async startAuthenticationFlow() {
+		const result = await this.client.mutation(START_AUTHENTICATION_FLOW, {}).toPromise();
+		if (result.error) throw new AuthenticationFlowError("GRAPHQL_ERROR", result.error.message);
+		const payload = result.data?.startAuthenticationFlow;
+		if (!payload) throw new AuthenticationFlowError("NO_RESPONSE", "No response from startAuthenticationFlow");
+		if (payload.error) throw new AuthenticationFlowError(payload.error.code, payload.error.message);
+		if (!payload.request) throw new AuthenticationFlowError("NO_REQUEST", "No authentication request returned");
+		const authRequest = {
+			id: payload.request.id,
+			userCode: payload.request.userCode,
+			verificationUrl: payload.request.verificationUrl,
+			expiresAt: new Date(payload.request.expiresAt)
+		};
+		await this.approver.approve(authRequest);
+		return await this.waitForToken(authRequest.id);
+	}
+	/**
+	* Subscribe and wait for the authentication token.
+	*
+	* @param requestId - The authentication request ID
+	* @returns The authentication token once the user authorizes
+	* @throws {AuthenticationError} If subscription fails or returns an error
+	*/
+	async waitForToken(requestId) {
+		return new Promise((resolve, reject) => {
+			const wsClient = (0, graphql_ws.createClient)({ url: this.websocketUrl });
+			const unsubscribe = wsClient.subscribe({
+				query: CREATED_AUTHENTICATION_TOKEN.loc?.source.body ?? `subscription CreatedAuthenticationToken($requestId: ID!) {
+              createdAuthenticationToken(requestId: $requestId) {
+                token { accessToken refreshToken expiresAt }
+                error { code message }
+              }
+            }`,
+				variables: { requestId }
+			}, {
+				next: (result) => {
+					const payload = result.data?.createdAuthenticationToken;
+					if (payload?.error) {
+						unsubscribe();
+						wsClient.dispose();
+						reject(new AuthenticationError(`${payload.error.code}: ${payload.error.message}`));
+						return;
+					}
+					if (payload?.token) {
+						unsubscribe();
+						wsClient.dispose();
+						resolve({
+							accessToken: payload.token.accessToken,
+							refreshToken: payload.token.refreshToken,
+							expiresAt: new Date(payload.token.expiresAt)
+						});
+					}
+				},
+				error: (error) => {
+					wsClient.dispose();
+					reject(new AuthenticationError(error instanceof Error ? error.message : String(error)));
+				},
+				complete: () => {
+					wsClient.dispose();
+					reject(new AuthenticationError("Subscription ended without receiving token"));
+				}
+			});
+		});
+	}
+	/**
+	* Refresh an access token using a refresh token.
+	*
+	* @param refreshToken - The refresh token from a previous authentication
+	* @returns New authentication token with updated access and refresh tokens
+	* @throws {TokenRefreshError} If the refresh fails
+	*/
+	async refreshToken(refreshToken) {
+		const result = await this.client.mutation(REFRESH_AUTHENTICATION_TOKEN, { refreshToken }).toPromise();
+		if (result.error) throw new TokenRefreshError("GRAPHQL_ERROR", result.error.message);
+		const payload = result.data?.refreshAuthenticationToken;
+		if (!payload) throw new TokenRefreshError("NO_RESPONSE", "No response from refreshAuthenticationToken");
+		if (payload.error) throw new TokenRefreshError(payload.error.code, payload.error.message);
+		if (!payload.token) throw new TokenRefreshError("NO_TOKEN", "No token returned from refresh");
+		return {
+			accessToken: payload.token.accessToken,
+			refreshToken: payload.token.refreshToken,
+			expiresAt: new Date(payload.token.expiresAt)
+		};
+	}
+};
+
+//#endregion
+//#region src/approvers/browser.ts
+/**
+* Browser-based approver that delegates to a callback function.
+* The callback should display the verification URL and user code to the user,
+* who then manually approves the request in their browser.
+*
+* @example
+* ```typescript
+* const approver = new BrowserApprover((request) => {
+*   console.log(`Visit ${request.verificationUrl}`);
+* });
+* ```
+*/
+var BrowserApprover = class {
+	onRequest;
+	/**
+	* Create a new BrowserApprover.
+	*
+	* @param onRequest - Callback function that will be called with the authentication request
+	*/
+	constructor(onRequest) {
+		this.onRequest = onRequest;
+	}
+	/**
+	* Approve the authentication request by calling the callback.
+	* The actual approval happens when the user visits the URL and enters the code.
+	*
+	* @param request - The authentication request
+	*/
+	async approve(request) {
+		await this.onRequest(request);
+	}
+};
+
+//#endregion
+//#region src/approvers/pat.ts
+const DEFAULT_API_URL = "https://api.caido.io";
+/**
+* PAT-based approver that automatically approves device code requests.
+* Uses a Personal Access Token to call the Caido API directly.
+*
+* @example
+* ```typescript
+* // Approve all scopes
+* const approver = new PATApprover({ pat: "caido_xxxxx" });
+*
+* // Approve only specific scopes
+* const limitedApprover = new PATApprover({
+*   pat: "caido_xxxxx",
+*   allowedScopes: ["read:projects", "write:requests"],
+* });
+* ```
+*/
+var PATApprover = class {
+	pat;
+	allowedScopes;
+	apiUrl;
+	/**
+	* Create a new PATApprover.
+	*
+	* @param options - Configuration options for the approver
+	*/
+	constructor(options) {
+		this.pat = options.pat;
+		this.allowedScopes = options.allowedScopes;
+		this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+	}
+	/**
+	* Approve the authentication request using the PAT.
+	* First fetches device information to get available scopes,
+	* then filters scopes if allowedScopes is set,
+	* and finally approves the device.
+	*
+	* @param request - The authentication request
+	* @throws {DeviceInformationError} If fetching device information fails
+	* @throws {DeviceApprovalError} If approving the device fails
+	*/
+	async approve(request) {
+		let scopesToApprove = (await this.getDeviceInformation(request.userCode)).scopes.map((s) => s.name);
+		if (this.allowedScopes) scopesToApprove = scopesToApprove.filter((scope) => this.allowedScopes.includes(scope));
+		await this.approveDevice(request.userCode, scopesToApprove);
+	}
+	/**
+	* Fetch device information from the API.
+	*
+	* @param userCode - The user code from the authentication request
+	* @returns The device information including available scopes
+	* @throws {DeviceInformationError} If the request fails
+	*/
+	async getDeviceInformation(userCode) {
+		const params = new URLSearchParams();
+		params.append("user_code", userCode);
+		const url = new URL(`${this.apiUrl}/oauth2/device/information`);
+		url.search = params.toString();
+		const response = await fetch(url, {
+			method: "GET",
+			headers: {
+				Authorization: `Bearer ${this.pat}`,
+				Accept: "application/json"
+			}
+		});
+		if (!response.ok) throw new DeviceInformationError(`Failed to get device information: ${await response.text().catch(() => "Unknown error")}`, response.status);
+		return await response.json();
+	}
+	/**
+	* Approve the device with the specified scopes.
+	*
+	* @param userCode - The user code from the authentication request
+	* @param scopes - The scopes to approve
+	* @throws {DeviceApprovalError} If the request fails
+	*/
+	async approveDevice(userCode, scopes) {
+		const params = new URLSearchParams();
+		params.append("user_code", userCode);
+		params.append("scope", scopes.join(","));
+		const url = new URL(`${this.apiUrl}/oauth2/device/approve`);
+		url.search = params.toString();
+		const response = await fetch(url, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${this.pat}`,
+				"Content-Type": "application/json",
+				Accept: "application/json"
+			}
+		});
+		if (!response.ok) throw new DeviceApprovalError(`Failed to approve device: ${await response.text().catch(() => "Unknown error")}`, response.status);
+	}
+};
+
+//#endregion
+exports.AuthenticationError = AuthenticationError;
+exports.AuthenticationFlowError = AuthenticationFlowError;
+exports.BrowserApprover = BrowserApprover;
+exports.CaidoAuth = CaidoAuth;
+exports.DeviceApprovalError = DeviceApprovalError;
+exports.DeviceInformationError = DeviceInformationError;
+exports.PATApprover = PATApprover;
+exports.TokenRefreshError = TokenRefreshError;
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["Client","fetchExchange"],"sources":["../src/errors.ts","../src/queries.ts","../src/client.ts","../src/approvers/browser.ts","../src/approvers/pat.ts"],"sourcesContent":["/**\n * Base error class for authentication-related errors.\n */\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"AuthenticationError\";\n  }\n}\n\n/**\n * Error thrown when the authentication flow fails to start.\n */\nexport class AuthenticationFlowError extends AuthenticationError {\n  /** Error code from the API */\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`${code}: ${message}`);\n    this.name = \"AuthenticationFlowError\";\n    this.code = code;\n  }\n}\n\n/**\n * Error thrown when token refresh fails.\n */\nexport class TokenRefreshError extends AuthenticationError {\n  /** Error code from the API */\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`${code}: ${message}`);\n    this.name = \"TokenRefreshError\";\n    this.code = code;\n  }\n}\n\n/**\n * Error thrown when device approval fails.\n */\nexport class DeviceApprovalError extends AuthenticationError {\n  /** HTTP status code if available */\n  readonly statusCode: number | undefined;\n\n  constructor(message: string, statusCode?: number) {\n    super(message);\n    this.name = \"DeviceApprovalError\";\n    this.statusCode = statusCode;\n  }\n}\n\n/**\n * Error thrown when fetching device information fails.\n */\nexport class DeviceInformationError extends AuthenticationError {\n  /** HTTP status code if available */\n  readonly statusCode: number | undefined;\n\n  constructor(message: string, statusCode?: number) {\n    super(message);\n    this.name = \"DeviceInformationError\";\n    this.statusCode = statusCode;\n  }\n}\n","import type { DocumentNode } from \"graphql\";\nimport { gql } from \"graphql-tag\";\n\nexport const START_AUTHENTICATION_FLOW: DocumentNode = gql`\n  mutation StartAuthenticationFlow {\n    startAuthenticationFlow {\n      request {\n        id\n        userCode\n        verificationUrl\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\nexport const CREATED_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  subscription CreatedAuthenticationToken($requestId: ID!) {\n    createdAuthenticationToken(requestId: $requestId) {\n      token {\n        accessToken\n        refreshToken\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n\nexport const REFRESH_AUTHENTICATION_TOKEN: DocumentNode = gql`\n  mutation RefreshAuthenticationToken($refreshToken: String!) {\n    refreshAuthenticationToken(refreshToken: $refreshToken) {\n      token {\n        accessToken\n        refreshToken\n        expiresAt\n      }\n      error {\n        code\n        message\n      }\n    }\n  }\n`;\n","import { Client, fetchExchange } from \"@urql/core\";\nimport { createClient as createWSClient } from \"graphql-ws\";\n\nimport type { AuthApprover } from \"./approvers/types.js\";\nimport {\n  AuthenticationError,\n  AuthenticationFlowError,\n  TokenRefreshError,\n} from \"./errors.js\";\nimport {\n  CREATED_AUTHENTICATION_TOKEN,\n  REFRESH_AUTHENTICATION_TOKEN,\n  START_AUTHENTICATION_FLOW,\n} from \"./queries.js\";\nimport type {\n  AuthenticationRequest,\n  AuthenticationToken,\n  CreatedAuthenticationTokenResponse,\n  RefreshAuthenticationTokenResponse,\n  StartAuthenticationFlowResponse,\n} from \"./types.js\";\n\n/**\n * Client for authenticating with a Caido instance.\n *\n * @example\n * ```typescript\n * import { CaidoAuth, BrowserApprover } from \"@caido/auth\";\n *\n * const auth = new CaidoAuth(\n *   \"http://localhost:8080\",\n *   new BrowserApprover((request) => {\n *     console.log(`Visit ${request.verificationUrl}`);\n *   })\n * );\n *\n * const token = await auth.startAuthenticationFlow();\n * console.log(\"Access token:\", token.accessToken);\n * ```\n */\nexport class CaidoAuth {\n  private readonly instanceUrl: string;\n  private readonly graphqlUrl: string;\n  private readonly websocketUrl: string;\n  private readonly approver: AuthApprover;\n  private readonly client: Client;\n\n  /**\n   * Create a new CaidoAuth client.\n   *\n   * @param instanceUrl - Base URL of the Caido instance (e.g., \"http://localhost:8080\")\n   * @param approver - The approver to use for the authentication flow\n   */\n  constructor(instanceUrl: string, approver: AuthApprover) {\n    this.instanceUrl = instanceUrl.replace(/\\/$/, \"\");\n    this.graphqlUrl = `${this.instanceUrl}/graphql`;\n    this.websocketUrl = this.getWebsocketUrl();\n    this.approver = approver;\n\n    this.client = new Client({\n      url: this.graphqlUrl,\n      exchanges: [fetchExchange],\n    });\n  }\n\n  /**\n   * Convert HTTP(S) URL to WS(S) URL for subscriptions.\n   */\n  private getWebsocketUrl(): string {\n    const url = new URL(this.graphqlUrl);\n    const scheme = url.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n    return `${scheme}//${url.host}/ws/graphql`;\n  }\n\n  /**\n   * Start the device code authentication flow.\n   *\n   * This method:\n   * 1. Initiates the authentication flow via GraphQL mutation\n   * 2. Calls the approver with the authentication request\n   * 3. Waits for the user to authorize via WebSocket subscription\n   * 4. Returns the authentication token once approved\n   *\n   * @returns The authentication token\n   * @throws {AuthenticationFlowError} If the flow fails to start\n   * @throws {AuthenticationError} If token retrieval fails\n   */\n  async startAuthenticationFlow(): Promise<AuthenticationToken> {\n    // Step 1: Start the authentication flow\n    const result = await this.client\n      .mutation<StartAuthenticationFlowResponse>(START_AUTHENTICATION_FLOW, {})\n      .toPromise();\n\n    if (result.error) {\n      throw new AuthenticationFlowError(\"GRAPHQL_ERROR\", result.error.message);\n    }\n\n    const payload = result.data?.startAuthenticationFlow;\n    if (!payload) {\n      throw new AuthenticationFlowError(\n        \"NO_RESPONSE\",\n        \"No response from startAuthenticationFlow\",\n      );\n    }\n\n    if (payload.error) {\n      throw new AuthenticationFlowError(\n        payload.error.code,\n        payload.error.message,\n      );\n    }\n\n    if (!payload.request) {\n      throw new AuthenticationFlowError(\n        \"NO_REQUEST\",\n        \"No authentication request returned\",\n      );\n    }\n\n    const authRequest: AuthenticationRequest = {\n      id: payload.request.id,\n      userCode: payload.request.userCode,\n      verificationUrl: payload.request.verificationUrl,\n      expiresAt: new Date(payload.request.expiresAt),\n    };\n\n    // Step 2: Call the approver\n    await this.approver.approve(authRequest);\n\n    // Step 3: Wait for the token via subscription\n    const token = await this.waitForToken(authRequest.id);\n    return token;\n  }\n\n  /**\n   * Subscribe and wait for the authentication token.\n   *\n   * @param requestId - The authentication request ID\n   * @returns The authentication token once the user authorizes\n   * @throws {AuthenticationError} If subscription fails or returns an error\n   */\n  private async waitForToken(requestId: string): Promise<AuthenticationToken> {\n    return new Promise<AuthenticationToken>((resolve, reject) => {\n      const wsClient = createWSClient({\n        url: this.websocketUrl,\n      });\n\n      const unsubscribe =\n        wsClient.subscribe<CreatedAuthenticationTokenResponse>(\n          {\n            query:\n              CREATED_AUTHENTICATION_TOKEN.loc?.source.body ??\n              `subscription CreatedAuthenticationToken($requestId: ID!) {\n              createdAuthenticationToken(requestId: $requestId) {\n                token { accessToken refreshToken expiresAt }\n                error { code message }\n              }\n            }`,\n            variables: { requestId },\n          },\n          {\n            next: (result) => {\n              const payload = result.data?.createdAuthenticationToken;\n\n              if (payload?.error) {\n                unsubscribe();\n                wsClient.dispose();\n                reject(\n                  new AuthenticationError(\n                    `${payload.error.code}: ${payload.error.message}`,\n                  ),\n                );\n                return;\n              }\n\n              if (payload?.token) {\n                unsubscribe();\n                wsClient.dispose();\n                resolve({\n                  accessToken: payload.token.accessToken,\n                  refreshToken: payload.token.refreshToken,\n                  expiresAt: new Date(payload.token.expiresAt),\n                });\n              }\n            },\n            error: (error) => {\n              wsClient.dispose();\n              reject(\n                new AuthenticationError(\n                  error instanceof Error ? error.message : String(error),\n                ),\n              );\n            },\n            complete: () => {\n              wsClient.dispose();\n              reject(\n                new AuthenticationError(\n                  \"Subscription ended without receiving token\",\n                ),\n              );\n            },\n          },\n        );\n    });\n  }\n\n  /**\n   * Refresh an access token using a refresh token.\n   *\n   * @param refreshToken - The refresh token from a previous authentication\n   * @returns New authentication token with updated access and refresh tokens\n   * @throws {TokenRefreshError} If the refresh fails\n   */\n  async refreshToken(refreshToken: string): Promise<AuthenticationToken> {\n    const result = await this.client\n      .mutation<RefreshAuthenticationTokenResponse>(\n        REFRESH_AUTHENTICATION_TOKEN,\n        { refreshToken },\n      )\n      .toPromise();\n\n    if (result.error) {\n      throw new TokenRefreshError(\"GRAPHQL_ERROR\", result.error.message);\n    }\n\n    const payload = result.data?.refreshAuthenticationToken;\n    if (!payload) {\n      throw new TokenRefreshError(\n        \"NO_RESPONSE\",\n        \"No response from refreshAuthenticationToken\",\n      );\n    }\n\n    if (payload.error) {\n      throw new TokenRefreshError(payload.error.code, payload.error.message);\n    }\n\n    if (!payload.token) {\n      throw new TokenRefreshError(\"NO_TOKEN\", \"No token returned from refresh\");\n    }\n\n    return {\n      accessToken: payload.token.accessToken,\n      refreshToken: payload.token.refreshToken,\n      expiresAt: new Date(payload.token.expiresAt),\n    };\n  }\n}\n","import type { AuthenticationRequest } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\n/**\n * Callback function that receives the authentication request details.\n * Used to display the verification URL and user code to the user.\n */\nexport type OnRequestCallback = (\n  request: AuthenticationRequest,\n) => Promise<void> | void;\n\n/**\n * Browser-based approver that delegates to a callback function.\n * The callback should display the verification URL and user code to the user,\n * who then manually approves the request in their browser.\n *\n * @example\n * ```typescript\n * const approver = new BrowserApprover((request) => {\n *   console.log(`Visit ${request.verificationUrl}`);\n * });\n * ```\n */\nexport class BrowserApprover implements AuthApprover {\n  private readonly onRequest: OnRequestCallback;\n\n  /**\n   * Create a new BrowserApprover.\n   *\n   * @param onRequest - Callback function that will be called with the authentication request\n   */\n  constructor(onRequest: OnRequestCallback) {\n    this.onRequest = onRequest;\n  }\n\n  /**\n   * Approve the authentication request by calling the callback.\n   * The actual approval happens when the user visits the URL and enters the code.\n   *\n   * @param request - The authentication request\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    await this.onRequest(request);\n  }\n}\n","import { DeviceApprovalError, DeviceInformationError } from \"../errors.js\";\nimport type { AuthenticationRequest, DeviceInformation } from \"../types.js\";\n\nimport type { AuthApprover } from \"./types.js\";\n\nconst DEFAULT_API_URL = \"https://api.caido.io\";\n\n/**\n * Options for the PATApprover.\n */\nexport interface PATApproverOptions {\n  /** The Personal Access Token to use for approval */\n  pat: string;\n  /** If provided, only approve these scopes. Others will be filtered out. */\n  allowedScopes?: string[];\n  /** The API URL to use. Defaults to \"https://api.caido.io\" */\n  apiUrl?: string;\n}\n\n/**\n * PAT-based approver that automatically approves device code requests.\n * Uses a Personal Access Token to call the Caido API directly.\n *\n * @example\n * ```typescript\n * // Approve all scopes\n * const approver = new PATApprover({ pat: \"caido_xxxxx\" });\n *\n * // Approve only specific scopes\n * const limitedApprover = new PATApprover({\n *   pat: \"caido_xxxxx\",\n *   allowedScopes: [\"read:projects\", \"write:requests\"],\n * });\n * ```\n */\nexport class PATApprover implements AuthApprover {\n  private readonly pat: string;\n  private readonly allowedScopes: string[] | undefined;\n  private readonly apiUrl: string;\n\n  /**\n   * Create a new PATApprover.\n   *\n   * @param options - Configuration options for the approver\n   */\n  constructor(options: PATApproverOptions) {\n    this.pat = options.pat;\n    this.allowedScopes = options.allowedScopes;\n    this.apiUrl = (options.apiUrl ?? DEFAULT_API_URL).replace(/\\/$/, \"\");\n  }\n\n  /**\n   * Approve the authentication request using the PAT.\n   * First fetches device information to get available scopes,\n   * then filters scopes if allowedScopes is set,\n   * and finally approves the device.\n   *\n   * @param request - The authentication request\n   * @throws {DeviceInformationError} If fetching device information fails\n   * @throws {DeviceApprovalError} If approving the device fails\n   */\n  async approve(request: AuthenticationRequest): Promise<void> {\n    // Step 1: Get device information to retrieve available scopes\n    const deviceInfo = await this.getDeviceInformation(request.userCode);\n\n    // Step 2: Filter scopes if allowedScopes is provided\n    let scopesToApprove = deviceInfo.scopes.map((s) => s.name);\n    if (this.allowedScopes) {\n      scopesToApprove = scopesToApprove.filter((scope) =>\n        this.allowedScopes!.includes(scope),\n      );\n    }\n\n    // Step 3: Approve the device with the filtered scopes\n    await this.approveDevice(request.userCode, scopesToApprove);\n  }\n\n  /**\n   * Fetch device information from the API.\n   *\n   * @param userCode - The user code from the authentication request\n   * @returns The device information including available scopes\n   * @throws {DeviceInformationError} If the request fails\n   */\n  private async getDeviceInformation(\n    userCode: string,\n  ): Promise<DeviceInformation> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    const url = new URL(`${this.apiUrl}/oauth2/device/information`);\n    url.search = params.toString();\n\n    const response = await fetch(url, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text().catch(() => \"Unknown error\");\n      throw new DeviceInformationError(\n        `Failed to get device information: ${errorText}`,\n        response.status,\n      );\n    }\n\n    const data = (await response.json()) as DeviceInformation;\n    return data;\n  }\n\n  /**\n   * Approve the device with the specified scopes.\n   *\n   * @param userCode - The user code from the authentication request\n   * @param scopes - The scopes to approve\n   * @throws {DeviceApprovalError} If the request fails\n   */\n  private async approveDevice(\n    userCode: string,\n    scopes: string[],\n  ): Promise<void> {\n    const params = new URLSearchParams();\n    params.append(\"user_code\", userCode);\n    params.append(\"scope\", scopes.join(\",\"));\n    const url = new URL(`${this.apiUrl}/oauth2/device/approve`);\n    url.search = params.toString();\n\n    const response = await fetch(url, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.pat}`,\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json\",\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text().catch(() => \"Unknown error\");\n      throw new DeviceApprovalError(\n        `Failed to approve device: ${errorText}`,\n        response.status,\n      );\n    }\n  }\n}\n"],"mappings":";;;;;;;;AAGA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,YAAY,SAAiB;AAC3B,QAAM,QAAQ;AACd,OAAK,OAAO;;;;;;AAOhB,IAAa,0BAAb,cAA6C,oBAAoB;;CAE/D,AAAS;CAET,YAAY,MAAc,SAAiB;AACzC,QAAM,GAAG,KAAK,IAAI,UAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;AAOhB,IAAa,oBAAb,cAAuC,oBAAoB;;CAEzD,AAAS;CAET,YAAY,MAAc,SAAiB;AACzC,QAAM,GAAG,KAAK,IAAI,UAAU;AAC5B,OAAK,OAAO;AACZ,OAAK,OAAO;;;;;;AAOhB,IAAa,sBAAb,cAAyC,oBAAoB;;CAE3D,AAAS;CAET,YAAY,SAAiB,YAAqB;AAChD,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,aAAa;;;;;;AAOtB,IAAa,yBAAb,cAA4C,oBAAoB;;CAE9D,AAAS;CAET,YAAY,SAAiB,YAAqB;AAChD,QAAM,QAAQ;AACd,OAAK,OAAO;AACZ,OAAK,aAAa;;;;;;AC3DtB,MAAa,4BAA0C,eAAG;;;;;;;;;;;;;;;;AAiB1D,MAAa,+BAA6C,eAAG;;;;;;;;;;;;;;;AAgB7D,MAAa,+BAA6C,eAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACI7D,IAAa,YAAb,MAAuB;CACrB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;;;;;;CAQjB,YAAY,aAAqB,UAAwB;AACvD,OAAK,cAAc,YAAY,QAAQ,OAAO,GAAG;AACjD,OAAK,aAAa,GAAG,KAAK,YAAY;AACtC,OAAK,eAAe,KAAK,iBAAiB;AAC1C,OAAK,WAAW;AAEhB,OAAK,SAAS,IAAIA,kBAAO;GACvB,KAAK,KAAK;GACV,WAAW,CAACC,yBAAc;GAC3B,CAAC;;;;;CAMJ,AAAQ,kBAA0B;EAChC,MAAM,MAAM,IAAI,IAAI,KAAK,WAAW;AAEpC,SAAO,GADQ,IAAI,aAAa,WAAW,SAAS,MACnC,IAAI,IAAI,KAAK;;;;;;;;;;;;;;;CAgBhC,MAAM,0BAAwD;EAE5D,MAAM,SAAS,MAAM,KAAK,OACvB,SAA0C,2BAA2B,EAAE,CAAC,CACxE,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,wBAAwB,iBAAiB,OAAO,MAAM,QAAQ;EAG1E,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,wBACR,eACA,2CACD;AAGH,MAAI,QAAQ,MACV,OAAM,IAAI,wBACR,QAAQ,MAAM,MACd,QAAQ,MAAM,QACf;AAGH,MAAI,CAAC,QAAQ,QACX,OAAM,IAAI,wBACR,cACA,qCACD;EAGH,MAAM,cAAqC;GACzC,IAAI,QAAQ,QAAQ;GACpB,UAAU,QAAQ,QAAQ;GAC1B,iBAAiB,QAAQ,QAAQ;GACjC,WAAW,IAAI,KAAK,QAAQ,QAAQ,UAAU;GAC/C;AAGD,QAAM,KAAK,SAAS,QAAQ,YAAY;AAIxC,SADc,MAAM,KAAK,aAAa,YAAY,GAAG;;;;;;;;;CAWvD,MAAc,aAAa,WAAiD;AAC1E,SAAO,IAAI,SAA8B,SAAS,WAAW;GAC3D,MAAM,wCAA0B,EAC9B,KAAK,KAAK,cACX,CAAC;GAEF,MAAM,cACJ,SAAS,UACP;IACE,OACE,6BAA6B,KAAK,OAAO,QACzC;;;;;;IAMF,WAAW,EAAE,WAAW;IACzB,EACD;IACE,OAAO,WAAW;KAChB,MAAM,UAAU,OAAO,MAAM;AAE7B,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;AAClB,aACE,IAAI,oBACF,GAAG,QAAQ,MAAM,KAAK,IAAI,QAAQ,MAAM,UACzC,CACF;AACD;;AAGF,SAAI,SAAS,OAAO;AAClB,mBAAa;AACb,eAAS,SAAS;AAClB,cAAQ;OACN,aAAa,QAAQ,MAAM;OAC3B,cAAc,QAAQ,MAAM;OAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;OAC7C,CAAC;;;IAGN,QAAQ,UAAU;AAChB,cAAS,SAAS;AAClB,YACE,IAAI,oBACF,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACvD,CACF;;IAEH,gBAAgB;AACd,cAAS,SAAS;AAClB,YACE,IAAI,oBACF,6CACD,CACF;;IAEJ,CACF;IACH;;;;;;;;;CAUJ,MAAM,aAAa,cAAoD;EACrE,MAAM,SAAS,MAAM,KAAK,OACvB,SACC,8BACA,EAAE,cAAc,CACjB,CACA,WAAW;AAEd,MAAI,OAAO,MACT,OAAM,IAAI,kBAAkB,iBAAiB,OAAO,MAAM,QAAQ;EAGpE,MAAM,UAAU,OAAO,MAAM;AAC7B,MAAI,CAAC,QACH,OAAM,IAAI,kBACR,eACA,8CACD;AAGH,MAAI,QAAQ,MACV,OAAM,IAAI,kBAAkB,QAAQ,MAAM,MAAM,QAAQ,MAAM,QAAQ;AAGxE,MAAI,CAAC,QAAQ,MACX,OAAM,IAAI,kBAAkB,YAAY,iCAAiC;AAG3E,SAAO;GACL,aAAa,QAAQ,MAAM;GAC3B,cAAc,QAAQ,MAAM;GAC5B,WAAW,IAAI,KAAK,QAAQ,MAAM,UAAU;GAC7C;;;;;;;;;;;;;;;;;;AC7NL,IAAa,kBAAb,MAAqD;CACnD,AAAiB;;;;;;CAOjB,YAAY,WAA8B;AACxC,OAAK,YAAY;;;;;;;;CASnB,MAAM,QAAQ,SAA+C;AAC3D,QAAM,KAAK,UAAU,QAAQ;;;;;;ACtCjC,MAAM,kBAAkB;;;;;;;;;;;;;;;;;AA8BxB,IAAa,cAAb,MAAiD;CAC/C,AAAiB;CACjB,AAAiB;CACjB,AAAiB;;;;;;CAOjB,YAAY,SAA6B;AACvC,OAAK,MAAM,QAAQ;AACnB,OAAK,gBAAgB,QAAQ;AAC7B,OAAK,UAAU,QAAQ,UAAU,iBAAiB,QAAQ,OAAO,GAAG;;;;;;;;;;;;CAatE,MAAM,QAAQ,SAA+C;EAK3D,IAAI,mBAHe,MAAM,KAAK,qBAAqB,QAAQ,SAAS,EAGnC,OAAO,KAAK,MAAM,EAAE,KAAK;AAC1D,MAAI,KAAK,cACP,mBAAkB,gBAAgB,QAAQ,UACxC,KAAK,cAAe,SAAS,MAAM,CACpC;AAIH,QAAM,KAAK,cAAc,QAAQ,UAAU,gBAAgB;;;;;;;;;CAU7D,MAAc,qBACZ,UAC4B;EAC5B,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;EACpC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,4BAA4B;AAC/D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GAEZ,OAAM,IAAI,uBACR,qCAFgB,MAAM,SAAS,MAAM,CAAC,YAAY,gBAAgB,IAGlE,SAAS,OACV;AAIH,SADc,MAAM,SAAS,MAAM;;;;;;;;;CAWrC,MAAc,cACZ,UACA,QACe;EACf,MAAM,SAAS,IAAI,iBAAiB;AACpC,SAAO,OAAO,aAAa,SAAS;AACpC,SAAO,OAAO,SAAS,OAAO,KAAK,IAAI,CAAC;EACxC,MAAM,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,wBAAwB;AAC3D,MAAI,SAAS,OAAO,UAAU;EAE9B,MAAM,WAAW,MAAM,MAAM,KAAK;GAChC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU,KAAK;IAC9B,gBAAgB;IAChB,QAAQ;IACT;GACF,CAAC;AAEF,MAAI,CAAC,SAAS,GAEZ,OAAM,IAAI,oBACR,6BAFgB,MAAM,SAAS,MAAM,CAAC,YAAY,gBAAgB,IAGlE,SAAS,OACV"}