@cboxdk/id-js 0.18.0 → 0.19.0

package/dist/nextjs.cjs

@@ -339,6 +339,10 @@ function roles(source) {
 function permissions(source) {
   return stringList(claimsOf(source)["permissions"]);
 }
+function featureFlags(source) {
+  const claim = claimsOf(source)["feature_flags"];
+  return Array.isArray(claim) ? stringList(claim) : null;
+}
 var MAX_ACTOR_DEPTH = 8;
 function parseActor(claim, depth) {
   if (claim === void 0 || claim === null) {
@@ -365,6 +369,43 @@ function isUser(source) {
 }
 
 // src/vault.ts
+function withConnectReturn(connectUrl, options = {}) {
+  const url = new URL(connectUrl);
+  if (options.clientId) url.searchParams.set("client_id", options.clientId);
+  if (options.returnTo) url.searchParams.set("return_to", options.returnTo);
+  return url.toString();
+}
+function pipeConnectUrl(issuer, provider, options = {}) {
+  return withConnectReturn(
+    `${issuer.replace(/\/$/, "")}/account/connected-services/${encodeURIComponent(provider)}/connect`,
+    options
+  );
+}
+var PipeLeaseError = class extends CboxIdError {
+  constructor(message, error, status, connectUrl = null, retryAfter = null) {
+    super(message);
+    this.error = error;
+    this.status = status;
+    this.connectUrl = connectUrl;
+    this.retryAfter = retryAfter;
+  }
+  error;
+  status;
+  connectUrl;
+  retryAfter;
+  /** `connectUrl` with your `client_id` and `return_to` on it, or null when there is none. */
+  connectUrlWith(options) {
+    return this.connectUrl === null ? null : withConnectReturn(this.connectUrl, options);
+  }
+};
+var PipeNotConnectedError = class extends PipeLeaseError {
+};
+var PipeReauthorizationRequiredError = class extends PipeLeaseError {
+};
+var PipeTemporarilyUnavailableError = class extends PipeLeaseError {
+};
+var PipeLeaseDeniedError = class extends PipeLeaseError {
+};
 var VaultClient = class {
   constructor(issuer, token, timeoutMs = 1e4) {
     this.token = token;
@@ -420,11 +461,69 @@ var VaultClient = class {
       return { secretId: r.secret_id, provider: r.provider, secret: r.secret, expiresAt: r.expires_at };
     });
   }
+  /**
+   * Lease a fresh access token for a person's connected account at `provider` (Pipes,
+   * scope `vault.lease`). The token is refreshed first when it is about to expire, so
+   * you never handle a refresh token.
+   *
+   * With a client-credentials token, name the person in `userId`. With a token issued to
+   * your app FOR a person, leave it out — the lease is theirs.
+   *
+   * ```ts
+   * try {
+   *   const { accessToken } = await vault.leasePipeToken('github', { userId, purpose: 'list-repos' })
+   * } catch (e) {
+   *   if (e instanceof PipeNotConnectedError || e instanceof PipeReauthorizationRequiredError) {
+   *     return redirect(e.connectUrlWith({ clientId, returnTo }))
+   *   }
+   *   throw e
+   * }
+   * ```
+   */
+  async leasePipeToken(provider, options) {
+    const path = `/pipes/${encodeURIComponent(provider)}/token`;
+    const response = await this.send("POST", path, {
+      purpose: options.purpose,
+      ...options.userId !== void 0 ? { user_id: options.userId } : {}
+    });
+    let body = {};
+    try {
+      const parsed = await response.json();
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        body = parsed;
+      }
+    } catch {
+    }
+    if (!response.ok) {
+      throw pipeLeaseError(response, body);
+    }
+    if (typeof body.access_token !== "string") {
+      throw new PipeLeaseError("The pipe lease answered without an access token.", null, response.status);
+    }
+    return {
+      accessToken: body.access_token,
+      tokenType: "Bearer",
+      provider: String(body.provider ?? provider),
+      userId: String(body.user_id ?? ""),
+      connectionId: String(body.connection_id ?? ""),
+      scopes: Array.isArray(body.scopes) ? body.scopes.filter((s) => typeof s === "string") : [],
+      expiresAt: typeof body.expires_at === "string" ? body.expires_at : null,
+      leaseExpiresAt: String(body.lease_expires_at ?? ""),
+      metadata: isStringRecord(body.metadata) ? body.metadata : {}
+    };
+  }
   async json(method, path, body) {
     const response = await this.request(method, path, body);
     return await response.json();
   }
   async request(method, path, body) {
+    const response = await this.send(method, path, body);
+    if (!response.ok) {
+      throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
+    }
+    return response;
+  }
+  async send(method, path, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
     try {
@@ -439,16 +538,35 @@ var VaultClient = class {
       if (body) {
         init.body = JSON.stringify(body);
       }
-      const response = await fetch(`${this.base}${path}`, init);
-      if (!response.ok) {
-        throw new AuthenticationError(`Vault ${method} ${path} failed with status ${response.status}.`);
-      }
-      return response;
+      return await fetch(`${this.base}${path}`, init);
     } finally {
       clearTimeout(timer);
     }
   }
 };
+function pipeLeaseError(response, body) {
+  const error = typeof body.error === "string" ? body.error : null;
+  const message = typeof body.message === "string" && body.message !== "" ? body.message : `The pipe lease failed with status ${response.status}.`;
+  const connectUrl = typeof body.connect_url === "string" && body.connect_url !== "" ? body.connect_url : null;
+  const header = response.headers.get("retry-after")?.trim() ?? "";
+  const retryAfter = /^\d+$/.test(header) ? Number(header) : null;
+  if (response.status === 404 && connectUrl !== null) {
+    return new PipeNotConnectedError(message, error, 404, connectUrl, retryAfter);
+  }
+  if (response.status === 409 && connectUrl !== null) {
+    return new PipeReauthorizationRequiredError(message, error, 409, connectUrl, retryAfter);
+  }
+  if (response.status === 503) {
+    return new PipeTemporarilyUnavailableError(message, error, 503, connectUrl, retryAfter);
+  }
+  if (response.status === 403 && error !== "insufficient_scope") {
+    return new PipeLeaseDeniedError(message, error, 403, connectUrl, retryAfter);
+  }
+  return new PipeLeaseError(message, error, response.status, connectUrl, retryAfter);
+}
+function isStringRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
 
 // src/webhook.ts
 function timingSafeEqual(a, b) {
@@ -666,6 +784,7 @@ var CboxIdClient = class {
       organization: organization(claims),
       roles: roles(claims),
       permissions: permissions(claims),
+      featureFlags: featureFlags(claims),
       actor: actor(claims),
       sessionId: sessionId(claims),
       // Only present when the instance emitted the claim (exactOptionalPropertyTypes).
@@ -845,6 +964,18 @@ var CboxIdClient = class {
    * registered. `organization` picks which of the person's organizations the keys act in;
    * omitted, the page uses the one they are in.
    */
+  /**
+   * The hosted page where the signed-in person connects their account at `provider`
+   * (Pipes) — `/account/connected-services/{provider}/connect`, preselected to this app.
+   * They come back to `returnTo` with `?provider=…&status=connected|cancelled|failed`,
+   * honoured only on an origin the app registered.
+   */
+  pipeConnectUrl(provider, returnTo) {
+    return pipeConnectUrl(this.config.issuer, provider, {
+      clientId: this.config.clientId,
+      ...returnTo !== void 0 ? { returnTo } : {}
+    });
+  }
   apiKeysUrl(options = {}) {
     const params = new URLSearchParams({ client_id: options.clientId ?? this.config.clientId });
     if (options.returnTo) {