@cdot65/prisma-airs-sdk 0.4.0 → 0.5.0

package/dist/index.cjs

@@ -188,6 +188,7 @@ __export(index_exports, {
   ModelSecurityRuleResponseSchema: () => ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient: () => ModelSecurityRulesClient,
   ModelSecurityScansClient: () => ModelSecurityScansClient,
+  OAuthClient: () => OAuthClient,
   PAYLOAD_HASH: () => PAYLOAD_HASH,
   PolicySchema: () => PolicySchema,
   PolicyType: () => PolicyType,
@@ -361,7 +362,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.4.0";
+var SDK_VERSION = "0.5.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -2647,12 +2648,14 @@ var OAuthTokenResponseSchema = import_zod19.z.object({
 });
 
 // src/management/oauth-client.ts
-var TOKEN_BUFFER_MS = 3e4;
+var DEFAULT_TOKEN_BUFFER_MS = 3e4;
 var OAuthClient = class {
   tokenEndpoint;
   clientId;
   clientSecret;
   tsgId;
+  tokenBufferMs;
+  onTokenRefresh;
   accessToken = null;
   expiresAt = 0;
   pendingFetch = null;
@@ -2661,13 +2664,15 @@ var OAuthClient = class {
     this.clientSecret = opts.clientSecret;
     this.tsgId = opts.tsgId;
     this.tokenEndpoint = opts.tokenEndpoint ?? DEFAULT_TOKEN_ENDPOINT;
+    this.tokenBufferMs = opts.tokenBufferMs ?? DEFAULT_TOKEN_BUFFER_MS;
+    this.onTokenRefresh = opts.onTokenRefresh;
   }
   /**
    * Get a valid access token, refreshing if needed.
    * @returns Bearer access token string.
    */
   async getToken() {
-    if (this.accessToken && Date.now() < this.expiresAt - TOKEN_BUFFER_MS) {
+    if (this.accessToken && Date.now() < this.expiresAt - this.tokenBufferMs) {
       return this.accessToken;
     }
     if (this.pendingFetch) {
@@ -2683,6 +2688,40 @@ var OAuthClient = class {
     this.accessToken = null;
     this.expiresAt = 0;
   }
+  /** Check if the current token has passed its expiry time. Returns true if no token exists. */
+  isTokenExpired() {
+    if (!this.accessToken) return true;
+    return Date.now() >= this.expiresAt;
+  }
+  /**
+   * Check if the token is within the pre-expiry buffer window.
+   * Returns true if no token exists.
+   * @param bufferMs - Custom buffer in ms. Defaults to the configured `tokenBufferMs`.
+   */
+  isTokenExpiringSoon(bufferMs) {
+    if (!this.accessToken) return true;
+    const buffer = bufferMs ?? this.tokenBufferMs;
+    return Date.now() >= this.expiresAt - buffer;
+  }
+  /**
+   * Get a snapshot of the current token state without exposing the actual token value.
+   * @returns Current {@link TokenInfo}.
+   */
+  getTokenInfo() {
+    const now = Date.now();
+    const hasToken = this.accessToken !== null;
+    const isExpired = !hasToken || now >= this.expiresAt;
+    const isExpiringSoon = !hasToken || now >= this.expiresAt - this.tokenBufferMs;
+    const expiresInMs = hasToken ? Math.max(0, this.expiresAt - now) : 0;
+    return {
+      hasToken,
+      isValid: hasToken && !isExpiringSoon,
+      isExpired,
+      isExpiringSoon,
+      expiresInMs,
+      expiresAt: hasToken ? this.expiresAt : 0
+    };
+  }
   async fetchToken() {
     const credentials = btoa(`${this.clientId}:${this.clientSecret}`);
     const body = new URLSearchParams({
@@ -2718,6 +2757,12 @@ var OAuthClient = class {
     const data = OAuthTokenResponseSchema.parse(await response.json());
     this.accessToken = data.access_token;
     this.expiresAt = Date.now() + data.expires_in * 1e3;
+    if (this.onTokenRefresh) {
+      try {
+        this.onTokenRefresh(this.getTokenInfo());
+      } catch {
+      }
+    }
     return this.accessToken;
   }
 };
@@ -2749,7 +2794,7 @@ async function managementHttpRequest(opts) {
       return fetch(url.toString(), { method, headers, body: bodyStr });
     },
     onRetryableFailure: async (response2) => {
-      if (response2.status === 401 && !hadTokenRefresh) {
+      if ((response2.status === 401 || response2.status === 403) && !hadTokenRefresh) {
         hadTokenRefresh = true;
         oauthClient.clearToken();
         return true;
@@ -4895,6 +4940,7 @@ var RedTeamClient = class {
   ModelSecurityRuleResponseSchema,
   ModelSecurityRulesClient,
   ModelSecurityScansClient,
+  OAuthClient,
   PAYLOAD_HASH,
   PolicySchema,
   PolicyType,