@databasin/mcp-client 0.2.0 → 0.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -16
- package/dist/auth-schema.js +2 -2
- package/dist/auth-schema.js.map +1 -1
- package/dist/auth-tools.js +3 -3
- package/dist/auth-tools.js.map +1 -1
- package/dist/auth.d.ts +13 -74
- package/dist/auth.d.ts.map +1 -1
- package/dist/auth.js +16 -228
- package/dist/auth.js.map +1 -1
- package/dist/auth0-store.d.ts +14 -0
- package/dist/auth0-store.d.ts.map +1 -0
- package/dist/auth0-store.js +78 -0
- package/dist/auth0-store.js.map +1 -0
- package/dist/auth0-token.d.ts +3 -0
- package/dist/auth0-token.d.ts.map +1 -0
- package/dist/auth0-token.js +13 -0
- package/dist/auth0-token.js.map +1 -0
- package/dist/auth0.d.ts +41 -0
- package/dist/auth0.d.ts.map +1 -0
- package/dist/auth0.js +236 -0
- package/dist/auth0.js.map +1 -0
- package/dist/browser.d.ts.map +1 -1
- package/dist/browser.js +3 -2
- package/dist/browser.js.map +1 -1
- package/dist/cli.js +1 -1
- package/dist/config.d.ts +5 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +12 -2
- package/dist/config.js.map +1 -1
- package/dist/entra-auth.d.ts +84 -0
- package/dist/entra-auth.d.ts.map +1 -0
- package/dist/entra-auth.js +234 -0
- package/dist/entra-auth.js.map +1 -0
- package/dist/login-url.d.ts +2 -0
- package/dist/login-url.d.ts.map +1 -1
- package/dist/login-url.js +14 -0
- package/dist/login-url.js.map +1 -1
- package/dist/server.d.ts +1 -1
- package/dist/server.js +1 -1
- package/dist/server.js.map +1 -1
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/package.json +5 -2
package/README.md
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
1
|
# DataBasin MCP Client
|
|
2
2
|
|
|
3
|
-
Local stdio MCP proxy for DataBasin. It
|
|
3
|
+
Local stdio MCP proxy for DataBasin. It uses Auth0 device sign-in, keeps tokens in OS-protected credential storage, and connects to DataBasin's Streamable HTTP MCP endpoint with the official MCP SDK.
|
|
4
4
|
|
|
5
5
|
Production is the default. The non-production profile is selected with `--environment np`.
|
|
6
6
|
|
|
7
|
-
## Version 0.2.
|
|
7
|
+
## Version 0.2.1 authentication fix
|
|
8
8
|
|
|
9
|
-
Version `0.2.
|
|
9
|
+
Version `0.2.1` adds Auth0 login using the providers enabled for the DataBasin MCP native application. Version `0.2.0` supported only direct Microsoft Entra login; its cached sessions do not establish an Auth0 login. After upgrading, sign in again. Existing Entra credentials are neither reused nor deleted. The true MCP transport, support tickets, and notifications remain unchanged. Production is the default:
|
|
10
10
|
|
|
11
11
|
```bash
|
|
12
|
-
npx -y @databasin/mcp-client@0.2.
|
|
13
|
-
npx -y @databasin/mcp-client@0.2.
|
|
12
|
+
npx -y @databasin/mcp-client@0.2.1 doctor
|
|
13
|
+
npx -y @databasin/mcp-client@0.2.1 login
|
|
14
14
|
```
|
|
15
15
|
|
|
16
16
|
The client requires Node.js 22.20+ or Node.js 24 and an available OS-protected credential store. `doctor` reports the selected fixed profile, runtime support, credential-store availability, and sign-in state; it never prints account identity, tokens, or credentials.
|
|
@@ -19,8 +19,8 @@ For non-production, use the same stable package with the NP profile:
|
|
|
19
19
|
|
|
20
20
|
| Host | NP setup |
|
|
21
21
|
| --- | --- |
|
|
22
|
-
| Codex | `codex mcp add databasin-np -- npx -y @databasin/mcp-client@0.2.
|
|
23
|
-
| Claude Code | `claude mcp add --transport stdio --scope user databasin-np -- npx -y @databasin/mcp-client@0.2.
|
|
22
|
+
| Codex | `codex mcp add databasin-np -- npx -y @databasin/mcp-client@0.2.1 --environment np` |
|
|
23
|
+
| Claude Code | `claude mcp add --transport stdio --scope user databasin-np -- npx -y @databasin/mcp-client@0.2.1 --environment np` |
|
|
24
24
|
| Claude Desktop / Cursor-compatible config | Use the `mcpServers` JSON below |
|
|
25
25
|
| VS Code | Use the `servers` JSON below in user or workspace `mcp.json` |
|
|
26
26
|
| OpenCode v2 | Use the `mcp.servers` JSON below in `opencode.jsonc` |
|
|
@@ -33,7 +33,7 @@ Claude Desktop and other hosts that accept the common `mcpServers` shape:
|
|
|
33
33
|
"databasin-np": {
|
|
34
34
|
"type": "stdio",
|
|
35
35
|
"command": "npx",
|
|
36
|
-
"args": ["-y", "@databasin/mcp-client@0.2.
|
|
36
|
+
"args": ["-y", "@databasin/mcp-client@0.2.1", "--environment", "np"]
|
|
37
37
|
}
|
|
38
38
|
}
|
|
39
39
|
}
|
|
@@ -47,7 +47,7 @@ VS Code `mcp.json`:
|
|
|
47
47
|
"databasinNp": {
|
|
48
48
|
"type": "stdio",
|
|
49
49
|
"command": "npx",
|
|
50
|
-
"args": ["-y", "@databasin/mcp-client@0.2.
|
|
50
|
+
"args": ["-y", "@databasin/mcp-client@0.2.1", "--environment", "np"]
|
|
51
51
|
}
|
|
52
52
|
}
|
|
53
53
|
}
|
|
@@ -62,7 +62,7 @@ OpenCode v2 `opencode.jsonc`:
|
|
|
62
62
|
"servers": {
|
|
63
63
|
"databasin-np": {
|
|
64
64
|
"type": "local",
|
|
65
|
-
"command": ["npx", "-y", "@databasin/mcp-client@0.2.
|
|
65
|
+
"command": ["npx", "-y", "@databasin/mcp-client@0.2.1", "--environment", "np"]
|
|
66
66
|
}
|
|
67
67
|
}
|
|
68
68
|
}
|
|
@@ -107,11 +107,13 @@ To use non-production:
|
|
|
107
107
|
npx -y @databasin/mcp-client --environment np
|
|
108
108
|
```
|
|
109
109
|
|
|
110
|
-
The assistant can call `databasin_login` and give you the
|
|
110
|
+
The assistant can call `databasin_login` and give you the DataBasin Auth0 activation URL and a short-lived user code. Enter credentials only on the sign-in page or the identity provider it redirects you to. The client never sends credentials or tokens through MCP tool output.
|
|
111
111
|
|
|
112
|
-
|
|
112
|
+
Auth0 login output is restricted to `https://databasin.us.auth0.com/activate`; both CLI and assistant login use device authorization. Raw device codes and tokens remain private to the client. Authentication requests reject redirects; unexpected login hosts, schemes, paths, queries, ports, and fragments are rejected. No callback URL, client secret, or password is configured in the plugin.
|
|
113
113
|
|
|
114
|
-
|
|
114
|
+
Auth0 access tokens undergo RS256 signature verification against the pinned tenant JWKS, plus issuer, environment-specific API audience, authorized client, subject, and expiry checks. Refresh tokens are stored only in the OS-protected store, separately by provider, environment, client, and audience. Refresh-token rotation is serialized across processes. Logout clears this client's local Auth0 session and cancels pending login; it does not sign out the website or erase legacy Entra sessions. The server independently validates tokens and authorizes every product operation. Entra support remains available in the code for explicitly configured non-Auth0 profiles; built-in hosted profiles do not silently fall back to it.
|
|
115
|
+
|
|
116
|
+
Automatic renewal requires both the native application's Refresh Token grant and the API's Allow Offline Access setting. The client requests `offline_access`; if Auth0 does not issue a refresh token, it requires sign-in again when the access token expires. It does not silently substitute another provider or keep expired credentials working.
|
|
115
117
|
|
|
116
118
|
## Tools
|
|
117
119
|
|
|
@@ -131,7 +133,7 @@ The production server currently exposes twenty product tools, plus this client's
|
|
|
131
133
|
|
|
132
134
|
Support tools are also discovered: `databasin_get_support_context`, `databasin_list_support_tickets`, `databasin_get_support_ticket`, `databasin_create_support_ticket`, `databasin_add_support_ticket_message`, `databasin_update_support_ticket`, `databasin_list_support_notifications`, `databasin_mark_support_notification_read`, and `databasin_mark_all_support_notifications_read`. Support operations include writes; follow their server-owned schemas and annotations. Ticket/message data includes authorized email fields, and optional values may be null.
|
|
133
135
|
|
|
134
|
-
The other two tools, `databasin_auth_status` and `databasin_login`, are client-local authentication helpers. They interact
|
|
136
|
+
The other two tools, `databasin_auth_status` and `databasin_login`, are client-local authentication helpers. They interact with Auth0 and the OS credential store; they are not part of the remote product catalog.
|
|
135
137
|
|
|
136
138
|
No organization configuration is required. Unscoped `databasin_get_context` and `databasin_search` discover metadata only across organizations the signed-in user is authorized to access. A project-scoped search must include its `institutionId`; account discovery is not a wildcard and never broadens server-side authorization.
|
|
137
139
|
|
|
@@ -171,9 +173,9 @@ npm run verify:package
|
|
|
171
173
|
Release qualification uses an exact local tarball, never a mutable dist-tag. After `npm pack`, an authorized tester with an existing production session can run the read-only qualification:
|
|
172
174
|
|
|
173
175
|
```bash
|
|
174
|
-
DATABASIN_MCP_TARBALL=./databasin-mcp-client-0.2.
|
|
176
|
+
DATABASIN_MCP_TARBALL=./databasin-mcp-client-0.2.1.tgz npm run qualify:package
|
|
175
177
|
```
|
|
176
178
|
|
|
177
179
|
Set `DATABASIN_MCP_QUALIFY_ENVIRONMENT=np` to qualify against NP instead. This check installs the exact artifact in a temporary directory, starts its stdio executable, checks local sign-in and the twenty-two-tool inventory, and calls only context/search/support read operations. It never creates agent jobs, executes SQL, or changes support data, and does not print credentials or business content. The old `qualify:np` script remains only for historical beta lifecycle qualification.
|
|
178
180
|
|
|
179
|
-
|
|
181
|
+
An authentication release requires a fresh Auth0 device login, signed-token validation, secure persistence across client restarts, refresh-token renewal, and authorized MCP calls against the target environment. Cached Microsoft sessions and mocked login tests are not substitutes for this release gate. Qualifying production does not claim that non-production login or every enabled identity provider was tested.
|
package/dist/auth-schema.js
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import {
|
|
2
|
+
import { validateAssistantLoginUrl } from './login-url.js';
|
|
3
3
|
const authEnvironment = z.enum(['prod', 'np']);
|
|
4
4
|
const URL_LIKE_AUTH_MESSAGE = /(?:\b(?:https?|hxxps?|ftp|file|data|javascript)\s*:\s*(?:[/\\]\s*){0,2}|\bwww\s*(?:\.|\[\.\]|\(\.\))|(?:\b|@)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.|\[\.\]|\(\.\)))+[a-z]{2,63}(?=\b|[/:?#])|\b(?:localhost|(?:\d{1,3}\.){3}\d{1,3})(?=[:/\s]|$))/iu;
|
|
5
5
|
const authMessage = z.string().max(1_000).refine((value) => !URL_LIKE_AUTH_MESSAGE.test(normalizeAuthMessage(value)), 'The authentication message was rejected.');
|
|
6
6
|
const safeDeviceLoginUrl = z.string().max(4_096).superRefine((value, context) => {
|
|
7
7
|
try {
|
|
8
|
-
|
|
8
|
+
validateAssistantLoginUrl(value);
|
|
9
9
|
}
|
|
10
10
|
catch {
|
|
11
11
|
context.addIssue({ code: 'custom', message: 'The authentication result was rejected.' });
|
package/dist/auth-schema.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/C,MAAM,qBAAqB,GACzB,2PAA2P,CAAC;AAE9P,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EACnE,0CAA0C,CAC3C,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9E,IAAI,CAAC;QACH,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACtE,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;QACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtC,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC,MAAM,EAAE;IACX,GAAI,CAAC,eAAe,EAAE,mBAAmB,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACtF,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACzB,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC9B,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC,MAAM,EAAE,CAAC;CACb,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC1C,IAAI,SAAS,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,SAAS,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACpG,CAAC"}
|
package/dist/auth-tools.js
CHANGED
|
@@ -19,7 +19,7 @@ export function registerAuthTools(server, auth) {
|
|
|
19
19
|
}, async (_input, context) => authToolResult(() => auth.getLoginStatus(), context));
|
|
20
20
|
server.registerTool(LOCAL_AUTH_TOOL_NAMES[1], {
|
|
21
21
|
title: 'Sign in to DataBasin',
|
|
22
|
-
description: 'Start
|
|
22
|
+
description: 'Start DataBasin device sign-in. Enter credentials only on the approved sign-in page; never provide credentials in chat.',
|
|
23
23
|
inputSchema: emptyInput,
|
|
24
24
|
outputSchema: AssistantAuthOutputSchema,
|
|
25
25
|
annotations: { ...annotations, readOnlyHint: false, openWorldHint: true }
|
|
@@ -48,8 +48,8 @@ async function authToolResult(operation, _context) {
|
|
|
48
48
|
function authOutputMessage(output) {
|
|
49
49
|
if (output.status === 'pending') {
|
|
50
50
|
return output.loginUrl === null
|
|
51
|
-
? '
|
|
52
|
-
: '
|
|
51
|
+
? 'DataBasin is preparing the device sign-in instructions.'
|
|
52
|
+
: 'DataBasin device sign-in is ready. Use the approved login URL and user code, then call databasin_auth_status.';
|
|
53
53
|
}
|
|
54
54
|
if (output.status === 'authenticated')
|
|
55
55
|
return 'DataBasin sign-in is complete.';
|
package/dist/auth-tools.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-tools.js","sourceRoot":"","sources":["../src/auth-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,uBAAuB;IACvB,iBAAiB;CACT,CAAC,CAAC;AAOZ,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAEzF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,IAAe;IAClE,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;QAC5C,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,yBAAyB;QACvC,WAAW;KACZ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpF,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;QAC5C,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,
|
|
1
|
+
{"version":3,"file":"auth-tools.js","sourceRoot":"","sources":["../src/auth-tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAElC,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,uBAAuB;IACvB,iBAAiB;CACT,CAAC,CAAC;AAOZ,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzC,MAAM,WAAW,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAEzF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,IAAe;IAClE,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;QAC5C,KAAK,EAAE,yBAAyB;QAChC,WAAW,EAAE,8EAA8E;QAC3F,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,yBAAyB;QACvC,WAAW;KACZ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpF,MAAM,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE;QAC5C,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,yHAAyH;QACtI,WAAW,EAAE,UAAU;QACvB,YAAY,EAAE,yBAAyB;QACvC,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KAC1E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,SAA6C,EAC7C,QAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClE,iBAAiB,EAAE,MAAM;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,KAAK,YAAY,QAAQ;YAC1C,CAAC,CAAC,IAAI,cAAc,CAAC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,iCAAiC,CAAC;YACvG,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,aAAa,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QACnD,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACtG,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA0E;IACnG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,KAAK,IAAI;YAC7B,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,+GAA+G,CAAC;IACtH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,gCAAgC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,4DAA4D,CAAC;IAC/G,OAAO,wEAAwE,CAAC;AAClF,CAAC"}
|
package/dist/auth.d.ts
CHANGED
|
@@ -1,84 +1,23 @@
|
|
|
1
|
-
import { type
|
|
2
|
-
import { type
|
|
3
|
-
import {
|
|
4
|
-
export
|
|
5
|
-
|
|
6
|
-
environment: DataBasinEnvironment;
|
|
7
|
-
username?: string;
|
|
8
|
-
}
|
|
9
|
-
export type AssistantAuthState = 'authenticated' | 'pending' | 'not_authenticated' | 'failed';
|
|
10
|
-
interface AssistantAuthResultBase {
|
|
11
|
-
environment: DataBasinEnvironment;
|
|
12
|
-
message: string;
|
|
13
|
-
}
|
|
14
|
-
interface PendingAssistantAuthResult extends AssistantAuthResultBase {
|
|
15
|
-
status: 'pending';
|
|
16
|
-
loginUrl: string | null;
|
|
17
|
-
userCode?: string;
|
|
18
|
-
expiresAt?: string;
|
|
19
|
-
}
|
|
20
|
-
interface SettledAssistantAuthResult extends AssistantAuthResultBase {
|
|
21
|
-
status: Exclude<AssistantAuthState, 'pending'>;
|
|
22
|
-
loginUrl: null;
|
|
23
|
-
userCode?: never;
|
|
24
|
-
expiresAt?: never;
|
|
25
|
-
}
|
|
26
|
-
export type AssistantAuthResult = PendingAssistantAuthResult | SettledAssistantAuthResult;
|
|
27
|
-
export interface PublicClientLike {
|
|
28
|
-
getAllAccounts(): Promise<AccountInfo[]>;
|
|
29
|
-
acquireTokenSilent(request: {
|
|
30
|
-
account: AccountInfo;
|
|
31
|
-
scopes: string[];
|
|
32
|
-
}): Promise<AuthenticationResult>;
|
|
33
|
-
acquireTokenInteractive(request: {
|
|
34
|
-
scopes: string[];
|
|
35
|
-
openBrowser: (url: string) => Promise<void>;
|
|
36
|
-
prompt?: string;
|
|
37
|
-
successTemplate?: string;
|
|
38
|
-
errorTemplate?: string;
|
|
39
|
-
}): Promise<AuthenticationResult>;
|
|
40
|
-
acquireTokenByDeviceCode(request: {
|
|
41
|
-
scopes: string[];
|
|
42
|
-
timeout?: number;
|
|
43
|
-
cancel?: boolean;
|
|
44
|
-
deviceCodeCallback: (response: RawDeviceCodeResponse) => void;
|
|
45
|
-
}): Promise<AuthenticationResult | null>;
|
|
46
|
-
signOut(request: {
|
|
47
|
-
account: AccountInfo;
|
|
48
|
-
}): Promise<void>;
|
|
49
|
-
}
|
|
1
|
+
import { type Auth0Options } from './auth0.js';
|
|
2
|
+
import { type AuthManagerOptions as EntraOptions } from './entra-auth.js';
|
|
3
|
+
import type { DataBasinProfile } from './config.js';
|
|
4
|
+
export type { AuthStatus, AssistantAuthState, AssistantAuthResult, PublicClientLike } from './entra-auth.js';
|
|
5
|
+
export { createSecurePublicClient } from './credential-store.js';
|
|
50
6
|
export interface AuthManagerOptions {
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
now?: () => number;
|
|
7
|
+
auth0?: Auth0Options;
|
|
8
|
+
entra?: EntraOptions;
|
|
54
9
|
}
|
|
10
|
+
/** Use the configured provider. Never treat a cached Entra login as an Auth0 session. */
|
|
55
11
|
export declare class AuthManager {
|
|
56
12
|
readonly profile: DataBasinProfile;
|
|
57
|
-
private
|
|
58
|
-
private tokenPromise;
|
|
59
|
-
private activeLogin;
|
|
60
|
-
private lastLoginFailed;
|
|
61
|
-
private readonly createClient;
|
|
62
|
-
private readonly openBrowser;
|
|
63
|
-
private readonly now;
|
|
13
|
+
private readonly provider;
|
|
64
14
|
constructor(profile: DataBasinProfile, options?: AuthManagerOptions);
|
|
65
15
|
getAccessToken(): Promise<string>;
|
|
66
|
-
login(): Promise<AuthStatus>;
|
|
67
|
-
startLogin(): Promise<AssistantAuthResult>;
|
|
16
|
+
login(): Promise<import("./entra-auth.js").AuthStatus>;
|
|
17
|
+
startLogin(): Promise<import("./entra-auth.js").AssistantAuthResult>;
|
|
18
|
+
getLoginStatus(): Promise<import("./entra-auth.js").AssistantAuthResult>;
|
|
68
19
|
cancelPendingLogin(): void;
|
|
69
|
-
getLoginStatus(): Promise<AssistantAuthResult>;
|
|
70
|
-
private pendingAssistantResult;
|
|
71
|
-
private cachedAssistantResult;
|
|
72
|
-
private failedAssistantResult;
|
|
73
|
-
private beginDeviceLogin;
|
|
74
|
-
private performDeviceLogin;
|
|
75
|
-
private performInteractiveLogin;
|
|
76
|
-
private completeLogin;
|
|
77
|
-
private assistantResult;
|
|
78
20
|
logout(): Promise<number>;
|
|
79
|
-
status(): Promise<AuthStatus>;
|
|
80
|
-
private acquireSilent;
|
|
81
|
-
private client;
|
|
21
|
+
status(): Promise<import("./entra-auth.js").AuthStatus>;
|
|
82
22
|
}
|
|
83
|
-
export { createSecurePublicClient } from './credential-store.js';
|
|
84
23
|
//# sourceMappingURL=auth.d.ts.map
|
package/dist/auth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAoB,KAAK,kBAAkB,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,MAAM,WAAW,kBAAkB;IAAG,KAAK,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE;AAElF,yFAAyF;AACzF,qBAAa,WAAW;IAEV,QAAQ,CAAC,OAAO,EAAE,gBAAgB;IAD9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;gBACtC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,kBAAuB;IAKhF,cAAc;IACd,KAAK;IACL,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,MAAM;IACN,MAAM;CACP"}
|
package/dist/auth.js
CHANGED
|
@@ -1,234 +1,22 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import {
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import { projectDevicePrompt, validateInteractiveLoginUrl } from './login-url.js';
|
|
6
|
-
import { accountMatchesProfile, validateAccessTokenResult } from './token-validation.js';
|
|
1
|
+
import { Auth0Manager } from './auth0.js';
|
|
2
|
+
import { EntraAuthManager } from './entra-auth.js';
|
|
3
|
+
export { createSecurePublicClient } from './credential-store.js';
|
|
4
|
+
/** Use the configured provider. Never treat a cached Entra login as an Auth0 session. */
|
|
7
5
|
export class AuthManager {
|
|
8
6
|
profile;
|
|
9
|
-
|
|
10
|
-
tokenPromise;
|
|
11
|
-
activeLogin;
|
|
12
|
-
lastLoginFailed = false;
|
|
13
|
-
createClient;
|
|
14
|
-
openBrowser;
|
|
15
|
-
now;
|
|
7
|
+
provider;
|
|
16
8
|
constructor(profile, options = {}) {
|
|
17
9
|
this.profile = profile;
|
|
18
|
-
this.
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
}
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
}
|
|
28
|
-
|
|
29
|
-
return this.performInteractiveLogin(this.openBrowser);
|
|
30
|
-
}
|
|
31
|
-
async startLogin() {
|
|
32
|
-
const status = await this.getLoginStatus();
|
|
33
|
-
if (status.status === 'authenticated' || status.status === 'pending')
|
|
34
|
-
return status;
|
|
35
|
-
const login = this.beginDeviceLogin();
|
|
36
|
-
const outcome = await Promise.race([
|
|
37
|
-
login.prompted.then((prompt) => ({ state: 'prompted', prompt })),
|
|
38
|
-
login.completion.then(() => ({ state: 'completed' }), () => ({ state: 'failed' }))
|
|
39
|
-
]);
|
|
40
|
-
if (outcome.state === 'completed') {
|
|
41
|
-
return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} sign-in is complete.`);
|
|
42
|
-
}
|
|
43
|
-
if (outcome.state === 'failed') {
|
|
44
|
-
return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
|
|
45
|
-
}
|
|
46
|
-
return this.assistantResult('pending', outcome.prompt.verificationUri, `Open the Microsoft sign-in URL on any device and enter code ${outcome.prompt.userCode}. Then call databasin_auth_status.`, outcome.prompt.userCode, login.expiresAt);
|
|
47
|
-
}
|
|
48
|
-
cancelPendingLogin() {
|
|
49
|
-
this.activeLogin?.cancel();
|
|
50
|
-
}
|
|
51
|
-
async getLoginStatus() {
|
|
52
|
-
if (this.activeLogin)
|
|
53
|
-
return this.pendingAssistantResult(this.activeLogin);
|
|
54
|
-
const authenticated = await this.cachedAssistantResult();
|
|
55
|
-
if (authenticated)
|
|
56
|
-
return authenticated;
|
|
57
|
-
if (this.lastLoginFailed)
|
|
58
|
-
return this.failedAssistantResult();
|
|
59
|
-
return this.assistantResult('not_authenticated', null, `DataBasin ${this.profile.label} is not signed in. Call databasin_login to begin.`);
|
|
60
|
-
}
|
|
61
|
-
pendingAssistantResult(login) {
|
|
62
|
-
const message = login.prompt
|
|
63
|
-
? `Open the Microsoft sign-in URL on any device and enter code ${login.prompt.userCode}.`
|
|
64
|
-
: 'Microsoft is preparing the device sign-in instructions.';
|
|
65
|
-
return this.assistantResult('pending', login.prompt?.verificationUri ?? null, message, login.prompt?.userCode, login.expiresAt);
|
|
66
|
-
}
|
|
67
|
-
async cachedAssistantResult() {
|
|
68
|
-
const cachedStatus = await this.status();
|
|
69
|
-
if (!cachedStatus.authenticated)
|
|
70
|
-
return undefined;
|
|
71
|
-
try {
|
|
72
|
-
await this.getAccessToken();
|
|
73
|
-
return this.assistantResult('authenticated', null, `DataBasin ${this.profile.label} is signed in.`);
|
|
74
|
-
}
|
|
75
|
-
catch (error) {
|
|
76
|
-
if (error instanceof DataBasinError && error.code === 'UNAUTHENTICATED')
|
|
77
|
-
return undefined;
|
|
78
|
-
throw error;
|
|
79
|
-
}
|
|
80
|
-
}
|
|
81
|
-
failedAssistantResult() {
|
|
82
|
-
return this.assistantResult('failed', null, `DataBasin ${this.profile.label} sign-in did not complete. Call databasin_login to try again.`);
|
|
83
|
-
}
|
|
84
|
-
beginDeviceLogin() {
|
|
85
|
-
if (this.activeLogin)
|
|
86
|
-
return this.activeLogin;
|
|
87
|
-
this.lastLoginFailed = false;
|
|
88
|
-
let resolvePrompted = () => undefined;
|
|
89
|
-
let cancelRequested = false;
|
|
90
|
-
let deviceRequest;
|
|
91
|
-
const login = {
|
|
92
|
-
prompted: new Promise((resolve) => {
|
|
93
|
-
resolvePrompted = resolve;
|
|
94
|
-
}),
|
|
95
|
-
completion: Promise.resolve({ authenticated: false, environment: this.profile.environment }),
|
|
96
|
-
prompt: undefined,
|
|
97
|
-
expiresAt: undefined,
|
|
98
|
-
cancel: () => {
|
|
99
|
-
cancelRequested = true;
|
|
100
|
-
if (deviceRequest)
|
|
101
|
-
deviceRequest.cancel = true;
|
|
102
|
-
}
|
|
103
|
-
};
|
|
104
|
-
login.completion = this.performDeviceLogin((prompt) => {
|
|
105
|
-
login.prompt = prompt;
|
|
106
|
-
login.expiresAt = new Date(this.now() + prompt.expiresIn * 1_000).toISOString();
|
|
107
|
-
resolvePrompted(prompt);
|
|
108
|
-
}, (request) => {
|
|
109
|
-
deviceRequest = request;
|
|
110
|
-
if (cancelRequested)
|
|
111
|
-
request.cancel = true;
|
|
112
|
-
}).catch((error) => {
|
|
113
|
-
this.lastLoginFailed = true;
|
|
114
|
-
throw error;
|
|
115
|
-
}).finally(() => {
|
|
116
|
-
if (this.activeLogin === login)
|
|
117
|
-
this.activeLogin = undefined;
|
|
118
|
-
});
|
|
119
|
-
this.activeLogin = login;
|
|
120
|
-
void login.completion.catch(() => undefined);
|
|
121
|
-
return login;
|
|
122
|
-
}
|
|
123
|
-
async performDeviceLogin(onPrompt, onRequest) {
|
|
124
|
-
const client = await this.client();
|
|
125
|
-
let result;
|
|
126
|
-
try {
|
|
127
|
-
const request = {
|
|
128
|
-
scopes: [...this.profile.scopes],
|
|
129
|
-
timeout: 900,
|
|
130
|
-
cancel: false,
|
|
131
|
-
deviceCodeCallback: (response) => onPrompt(projectDevicePrompt(response))
|
|
132
|
-
};
|
|
133
|
-
onRequest(request);
|
|
134
|
-
result = await client.acquireTokenByDeviceCode(request);
|
|
135
|
-
}
|
|
136
|
-
catch {
|
|
137
|
-
throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
|
|
138
|
-
}
|
|
139
|
-
return this.completeLogin(client, result);
|
|
140
|
-
}
|
|
141
|
-
async performInteractiveLogin(openBrowser) {
|
|
142
|
-
const client = await this.client();
|
|
143
|
-
let result;
|
|
144
|
-
try {
|
|
145
|
-
result = await client.acquireTokenInteractive({
|
|
146
|
-
scopes: [...this.profile.scopes],
|
|
147
|
-
openBrowser: async (url) => openBrowser(validateInteractiveLoginUrl(url, this.profile)),
|
|
148
|
-
prompt: 'select_account',
|
|
149
|
-
successTemplate: successPage(this.profile.label),
|
|
150
|
-
errorTemplate: errorPage()
|
|
151
|
-
});
|
|
152
|
-
}
|
|
153
|
-
catch {
|
|
154
|
-
throw new DataBasinError('UNAUTHENTICATED', `DataBasin ${this.profile.label} sign-in did not complete.`);
|
|
155
|
-
}
|
|
156
|
-
return this.completeLogin(client, result);
|
|
157
|
-
}
|
|
158
|
-
async completeLogin(client, result) {
|
|
159
|
-
validateAccessTokenResult(result, this.profile, this.now());
|
|
160
|
-
const account = result.account;
|
|
161
|
-
const accounts = await client.getAllAccounts();
|
|
162
|
-
await Promise.all(accounts
|
|
163
|
-
.filter((cachedAccount) => cachedAccount.homeAccountId !== account.homeAccountId)
|
|
164
|
-
.map((account) => client.signOut({ account })));
|
|
165
|
-
return {
|
|
166
|
-
authenticated: true,
|
|
167
|
-
environment: this.profile.environment,
|
|
168
|
-
username: account.username
|
|
169
|
-
};
|
|
170
|
-
}
|
|
171
|
-
assistantResult(status, loginUrl, message, userCode, expiresAt) {
|
|
172
|
-
if (status !== 'pending') {
|
|
173
|
-
return { status, environment: this.profile.environment, loginUrl: null, message };
|
|
174
|
-
}
|
|
175
|
-
return {
|
|
176
|
-
status,
|
|
177
|
-
environment: this.profile.environment,
|
|
178
|
-
loginUrl,
|
|
179
|
-
...(userCode ? { userCode } : {}),
|
|
180
|
-
...(expiresAt ? { expiresAt } : {}),
|
|
181
|
-
message
|
|
182
|
-
};
|
|
183
|
-
}
|
|
184
|
-
async logout() {
|
|
185
|
-
const client = await this.client();
|
|
186
|
-
const accounts = await client.getAllAccounts();
|
|
187
|
-
await Promise.all(accounts.map((account) => client.signOut({ account })));
|
|
188
|
-
return accounts.length;
|
|
189
|
-
}
|
|
190
|
-
async status() {
|
|
191
|
-
const accounts = await (await this.client()).getAllAccounts();
|
|
192
|
-
const account = selectAccount(accounts, this.profile);
|
|
193
|
-
return account
|
|
194
|
-
? { authenticated: true, environment: this.profile.environment, username: account.username }
|
|
195
|
-
: { authenticated: false, environment: this.profile.environment };
|
|
196
|
-
}
|
|
197
|
-
async acquireSilent() {
|
|
198
|
-
const client = await this.client();
|
|
199
|
-
const account = selectAccount(await client.getAllAccounts(), this.profile);
|
|
200
|
-
if (!account)
|
|
201
|
-
throw new LoginRequiredError(this.profile.environment);
|
|
202
|
-
try {
|
|
203
|
-
const result = await client.acquireTokenSilent({ account, scopes: [...this.profile.scopes] });
|
|
204
|
-
return validateAccessTokenResult(result, this.profile, this.now());
|
|
205
|
-
}
|
|
206
|
-
catch (error) {
|
|
207
|
-
if (error instanceof InteractionRequiredAuthError) {
|
|
208
|
-
throw new LoginRequiredError(this.profile.environment);
|
|
209
|
-
}
|
|
210
|
-
throw new DataBasinError('UNAUTHENTICATED', `The DataBasin ${this.profile.label} session could not be refreshed. Sign in again.`);
|
|
211
|
-
}
|
|
212
|
-
}
|
|
213
|
-
client() {
|
|
214
|
-
this.clientPromise ??= this.createClient().catch((error) => {
|
|
215
|
-
this.clientPromise = undefined;
|
|
216
|
-
const detail = error instanceof Error && error.message.includes('libsecret')
|
|
217
|
-
? ' Install or unlock the system keyring and try again.'
|
|
218
|
-
: '';
|
|
219
|
-
throw new DataBasinError('UNAUTHENTICATED', `Secure DataBasin credential storage is unavailable.${detail}`);
|
|
220
|
-
});
|
|
221
|
-
return this.clientPromise;
|
|
222
|
-
}
|
|
223
|
-
}
|
|
224
|
-
function selectAccount(accounts, profile) {
|
|
225
|
-
return accounts.find((account) => accountMatchesProfile(account, profile));
|
|
226
|
-
}
|
|
227
|
-
function successPage(label) {
|
|
228
|
-
return `<!doctype html><html><body><h1>DataBasin sign-in complete</h1><p>You are signed in to ${label}. You can close this window.</p></body></html>`;
|
|
10
|
+
this.provider = profile.auth0
|
|
11
|
+
? new Auth0Manager(profile, profile.auth0, options.auth0)
|
|
12
|
+
: new EntraAuthManager(profile, options.entra);
|
|
13
|
+
}
|
|
14
|
+
getAccessToken() { return this.provider.getAccessToken(); }
|
|
15
|
+
login() { return this.provider.login(); }
|
|
16
|
+
startLogin() { return this.provider.startLogin(); }
|
|
17
|
+
getLoginStatus() { return this.provider.getLoginStatus(); }
|
|
18
|
+
cancelPendingLogin() { this.provider.cancelPendingLogin(); }
|
|
19
|
+
logout() { return this.provider.logout(); }
|
|
20
|
+
status() { return this.provider.status(); }
|
|
229
21
|
}
|
|
230
|
-
function errorPage() {
|
|
231
|
-
return '<!doctype html><html><body><h1>DataBasin sign-in failed</h1><p>Return to your assistant or terminal and try again.</p></body></html>';
|
|
232
|
-
}
|
|
233
|
-
export { createSecurePublicClient } from './credential-store.js';
|
|
234
22
|
//# sourceMappingURL=auth.js.map
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAqB,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAA2C,MAAM,iBAAiB,CAAC;AAI5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,yFAAyF;AACzF,MAAM,OAAO,WAAW;IAED;IADJ,QAAQ,CAAkC;IAC3D,YAAqB,OAAyB,EAAE,UAA8B,EAAE;QAA3D,YAAO,GAAP,OAAO,CAAkB;QAC5C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK;YAC3B,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;YACzD,CAAC,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,cAAc,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3D,KAAK,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,UAAU,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnD,cAAc,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3D,kBAAkB,KAAK,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CAC5C"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
import { z } from 'zod';
|
|
2
|
+
import type { DataBasinEnvironment } from './config.js';
|
|
3
|
+
export declare const Auth0SessionSchema: z.ZodObject<{
|
|
4
|
+
accessToken: z.ZodString;
|
|
5
|
+
refreshToken: z.ZodOptional<z.ZodString>;
|
|
6
|
+
expiresAt: z.ZodNumber;
|
|
7
|
+
}, z.core.$strict>;
|
|
8
|
+
export type Auth0Session = z.infer<typeof Auth0SessionSchema>;
|
|
9
|
+
export interface Auth0Store {
|
|
10
|
+
transact<T>(operation: (session: Auth0Session | null, save: (next: Auth0Session | null) => Promise<void>) => Promise<T>): Promise<T>;
|
|
11
|
+
}
|
|
12
|
+
/** Separate OS-protected records and cross-process locks for each provider/client/environment. */
|
|
13
|
+
export declare function createAuth0Store(environment: DataBasinEnvironment, issuer: string, clientId: string, audience: string): Promise<Auth0Store>;
|
|
14
|
+
//# sourceMappingURL=auth0-store.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth0-store.d.ts","sourceRoot":"","sources":["../src/auth0-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;kBAIpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtI;AAED,kGAAkG;AAClG,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,oBAAoB,EACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CAwDrB"}
|