@dataflint/mcp-server 1.0.12 → 1.0.15

package/dist/auth/service-account-service.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Service Account Authentication Service
+ *
+ * Provides authentication using a pre-generated JWT token read from a file.
+ * This is typically used for M2M (machine-to-machine) scenarios where a service
+ * account token is mounted as a file (e.g., in Kubernetes).
+ *
+ * The token is expected to be a valid JWT with an 'exp' claim.
+ */
+import { IAuthStrategy, AuthStrategyType, AuthUserInfo, IAuthLogger } from "./types";
+/**
+ * Service Account authentication strategy
+ *
+ * Reads a JWT token from a file path and manages token caching and expiration.
+ *
+ * @example
+ * ```typescript
+ * const service = new ServiceAccountService(
+ *   '/var/run/secrets/dataflint/token',
+ *   'tenant-123',
+ *   logger
+ * );
+ *
+ * await service.initialize();
+ * const token = await service.getToken();
+ * ```
+ */
+export declare class ServiceAccountService implements IAuthStrategy {
+    private tokenPath;
+    private tenantId;
+    private tokenCache;
+    private logger;
+    constructor(tokenPath: string, tenantId?: string, logger?: IAuthLogger);
+    /**
+     * Get the strategy type identifier
+     */
+    getType(): AuthStrategyType;
+    /**
+     * Initialize the service account strategy
+     * Validates that the token file exists and is readable
+     */
+    initialize(): Promise<void>;
+    /**
+     * Get a valid access token, reading from file if cache is expired
+     */
+    getToken(): Promise<string>;
+    /**
+     * Force refresh the token by clearing cache and re-reading from file
+     */
+    refreshToken(): Promise<void>;
+    /**
+     * Check if currently authenticated (token file exists and is valid)
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Get user information for the service account
+     * Returns synthetic user info since service accounts don't have traditional user profiles
+     */
+    getUserInfo(): Promise<AuthUserInfo>;
+    /**
+     * Get the tenant ID associated with this service account
+     */
+    getTenantId(): string | undefined;
+    /**
+     * Read the token from the file system
+     */
+    private readTokenFromFile;
+    /**
+     * Validate the token format and cache it with expiration
+     */
+    private validateAndCacheToken;
+    /**
+     * Extract expiration time from JWT payload
+     */
+    private extractExpiration;
+}
+//# sourceMappingURL=service-account-service.d.ts.map

package/dist/auth/service-account-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-service.d.ts","sourceRoot":"","sources":["../../src/auth/service-account-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACH,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACd,MAAM,SAAS,CAAC;AAiBjB;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IACvD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,MAAM,CAAc;gBAEhB,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW;IAMtE;;OAEG;IACH,OAAO,IAAI,gBAAgB;IAI3B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBjC;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAgBjC;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAOnC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IASzC;;;OAGG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IAQ1C;;OAEG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS;IAIjC;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiC7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAuB5B"}

package/dist/auth/service-account-service.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * Service Account Authentication Service
+ *
+ * Provides authentication using a pre-generated JWT token read from a file.
+ * This is typically used for M2M (machine-to-machine) scenarios where a service
+ * account token is mounted as a file (e.g., in Kubernetes).
+ *
+ * The token is expected to be a valid JWT with an 'exp' claim.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountService = void 0;
+const fs = __importStar(require("fs"));
+const types_1 = require("./types");
+/**
+ * Default no-op logger for when no logger is provided
+ */
+const noopLogger = {
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+    debug: () => { },
+};
+/**
+ * Service Account authentication strategy
+ *
+ * Reads a JWT token from a file path and manages token caching and expiration.
+ *
+ * @example
+ * ```typescript
+ * const service = new ServiceAccountService(
+ *   '/var/run/secrets/dataflint/token',
+ *   'tenant-123',
+ *   logger
+ * );
+ *
+ * await service.initialize();
+ * const token = await service.getToken();
+ * ```
+ */
+class ServiceAccountService {
+    tokenPath;
+    tenantId;
+    tokenCache = null;
+    logger;
+    constructor(tokenPath, tenantId, logger) {
+        this.tokenPath = tokenPath;
+        this.tenantId = tenantId;
+        this.logger = logger || noopLogger;
+    }
+    /**
+     * Get the strategy type identifier
+     */
+    getType() {
+        return types_1.AuthStrategyType.SERVICE_ACCOUNT;
+    }
+    /**
+     * Initialize the service account strategy
+     * Validates that the token file exists and is readable
+     */
+    async initialize() {
+        this.logger.info(`Initializing ServiceAccountService with token path: ${this.tokenPath}`);
+        if (!fs.existsSync(this.tokenPath)) {
+            throw new Error(`Service account token file not found: ${this.tokenPath}`);
+        }
+        // Pre-load and validate the token
+        await this.getToken();
+        this.logger.info("ServiceAccountService initialized successfully");
+    }
+    /**
+     * Get a valid access token, reading from file if cache is expired
+     */
+    async getToken() {
+        const now = Date.now();
+        // Check if we have a valid cached token (with 5-minute buffer)
+        const bufferMs = 5 * 60 * 1000;
+        if (this.tokenCache && now < this.tokenCache.expiresAt - bufferMs) {
+            this.logger.debug("Using cached service account token");
+            return this.tokenCache.token;
+        }
+        const rawToken = this.readTokenFromFile();
+        this.validateAndCacheToken(rawToken);
+        return this.tokenCache.token;
+    }
+    /**
+     * Force refresh the token by clearing cache and re-reading from file
+     */
+    async refreshToken() {
+        this.logger.info("Refreshing service account token...");
+        this.tokenCache = null;
+        await this.getToken();
+        this.logger.info("Service account token refreshed");
+    }
+    /**
+     * Check if currently authenticated (token file exists and is valid)
+     */
+    async isAuthenticated() {
+        try {
+            await this.getToken();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Get user information for the service account
+     * Returns synthetic user info since service accounts don't have traditional user profiles
+     */
+    async getUserInfo() {
+        return {
+            sub: "m2m-service-account",
+            name: "M2M Service Account",
+            ...(this.tenantId && { tenant_id: this.tenantId }),
+        };
+    }
+    /**
+     * Get the tenant ID associated with this service account
+     */
+    getTenantId() {
+        return this.tenantId;
+    }
+    /**
+     * Read the token from the file system
+     */
+    readTokenFromFile() {
+        return fs.readFileSync(this.tokenPath, "utf8");
+    }
+    /**
+     * Validate the token format and cache it with expiration
+     */
+    validateAndCacheToken(rawToken) {
+        const token = rawToken.trim();
+        if (!token) {
+            throw new Error("Service account token is empty");
+        }
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            throw new Error(`Invalid JWT format: expected 3 parts, got ${parts.length}`);
+        }
+        const expiresAt = this.extractExpiration(token);
+        const now = Date.now();
+        const expiresIn = Math.floor((expiresAt - now) / 1000);
+        // Check if token is already expired
+        if (expiresAt <= now) {
+            throw new Error("Service account token is expired");
+        }
+        this.logger.info(`Service account token loaded${this.tenantId ? ` for tenant ${this.tenantId}` : ""}: expires in ${expiresIn}s (${new Date(expiresAt).toISOString()})`);
+        this.tokenCache = {
+            token,
+            expiresAt,
+        };
+    }
+    /**
+     * Extract expiration time from JWT payload
+     */
+    extractExpiration(token) {
+        const parts = token.split(".");
+        try {
+            const payload = parts[1];
+            const decoded = Buffer.from(payload, "base64url").toString("utf8");
+            const parsed = JSON.parse(decoded);
+            if (typeof parsed.exp === "number") {
+                return parsed.exp * 1000;
+            }
+            this.logger.warn("JWT missing 'exp' field, using fallback expiration");
+            return Date.now() + 300000; // 5 minutes fallback
+        }
+        catch (error) {
+            this.logger.warn(`Failed to parse JWT expiration: ${error}, using fallback expiration`);
+            return Date.now() + 300000; // 5 minutes fallback
+        }
+    }
+}
+exports.ServiceAccountService = ServiceAccountService;
+//# sourceMappingURL=service-account-service.js.map

package/dist/auth/service-account-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account-service.js","sourceRoot":"","sources":["../../src/auth/service-account-service.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,mCAKiB;AAOjB;;GAEG;AACH,MAAM,UAAU,GAAgB;IAC5B,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,qBAAqB;IACtB,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,UAAU,GAA2B,IAAI,CAAC;IAC1C,MAAM,CAAc;IAE5B,YAAY,SAAiB,EAAE,QAAiB,EAAE,MAAoB;QAClE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,UAAU,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,OAAO;QACH,OAAO,wBAAgB,CAAC,eAAe,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,uDAAuD,IAAI,CAAC,SAAS,EAAE,CAC1E,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACX,yCAAyC,IAAI,CAAC,SAAS,EAAE,CAC5D,CAAC;QACN,CAAC;QAED,kCAAkC;QAClC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACjB,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACb,OAAO;YACH,GAAG,EAAE,qBAAqB;YAC1B,IAAI,EAAE,qBAAqB;YAC3B,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SACrD,CAAC;IACN,CAAC;IAED;;OAEG;IACH,WAAW;QACP,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,iBAAiB;QACrB,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,QAAgB;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,6CAA6C,KAAK,CAAC,MAAM,EAAE,CAC9D,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAEvD,oCAAoC;QACpC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,+BAA+B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,SAAS,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,GAAG,CACxJ,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG;YACd,KAAK;YACL,SAAS;SACZ,CAAC;IACN,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,KAAa;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEnC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;YAC7B,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,oDAAoD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,qBAAqB;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACZ,mCAAmC,KAAK,6BAA6B,CACxE,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,qBAAqB;QACrD,CAAC;IACL,CAAC;CACJ;AAxKD,sDAwKC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Auth types and interfaces for DataFlint authentication
+ *
+ * This module defines the core interfaces used across all authentication strategies:
+ * - Service Account (M2M token from file)
+ * - Auth0 M2M (client credentials grant)
+ * - Auth0 User (interactive OAuth2/PKCE flow)
+ */
+/**
+ * Basic authentication configuration for Auth0
+ */
+export interface AuthConfig {
+    domain: string;
+    clientId: string;
+    scope: string;
+    audience: string;
+}
+/**
+ * Result from a successful authentication
+ */
+export interface AuthResult {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    expiresAt?: Date;
+    userInfo?: unknown;
+}
+/**
+ * Credentials required for Auth0 M2M (client credentials) authentication
+ */
+export interface Auth0M2MCredentials {
+    client_id: string;
+    client_secret: string;
+    audience: string;
+    domain: string;
+}
+/**
+ * Authentication strategy types
+ */
+export declare enum AuthStrategyType {
+    SERVICE_ACCOUNT = "service_account",
+    AUTH0_M2M = "auth0_m2m",
+    AUTH0_USER = "auth0_user"
+}
+/**
+ * M2M authentication mode types
+ */
+export declare enum M2MType {
+    NONE = "none",
+    SERVICE_ACCOUNT = "service_account",
+    AUTH0_M2M = "auth0_m2m"
+}
+/**
+ * M2M authentication mode - single source of truth for M2M detection
+ */
+export type M2MMode = {
+    type: M2MType.NONE;
+} | {
+    type: M2MType.SERVICE_ACCOUNT;
+    tokenPath: string;
+    tenantId?: string;
+} | {
+    type: M2MType.AUTH0_M2M;
+    secretName: string;
+    tenantId?: string;
+};
+/**
+ * User information returned from authentication
+ */
+export interface AuthUserInfo {
+    sub: string;
+    name: string;
+    tenant_id?: string;
+}
+/**
+ * Common interface for all authentication strategies
+ *
+ * Implementations:
+ * - ServiceAccountService: Reads JWT from file path
+ * - Auth0M2MService: Uses client credentials grant
+ * - Auth0Service: Uses interactive OAuth2/PKCE flow
+ */
+export interface IAuthStrategy {
+    /**
+     * Get the type of this authentication strategy
+     */
+    getType(): AuthStrategyType;
+    /**
+     * Initialize the authentication strategy (e.g., discover issuer, validate credentials)
+     */
+    initialize(): Promise<void>;
+    /**
+     * Get a valid access token, refreshing if necessary
+     */
+    getToken(): Promise<string>;
+    /**
+     * Force refresh the token
+     */
+    refreshToken(): Promise<void>;
+    /**
+     * Check if currently authenticated with a valid token
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Get user information for the current authentication
+     */
+    getUserInfo(): Promise<AuthUserInfo>;
+    /**
+     * Get the tenant ID associated with this authentication (if any)
+     */
+    getTenantId(): string | undefined;
+}
+/**
+ * Configuration provider interface for authentication
+ */
+export interface IAuthConfigProvider {
+    getAuthConfig(): AuthConfig;
+    getM2MMode(): M2MMode;
+    getTenantId(): string | undefined;
+    getEnvironment(): string;
+    getServerUrl(): string;
+}
+/**
+ * Logger interface for authentication services
+ */
+export interface IAuthLogger {
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string, error?: unknown): void;
+    debug(message: string): void;
+}
+/**
+ * Handler for opening URLs (used for OAuth2 browser-based flow)
+ */
+export type OpenUrlHandler = (url: string) => Promise<void>;
+/**
+ * Provider function for AuthConfig
+ */
+export type ConfigProvider = () => AuthConfig;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,oBAAY,gBAAgB;IACxB,eAAe,oBAAoB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;CAC5B;AAED;;GAEG;AACH,oBAAY,OAAO;IACf,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,SAAS,cAAc;CAC1B;AAED;;GAEG;AACH,MAAM,MAAM,OAAO,GACb;IAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,OAAO,IAAI,gBAAgB,CAAC;IAE5B;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpC;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAErC;;OAEG;IACH,WAAW,IAAI,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,aAAa,IAAI,UAAU,CAAC;IAC5B,UAAU,IAAI,OAAO,CAAC;IACtB,WAAW,IAAI,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,IAAI,MAAM,CAAC;IACzB,YAAY,IAAI,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9C,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Auth types and interfaces for DataFlint authentication
+ *
+ * This module defines the core interfaces used across all authentication strategies:
+ * - Service Account (M2M token from file)
+ * - Auth0 M2M (client credentials grant)
+ * - Auth0 User (interactive OAuth2/PKCE flow)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.M2MType = exports.AuthStrategyType = void 0;
+/**
+ * Authentication strategy types
+ */
+var AuthStrategyType;
+(function (AuthStrategyType) {
+    AuthStrategyType["SERVICE_ACCOUNT"] = "service_account";
+    AuthStrategyType["AUTH0_M2M"] = "auth0_m2m";
+    AuthStrategyType["AUTH0_USER"] = "auth0_user";
+})(AuthStrategyType || (exports.AuthStrategyType = AuthStrategyType = {}));
+/**
+ * M2M authentication mode types
+ */
+var M2MType;
+(function (M2MType) {
+    M2MType["NONE"] = "none";
+    M2MType["SERVICE_ACCOUNT"] = "service_account";
+    M2MType["AUTH0_M2M"] = "auth0_m2m";
+})(M2MType || (exports.M2MType = M2MType = {}));
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAiCH;;GAEG;AACH,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IACxB,uDAAmC,CAAA;IACnC,2CAAuB,CAAA;IACvB,6CAAyB,CAAA;AAC7B,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAED;;GAEG;AACH,IAAY,OAIX;AAJD,WAAY,OAAO;IACf,wBAAa,CAAA;IACb,8CAAmC,CAAA;IACnC,kCAAuB,CAAA;AAC3B,CAAC,EAJW,OAAO,uBAAP,OAAO,QAIlB"}

package/dist/dataflint-server-service.d.ts

@@ -1,4 +1,4 @@
-import { Auth0Service, AuthResult, IAuthStrategy } from "@dataflint/shared-auth-config";
+import { Auth0Service, AuthResult, IAuthStrategy } from "./auth/index.js";
 import { IConfigService } from "./types";
 import { ApplicationSummary, DataFlintPromptsResponse, Job, JobAlert, FullJobAlert, ServiceStatus, SqlQueriesCode, CopilotApplicationRichResponse, CopilotJobRichResponse, GetApplicationsParams, GetJobsRichParams, NodeMapping, HighlightResponse, LLMFinding, FindingsResponse, ClearHighlightsResponse, RemapReason, RemapResponse, GetFindingsParams, StoredFinding, UpdateFindingStatusResponse, MultiNodeFinding, MultiNodeFindingsResponse, SparkExpertiseResponse, ExpertiseTopicsResponse, HighlightContextResponse, PromptLayerType, PromptLayerResponse, AvailableLayersResponse, JobSparkConfigResponse, IssueReportMetadataResponse, IssueReportRequest, IssueReportResponse } from "./dataflint-server-models";
 type Auth0ServiceFactory = () => Auth0Service;

package/dist/dataflint-server-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dataflint-server-service.d.ts","sourceRoot":"","sources":["../src/dataflint-server-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,EACZ,UAAU,EACV,aAAa,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EACH,kBAAkB,EAClB,wBAAwB,EACxB,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,2BAA2B,EAC3B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACtB,MAAM,2BAA2B,CAAC;AAInC,KAAK,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAC9C,KAAK,eAAe,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAC3C,KAAK,cAAc,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAE1C,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAMzB;IAEX,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,WAAW,CAA8B;gBAG7C,kBAAkB,EAAE,mBAAmB,EACvC,aAAa,EAAE,cAAc,EAC7B,eAAe,CAAC,EAAE,eAAe,EACjC,WAAW,CAAC,EAAE,aAAa,EAC3B,cAAc,CAAC,EAAE,cAAc;IAgBnC;;OAEG;YACW,cAAc;IAiB5B;;OAEG;YACW,cAAc;IAqB5B;;OAEG;YACW,eAAe;IAYvB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAarC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuF5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7B;;OAEG;YACW,mBAAmB;IA2CjC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA6B9C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAmCjC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAuBzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyCrC;;OAEG;IACH,cAAc,IAAI,UAAU,GAAG,IAAI;IAInC;;OAEG;IACH,gBAAgB,IAAI,aAAa;IASjC;;OAEG;YACW,wBAAwB;IA8FtC;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAc9D;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAoBxE;;OAEG;IACG,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAiB/D;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;YACW,gBAAgB;IAsD9B;;OAEG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KAClB,GACP,OAAO,CAAC,cAAc,CAAC;IAuB1B;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAYtD;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAY9D;;OAEG;IACG,UAAU,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,EAAE,OAAO,CAAC;KACb,GACP,OAAO,CAAC,GAAG,CAAC;IAkCf;;;OAGG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KACf,GACP,OAAO,CAAC,GAAG,CAAC;IAOf;;OAEG;IACG,eAAe,CACjB,MAAM,EAAE,qBAAqB,GAC9B,OAAO,CAAC,8BAA8B,EAAE,CAAC;IAsB5C;;OAEG;IACG,sBAAsB,CACxB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAiBpC;;OAEG;IACG,kBAAkB,CACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,GACxB,OAAO,CAAC,iBAAiB,CAAC;IAoB7B;;OAEG;IACG,uBAAuB,CACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,UAAU,EAAE,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqB5B;;OAEG;IACG,aAAa,CACf,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC;IAkB7B;;OAEG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IActE;;OAEG;IACG,qBAAqB,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBzB;;OAEG;IACG,mBAAmB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAW,EACnB,OAAO,GAAE,MAAW,GACrB,OAAO,CAAC,wBAAwB,CAAC;IAuBpC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAoBtE;;OAEG;IACG,mBAAmB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,GAAG,SAAS,GAChC,OAAO,CAAC,2BAA2B,CAAC;IAkBvC;;OAEG;IACG,uBAAuB,CACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAqBrC;;OAEG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,OAAe,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAiBlC;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAgB7D;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmB1E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAa1D;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAqBvE;;;OAGG;IACG,sBAAsB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAcpE;;;;;;OAMG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kBAAkB,GAC5B,OAAO,CAAC,mBAAmB,CAAC;CAiBlC"}
+{"version":3,"file":"dataflint-server-service.d.ts","sourceRoot":"","sources":["../src/dataflint-server-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EACH,kBAAkB,EAClB,wBAAwB,EACxB,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,2BAA2B,EAC3B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,mBAAmB,EACtB,MAAM,2BAA2B,CAAC;AAgBnC,KAAK,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAC9C,KAAK,eAAe,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAC3C,KAAK,cAAc,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAE1C,qBAAa,sBAAsB;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAMzB;IAEX,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,WAAW,CAA8B;gBAG7C,kBAAkB,EAAE,mBAAmB,EACvC,aAAa,EAAE,cAAc,EAC7B,eAAe,CAAC,EAAE,eAAe,EACjC,WAAW,CAAC,EAAE,aAAa,EAC3B,cAAc,CAAC,EAAE,cAAc;IAgBnC;;OAEG;YACW,cAAc;IAiB5B;;OAEG;YACW,cAAc;IA8B5B;;OAEG;YACW,eAAe;IAYvB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAarC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4F5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7B;;OAEG;YACW,mBAAmB;IAiDjC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA6B9C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAmCjC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAuBzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAyCrC;;OAEG;IACH,cAAc,IAAI,UAAU,GAAG,IAAI;IAInC;;OAEG;IACH,gBAAgB,IAAI,aAAa;IASjC;;OAEG;YACW,wBAAwB;IA8FtC;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAc9D;;OAEG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAoBxE;;OAEG;IACG,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAiB/D;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;YACW,gBAAgB;IAsD9B;;OAEG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KAClB,GACP,OAAO,CAAC,cAAc,CAAC;IAuB1B;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAYtD;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAY9D;;OAEG;IACG,UAAU,CACZ,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,IAAI,CAAC,EAAE,OAAO,CAAC;KACb,GACP,OAAO,CAAC,GAAG,CAAC;IAkCf;;;OAGG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QACL,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KACf,GACP,OAAO,CAAC,GAAG,CAAC;IAOf;;OAEG;IACG,eAAe,CACjB,MAAM,EAAE,qBAAqB,GAC9B,OAAO,CAAC,8BAA8B,EAAE,CAAC;IAsB5C;;OAEG;IACG,sBAAsB,CACxB,MAAM,EAAE,iBAAiB,GAC1B,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAiBpC;;OAEG;IACG,kBAAkB,CACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,EAAE,GACxB,OAAO,CAAC,iBAAiB,CAAC;IAoB7B;;OAEG;IACG,uBAAuB,CACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,UAAU,EAAE,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAqB5B;;OAEG;IACG,aAAa,CACf,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC;IAkB7B;;OAEG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IActE;;OAEG;IACG,qBAAqB,CACvB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GACpB,OAAO,CAAC,aAAa,CAAC;IAqBzB;;OAEG;IACG,mBAAmB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAW,EACnB,OAAO,GAAE,MAAW,GACrB,OAAO,CAAC,wBAAwB,CAAC;IAuBpC;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAoBtE;;OAEG;IACG,mBAAmB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,GAAG,SAAS,GAChC,OAAO,CAAC,2BAA2B,CAAC;IAkBvC;;OAEG;IACG,uBAAuB,CACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAqBrC;;OAEG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,OAAe,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAiBlC;;OAEG;IACG,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAgB7D;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmB1E;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAa1D;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAqBvE;;;OAGG;IACG,sBAAsB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAcpE;;;;;;OAMG;IACG,iBAAiB,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kBAAkB,GAC5B,OAAO,CAAC,mBAAmB,CAAC;CAiBlC"}

package/dist/dataflint-server-service.js

@@ -34,8 +34,20 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataFlintServerService = void 0;
+const zod_1 = require("zod");
 const logger_1 = require("./logger");
 const retry = __importStar(require("retry"));
+// Zod schema for runtime validation of stored auth results
+const AuthResultSchema = zod_1.z.object({
+    accessToken: zod_1.z.string(),
+    idToken: zod_1.z.string().optional(),
+    refreshToken: zod_1.z.string().optional(),
+    expiresAt: zod_1.z
+        .union([zod_1.z.string(), zod_1.z.date()])
+        .optional()
+        .transform((val) => (typeof val === "string" ? new Date(val) : val)),
+    userInfo: zod_1.z.unknown().optional(),
+});
 class DataFlintServerService {
     static RETRY_CONFIG = {
         RETRIES: 25, // Total retry attempts (was 5 + 20 = 25)
@@ -90,9 +102,16 @@ class DataFlintServerService {
         try {
             const storedAuth = await this.configService.getAuthSecret();
             if (storedAuth) {
-                const authResult = JSON.parse(storedAuth);
+                const parsed = JSON.parse(storedAuth);
+                const result = AuthResultSchema.safeParse(parsed);
+                if (!result.success) {
+                    logger.warn(`Invalid stored auth format: ${result.error.issues.map((i) => i.message).join(", ")}`);
+                    // Clear invalid stored auth
+                    await this.clearAuthResult();
+                    return null;
+                }
                 logger.debug(`Authentication result loaded from persistent storage for environment: ${this.configService.getEnvironment()}`);
-                return authResult;
+                return result.data;
             }
             logger.debug(`No authentication result found in persistent storage for environment: ${this.configService.getEnvironment()}`);
             return null;
@@ -146,6 +165,9 @@ class DataFlintServerService {
                 logger.info(`Environment: ${this.configService.getEnvironment()}`);
                 logger.info(`Admin Company Domain: ${this.configService.getAdminCompanyDomain()}`);
                 logger.info("Step 1/4: Initializing Auth0 service...");
+                if (!this.authService) {
+                    throw new Error("Auth service not initialized - this should not happen in OAuth mode");
+                }
                 await this.authService.initialize();
                 logger.info("Auth0 service initialized successfully");
                 logger.info("Step 2/4: Loading existing authentication...");
@@ -223,6 +245,9 @@ class DataFlintServerService {
             return;
         }
         const logger = logger_1.Logger.getInstance();
+        if (!this.authService) {
+            throw new Error("Auth service not initialized - cannot authenticate without auth service");
+        }
         try {
             if (this.currentAuth &&
                 !this.authService.isTokenExpired(this.currentAuth)) {