@drawbridge/drawbridge-utils 0.0.40 → 0.0.41

package/dist/{chunk-N5EMSZLI.js → chunk-2DRAIKGZ.js}

@@ -1,6 +1,6 @@
 import {
   generate
-} from "./chunk-HOA2JHXC.js";
+} from "./chunk-OS2AHUWX.js";
 
 // encrypt.js
 import crypto from "crypto";

package/dist/chunk-OS2AHUWX.js

@@ -0,0 +1,27 @@
+// token.js
+import crypto from "crypto";
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = crypto.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return crypto.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return crypto.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
+
+export {
+  generate,
+  hash,
+  compare
+};

package/dist/encrypt.js

@@ -1,8 +1,8 @@
 import {
   decrypt,
   encrypt
-} from "./chunk-N5EMSZLI.js";
-import "./chunk-HOA2JHXC.js";
+} from "./chunk-2DRAIKGZ.js";
+import "./chunk-OS2AHUWX.js";
 export {
   decrypt,
   encrypt

package/dist/oauth.cjs

@@ -0,0 +1,94 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// oauth.js
+var oauth_exports = {};
+__export(oauth_exports, {
+  createOAuthClient: () => createOAuthClient
+});
+module.exports = __toCommonJS(oauth_exports);
+var REFRESH_LEAD_SECONDS = 60;
+var createOAuthClient = ({
+  clientId,
+  clientSecret,
+  scopes = [],
+  tokenUri
+}) => {
+  if (!clientId) throw new Error("createOAuthClient: clientId required");
+  if (!clientSecret) throw new Error("createOAuthClient: clientSecret required");
+  if (!tokenUri) throw new Error("createOAuthClient: tokenUri required");
+  let cached = null;
+  let pending = null;
+  const isFresh = () => {
+    if (!cached) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    return cached.expiresAt - REFRESH_LEAD_SECONDS > now;
+  };
+  const fetchToken = async () => {
+    const params = new URLSearchParams();
+    params.set("grant_type", "client_credentials");
+    if (scopes.length > 0) {
+      params.set("scope", scopes.join(" "));
+    }
+    const basic = Buffer.from(clientId + ":" + clientSecret).toString("base64");
+    const response = await fetch(
+      tokenUri,
+      {
+        body: params.toString(),
+        headers: {
+          "authorization": "Basic " + basic,
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      }
+    );
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error("createOAuthClient: token fetch failed (" + response.status + "): " + text);
+    }
+    const body = await response.json();
+    cached = {
+      accessToken: body.access_token,
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      scope: body.scope
+    };
+    return cached.accessToken;
+  };
+  const refresh = () => {
+    if (pending) return pending;
+    pending = fetchToken().finally(() => {
+      pending = null;
+    });
+    return pending;
+  };
+  return {
+    token: async () => {
+      if (isFresh()) return cached.accessToken;
+      return refresh();
+    },
+    // Force a refresh on the next call. Use this when a request returns 401
+    // before the cached token's expiry — the server may have revoked it.
+    invalidate: () => {
+      cached = null;
+    }
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createOAuthClient
+});

package/dist/oauth.d.cts

@@ -0,0 +1,129 @@
+// Client_credentials token caching helper for first-party Drawbridge apps
+// that call drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
+// drawbridge-webhooks, etc.).
+//
+// Caches the access token in process memory; refreshes when nearing expiry
+// or after a 401. Single-flight refresh prevents thundering herd when many
+// concurrent requests arrive while the token is being rotated.
+//
+// Usage:
+//   import { createOAuthClient } from '@drawbridge/drawbridge-utils/oauth';
+//
+//   const client = createOAuthClient({
+//       clientId : process.env.OAUTH_CLIENT_ID,
+//       clientSecret : process.env.OAUTH_CLIENT_SECRET,
+//       tokenUri : process.env.NEXT_PUBLIC_API_URI + '/oauth/token',
+//       scopes : [ 'share:read' ]
+//   });
+//
+//   await request({ endpoint : '/page/abc', token : await client.token() });
+
+const REFRESH_LEAD_SECONDS = 60;
+
+const createOAuthClient = ({
+	clientId,
+	clientSecret,
+	scopes = [],
+	tokenUri
+}) => {
+
+	if( ! clientId ) throw new Error( 'createOAuthClient: clientId required' );
+	if( ! clientSecret ) throw new Error( 'createOAuthClient: clientSecret required' );
+	if( ! tokenUri ) throw new Error( 'createOAuthClient: tokenUri required' );
+
+	let cached = null;
+	let pending = null;
+
+	const isFresh = () => {
+
+		if( ! cached ) return false;
+
+		const now = Math.floor( Date.now() / 1000 );
+
+		return cached.expiresAt - REFRESH_LEAD_SECONDS > now;
+
+	};
+
+	const fetchToken = async () => {
+
+		const params = new URLSearchParams();
+
+		params.set( 'grant_type', 'client_credentials' );
+
+		if( scopes.length > 0 ){
+
+			params.set( 'scope', scopes.join( ' ' ) );
+
+		}
+
+		const basic = Buffer
+			.from( clientId + ':' + clientSecret )
+			.toString( 'base64' );
+
+		const response = await fetch(
+			tokenUri,
+			{
+				body : params.toString(),
+				headers : {
+					'authorization' : 'Basic ' + basic,
+					'content-type' : 'application/x-www-form-urlencoded'
+				},
+				method : 'POST'
+			}
+		);
+
+		if( ! response.ok ){
+
+			const text = await response.text();
+
+			throw new Error( 'createOAuthClient: token fetch failed (' + response.status + '): ' + text );
+
+		}
+
+		const body = await response.json();
+
+		cached = {
+			accessToken : body.access_token,
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			scope : body.scope
+		};
+
+		return cached.accessToken;
+
+	};
+
+	// Single-flight: collapse concurrent token fetches into one network call.
+	const refresh = () => {
+
+		if( pending ) return pending;
+
+		pending = fetchToken().finally( () => {
+
+			pending = null;
+
+		});
+
+		return pending;
+
+	};
+
+	return {
+		token : async () => {
+
+			if( isFresh() ) return cached.accessToken;
+
+			return refresh();
+
+		},
+		// Force a refresh on the next call. Use this when a request returns 401
+		// before the cached token's expiry — the server may have revoked it.
+		invalidate : () => {
+
+			cached = null;
+
+		}
+	};
+
+};
+
+export { createOAuthClient };

package/dist/oauth.d.ts

@@ -0,0 +1,129 @@
+// Client_credentials token caching helper for first-party Drawbridge apps
+// that call drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
+// drawbridge-webhooks, etc.).
+//
+// Caches the access token in process memory; refreshes when nearing expiry
+// or after a 401. Single-flight refresh prevents thundering herd when many
+// concurrent requests arrive while the token is being rotated.
+//
+// Usage:
+//   import { createOAuthClient } from '@drawbridge/drawbridge-utils/oauth';
+//
+//   const client = createOAuthClient({
+//       clientId : process.env.OAUTH_CLIENT_ID,
+//       clientSecret : process.env.OAUTH_CLIENT_SECRET,
+//       tokenUri : process.env.NEXT_PUBLIC_API_URI + '/oauth/token',
+//       scopes : [ 'share:read' ]
+//   });
+//
+//   await request({ endpoint : '/page/abc', token : await client.token() });
+
+const REFRESH_LEAD_SECONDS = 60;
+
+const createOAuthClient = ({
+	clientId,
+	clientSecret,
+	scopes = [],
+	tokenUri
+}) => {
+
+	if( ! clientId ) throw new Error( 'createOAuthClient: clientId required' );
+	if( ! clientSecret ) throw new Error( 'createOAuthClient: clientSecret required' );
+	if( ! tokenUri ) throw new Error( 'createOAuthClient: tokenUri required' );
+
+	let cached = null;
+	let pending = null;
+
+	const isFresh = () => {
+
+		if( ! cached ) return false;
+
+		const now = Math.floor( Date.now() / 1000 );
+
+		return cached.expiresAt - REFRESH_LEAD_SECONDS > now;
+
+	};
+
+	const fetchToken = async () => {
+
+		const params = new URLSearchParams();
+
+		params.set( 'grant_type', 'client_credentials' );
+
+		if( scopes.length > 0 ){
+
+			params.set( 'scope', scopes.join( ' ' ) );
+
+		}
+
+		const basic = Buffer
+			.from( clientId + ':' + clientSecret )
+			.toString( 'base64' );
+
+		const response = await fetch(
+			tokenUri,
+			{
+				body : params.toString(),
+				headers : {
+					'authorization' : 'Basic ' + basic,
+					'content-type' : 'application/x-www-form-urlencoded'
+				},
+				method : 'POST'
+			}
+		);
+
+		if( ! response.ok ){
+
+			const text = await response.text();
+
+			throw new Error( 'createOAuthClient: token fetch failed (' + response.status + '): ' + text );
+
+		}
+
+		const body = await response.json();
+
+		cached = {
+			accessToken : body.access_token,
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			scope : body.scope
+		};
+
+		return cached.accessToken;
+
+	};
+
+	// Single-flight: collapse concurrent token fetches into one network call.
+	const refresh = () => {
+
+		if( pending ) return pending;
+
+		pending = fetchToken().finally( () => {
+
+			pending = null;
+
+		});
+
+		return pending;
+
+	};
+
+	return {
+		token : async () => {
+
+			if( isFresh() ) return cached.accessToken;
+
+			return refresh();
+
+		},
+		// Force a refresh on the next call. Use this when a request returns 401
+		// before the cached token's expiry — the server may have revoked it.
+		invalidate : () => {
+
+			cached = null;
+
+		}
+	};
+
+};
+
+export { createOAuthClient };

package/dist/oauth.js

@@ -0,0 +1,70 @@
+// oauth.js
+var REFRESH_LEAD_SECONDS = 60;
+var createOAuthClient = ({
+  clientId,
+  clientSecret,
+  scopes = [],
+  tokenUri
+}) => {
+  if (!clientId) throw new Error("createOAuthClient: clientId required");
+  if (!clientSecret) throw new Error("createOAuthClient: clientSecret required");
+  if (!tokenUri) throw new Error("createOAuthClient: tokenUri required");
+  let cached = null;
+  let pending = null;
+  const isFresh = () => {
+    if (!cached) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    return cached.expiresAt - REFRESH_LEAD_SECONDS > now;
+  };
+  const fetchToken = async () => {
+    const params = new URLSearchParams();
+    params.set("grant_type", "client_credentials");
+    if (scopes.length > 0) {
+      params.set("scope", scopes.join(" "));
+    }
+    const basic = Buffer.from(clientId + ":" + clientSecret).toString("base64");
+    const response = await fetch(
+      tokenUri,
+      {
+        body: params.toString(),
+        headers: {
+          "authorization": "Basic " + basic,
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        method: "POST"
+      }
+    );
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error("createOAuthClient: token fetch failed (" + response.status + "): " + text);
+    }
+    const body = await response.json();
+    cached = {
+      accessToken: body.access_token,
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      scope: body.scope
+    };
+    return cached.accessToken;
+  };
+  const refresh = () => {
+    if (pending) return pending;
+    pending = fetchToken().finally(() => {
+      pending = null;
+    });
+    return pending;
+  };
+  return {
+    token: async () => {
+      if (isFresh()) return cached.accessToken;
+      return refresh();
+    },
+    // Force a refresh on the next call. Use this when a request returns 401
+    // before the cached token's expiry — the server may have revoked it.
+    invalidate: () => {
+      cached = null;
+    }
+  };
+};
+export {
+  createOAuthClient
+};

package/dist/shopify.js

@@ -1,8 +1,8 @@
 import {
   decrypt,
   encrypt
-} from "./chunk-N5EMSZLI.js";
-import "./chunk-HOA2JHXC.js";
+} from "./chunk-2DRAIKGZ.js";
+import "./chunk-OS2AHUWX.js";
 
 // shopify.js
 import crypto from "crypto";

package/dist/token.cjs

@@ -29,7 +29,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // token.js
 var token_exports = {};
 __export(token_exports, {
-  generate: () => generate
+  compare: () => compare,
+  generate: () => generate,
+  hash: () => hash
 });
 module.exports = __toCommonJS(token_exports);
 var import_crypto = __toESM(require("crypto"), 1);
@@ -37,7 +39,24 @@ var generate = (bytes = 32, encoding = "base64url") => {
   const buf = import_crypto.default.randomBytes(bytes);
   return encoding ? buf.toString(encoding) : buf;
 };
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return import_crypto.default.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return import_crypto.default.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return import_crypto.default.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  generate
+  compare,
+  generate,
+  hash
 });

package/dist/token.d.cts

@@ -19,4 +19,43 @@ const generate = ( bytes = 32, encoding = 'base64url' ) => {
 
 };
 
-export { generate };
+// Hash a token value for storage. When `key` is provided, uses HMAC-SHA256
+// so DB compromise alone doesn't allow forgery via reverse lookup. Without
+// a key, falls back to plain SHA256 (matches the legacy session pattern
+// during transition).
+const hash = ( value, key ) => {
+
+	if( ! value ) return null;
+
+	if( key ){
+
+		return crypto
+			.createHmac( 'sha256', key )
+			.update( String( value ) )
+			.digest( 'base64url' );
+
+	}
+
+	return crypto
+		.createHash( 'sha256' )
+		.update( String( value ) )
+		.digest( 'base64url' );
+
+};
+
+// Constant-time comparison. Returns false for length mismatches without
+// timing leak. Use whenever comparing user-supplied input against stored
+// hashes / secrets.
+const compare = ( a, b ) => {
+
+	if( typeof a !== 'string' || typeof b !== 'string' ) return false;
+	if( a.length !== b.length ) return false;
+
+	return crypto.timingSafeEqual(
+		Buffer.from( a ),
+		Buffer.from( b )
+	);
+
+};
+
+export { compare, generate, hash };

package/dist/token.d.ts

@@ -19,4 +19,43 @@ const generate = ( bytes = 32, encoding = 'base64url' ) => {
 
 };
 
-export { generate };
+// Hash a token value for storage. When `key` is provided, uses HMAC-SHA256
+// so DB compromise alone doesn't allow forgery via reverse lookup. Without
+// a key, falls back to plain SHA256 (matches the legacy session pattern
+// during transition).
+const hash = ( value, key ) => {
+
+	if( ! value ) return null;
+
+	if( key ){
+
+		return crypto
+			.createHmac( 'sha256', key )
+			.update( String( value ) )
+			.digest( 'base64url' );
+
+	}
+
+	return crypto
+		.createHash( 'sha256' )
+		.update( String( value ) )
+		.digest( 'base64url' );
+
+};
+
+// Constant-time comparison. Returns false for length mismatches without
+// timing leak. Use whenever comparing user-supplied input against stored
+// hashes / secrets.
+const compare = ( a, b ) => {
+
+	if( typeof a !== 'string' || typeof b !== 'string' ) return false;
+	if( a.length !== b.length ) return false;
+
+	return crypto.timingSafeEqual(
+		Buffer.from( a ),
+		Buffer.from( b )
+	);
+
+};
+
+export { compare, generate, hash };

package/dist/token.js

@@ -1,6 +1,10 @@
 import {
-  generate
-} from "./chunk-HOA2JHXC.js";
+  compare,
+  generate,
+  hash
+} from "./chunk-OS2AHUWX.js";
 export {
-  generate
+  compare,
+  generate,
+  hash
 };

package/package.json

@@ -48,6 +48,11 @@
       "import": "./dist/nanoid.js",
       "require": "./dist/nanoid.cjs"
     },
+    "./oauth": {
+      "types": "./dist/oauth.d.ts",
+      "import": "./dist/oauth.js",
+      "require": "./dist/oauth.cjs"
+    },
     "./orders": {
       "types": "./dist/orders.d.ts",
       "import": "./dist/orders.js",
@@ -109,5 +114,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.40"
+  "version": "0.0.41"
 }

package/dist/chunk-HOA2JHXC.js

@@ -1,10 +0,0 @@
-// token.js
-import crypto from "crypto";
-var generate = (bytes = 32, encoding = "base64url") => {
-  const buf = crypto.randomBytes(bytes);
-  return encoding ? buf.toString(encoding) : buf;
-};
-
-export {
-  generate
-};