@drawbridge/drawbridge-utils 0.0.41 → 0.0.42

package/dist/oauth.cjs

@@ -1,6 +1,8 @@
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -14,14 +16,105 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // oauth.js
 var oauth_exports = {};
 __export(oauth_exports, {
-  createOAuthClient: () => createOAuthClient
+  DEVELOPER_ALLOWED_SCOPES: () => DEVELOPER_ALLOWED_SCOPES,
+  SCOPES: () => SCOPES,
+  compare: () => compare,
+  createOAuthClient: () => createOAuthClient,
+  generateToken: () => generateToken,
+  hashToken: () => hashToken,
+  intersect: () => intersect,
+  isDeveloperAllowed: () => isDeveloperAllowed,
+  parse: () => parse,
+  validate: () => validate
 });
 module.exports = __toCommonJS(oauth_exports);
+
+// token.js
+var import_crypto = __toESM(require("crypto"), 1);
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = import_crypto.default.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return import_crypto.default.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return import_crypto.default.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return import_crypto.default.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
+
+// oauth.js
+var SCOPES = [
+  "profile:read",
+  "profile:write",
+  "organization:read",
+  "organization:write",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write",
+  "billing:read",
+  "billing:write",
+  "admin"
+];
+var DEVELOPER_ALLOWED_SCOPES = [
+  "profile:read",
+  "organization:read",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write"
+];
+var parse = (raw) => {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw;
+  return String(raw).split(/\s+/).filter(Boolean);
+};
+var validate = (scopes) => {
+  const parsed = parse(scopes);
+  const invalid = parsed.filter((scope) => !SCOPES.includes(scope));
+  return {
+    invalid,
+    valid: invalid.length === 0
+  };
+};
+var intersect = (requested, allowed) => {
+  const r = parse(requested);
+  const a = parse(allowed);
+  return r.filter((scope) => a.includes(scope));
+};
+var isDeveloperAllowed = (scope) => DEVELOPER_ALLOWED_SCOPES.includes(scope);
+var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
+var generateToken = () => generate(32, "base64url");
 var REFRESH_LEAD_SECONDS = 60;
 var createOAuthClient = ({
   clientId,
@@ -90,5 +183,14 @@ var createOAuthClient = ({
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createOAuthClient
+  DEVELOPER_ALLOWED_SCOPES,
+  SCOPES,
+  compare,
+  createOAuthClient,
+  generateToken,
+  hashToken,
+  intersect,
+  isDeveloperAllowed,
+  parse,
+  validate
 });

package/dist/oauth.d.cts

@@ -1,5 +1,106 @@
-// Client_credentials token caching helper for first-party Drawbridge apps
-// that call drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
+import { generate, hash } from './token.cjs';
+export { compare } from './token.cjs';
+import 'crypto';
+
+// Shared OAuth helpers used across drawbridge-api, drawbridge-sync,
+// drawbridge-app-web, and any first-party app that needs to participate
+// in the OAuth 2.1 provider:
+//
+//   - SCOPES, DEVELOPER_ALLOWED_SCOPES: the locked scope vocabulary
+//   - parse, validate, intersect, isDeveloperAllowed: scope set operations
+//   - hashToken, generateToken, compare: opaque-token primitives
+//   - createOAuthClient: cached client_credentials access token getter
+
+
+// ─────────────────────────────────────────────────────────────────────────
+// Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)
+// ─────────────────────────────────────────────────────────────────────────
+
+const SCOPES = [
+	'profile:read',
+	'profile:write',
+	'organization:read',
+	'organization:write',
+	'campaigns:read',
+	'campaigns:write',
+	'contacts:read',
+	'contacts:write',
+	'workflows:read',
+	'workflows:write',
+	'connections:read',
+	'connections:write',
+	'billing:read',
+	'billing:write',
+	'admin'
+];
+
+// Subset granted to third-party developer apps via /oauth/clients self-service
+// registration. Excludes profile:write (account-level), organization:write
+// (org admin only), billing:* (financial), admin (privileged).
+const DEVELOPER_ALLOWED_SCOPES = [
+	'profile:read',
+	'organization:read',
+	'campaigns:read',
+	'campaigns:write',
+	'contacts:read',
+	'contacts:write',
+	'workflows:read',
+	'workflows:write',
+	'connections:read',
+	'connections:write'
+];
+
+const parse = ( raw ) => {
+
+	if( ! raw ) return [];
+
+	if( Array.isArray( raw ) ) return raw;
+
+	return String( raw ).split( /\s+/ ).filter( Boolean );
+
+};
+
+const validate = ( scopes ) => {
+
+	const parsed = parse( scopes );
+	const invalid = parsed.filter( ( scope ) => ! SCOPES.includes( scope ) );
+
+	return {
+		invalid,
+		valid : invalid.length === 0
+	};
+
+};
+
+const intersect = ( requested, allowed ) => {
+
+	const r = parse( requested );
+	const a = parse( allowed );
+
+	return r.filter( ( scope ) => a.includes( scope ) );
+
+};
+
+const isDeveloperAllowed = ( scope ) => DEVELOPER_ALLOWED_SCOPES.includes( scope );
+
+// ─────────────────────────────────────────────────────────────────────────
+// Token primitives — convenience wrappers over drawbridge-utils/token that
+// fix the OAuth-specific conventions (32 bytes base64url, env-keyed HMAC)
+// ─────────────────────────────────────────────────────────────────────────
+
+// Hash an OAuth token with the deployment's HMAC key (OAUTH_TOKEN_HMAC_KEY).
+// Falls back to plain SHA256 if the env var is unset — fine for local dev,
+// not for production (DB compromise would then allow token forgery).
+const hashToken = ( raw ) => hash( raw, process.env.OAUTH_TOKEN_HMAC_KEY );
+
+// 32 cryptographically random bytes encoded as a 43-char base64url string —
+// the shape used for access tokens, refresh tokens, PATs, and authorization
+// codes.
+const generateToken = () => generate( 32, 'base64url' );
+
+// ─────────────────────────────────────────────────────────────────────────
+// Client_credentials token caching for first-party apps that call
+// drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
 // drawbridge-webhooks, etc.).
 //
 // Caches the access token in process memory; refreshes when nearing expiry
@@ -13,10 +114,11 @@
 //       clientId : process.env.OAUTH_CLIENT_ID,
 //       clientSecret : process.env.OAUTH_CLIENT_SECRET,
 //       tokenUri : process.env.NEXT_PUBLIC_API_URI + '/oauth/token',
-//       scopes : [ 'share:read' ]
+//       scopes : [ 'campaigns:read' ]
 //   });
 //
 //   await request({ endpoint : '/page/abc', token : await client.token() });
+// ─────────────────────────────────────────────────────────────────────────
 
 const REFRESH_LEAD_SECONDS = 60;
 
@@ -126,4 +228,4 @@ const createOAuthClient = ({
 
 };
 
-export { createOAuthClient };
+export { DEVELOPER_ALLOWED_SCOPES, SCOPES, createOAuthClient, generateToken, hashToken, intersect, isDeveloperAllowed, parse, validate };

package/dist/oauth.d.ts

@@ -1,5 +1,106 @@
-// Client_credentials token caching helper for first-party Drawbridge apps
-// that call drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
+import { generate, hash } from './token.js';
+export { compare } from './token.js';
+import 'crypto';
+
+// Shared OAuth helpers used across drawbridge-api, drawbridge-sync,
+// drawbridge-app-web, and any first-party app that needs to participate
+// in the OAuth 2.1 provider:
+//
+//   - SCOPES, DEVELOPER_ALLOWED_SCOPES: the locked scope vocabulary
+//   - parse, validate, intersect, isDeveloperAllowed: scope set operations
+//   - hashToken, generateToken, compare: opaque-token primitives
+//   - createOAuthClient: cached client_credentials access token getter
+
+
+// ─────────────────────────────────────────────────────────────────────────
+// Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)
+// ─────────────────────────────────────────────────────────────────────────
+
+const SCOPES = [
+	'profile:read',
+	'profile:write',
+	'organization:read',
+	'organization:write',
+	'campaigns:read',
+	'campaigns:write',
+	'contacts:read',
+	'contacts:write',
+	'workflows:read',
+	'workflows:write',
+	'connections:read',
+	'connections:write',
+	'billing:read',
+	'billing:write',
+	'admin'
+];
+
+// Subset granted to third-party developer apps via /oauth/clients self-service
+// registration. Excludes profile:write (account-level), organization:write
+// (org admin only), billing:* (financial), admin (privileged).
+const DEVELOPER_ALLOWED_SCOPES = [
+	'profile:read',
+	'organization:read',
+	'campaigns:read',
+	'campaigns:write',
+	'contacts:read',
+	'contacts:write',
+	'workflows:read',
+	'workflows:write',
+	'connections:read',
+	'connections:write'
+];
+
+const parse = ( raw ) => {
+
+	if( ! raw ) return [];
+
+	if( Array.isArray( raw ) ) return raw;
+
+	return String( raw ).split( /\s+/ ).filter( Boolean );
+
+};
+
+const validate = ( scopes ) => {
+
+	const parsed = parse( scopes );
+	const invalid = parsed.filter( ( scope ) => ! SCOPES.includes( scope ) );
+
+	return {
+		invalid,
+		valid : invalid.length === 0
+	};
+
+};
+
+const intersect = ( requested, allowed ) => {
+
+	const r = parse( requested );
+	const a = parse( allowed );
+
+	return r.filter( ( scope ) => a.includes( scope ) );
+
+};
+
+const isDeveloperAllowed = ( scope ) => DEVELOPER_ALLOWED_SCOPES.includes( scope );
+
+// ─────────────────────────────────────────────────────────────────────────
+// Token primitives — convenience wrappers over drawbridge-utils/token that
+// fix the OAuth-specific conventions (32 bytes base64url, env-keyed HMAC)
+// ─────────────────────────────────────────────────────────────────────────
+
+// Hash an OAuth token with the deployment's HMAC key (OAUTH_TOKEN_HMAC_KEY).
+// Falls back to plain SHA256 if the env var is unset — fine for local dev,
+// not for production (DB compromise would then allow token forgery).
+const hashToken = ( raw ) => hash( raw, process.env.OAUTH_TOKEN_HMAC_KEY );
+
+// 32 cryptographically random bytes encoded as a 43-char base64url string —
+// the shape used for access tokens, refresh tokens, PATs, and authorization
+// codes.
+const generateToken = () => generate( 32, 'base64url' );
+
+// ─────────────────────────────────────────────────────────────────────────
+// Client_credentials token caching for first-party apps that call
+// drawbridge-api as themselves (drawbridge-share, drawbridge-emails,
 // drawbridge-webhooks, etc.).
 //
 // Caches the access token in process memory; refreshes when nearing expiry
@@ -13,10 +114,11 @@
 //       clientId : process.env.OAUTH_CLIENT_ID,
 //       clientSecret : process.env.OAUTH_CLIENT_SECRET,
 //       tokenUri : process.env.NEXT_PUBLIC_API_URI + '/oauth/token',
-//       scopes : [ 'share:read' ]
+//       scopes : [ 'campaigns:read' ]
 //   });
 //
 //   await request({ endpoint : '/page/abc', token : await client.token() });
+// ─────────────────────────────────────────────────────────────────────────
 
 const REFRESH_LEAD_SECONDS = 60;
 
@@ -126,4 +228,4 @@ const createOAuthClient = ({
 
 };
 
-export { createOAuthClient };
+export { DEVELOPER_ALLOWED_SCOPES, SCOPES, createOAuthClient, generateToken, hashToken, intersect, isDeveloperAllowed, parse, validate };

package/dist/oauth.js

@@ -1,4 +1,60 @@
+import {
+  compare,
+  generate,
+  hash
+} from "./chunk-OS2AHUWX.js";
+
 // oauth.js
+var SCOPES = [
+  "profile:read",
+  "profile:write",
+  "organization:read",
+  "organization:write",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write",
+  "billing:read",
+  "billing:write",
+  "admin"
+];
+var DEVELOPER_ALLOWED_SCOPES = [
+  "profile:read",
+  "organization:read",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write"
+];
+var parse = (raw) => {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw;
+  return String(raw).split(/\s+/).filter(Boolean);
+};
+var validate = (scopes) => {
+  const parsed = parse(scopes);
+  const invalid = parsed.filter((scope) => !SCOPES.includes(scope));
+  return {
+    invalid,
+    valid: invalid.length === 0
+  };
+};
+var intersect = (requested, allowed) => {
+  const r = parse(requested);
+  const a = parse(allowed);
+  return r.filter((scope) => a.includes(scope));
+};
+var isDeveloperAllowed = (scope) => DEVELOPER_ALLOWED_SCOPES.includes(scope);
+var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
+var generateToken = () => generate(32, "base64url");
 var REFRESH_LEAD_SECONDS = 60;
 var createOAuthClient = ({
   clientId,
@@ -66,5 +122,14 @@ var createOAuthClient = ({
   };
 };
 export {
-  createOAuthClient
+  DEVELOPER_ALLOWED_SCOPES,
+  SCOPES,
+  compare,
+  createOAuthClient,
+  generateToken,
+  hashToken,
+  intersect,
+  isDeveloperAllowed,
+  parse,
+  validate
 };

package/package.json

@@ -114,5 +114,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.41"
+  "version": "0.0.42"
 }