@drawbridge/drawbridge-utils 0.0.41 → 0.0.43

package/dist/oauth/server.d.ts

@@ -0,0 +1,387 @@
+import OAuth2Server from '@node-oauth/oauth2-server';
+import { developer, generateToken, hashToken, intersect } from './index.js';
+import { compare } from '../token.js';
+import 'crypto';
+
+// Server-side OAuth 2.1 provider helpers. Server-only — pulls in
+// `@node-oauth/oauth2-server`, which has no business in a browser bundle.
+// Keep imports from this entry behind server-side code paths only.
+//
+// Exports:
+//   - createOAuthModel({ controller })
+//       Returns the @node-oauth/oauth2-server model adapter. The controller
+//       is duck-typed: any object with { get, create, update } accepting
+//       { collection, query, data } works. drawbridge-api passes its base
+//       controller; tests can pass an in-memory mock.
+//
+//   - createOAuthServer({ controller })
+//       Convenience: creates the model + wraps it in an OAuth2Server with
+//       the standard Drawbridge lifetimes (1h access / 30d refresh) and
+//       client-authentication requirements.
+//
+//   - createClient({ base, allowedScopes, name, organization, ... })
+//       Inserts a new oauth client row. Validates scopes against the
+//       developer set; throws 400 on invalid. Returns
+//       { client, rawSecret } — secret is plaintext, return ONCE.
+
+
+const ACCESS_TOKEN_LIFETIME_SECONDS = 60 * 60;            // 1 hour
+const REFRESH_TOKEN_LIFETIME_SECONDS = 60 * 60 * 24 * 30; // 30 days
+const AUTHORIZATION_CODE_LIFETIME_MS = 10 * 60 * 1000;    // 10 minutes
+
+const createOAuthModel = ({ controller }) => ({
+
+	getClient : async ( clientId, clientSecret ) => {
+
+		const client = await controller.get({
+			collection : 'oauth',
+			query : {
+				clientId,
+				status : 'active'
+			}
+		});
+
+		if( ! client ) return false;
+
+		if( clientSecret ){
+
+			const validSecret = client.clientSecretHashes?.some( ( entry ) => {
+
+				if( entry.retiredAt ) return false;
+
+				return compare( hashToken( clientSecret ), entry.hash );
+
+			});
+
+			if( ! validSecret ) return false;
+
+		}
+		return {
+			clientId : client.clientId,
+			grants : [ 'authorization_code', 'client_credentials', 'refresh_token' ],
+			id : client.id,
+			redirectUris : client.redirectUris ?? [],
+			scopes : client.allowedScopes ?? []
+		};
+
+	},
+
+	saveAuthorizationCode : async ( code, client, user ) => {
+
+		const rawCode = code.authorizationCode;
+		const tokenHash = hashToken( rawCode );
+		const expiresAt = new Date( Date.now() + AUTHORIZATION_CODE_LIFETIME_MS );
+
+		await controller.create({
+			collection : 'otc',
+			data : {
+				client : client.clientId,
+				codeChallenge : code.codeChallenge ?? null,
+				codeChallengeMethod : code.codeChallengeMethod ?? null,
+				consumedAt : null,
+				context : 'oauth.authorize',
+				expiresAt,
+				redirectUri : code.redirectUri ?? null,
+				scopes : code.scope ?? [],
+				tokenHash,
+				user : user.id
+			}
+		});
+
+		return {
+			authorizationCode : rawCode,
+			client : { id : client.id },
+			expiresAt,
+			redirectUri : code.redirectUri,
+			scope : code.scope,
+			user : { id : user.id }
+		};
+
+	},
+
+	getAuthorizationCode : async ( authorizationCode ) => {
+
+		const tokenHash = hashToken( authorizationCode );
+		const now = new Date();
+
+		const record = await controller.get({
+			collection : 'otc',
+			query : {
+				consumedAt : null,
+				context : 'oauth.authorize',
+				expiresAt : { $gt : now },
+				tokenHash
+			}
+		});
+
+		if( ! record ) return false;
+
+		return {
+			authorizationCode,
+			client : { id : record.client },
+			codeChallenge : record.codeChallenge,
+			codeChallengeMethod : record.codeChallengeMethod,
+			expiresAt : record.expiresAt,
+			redirectUri : record.redirectUri,
+			scope : record.scopes,
+			user : { id : record.user }
+		};
+
+	},
+
+	revokeAuthorizationCode : async ( code ) => {
+
+		const tokenHash = hashToken( code.authorizationCode );
+
+		await controller.update({
+			collection : 'otc',
+			data : {
+				$set : {
+					consumedAt : new Date()
+				}
+			},
+			query : {
+				context : 'oauth.authorize',
+				tokenHash
+			}
+		});
+
+		return true;
+
+	},
+
+	saveToken : async ( token, client, user ) => {
+
+		const now = new Date();
+		const accessRaw = token.accessToken;
+		const accessHash = hashToken( accessRaw );
+		const accessExpiresAt = token.accessTokenExpiresAt ?? new Date( now.getTime() + ACCESS_TOKEN_LIFETIME_SECONDS * 1000 );
+
+		await controller.create({
+			collection : 'token',
+			data : {
+				client : client.clientId,
+				consumedAt : null,
+				data : {},
+				email : null,
+				expiresAt : accessExpiresAt,
+				lastUsedAt : null,
+				name : null,
+				revoked : false,
+				revokedAt : null,
+				rotatedFrom : null,
+				scopes : token.scope ?? [],
+				tokenHash : accessHash,
+				type : 'access',
+				user : user?.id ?? null
+			}
+		});
+
+		const result = {
+			accessToken : accessRaw,
+			accessTokenExpiresAt : accessExpiresAt,
+			client : { id : client.id },
+			scope : token.scope,
+			user : { id : user?.id ?? null }
+		};
+
+		if( token.refreshToken ){
+
+			const refreshRaw = token.refreshToken;
+			const refreshHash = hashToken( refreshRaw );
+			const refreshExpiresAt = token.refreshTokenExpiresAt ?? new Date( now.getTime() + REFRESH_TOKEN_LIFETIME_SECONDS * 1000 );
+
+			await controller.create({
+				collection : 'token',
+				data : {
+					client : client.clientId,
+					consumedAt : null,
+					data : {},
+					email : null,
+					expiresAt : refreshExpiresAt,
+					lastUsedAt : null,
+					name : null,
+					revoked : false,
+					revokedAt : null,
+					rotatedFrom : null,
+					scopes : token.scope ?? [],
+					tokenHash : refreshHash,
+					type : 'refresh',
+					user : user?.id ?? null
+				}
+			});
+
+			result.refreshToken = refreshRaw;
+			result.refreshTokenExpiresAt = refreshExpiresAt;
+
+		}
+		return result;
+
+	},
+
+	getAccessToken : async ( accessToken ) => {
+
+		const tokenHash = hashToken( accessToken );
+		const now = new Date();
+
+		const record = await controller.get({
+			collection : 'token',
+			query : {
+				expiresAt : { $gt : now },
+				revoked : false,
+				tokenHash,
+				type : 'access'
+			}
+		});
+
+		if( ! record ) return false;
+
+		return {
+			accessToken,
+			accessTokenExpiresAt : record.expiresAt,
+			client : { id : record.client },
+			scope : record.scopes,
+			user : { id : record.user }
+		};
+
+	},
+
+	getRefreshToken : async ( refreshToken ) => {
+
+		const tokenHash = hashToken( refreshToken );
+
+		const record = await controller.get({
+			collection : 'token',
+			query : {
+				revoked : false,
+				tokenHash,
+				type : 'refresh'
+			}
+		});
+
+		if( ! record ) return false;
+
+		return {
+			client : { id : record.client },
+			refreshToken,
+			refreshTokenExpiresAt : record.expiresAt,
+			scope : record.scopes,
+			user : { id : record.user }
+		};
+
+	},
+
+	revokeToken : async ( token ) => {
+
+		const rawToken = token.refreshToken ?? token.accessToken;
+		const tokenHash = hashToken( rawToken );
+
+		await controller.update({
+			collection : 'token',
+			data : {
+				$set : {
+					revoked : true,
+					revokedAt : new Date()
+				}
+			},
+			query : { tokenHash }
+		});
+
+		return true;
+
+	},
+
+	verifyScope : ( token, scope ) => {
+
+		const granted = intersect( scope, token.scope ?? [] );
+
+		return granted.length > 0;
+
+	},
+
+	// client_credentials grant: treat the client as the resource owner.
+	getUserFromClient : ( client ) => ({ id : client.id, type : 'client' })
+
+});
+
+const createOAuthServer = ({ controller }) => new OAuth2Server({
+	accessTokenLifetime : ACCESS_TOKEN_LIFETIME_SECONDS,
+	allowBearerTokensInQueryString : false,
+	model : createOAuthModel({ controller }),
+	refreshTokenLifetime : REFRESH_TOKEN_LIFETIME_SECONDS,
+	requireClientAuthentication : {
+		authorization_code : true,
+		client_credentials : true,
+		refresh_token : true
+	}
+});
+
+// Inserts a new oauth client row. Validates allowedScopes against the
+// developer-allowed subset; throws a 400-flagged error on invalid scopes.
+// Returns { client: <inserted-doc>, rawSecret: <plaintext> }. The raw
+// secret is only available here — store immediately.
+const createClient = async ({
+	allowedScopes = [],
+	controller,
+	createdBy = null,
+	description = null,
+	grantTypes = [ 'authorization_code' ],
+	name,
+	organization = null,
+	redirectUris = [],
+	webOrigins = []
+}) => {
+
+	const invalid = allowedScopes.filter( ( scope ) => ! developer.includes( scope ) );
+
+	if( invalid.length > 0 ){
+
+		const error = new Error( 'Scopes not permitted for developer apps: ' + invalid.join( ', ' ) );
+
+		error.status = 400;
+
+		throw error;
+
+	}
+	const rawClientId = generateToken();
+	const clientId = 'drawbridge.' + rawClientId;
+
+	const rawSecret = generateToken();
+	const secretHash = hashToken( rawSecret );
+
+	const now = new Date();
+
+	const doc = await controller.insert({
+		collection : 'oauth',
+		data : {
+			allowedScopes,
+			clientId,
+			clientSecretHashes : [
+				{
+					createdAt : now,
+					hash : secretHash,
+					retiredAt : null
+				}
+			],
+			clientType : 'confidential',
+			createdBy,
+			description,
+			grantTypes,
+			name,
+			organization,
+			rateLimitOverrides : null,
+			redirectUris,
+			status : 'active',
+			tokenEndpointAuthMethod : 'client_secret_basic',
+			webOrigins
+		}
+	});
+
+	return {
+		client : doc,
+		rawSecret
+	};
+
+};
+
+export { createClient, createOAuthModel, createOAuthServer };

package/dist/oauth/server.js

@@ -0,0 +1,341 @@
+// lib/oauth/server.js
+import OAuth2Server from "@node-oauth/oauth2-server";
+
+// lib/token.js
+import crypto from "crypto";
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = crypto.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return crypto.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return crypto.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
+
+// lib/oauth/index.js
+var developer = [
+  "profile:read",
+  "organization:read",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write"
+];
+var parse = (raw) => {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw;
+  return String(raw).split(/\s+/).filter(Boolean);
+};
+var intersect = (requested, allowed) => {
+  const r = parse(requested);
+  const a = parse(allowed);
+  return r.filter((scope) => a.includes(scope));
+};
+var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
+var generateToken = () => generate(32, "base64url");
+
+// lib/oauth/server.js
+var ACCESS_TOKEN_LIFETIME_SECONDS = 60 * 60;
+var REFRESH_TOKEN_LIFETIME_SECONDS = 60 * 60 * 24 * 30;
+var AUTHORIZATION_CODE_LIFETIME_MS = 10 * 60 * 1e3;
+var createOAuthModel = ({ controller }) => ({
+  getClient: async (clientId, clientSecret) => {
+    var _a;
+    const client = await controller.get({
+      collection: "oauth",
+      query: {
+        clientId,
+        status: "active"
+      }
+    });
+    if (!client) return false;
+    if (clientSecret) {
+      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+        if (entry.retiredAt) return false;
+        return compare(hashToken(clientSecret), entry.hash);
+      });
+      if (!validSecret) return false;
+    }
+    ;
+    return {
+      clientId: client.clientId,
+      grants: ["authorization_code", "client_credentials", "refresh_token"],
+      id: client.id,
+      redirectUris: client.redirectUris ?? [],
+      scopes: client.allowedScopes ?? []
+    };
+  },
+  saveAuthorizationCode: async (code, client, user) => {
+    const rawCode = code.authorizationCode;
+    const tokenHash = hashToken(rawCode);
+    const expiresAt = new Date(Date.now() + AUTHORIZATION_CODE_LIFETIME_MS);
+    await controller.create({
+      collection: "otc",
+      data: {
+        client: client.clientId,
+        codeChallenge: code.codeChallenge ?? null,
+        codeChallengeMethod: code.codeChallengeMethod ?? null,
+        consumedAt: null,
+        context: "oauth.authorize",
+        expiresAt,
+        redirectUri: code.redirectUri ?? null,
+        scopes: code.scope ?? [],
+        tokenHash,
+        user: user.id
+      }
+    });
+    return {
+      authorizationCode: rawCode,
+      client: { id: client.id },
+      expiresAt,
+      redirectUri: code.redirectUri,
+      scope: code.scope,
+      user: { id: user.id }
+    };
+  },
+  getAuthorizationCode: async (authorizationCode) => {
+    const tokenHash = hashToken(authorizationCode);
+    const now = /* @__PURE__ */ new Date();
+    const record = await controller.get({
+      collection: "otc",
+      query: {
+        consumedAt: null,
+        context: "oauth.authorize",
+        expiresAt: { $gt: now },
+        tokenHash
+      }
+    });
+    if (!record) return false;
+    return {
+      authorizationCode,
+      client: { id: record.client },
+      codeChallenge: record.codeChallenge,
+      codeChallengeMethod: record.codeChallengeMethod,
+      expiresAt: record.expiresAt,
+      redirectUri: record.redirectUri,
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  revokeAuthorizationCode: async (code) => {
+    const tokenHash = hashToken(code.authorizationCode);
+    await controller.update({
+      collection: "otc",
+      data: {
+        $set: {
+          consumedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: {
+        context: "oauth.authorize",
+        tokenHash
+      }
+    });
+    return true;
+  },
+  saveToken: async (token, client, user) => {
+    const now = /* @__PURE__ */ new Date();
+    const accessRaw = token.accessToken;
+    const accessHash = hashToken(accessRaw);
+    const accessExpiresAt = token.accessTokenExpiresAt ?? new Date(now.getTime() + ACCESS_TOKEN_LIFETIME_SECONDS * 1e3);
+    await controller.create({
+      collection: "token",
+      data: {
+        client: client.clientId,
+        consumedAt: null,
+        data: {},
+        email: null,
+        expiresAt: accessExpiresAt,
+        lastUsedAt: null,
+        name: null,
+        revoked: false,
+        revokedAt: null,
+        rotatedFrom: null,
+        scopes: token.scope ?? [],
+        tokenHash: accessHash,
+        type: "access",
+        user: (user == null ? void 0 : user.id) ?? null
+      }
+    });
+    const result = {
+      accessToken: accessRaw,
+      accessTokenExpiresAt: accessExpiresAt,
+      client: { id: client.id },
+      scope: token.scope,
+      user: { id: (user == null ? void 0 : user.id) ?? null }
+    };
+    if (token.refreshToken) {
+      const refreshRaw = token.refreshToken;
+      const refreshHash = hashToken(refreshRaw);
+      const refreshExpiresAt = token.refreshTokenExpiresAt ?? new Date(now.getTime() + REFRESH_TOKEN_LIFETIME_SECONDS * 1e3);
+      await controller.create({
+        collection: "token",
+        data: {
+          client: client.clientId,
+          consumedAt: null,
+          data: {},
+          email: null,
+          expiresAt: refreshExpiresAt,
+          lastUsedAt: null,
+          name: null,
+          revoked: false,
+          revokedAt: null,
+          rotatedFrom: null,
+          scopes: token.scope ?? [],
+          tokenHash: refreshHash,
+          type: "refresh",
+          user: (user == null ? void 0 : user.id) ?? null
+        }
+      });
+      result.refreshToken = refreshRaw;
+      result.refreshTokenExpiresAt = refreshExpiresAt;
+    }
+    ;
+    return result;
+  },
+  getAccessToken: async (accessToken) => {
+    const tokenHash = hashToken(accessToken);
+    const now = /* @__PURE__ */ new Date();
+    const record = await controller.get({
+      collection: "token",
+      query: {
+        expiresAt: { $gt: now },
+        revoked: false,
+        tokenHash,
+        type: "access"
+      }
+    });
+    if (!record) return false;
+    return {
+      accessToken,
+      accessTokenExpiresAt: record.expiresAt,
+      client: { id: record.client },
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  getRefreshToken: async (refreshToken) => {
+    const tokenHash = hashToken(refreshToken);
+    const record = await controller.get({
+      collection: "token",
+      query: {
+        revoked: false,
+        tokenHash,
+        type: "refresh"
+      }
+    });
+    if (!record) return false;
+    return {
+      client: { id: record.client },
+      refreshToken,
+      refreshTokenExpiresAt: record.expiresAt,
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  revokeToken: async (token) => {
+    const rawToken = token.refreshToken ?? token.accessToken;
+    const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          revoked: true,
+          revokedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { tokenHash }
+    });
+    return true;
+  },
+  verifyScope: (token, scope) => {
+    const granted = intersect(scope, token.scope ?? []);
+    return granted.length > 0;
+  },
+  // client_credentials grant: treat the client as the resource owner.
+  getUserFromClient: (client) => ({ id: client.id, type: "client" })
+});
+var createOAuthServer = ({ controller }) => new OAuth2Server({
+  accessTokenLifetime: ACCESS_TOKEN_LIFETIME_SECONDS,
+  allowBearerTokensInQueryString: false,
+  model: createOAuthModel({ controller }),
+  refreshTokenLifetime: REFRESH_TOKEN_LIFETIME_SECONDS,
+  requireClientAuthentication: {
+    authorization_code: true,
+    client_credentials: true,
+    refresh_token: true
+  }
+});
+var createClient = async ({
+  allowedScopes = [],
+  controller,
+  createdBy = null,
+  description = null,
+  grantTypes = ["authorization_code"],
+  name,
+  organization = null,
+  redirectUris = [],
+  webOrigins = []
+}) => {
+  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  if (invalid.length > 0) {
+    const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
+    error.status = 400;
+    throw error;
+  }
+  ;
+  const rawClientId = generateToken();
+  const clientId = "drawbridge." + rawClientId;
+  const rawSecret = generateToken();
+  const secretHash = hashToken(rawSecret);
+  const now = /* @__PURE__ */ new Date();
+  const doc = await controller.insert({
+    collection: "oauth",
+    data: {
+      allowedScopes,
+      clientId,
+      clientSecretHashes: [
+        {
+          createdAt: now,
+          hash: secretHash,
+          retiredAt: null
+        }
+      ],
+      clientType: "confidential",
+      createdBy,
+      description,
+      grantTypes,
+      name,
+      organization,
+      rateLimitOverrides: null,
+      redirectUris,
+      status: "active",
+      tokenEndpointAuthMethod: "client_secret_basic",
+      webOrigins
+    }
+  });
+  return {
+    client: doc,
+    rawSecret
+  };
+};
+export {
+  createClient,
+  createOAuthModel,
+  createOAuthServer
+};