@drawbridge/drawbridge-utils 0.0.42 → 0.0.44

package/dist/{oauth.d.cts → oauth/index.d.ts}

@@ -1,12 +1,12 @@
-import { generate, hash } from './token.cjs';
-export { compare } from './token.cjs';
+import { generate, hash } from '../token.js';
+export { compare } from '../token.js';
 import 'crypto';
 
 // Shared OAuth helpers used across drawbridge-api, drawbridge-sync,
 // drawbridge-app-web, and any first-party app that needs to participate
 // in the OAuth 2.1 provider:
 //
-//   - SCOPES, DEVELOPER_ALLOWED_SCOPES: the locked scope vocabulary
+//   - scopes, developer: the locked scope vocabulary
 //   - parse, validate, intersect, isDeveloperAllowed: scope set operations
 //   - hashToken, generateToken, compare: opaque-token primitives
 //   - createOAuthClient: cached client_credentials access token getter
@@ -16,7 +16,7 @@ import 'crypto';
 // Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)
 // ─────────────────────────────────────────────────────────────────────────
 
-const SCOPES = [
+const scopes = [
 	'profile:read',
 	'profile:write',
 	'organization:read',
@@ -37,7 +37,7 @@ const SCOPES = [
 // Subset granted to third-party developer apps via /oauth/clients self-service
 // registration. Excludes profile:write (account-level), organization:write
 // (org admin only), billing:* (financial), admin (privileged).
-const DEVELOPER_ALLOWED_SCOPES = [
+const developer = [
 	'profile:read',
 	'organization:read',
 	'campaigns:read',
@@ -63,7 +63,7 @@ const parse = ( raw ) => {
 const validate = ( scopes ) => {
 
 	const parsed = parse( scopes );
-	const invalid = parsed.filter( ( scope ) => ! SCOPES.includes( scope ) );
+	const invalid = parsed.filter( ( scope ) => ! scopes.includes( scope ) );
 
 	return {
 		invalid,
@@ -81,7 +81,39 @@ const intersect = ( requested, allowed ) => {
 
 };
 
-const isDeveloperAllowed = ( scope ) => DEVELOPER_ALLOWED_SCOPES.includes( scope );
+const isDeveloperAllowed = ( scope ) => developer.includes( scope );
+
+// User-facing labels for each scope — used by UI components rendering
+// scope pickers. Centralized here so the dashboard, future admin tools,
+// and any other consumer surface the same strings.
+const scopeLabels = {
+	'profile:read' : 'Read own profile',
+	'profile:write' : 'Update own profile',
+	'organization:read' : 'Read organization info',
+	'organization:write' : 'Manage organization',
+	'campaigns:read' : 'Read campaigns',
+	'campaigns:write' : 'Manage campaigns',
+	'contacts:read' : 'Read contacts',
+	'contacts:write' : 'Manage contacts',
+	'workflows:read' : 'Read workflows',
+	'workflows:write' : 'Manage workflows',
+	'connections:read' : 'Read integrations',
+	'connections:write' : 'Manage integrations',
+	'billing:read' : 'Read billing',
+	'billing:write' : 'Manage billing',
+	admin : 'Admin access'
+};
+
+const toOption = ( scope ) => ({
+	key : scopeLabels[ scope ] || scope,
+	value : scope
+});
+
+// `{ key, value }` option arrays ready to feed any standard checkbox-list
+// component. Derived from the canonical scope arrays so vocabulary
+// changes auto-propagate to every consumer on the next utils bump.
+const developerOptions = developer.map( toOption );
+const scopeOptions = scopes.map( toOption );
 
 // ─────────────────────────────────────────────────────────────────────────
 // Token primitives — convenience wrappers over drawbridge-utils/token that
@@ -228,4 +260,4 @@ const createOAuthClient = ({
 
 };
 
-export { DEVELOPER_ALLOWED_SCOPES, SCOPES, createOAuthClient, generateToken, hashToken, intersect, isDeveloperAllowed, parse, validate };
+export { createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, parse, scopeLabels, scopeOptions, scopes, validate };

package/dist/{oauth.js → oauth/index.js}

@@ -1,11 +1,27 @@
-import {
-  compare,
-  generate,
-  hash
-} from "./chunk-OS2AHUWX.js";
+// lib/token.js
+import crypto from "crypto";
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = crypto.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return crypto.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return crypto.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
 
-// oauth.js
-var SCOPES = [
+// lib/oauth/index.js
+var scopes = [
   "profile:read",
   "profile:write",
   "organization:read",
@@ -22,7 +38,7 @@ var SCOPES = [
   "billing:write",
   "admin"
 ];
-var DEVELOPER_ALLOWED_SCOPES = [
+var developer = [
   "profile:read",
   "organization:read",
   "campaigns:read",
@@ -39,9 +55,9 @@ var parse = (raw) => {
   if (Array.isArray(raw)) return raw;
   return String(raw).split(/\s+/).filter(Boolean);
 };
-var validate = (scopes) => {
-  const parsed = parse(scopes);
-  const invalid = parsed.filter((scope) => !SCOPES.includes(scope));
+var validate = (scopes2) => {
+  const parsed = parse(scopes2);
+  const invalid = parsed.filter((scope) => !scopes2.includes(scope));
   return {
     invalid,
     valid: invalid.length === 0
@@ -52,14 +68,37 @@ var intersect = (requested, allowed) => {
   const a = parse(allowed);
   return r.filter((scope) => a.includes(scope));
 };
-var isDeveloperAllowed = (scope) => DEVELOPER_ALLOWED_SCOPES.includes(scope);
+var isDeveloperAllowed = (scope) => developer.includes(scope);
+var scopeLabels = {
+  "profile:read": "Read own profile",
+  "profile:write": "Update own profile",
+  "organization:read": "Read organization info",
+  "organization:write": "Manage organization",
+  "campaigns:read": "Read campaigns",
+  "campaigns:write": "Manage campaigns",
+  "contacts:read": "Read contacts",
+  "contacts:write": "Manage contacts",
+  "workflows:read": "Read workflows",
+  "workflows:write": "Manage workflows",
+  "connections:read": "Read integrations",
+  "connections:write": "Manage integrations",
+  "billing:read": "Read billing",
+  "billing:write": "Manage billing",
+  admin: "Admin access"
+};
+var toOption = (scope) => ({
+  key: scopeLabels[scope] || scope,
+  value: scope
+});
+var developerOptions = developer.map(toOption);
+var scopeOptions = scopes.map(toOption);
 var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 var REFRESH_LEAD_SECONDS = 60;
 var createOAuthClient = ({
   clientId,
   clientSecret,
-  scopes = [],
+  scopes: scopes2 = [],
   tokenUri
 }) => {
   if (!clientId) throw new Error("createOAuthClient: clientId required");
@@ -75,8 +114,8 @@ var createOAuthClient = ({
   const fetchToken = async () => {
     const params = new URLSearchParams();
     params.set("grant_type", "client_credentials");
-    if (scopes.length > 0) {
-      params.set("scope", scopes.join(" "));
+    if (scopes2.length > 0) {
+      params.set("scope", scopes2.join(" "));
     }
     const basic = Buffer.from(clientId + ":" + clientSecret).toString("base64");
     const response = await fetch(
@@ -122,14 +161,17 @@ var createOAuthClient = ({
   };
 };
 export {
-  DEVELOPER_ALLOWED_SCOPES,
-  SCOPES,
   compare,
   createOAuthClient,
+  developer,
+  developerOptions,
   generateToken,
   hashToken,
   intersect,
   isDeveloperAllowed,
   parse,
+  scopeLabels,
+  scopeOptions,
+  scopes,
   validate
 };

package/dist/oauth/server.cjs

@@ -0,0 +1,417 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/oauth/server.js
+var server_exports = {};
+__export(server_exports, {
+  createClient: () => createClient,
+  createOAuthModel: () => createOAuthModel,
+  createOAuthServer: () => createOAuthServer
+});
+module.exports = __toCommonJS(server_exports);
+var import_oauth2_server = __toESM(require("@node-oauth/oauth2-server"), 1);
+
+// lib/token.js
+var import_crypto = __toESM(require("crypto"), 1);
+var generate = (bytes = 32, encoding = "base64url") => {
+  const buf = import_crypto.default.randomBytes(bytes);
+  return encoding ? buf.toString(encoding) : buf;
+};
+var hash = (value, key) => {
+  if (!value) return null;
+  if (key) {
+    return import_crypto.default.createHmac("sha256", key).update(String(value)).digest("base64url");
+  }
+  return import_crypto.default.createHash("sha256").update(String(value)).digest("base64url");
+};
+var compare = (a, b) => {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length) return false;
+  return import_crypto.default.timingSafeEqual(
+    Buffer.from(a),
+    Buffer.from(b)
+  );
+};
+
+// lib/oauth/index.js
+var scopes = [
+  "profile:read",
+  "profile:write",
+  "organization:read",
+  "organization:write",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write",
+  "billing:read",
+  "billing:write",
+  "admin"
+];
+var developer = [
+  "profile:read",
+  "organization:read",
+  "campaigns:read",
+  "campaigns:write",
+  "contacts:read",
+  "contacts:write",
+  "workflows:read",
+  "workflows:write",
+  "connections:read",
+  "connections:write"
+];
+var parse = (raw) => {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw;
+  return String(raw).split(/\s+/).filter(Boolean);
+};
+var intersect = (requested, allowed) => {
+  const r = parse(requested);
+  const a = parse(allowed);
+  return r.filter((scope) => a.includes(scope));
+};
+var scopeLabels = {
+  "profile:read": "Read own profile",
+  "profile:write": "Update own profile",
+  "organization:read": "Read organization info",
+  "organization:write": "Manage organization",
+  "campaigns:read": "Read campaigns",
+  "campaigns:write": "Manage campaigns",
+  "contacts:read": "Read contacts",
+  "contacts:write": "Manage contacts",
+  "workflows:read": "Read workflows",
+  "workflows:write": "Manage workflows",
+  "connections:read": "Read integrations",
+  "connections:write": "Manage integrations",
+  "billing:read": "Read billing",
+  "billing:write": "Manage billing",
+  admin: "Admin access"
+};
+var toOption = (scope) => ({
+  key: scopeLabels[scope] || scope,
+  value: scope
+});
+var developerOptions = developer.map(toOption);
+var scopeOptions = scopes.map(toOption);
+var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
+var generateToken = () => generate(32, "base64url");
+
+// lib/oauth/server.js
+var ACCESS_TOKEN_LIFETIME_SECONDS = 60 * 60;
+var REFRESH_TOKEN_LIFETIME_SECONDS = 60 * 60 * 24 * 30;
+var AUTHORIZATION_CODE_LIFETIME_MS = 10 * 60 * 1e3;
+var createOAuthModel = ({ controller }) => ({
+  getClient: async (clientId, clientSecret) => {
+    var _a;
+    const client = await controller.get({
+      collection: "oauth",
+      query: {
+        clientId,
+        status: "active"
+      }
+    });
+    if (!client) return false;
+    if (clientSecret) {
+      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+        if (entry.retiredAt) return false;
+        return compare(hashToken(clientSecret), entry.hash);
+      });
+      if (!validSecret) return false;
+    }
+    ;
+    return {
+      clientId: client.clientId,
+      grants: ["authorization_code", "client_credentials", "refresh_token"],
+      id: client.id,
+      redirectUris: client.redirectUris ?? [],
+      scopes: client.allowedScopes ?? []
+    };
+  },
+  saveAuthorizationCode: async (code, client, user) => {
+    const rawCode = code.authorizationCode;
+    const tokenHash = hashToken(rawCode);
+    const expiresAt = new Date(Date.now() + AUTHORIZATION_CODE_LIFETIME_MS);
+    await controller.create({
+      collection: "otc",
+      data: {
+        client: client.clientId,
+        codeChallenge: code.codeChallenge ?? null,
+        codeChallengeMethod: code.codeChallengeMethod ?? null,
+        consumedAt: null,
+        context: "oauth.authorize",
+        expiresAt,
+        redirectUri: code.redirectUri ?? null,
+        scopes: code.scope ?? [],
+        tokenHash,
+        user: user.id
+      }
+    });
+    return {
+      authorizationCode: rawCode,
+      client: { id: client.id },
+      expiresAt,
+      redirectUri: code.redirectUri,
+      scope: code.scope,
+      user: { id: user.id }
+    };
+  },
+  getAuthorizationCode: async (authorizationCode) => {
+    const tokenHash = hashToken(authorizationCode);
+    const now = /* @__PURE__ */ new Date();
+    const record = await controller.get({
+      collection: "otc",
+      query: {
+        consumedAt: null,
+        context: "oauth.authorize",
+        expiresAt: { $gt: now },
+        tokenHash
+      }
+    });
+    if (!record) return false;
+    return {
+      authorizationCode,
+      client: { id: record.client },
+      codeChallenge: record.codeChallenge,
+      codeChallengeMethod: record.codeChallengeMethod,
+      expiresAt: record.expiresAt,
+      redirectUri: record.redirectUri,
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  revokeAuthorizationCode: async (code) => {
+    const tokenHash = hashToken(code.authorizationCode);
+    await controller.update({
+      collection: "otc",
+      data: {
+        $set: {
+          consumedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: {
+        context: "oauth.authorize",
+        tokenHash
+      }
+    });
+    return true;
+  },
+  saveToken: async (token, client, user) => {
+    const now = /* @__PURE__ */ new Date();
+    const accessRaw = token.accessToken;
+    const accessHash = hashToken(accessRaw);
+    const accessExpiresAt = token.accessTokenExpiresAt ?? new Date(now.getTime() + ACCESS_TOKEN_LIFETIME_SECONDS * 1e3);
+    await controller.create({
+      collection: "token",
+      data: {
+        client: client.clientId,
+        consumedAt: null,
+        data: {},
+        email: null,
+        expiresAt: accessExpiresAt,
+        lastUsedAt: null,
+        name: null,
+        revoked: false,
+        revokedAt: null,
+        rotatedFrom: null,
+        scopes: token.scope ?? [],
+        tokenHash: accessHash,
+        type: "access",
+        user: (user == null ? void 0 : user.id) ?? null
+      }
+    });
+    const result = {
+      accessToken: accessRaw,
+      accessTokenExpiresAt: accessExpiresAt,
+      client: { id: client.id },
+      scope: token.scope,
+      user: { id: (user == null ? void 0 : user.id) ?? null }
+    };
+    if (token.refreshToken) {
+      const refreshRaw = token.refreshToken;
+      const refreshHash = hashToken(refreshRaw);
+      const refreshExpiresAt = token.refreshTokenExpiresAt ?? new Date(now.getTime() + REFRESH_TOKEN_LIFETIME_SECONDS * 1e3);
+      await controller.create({
+        collection: "token",
+        data: {
+          client: client.clientId,
+          consumedAt: null,
+          data: {},
+          email: null,
+          expiresAt: refreshExpiresAt,
+          lastUsedAt: null,
+          name: null,
+          revoked: false,
+          revokedAt: null,
+          rotatedFrom: null,
+          scopes: token.scope ?? [],
+          tokenHash: refreshHash,
+          type: "refresh",
+          user: (user == null ? void 0 : user.id) ?? null
+        }
+      });
+      result.refreshToken = refreshRaw;
+      result.refreshTokenExpiresAt = refreshExpiresAt;
+    }
+    ;
+    return result;
+  },
+  getAccessToken: async (accessToken) => {
+    const tokenHash = hashToken(accessToken);
+    const now = /* @__PURE__ */ new Date();
+    const record = await controller.get({
+      collection: "token",
+      query: {
+        expiresAt: { $gt: now },
+        revoked: false,
+        tokenHash,
+        type: "access"
+      }
+    });
+    if (!record) return false;
+    return {
+      accessToken,
+      accessTokenExpiresAt: record.expiresAt,
+      client: { id: record.client },
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  getRefreshToken: async (refreshToken) => {
+    const tokenHash = hashToken(refreshToken);
+    const record = await controller.get({
+      collection: "token",
+      query: {
+        revoked: false,
+        tokenHash,
+        type: "refresh"
+      }
+    });
+    if (!record) return false;
+    return {
+      client: { id: record.client },
+      refreshToken,
+      refreshTokenExpiresAt: record.expiresAt,
+      scope: record.scopes,
+      user: { id: record.user }
+    };
+  },
+  revokeToken: async (token) => {
+    const rawToken = token.refreshToken ?? token.accessToken;
+    const tokenHash = hashToken(rawToken);
+    await controller.update({
+      collection: "token",
+      data: {
+        $set: {
+          revoked: true,
+          revokedAt: /* @__PURE__ */ new Date()
+        }
+      },
+      query: { tokenHash }
+    });
+    return true;
+  },
+  verifyScope: (token, scope) => {
+    const granted = intersect(scope, token.scope ?? []);
+    return granted.length > 0;
+  },
+  // client_credentials grant: treat the client as the resource owner.
+  getUserFromClient: (client) => ({ id: client.id, type: "client" })
+});
+var createOAuthServer = ({ controller }) => new import_oauth2_server.default({
+  accessTokenLifetime: ACCESS_TOKEN_LIFETIME_SECONDS,
+  allowBearerTokensInQueryString: false,
+  model: createOAuthModel({ controller }),
+  refreshTokenLifetime: REFRESH_TOKEN_LIFETIME_SECONDS,
+  requireClientAuthentication: {
+    authorization_code: true,
+    client_credentials: true,
+    refresh_token: true
+  }
+});
+var createClient = async ({
+  allowedScopes = [],
+  controller,
+  createdBy = null,
+  description = null,
+  grantTypes = ["authorization_code"],
+  name,
+  organization = null,
+  redirectUris = [],
+  webOrigins = []
+}) => {
+  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  if (invalid.length > 0) {
+    const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
+    error.status = 400;
+    throw error;
+  }
+  ;
+  const rawClientId = generateToken();
+  const clientId = "drawbridge." + rawClientId;
+  const rawSecret = generateToken();
+  const secretHash = hashToken(rawSecret);
+  const now = /* @__PURE__ */ new Date();
+  const doc = await controller.insert({
+    collection: "oauth",
+    data: {
+      allowedScopes,
+      clientId,
+      clientSecretHashes: [
+        {
+          createdAt: now,
+          hash: secretHash,
+          retiredAt: null
+        }
+      ],
+      clientType: "confidential",
+      createdBy,
+      description,
+      grantTypes,
+      name,
+      organization,
+      rateLimitOverrides: null,
+      redirectUris,
+      status: "active",
+      tokenEndpointAuthMethod: "client_secret_basic",
+      webOrigins
+    }
+  });
+  return {
+    client: doc,
+    rawSecret
+  };
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createClient,
+  createOAuthModel,
+  createOAuthServer
+});