@drawbridge/drawbridge-utils 0.0.48 → 0.0.50

package/dist/oauth/index.cjs

@@ -115,7 +115,15 @@ var cookieOptions = ({
   secure: process.env.NODE_ENV !== "development",
   ...expiresAt && { expires: new Date(expiresAt) }
 });
-var menuEndpoint = (type, id) => "/menu/" + type + (id ? "/" + id : "");
+var menuEndpoint = (type, ...ids) => {
+  if (type === "campaign") {
+    const [organization, campaign] = ids;
+    return "/menu/organization/" + organization + "/campaign/" + campaign;
+  }
+  ;
+  const [id] = ids;
+  return "/menu/" + type + (id ? "/" + id : "");
+};
 var scopes = [
   "profile:read",
   "profile:write",

package/dist/oauth/index.d.cts

@@ -74,9 +74,29 @@ const cookieOptions = ({
 });
 
 // Path builder for the API menu endpoints. Single source of truth for
-// the /menu/<type>(/<id>) shape — drawbridge-api routes and
-// drawbridge-app-web's ProviderLayout wrappers both read from here.
-const menuEndpoint = ( type, id ) => '/menu/' + type + ( id ? '/' + id : '' );
+// the /menu/<...> shape — drawbridge-api routes and drawbridge-app-web's
+// ProviderLayout wrappers both read from here.
+//
+// menuEndpoint('account')                          → /menu/account
+// menuEndpoint('admin')                            → /menu/admin
+// menuEndpoint('organization', orgId)              → /menu/organization/abc
+// menuEndpoint('campaign', orgId, campaignId)      → /menu/organization/abc/campaign/xyz
+//   (campaign menus piggyback on the org URL prefix so the standard
+//    hasOrganizationAccess → hasCampaignAccess middleware chain works.)
+const menuEndpoint = ( type, ...ids ) => {
+
+	if( type === 'campaign' ){
+
+		const [ organization, campaign ] = ids;
+
+		return '/menu/organization/' + organization + '/campaign/' + campaign;
+
+	}
+	const [ id ] = ids;
+
+	return '/menu/' + type + ( id ? '/' + id : '' );
+
+};
 
 // ─────────────────────────────────────────────────────────────────────────
 // Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)

package/dist/oauth/index.d.ts

@@ -74,9 +74,29 @@ const cookieOptions = ({
 });
 
 // Path builder for the API menu endpoints. Single source of truth for
-// the /menu/<type>(/<id>) shape — drawbridge-api routes and
-// drawbridge-app-web's ProviderLayout wrappers both read from here.
-const menuEndpoint = ( type, id ) => '/menu/' + type + ( id ? '/' + id : '' );
+// the /menu/<...> shape — drawbridge-api routes and drawbridge-app-web's
+// ProviderLayout wrappers both read from here.
+//
+// menuEndpoint('account')                          → /menu/account
+// menuEndpoint('admin')                            → /menu/admin
+// menuEndpoint('organization', orgId)              → /menu/organization/abc
+// menuEndpoint('campaign', orgId, campaignId)      → /menu/organization/abc/campaign/xyz
+//   (campaign menus piggyback on the org URL prefix so the standard
+//    hasOrganizationAccess → hasCampaignAccess middleware chain works.)
+const menuEndpoint = ( type, ...ids ) => {
+
+	if( type === 'campaign' ){
+
+		const [ organization, campaign ] = ids;
+
+		return '/menu/organization/' + organization + '/campaign/' + campaign;
+
+	}
+	const [ id ] = ids;
+
+	return '/menu/' + type + ( id ? '/' + id : '' );
+
+};
 
 // ─────────────────────────────────────────────────────────────────────────
 // Scope vocabulary (locked — 15 scopes, 10 in the developer-allowed subset)

package/dist/oauth/index.js

@@ -61,7 +61,15 @@ var cookieOptions = ({
   secure: process.env.NODE_ENV !== "development",
   ...expiresAt && { expires: new Date(expiresAt) }
 });
-var menuEndpoint = (type, id) => "/menu/" + type + (id ? "/" + id : "");
+var menuEndpoint = (type, ...ids) => {
+  if (type === "campaign") {
+    const [organization, campaign] = ids;
+    return "/menu/organization/" + organization + "/campaign/" + campaign;
+  }
+  ;
+  const [id] = ids;
+  return "/menu/" + type + (id ? "/" + id : "");
+};
 var scopes = [
   "profile:read",
   "profile:write",

package/dist/oauth/server.cjs

@@ -146,19 +146,20 @@ var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
+var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
-    const client = await controller.get({
+    const record = await controller.get({
       collection: "oauth",
       query: {
-        clientId,
+        client: clientId,
         status: "active"
       }
     });
-    if (!client) return false;
+    if (!record) return false;
     if (clientSecret) {
-      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+      const validSecret = (_a = record.hashes) == null ? void 0 : _a.some((entry) => {
         if (entry.retiredAt) return false;
         return compare(hashToken(clientSecret), entry.hash);
       });
@@ -166,11 +167,11 @@ var createOAuthModel = ({ controller }) => ({
     }
     ;
     return {
-      clientId: client.clientId,
-      grants: ["authorization_code", "client_credentials", "refresh_token"],
-      id: client.id,
-      redirectUris: client.redirectUris ?? [],
-      scopes: client.allowedScopes ?? []
+      clientId: record.client,
+      grants: SUPPORTED_GRANTS,
+      id: record.id,
+      redirectUris: record.redirects ?? [],
+      scopes: record.scopes ?? []
     };
   },
   saveAuthorizationCode: async (code, client, user) => {
@@ -375,17 +376,16 @@ var createOAuthServer = ({ controller }) => new import_oauth2_server.default({
   }
 });
 var createClient = async ({
-  allowedScopes = [],
   controller,
   createdBy = null,
   description = null,
-  grantTypes = ["authorization_code"],
   name,
   organization = null,
-  redirectUris = [],
-  webOrigins = []
+  redirects = [],
+  scopes: scopes2 = [],
+  origins = []
 }) => {
-  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  const invalid = scopes2.filter((scope) => !developer.includes(scope));
   if (invalid.length > 0) {
     const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
     error.status = 400;
@@ -393,37 +393,38 @@ var createClient = async ({
   }
   ;
   const rawClientId = generateToken();
-  const clientId = "drawbridge." + rawClientId;
+  const client = "drawbridge." + rawClientId;
   const rawSecret = generateToken();
   const secretHash = hashToken(rawSecret);
   const now = /* @__PURE__ */ new Date();
-  const doc = await controller.insert({
+  const record = await controller.create({
     collection: "oauth",
     data: {
-      allowedScopes,
-      clientId,
-      clientSecretHashes: [
+      client,
+      createdBy,
+      description,
+      endpoint: {
+        auth: "client_secret_basic"
+      },
+      hashes: [
         {
           createdAt: now,
           hash: secretHash,
           retiredAt: null
         }
       ],
-      clientType: "confidential",
-      createdBy,
-      description,
-      grantTypes,
+      limits: null,
       name,
       organization,
-      rateLimitOverrides: null,
-      redirectUris,
+      origins,
+      redirects,
+      scopes: scopes2,
       status: "active",
-      tokenEndpointAuthMethod: "client_secret_basic",
-      webOrigins
+      type: "confidential"
     }
   });
   return {
-    client: doc,
+    record,
     rawSecret
   };
 };

package/dist/oauth/server.d.cts

@@ -14,34 +14,43 @@ import 'crypto';
 //       { collection, query, data } works. drawbridge-api passes its base
 //       controller; tests can pass an in-memory mock.
 //
+//       Boundary translation: the DB uses our renamed schema (client,
+//       scopes, redirects, hashes, ...), but the @node-oauth library
+//       expects spec-named keys (clientId, scope, redirectUris, ...).
+//       Each model method translates at the return boundary.
+//
 //   - createOAuthServer({ controller })
 //       Convenience: creates the model + wraps it in an OAuth2Server with
 //       the standard Drawbridge lifetimes (1h access / 30d refresh) and
 //       client-authentication requirements.
 //
-//   - createClient({ base, allowedScopes, name, organization, ... })
+//   - createClient({ controller, scopes, name, organization, ... })
 //       Inserts a new oauth client row. Validates scopes against the
 //       developer set; throws 400 on invalid. Returns
-//       { client, rawSecret } — secret is plaintext, return ONCE.
+//       { record, rawSecret } — secret is plaintext, return ONCE.
+
 
+// Hardcoded — the supported grants don't vary per client today. If they
+// ever need to, store `grants` on the oauth doc and read it here.
+const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
 
-		const client = await controller.get({
+		const record = await controller.get({
 			collection : 'oauth',
 			query : {
-				clientId,
+				client : clientId,
 				status : 'active'
 			}
 		});
 
-		if( ! client ) return false;
+		if( ! record ) return false;
 
 		if( clientSecret ){
 
-			const validSecret = client.clientSecretHashes?.some( ( entry ) => {
+			const validSecret = record.hashes?.some( ( entry ) => {
 
 				if( entry.retiredAt ) return false;
 
@@ -53,11 +62,11 @@ const createOAuthModel = ({ controller }) => ({
 
 		}
 		return {
-			clientId : client.clientId,
-			grants : [ 'authorization_code', 'client_credentials', 'refresh_token' ],
-			id : client.id,
-			redirectUris : client.redirectUris ?? [],
-			scopes : client.allowedScopes ?? []
+			clientId : record.client,
+			grants : SUPPORTED_GRANTS,
+			id : record.id,
+			redirectUris : record.redirects ?? [],
+			scopes : record.scopes ?? []
 		};
 
 	},
@@ -312,23 +321,22 @@ const createOAuthServer = ({ controller }) => new OAuth2Server({
 	}
 });
 
-// Inserts a new oauth client row. Validates allowedScopes against the
+// Inserts a new oauth client row. Validates scopes against the
 // developer-allowed subset; throws a 400-flagged error on invalid scopes.
-// Returns { client: <inserted-doc>, rawSecret: <plaintext> }. The raw
+// Returns { record: <inserted-doc>, rawSecret: <plaintext> }. The raw
 // secret is only available here — store immediately.
 const createClient = async ({
-	allowedScopes = [],
 	controller,
 	createdBy = null,
 	description = null,
-	grantTypes = [ 'authorization_code' ],
 	name,
 	organization = null,
-	redirectUris = [],
-	webOrigins = []
+	redirects = [],
+	scopes = [],
+	origins = []
 }) => {
 
-	const invalid = allowedScopes.filter( ( scope ) => ! developer.includes( scope ) );
+	const invalid = scopes.filter( ( scope ) => ! developer.includes( scope ) );
 
 	if( invalid.length > 0 ){
 
@@ -340,41 +348,42 @@ const createClient = async ({
 
 	}
 	const rawClientId = generateToken();
-	const clientId = 'drawbridge.' + rawClientId;
+	const client = 'drawbridge.' + rawClientId;
 
 	const rawSecret = generateToken();
 	const secretHash = hashToken( rawSecret );
 
 	const now = new Date();
 
-	const doc = await controller.insert({
+	const record = await controller.create({
 		collection : 'oauth',
 		data : {
-			allowedScopes,
-			clientId,
-			clientSecretHashes : [
+			client,
+			createdBy,
+			description,
+			endpoint : {
+				auth : 'client_secret_basic'
+			},
+			hashes : [
 				{
 					createdAt : now,
 					hash : secretHash,
 					retiredAt : null
 				}
 			],
-			clientType : 'confidential',
-			createdBy,
-			description,
-			grantTypes,
+			limits : null,
 			name,
 			organization,
-			rateLimitOverrides : null,
-			redirectUris,
+			origins,
+			redirects,
+			scopes,
 			status : 'active',
-			tokenEndpointAuthMethod : 'client_secret_basic',
-			webOrigins
+			type : 'confidential'
 		}
 	});
 
 	return {
-		client : doc,
+		record,
 		rawSecret
 	};
 

package/dist/oauth/server.d.ts

@@ -14,34 +14,43 @@ import 'crypto';
 //       { collection, query, data } works. drawbridge-api passes its base
 //       controller; tests can pass an in-memory mock.
 //
+//       Boundary translation: the DB uses our renamed schema (client,
+//       scopes, redirects, hashes, ...), but the @node-oauth library
+//       expects spec-named keys (clientId, scope, redirectUris, ...).
+//       Each model method translates at the return boundary.
+//
 //   - createOAuthServer({ controller })
 //       Convenience: creates the model + wraps it in an OAuth2Server with
 //       the standard Drawbridge lifetimes (1h access / 30d refresh) and
 //       client-authentication requirements.
 //
-//   - createClient({ base, allowedScopes, name, organization, ... })
+//   - createClient({ controller, scopes, name, organization, ... })
 //       Inserts a new oauth client row. Validates scopes against the
 //       developer set; throws 400 on invalid. Returns
-//       { client, rawSecret } — secret is plaintext, return ONCE.
+//       { record, rawSecret } — secret is plaintext, return ONCE.
+
 
+// Hardcoded — the supported grants don't vary per client today. If they
+// ever need to, store `grants` on the oauth doc and read it here.
+const SUPPORTED_GRANTS = [ 'authorization_code', 'client_credentials', 'refresh_token' ];
 
 const createOAuthModel = ({ controller }) => ({
 
 	getClient : async ( clientId, clientSecret ) => {
 
-		const client = await controller.get({
+		const record = await controller.get({
 			collection : 'oauth',
 			query : {
-				clientId,
+				client : clientId,
 				status : 'active'
 			}
 		});
 
-		if( ! client ) return false;
+		if( ! record ) return false;
 
 		if( clientSecret ){
 
-			const validSecret = client.clientSecretHashes?.some( ( entry ) => {
+			const validSecret = record.hashes?.some( ( entry ) => {
 
 				if( entry.retiredAt ) return false;
 
@@ -53,11 +62,11 @@ const createOAuthModel = ({ controller }) => ({
 
 		}
 		return {
-			clientId : client.clientId,
-			grants : [ 'authorization_code', 'client_credentials', 'refresh_token' ],
-			id : client.id,
-			redirectUris : client.redirectUris ?? [],
-			scopes : client.allowedScopes ?? []
+			clientId : record.client,
+			grants : SUPPORTED_GRANTS,
+			id : record.id,
+			redirectUris : record.redirects ?? [],
+			scopes : record.scopes ?? []
 		};
 
 	},
@@ -312,23 +321,22 @@ const createOAuthServer = ({ controller }) => new OAuth2Server({
 	}
 });
 
-// Inserts a new oauth client row. Validates allowedScopes against the
+// Inserts a new oauth client row. Validates scopes against the
 // developer-allowed subset; throws a 400-flagged error on invalid scopes.
-// Returns { client: <inserted-doc>, rawSecret: <plaintext> }. The raw
+// Returns { record: <inserted-doc>, rawSecret: <plaintext> }. The raw
 // secret is only available here — store immediately.
 const createClient = async ({
-	allowedScopes = [],
 	controller,
 	createdBy = null,
 	description = null,
-	grantTypes = [ 'authorization_code' ],
 	name,
 	organization = null,
-	redirectUris = [],
-	webOrigins = []
+	redirects = [],
+	scopes = [],
+	origins = []
 }) => {
 
-	const invalid = allowedScopes.filter( ( scope ) => ! developer.includes( scope ) );
+	const invalid = scopes.filter( ( scope ) => ! developer.includes( scope ) );
 
 	if( invalid.length > 0 ){
 
@@ -340,41 +348,42 @@ const createClient = async ({
 
 	}
 	const rawClientId = generateToken();
-	const clientId = 'drawbridge.' + rawClientId;
+	const client = 'drawbridge.' + rawClientId;
 
 	const rawSecret = generateToken();
 	const secretHash = hashToken( rawSecret );
 
 	const now = new Date();
 
-	const doc = await controller.insert({
+	const record = await controller.create({
 		collection : 'oauth',
 		data : {
-			allowedScopes,
-			clientId,
-			clientSecretHashes : [
+			client,
+			createdBy,
+			description,
+			endpoint : {
+				auth : 'client_secret_basic'
+			},
+			hashes : [
 				{
 					createdAt : now,
 					hash : secretHash,
 					retiredAt : null
 				}
 			],
-			clientType : 'confidential',
-			createdBy,
-			description,
-			grantTypes,
+			limits : null,
 			name,
 			organization,
-			rateLimitOverrides : null,
-			redirectUris,
+			origins,
+			redirects,
+			scopes,
 			status : 'active',
-			tokenEndpointAuthMethod : 'client_secret_basic',
-			webOrigins
+			type : 'confidential'
 		}
 	});
 
 	return {
-		client : doc,
+		record,
 		rawSecret
 	};
 

package/dist/oauth/server.js

@@ -111,19 +111,20 @@ var hashToken = (raw) => hash(raw, process.env.OAUTH_TOKEN_HMAC_KEY);
 var generateToken = () => generate(32, "base64url");
 
 // lib/oauth/server.js
+var SUPPORTED_GRANTS = ["authorization_code", "client_credentials", "refresh_token"];
 var createOAuthModel = ({ controller }) => ({
   getClient: async (clientId, clientSecret) => {
     var _a;
-    const client = await controller.get({
+    const record = await controller.get({
       collection: "oauth",
       query: {
-        clientId,
+        client: clientId,
         status: "active"
       }
     });
-    if (!client) return false;
+    if (!record) return false;
     if (clientSecret) {
-      const validSecret = (_a = client.clientSecretHashes) == null ? void 0 : _a.some((entry) => {
+      const validSecret = (_a = record.hashes) == null ? void 0 : _a.some((entry) => {
         if (entry.retiredAt) return false;
         return compare(hashToken(clientSecret), entry.hash);
       });
@@ -131,11 +132,11 @@ var createOAuthModel = ({ controller }) => ({
     }
     ;
     return {
-      clientId: client.clientId,
-      grants: ["authorization_code", "client_credentials", "refresh_token"],
-      id: client.id,
-      redirectUris: client.redirectUris ?? [],
-      scopes: client.allowedScopes ?? []
+      clientId: record.client,
+      grants: SUPPORTED_GRANTS,
+      id: record.id,
+      redirectUris: record.redirects ?? [],
+      scopes: record.scopes ?? []
     };
   },
   saveAuthorizationCode: async (code, client, user) => {
@@ -340,17 +341,16 @@ var createOAuthServer = ({ controller }) => new OAuth2Server({
   }
 });
 var createClient = async ({
-  allowedScopes = [],
   controller,
   createdBy = null,
   description = null,
-  grantTypes = ["authorization_code"],
   name,
   organization = null,
-  redirectUris = [],
-  webOrigins = []
+  redirects = [],
+  scopes: scopes2 = [],
+  origins = []
 }) => {
-  const invalid = allowedScopes.filter((scope) => !developer.includes(scope));
+  const invalid = scopes2.filter((scope) => !developer.includes(scope));
   if (invalid.length > 0) {
     const error = new Error("Scopes not permitted for developer apps: " + invalid.join(", "));
     error.status = 400;
@@ -358,37 +358,38 @@ var createClient = async ({
   }
   ;
   const rawClientId = generateToken();
-  const clientId = "drawbridge." + rawClientId;
+  const client = "drawbridge." + rawClientId;
   const rawSecret = generateToken();
   const secretHash = hashToken(rawSecret);
   const now = /* @__PURE__ */ new Date();
-  const doc = await controller.insert({
+  const record = await controller.create({
     collection: "oauth",
     data: {
-      allowedScopes,
-      clientId,
-      clientSecretHashes: [
+      client,
+      createdBy,
+      description,
+      endpoint: {
+        auth: "client_secret_basic"
+      },
+      hashes: [
         {
           createdAt: now,
           hash: secretHash,
           retiredAt: null
         }
       ],
-      clientType: "confidential",
-      createdBy,
-      description,
-      grantTypes,
+      limits: null,
       name,
       organization,
-      rateLimitOverrides: null,
-      redirectUris,
+      origins,
+      redirects,
+      scopes: scopes2,
       status: "active",
-      tokenEndpointAuthMethod: "client_secret_basic",
-      webOrigins
+      type: "confidential"
     }
   });
   return {
-    client: doc,
+    record,
     rawSecret
   };
 };

package/package.json

@@ -130,5 +130,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.48"
+  "version": "0.0.50"
 }