@drawbridge/drawbridge-utils 0.0.50 → 0.0.51

package/dist/oauth/index.cjs

@@ -47,6 +47,7 @@ __export(oauth_exports, {
   scopeLabels: () => scopeLabels,
   scopeOptions: () => scopeOptions,
   scopes: () => scopes,
+  tokenFromHandshake: () => tokenFromHandshake,
   tokenTypes: () => tokenTypes,
   validate: () => validate
 });
@@ -84,9 +85,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -239,7 +261,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -283,6 +305,7 @@ var createOAuthClient = ({
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 });

package/dist/oauth/index.d.cts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.d.ts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.js

@@ -30,9 +30,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -185,7 +206,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -228,6 +249,7 @@ export {
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 };

package/dist/oauth/server.cjs

@@ -60,8 +60,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,

package/dist/oauth/server.js

@@ -25,8 +25,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,

package/package.json

@@ -130,5 +130,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.50"
+  "version": "0.0.51"
 }