@drawbridge/drawbridge-utils 0.0.50 → 0.0.52

package/dist/env.cjs

@@ -0,0 +1,41 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// lib/env.js
+var env_exports = {};
+__export(env_exports, {
+  assertEnv: () => assertEnv
+});
+module.exports = __toCommonJS(env_exports);
+var assertEnv = (required = [], { env = process.env, exit = true } = {}) => {
+  const missing = (required || []).filter((key) => {
+    const value = env[key];
+    return value === void 0 || value === null || String(value).trim() === "";
+  });
+  if (missing.length === 0) return;
+  const message = "Missing required environment variable" + (missing.length > 1 ? "s" : "") + ": " + missing.join(", ");
+  console.error("[boot] " + message);
+  if (exit) {
+    process.exit(1);
+  }
+  throw new Error(message);
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  assertEnv
+});

package/dist/env.d.cts

@@ -0,0 +1,41 @@
+// Boot-time required-environment-variable validation. A service calls
+// assertEnv(required) as the first thing in index.js so a missing must-have
+// config fails loudly at startup instead of silently degrading at first use
+// (e.g. a missing OAUTH_TOKEN_HMAC_KEY surfacing only as failed socket auth).
+//
+//   const { assertEnv } = require( '@drawbridge/drawbridge-utils/env' );
+//   assertEnv([ 'MONGODB_URI', 'REDIS_URL', 'OAUTH_TOKEN_HMAC_KEY' ]);
+//
+// Reports EVERY missing var in one message (not just the first) and exits the
+// process with code 1. A var counts as missing when unset, null, or an
+// empty/whitespace-only string. Pass { exit : false } to throw instead of
+// exiting (used in tests); pass { env } to validate against a supplied map.
+const assertEnv = ( required = [], { env = process.env, exit = true } = {} ) => {
+
+	const missing = ( required || [] ).filter( ( key ) => {
+
+		const value = env[ key ];
+
+		return value === undefined || value === null || String( value ).trim() === '';
+
+	});
+
+	if( missing.length === 0 ) return;
+
+	const message = 'Missing required environment variable'
+		+ ( missing.length > 1 ? 's' : '' )
+		+ ': ' + missing.join( ', ' );
+
+	console.error( '[boot] ' + message );
+
+	if( exit ){
+
+		process.exit( 1 );
+
+	}
+
+	throw new Error( message );
+
+};
+
+export { assertEnv };

package/dist/env.d.ts

@@ -0,0 +1,41 @@
+// Boot-time required-environment-variable validation. A service calls
+// assertEnv(required) as the first thing in index.js so a missing must-have
+// config fails loudly at startup instead of silently degrading at first use
+// (e.g. a missing OAUTH_TOKEN_HMAC_KEY surfacing only as failed socket auth).
+//
+//   const { assertEnv } = require( '@drawbridge/drawbridge-utils/env' );
+//   assertEnv([ 'MONGODB_URI', 'REDIS_URL', 'OAUTH_TOKEN_HMAC_KEY' ]);
+//
+// Reports EVERY missing var in one message (not just the first) and exits the
+// process with code 1. A var counts as missing when unset, null, or an
+// empty/whitespace-only string. Pass { exit : false } to throw instead of
+// exiting (used in tests); pass { env } to validate against a supplied map.
+const assertEnv = ( required = [], { env = process.env, exit = true } = {} ) => {
+
+	const missing = ( required || [] ).filter( ( key ) => {
+
+		const value = env[ key ];
+
+		return value === undefined || value === null || String( value ).trim() === '';
+
+	});
+
+	if( missing.length === 0 ) return;
+
+	const message = 'Missing required environment variable'
+		+ ( missing.length > 1 ? 's' : '' )
+		+ ': ' + missing.join( ', ' );
+
+	console.error( '[boot] ' + message );
+
+	if( exit ){
+
+		process.exit( 1 );
+
+	}
+
+	throw new Error( message );
+
+};
+
+export { assertEnv };

package/dist/env.js

@@ -0,0 +1,17 @@
+// lib/env.js
+var assertEnv = (required = [], { env = process.env, exit = true } = {}) => {
+  const missing = (required || []).filter((key) => {
+    const value = env[key];
+    return value === void 0 || value === null || String(value).trim() === "";
+  });
+  if (missing.length === 0) return;
+  const message = "Missing required environment variable" + (missing.length > 1 ? "s" : "") + ": " + missing.join(", ");
+  console.error("[boot] " + message);
+  if (exit) {
+    process.exit(1);
+  }
+  throw new Error(message);
+};
+export {
+  assertEnv
+};

package/dist/oauth/index.cjs

@@ -47,6 +47,7 @@ __export(oauth_exports, {
   scopeLabels: () => scopeLabels,
   scopeOptions: () => scopeOptions,
   scopes: () => scopes,
+  tokenFromHandshake: () => tokenFromHandshake,
   tokenTypes: () => tokenTypes,
   validate: () => validate
 });
@@ -84,9 +85,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -239,7 +261,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -283,6 +305,7 @@ var createOAuthClient = ({
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 });

package/dist/oauth/index.d.cts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.d.ts

@@ -32,10 +32,59 @@ const clients = {
 	share : 'drawbridge-share'
 };
 
+// Resolve the raw OAuth access token from a socket.io handshake. Precedence:
+//   1. handshake.auth.token — the browser client connects with
+//      io( uri, { auth : { token } } ); socket.io exposes it here.
+//   2. Sec-WebSocket-Protocol: bearer.<token> subprotocol.
+//   3. the drawbridge.session cookie on the upgrade request.
+// This is the OAuth handshake token-source contract; drawbridge-sync's WS auth
+// reads it so any future socket-authenticating service resolves it identically.
+const tokenFromHandshake = ( socket ) => {
+
+	if( socket?.handshake?.auth?.token ){
+
+		return socket.handshake.auth.token;
+
+	}
+
+	const headers = socket?.handshake?.headers || {};
+
+	const subprotocols = ( headers[ 'sec-websocket-protocol' ] || '' )
+		.split( ',' )
+		.map( ( value ) => value.trim() );
+
+	for( const subprotocol of subprotocols ){
+
+		if( subprotocol.startsWith( 'bearer.' ) ){
+
+			return subprotocol.slice( 'bearer.'.length ) || null;
+
+		}
+
+	}
+
+	if( ! headers.cookie ) return null;
+
+	const parsed = headers.cookie.split( ';' ).reduce( ( accumulator, pair ) => {
+
+		const index = pair.indexOf( '=' );
+
+		if( index < 0 ) return accumulator;
+
+		accumulator[ pair.slice( 0, index ).trim() ] = decodeURIComponent( pair.slice( index + 1 ).trim() );
+
+		return accumulator;
+
+	}, {} );
+
+	return parsed[ cookies.session ] || null;
+
+};
+
 // Token / authorization-code / OTC lifetimes in seconds (the OAuth spec's
 // unit for `expires_in`). Multiply by 1000 when feeding to JS Date math.
 const lifetimes = {
-	access : 60 * 60,               // 1 hour
+	access : 60 * 60 * 8,           // 8 hours
 	authorizationCode : 10 * 60,    // 10 minutes
 	code : 15 * 60,                 // 15 minutes (email OTC)
 	refresh : 30 * 24 * 60 * 60     // 30 days
@@ -304,7 +353,7 @@ const createOAuthClient = ({
 
 		cached = {
 			accessToken : body.access_token,
-			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || 3600 ),
+			expiresAt : Math.floor( Date.now() / 1000 ) + Number( body.expires_in || lifetimes.access ),
 			scope : body.scope
 		};
 
@@ -346,4 +395,4 @@ const createOAuthClient = ({
 
 };
 
-export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenTypes, validate };
+export { clients, cookieOptions, cookies, createOAuthClient, developer, developerOptions, generateToken, hashToken, intersect, isDeveloperAllowed, lifetimes, menuEndpoint, otcContexts, parse, scopeLabels, scopeOptions, scopes, tokenFromHandshake, tokenTypes, validate };

package/dist/oauth/index.js

@@ -30,9 +30,30 @@ var clients = {
   dashboard: "drawbridge-dashboard",
   share: "drawbridge-share"
 };
+var tokenFromHandshake = (socket) => {
+  var _a, _b, _c;
+  if ((_b = (_a = socket == null ? void 0 : socket.handshake) == null ? void 0 : _a.auth) == null ? void 0 : _b.token) {
+    return socket.handshake.auth.token;
+  }
+  const headers = ((_c = socket == null ? void 0 : socket.handshake) == null ? void 0 : _c.headers) || {};
+  const subprotocols = (headers["sec-websocket-protocol"] || "").split(",").map((value) => value.trim());
+  for (const subprotocol of subprotocols) {
+    if (subprotocol.startsWith("bearer.")) {
+      return subprotocol.slice("bearer.".length) || null;
+    }
+  }
+  if (!headers.cookie) return null;
+  const parsed = headers.cookie.split(";").reduce((accumulator, pair) => {
+    const index = pair.indexOf("=");
+    if (index < 0) return accumulator;
+    accumulator[pair.slice(0, index).trim()] = decodeURIComponent(pair.slice(index + 1).trim());
+    return accumulator;
+  }, {});
+  return parsed[cookies.session] || null;
+};
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,
@@ -185,7 +206,7 @@ var createOAuthClient = ({
     const body = await response.json();
     cached = {
       accessToken: body.access_token,
-      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || 3600),
+      expiresAt: Math.floor(Date.now() / 1e3) + Number(body.expires_in || lifetimes.access),
       scope: body.scope
     };
     return cached.accessToken;
@@ -228,6 +249,7 @@ export {
   scopeLabels,
   scopeOptions,
   scopes,
+  tokenFromHandshake,
   tokenTypes,
   validate
 };

package/dist/oauth/server.cjs

@@ -60,8 +60,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,

package/dist/oauth/server.js

@@ -25,8 +25,8 @@ var compare = (a, b) => {
 
 // lib/oauth/index.js
 var lifetimes = {
-  access: 60 * 60,
-  // 1 hour
+  access: 60 * 60 * 8,
+  // 8 hours
   authorizationCode: 10 * 60,
   // 10 minutes
   code: 15 * 60,

package/package.json

@@ -39,6 +39,11 @@
       "import": "./dist/encrypt.js",
       "require": "./dist/encrypt.cjs"
     },
+    "./env": {
+      "types": "./dist/env.d.ts",
+      "import": "./dist/env.js",
+      "require": "./dist/env.cjs"
+    },
     "./axios": {
       "types": "./dist/axios.d.ts",
       "import": "./dist/axios.js",
@@ -130,5 +135,5 @@
     "build": "tsup && npm publish"
   },
   "types": "dist/index.d.ts",
-  "version": "0.0.50"
+  "version": "0.0.52"
 }