@dropsh/plugin-oauth2 0.2.0 → 0.2.1

package/dist/plugins/oauth2/src/provider.js

@@ -54,7 +54,7 @@ export function oauth2Provider(cfg) {
                 });
             }
             const params = new URLSearchParams({ client_id: cfg.client_id });
-            const secret = await ctx.prompt({ label: "Client secret", secret: true });
+            const secret = cfg.client_secret ?? (await ctx.prompt({ label: "Client secret", secret: true }));
             params.set("client_secret", secret);
             if (cfg.type === "oauth2_password") {
                 const password = await ctx.prompt({ label: "Password", secret: true });
@@ -87,11 +87,11 @@ export function oauth2Provider(cfg) {
             return info;
         },
         createAdapter(session, rt) {
-            // Mutable reference to the live session, updated in place after a refresh
-            // so subsequent requests reuse the new token instead of re-refreshing.
+            // Mutable reference to the live session, updated in place after a renewal
+            // so subsequent requests reuse the new token instead of renewing again.
             let current = session;
-            let refreshing = null;
-            async function doRefresh(refreshToken) {
+            let inflight = null;
+            async function refreshAuthcode(refreshToken) {
                 const params = new URLSearchParams({
                     grant_type: "refresh_token",
                     refresh_token: refreshToken,
@@ -103,28 +103,47 @@ export function oauth2Provider(cfg) {
                 current = refreshed;
                 await rt.save(refreshed);
             }
+            // client_credentials is idempotent: re-mint from client_id + secret, no
+            // refresh_token needed. The secret is config-provided and kept in memory
+            // only — never written to the persisted session (rt.save stores the token).
+            async function mintClientCredentials(secret) {
+                const params = new URLSearchParams({
+                    grant_type: "client_credentials",
+                    client_id: cfg.client_id,
+                    client_secret: secret,
+                });
+                if (cfg.scope)
+                    params.set("scope", cfg.scope);
+                const minted = await postToken(rt.http, cfg.token_url, params, rt.now);
+                current = minted;
+                await rt.save(minted);
+            }
+            async function renew() {
+                if (cfg.type === "oauth2_authcode") {
+                    const refresh = current.refresh_token;
+                    if (typeof refresh !== "string")
+                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
+                    await refreshAuthcode(refresh);
+                    return;
+                }
+                if (cfg.type === "oauth2_client_credentials" && cfg.client_secret) {
+                    await mintClientCredentials(cfg.client_secret);
+                    return;
+                }
+                throw new AuthError("Session expired. Run 'dropsh auth login'.");
+            }
             return {
                 async apply(req) {
                     const token = current.access_token;
                     const expiresAt = typeof current.expires_at === "number" ? current.expires_at : 0;
                     if (typeof token === "string" && expiresAt - 30_000 > rt.now())
                         return { ...req, headers: bearer(req, token) };
-                    // Only the authcode grant uses a public client (PKCE) and can refresh
-                    // with client_id alone. For oauth2_password / oauth2_client_credentials
-                    // the client is confidential and a refresh without client_secret would
-                    // 401; we do not persist the long-lived client_secret at rest, so a
-                    // re-login is required instead.
-                    if (cfg.type !== "oauth2_authcode")
-                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
-                    const refresh = current.refresh_token;
-                    if (typeof refresh !== "string")
-                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
-                    // Coalesce concurrent refreshes so we exchange the token only once.
-                    if (!refreshing)
-                        refreshing = doRefresh(refresh).finally(() => {
-                            refreshing = null;
+                    // Coalesce concurrent renewals so we hit the token endpoint once.
+                    if (!inflight)
+                        inflight = renew().finally(() => {
+                            inflight = null;
                         });
-                    await refreshing;
+                    await inflight;
                     return { ...req, headers: bearer(req, current.access_token) };
                 },
             };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dropsh/plugin-oauth2",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "type": "module",
   "main": "./dist/plugins/oauth2/src/index.js",
   "exports": {
@@ -13,17 +13,18 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "pnpm run build"
+  },
   "peerDependencies": {
     "dropsh": "*"
   },
   "devDependencies": {
+    "dropsh": "workspace:*",
     "typescript": "^5.6.0",
-    "vitest": "^4.1.8",
-    "dropsh": "0.2.0"
-  },
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc --noEmit"
+    "vitest": "^4.1.8"
   }
-}
+}

package/LICENSE

@@ -1,51 +0,0 @@
-drupal-cli is dual-licensed. You may use this software under the terms of
-either the MIT License or the GNU General Public License version 2 or any
-later version, at your option.
-
-SPDX-License-Identifier: (MIT OR GPL-2.0-or-later)
-
-================================================================================
-MIT License
-================================================================================
-
-Copyright (c) 2026 Christian Wiedemann
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-================================================================================
-GNU General Public License, version 2 or later
-================================================================================
-
-The full text of the GNU GPL v2 is available at:
-  https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
-
-The full text of any later GPL version is available at:
-  https://www.gnu.org/licenses/
-
-Copyright (C) 2026 Christian Wiedemann
-
-This program is free software; you can redistribute it and/or modify it under
-the terms of the GNU General Public License as published by the Free Software
-Foundation; either version 2 of the License, or (at your option) any later
-version.
-
-This program is distributed in the hope that it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
-FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
-details.