@dropsh/plugin-oauth2 0.2.0 → 0.3.1

package/README.md

@@ -45,22 +45,41 @@ dropsh auth login --provider oauth2_authcode
 dropsh auth status
 ```
 
+## Named profiles
+
+Every `oauth2Plugin` is one auth **profile**, identified by its `id`. `id` defaults
+to the grant `type`, but set it explicitly to run several profiles of the same
+grant flow side by side (e.g. two `client_credentials` with different scopes).
+Mark one profile `default: true` to make it the fallback when none is selected.
+
+```js
+oauth2Plugin({ id: "session", default: true, type: "oauth2_client_credentials",
+  client_id: "my-client", client_secret, token_url, scope: "some:scope" }),
+oauth2Plugin({ id: "pm", type: "oauth2_client_credentials",
+  client_id: "my-client", client_secret, token_url, scope: "other:scope" }),
+```
+
+See the [dropsh README](../../README.md#named-profiles--many-identities-per-host)
+for `auth use`, `--auth-profile`, and selection precedence.
+
 ## Grant types
 
-| `type`                        | Interactive login prompts        | Token refresh        |
-| ----------------------------- | -------------------------------- | -------------------- |
-| `oauth2_authcode`             | opens browser (PKCE, public client) | yes (refresh token) |
-| `oauth2_password`             | client secret + user password    | re-login on expiry   |
-| `oauth2_client_credentials`   | client secret                     | re-login on expiry   |
+| `type`                        | Interactive login prompts        | Auto-renew (proactive + on 401) |
+| ----------------------------- | -------------------------------- | ------------------------------- |
+| `oauth2_authcode`             | opens browser (PKCE, public client) | yes — via `refresh_token`     |
+| `oauth2_password`             | client secret + user password    | yes — if `client_secret` in config |
+| `oauth2_client_credentials`   | client secret                     | yes — if `client_secret` in config |
 
-Config fields per grant:
+Config fields per grant (all accept the shared `id` and `default`):
 
 - `oauth2_authcode` — `client_id`, `token_url`, optional `scope`, `redirect_port`
-- `oauth2_password` — `client_id`, `token_url`, `username`, optional `scope`
-- `oauth2_client_credentials` — `client_id`, `token_url`, optional `scope`
+- `oauth2_password` — `client_id`, `token_url`, `username`, optional `scope`, `client_secret`
+- `oauth2_client_credentials` — `client_id`, `token_url`, optional `scope`, `client_secret`
 
-`client_secret` and the user `password` are **prompted at login**, never stored
-in config.
+`client_secret` and the user `password` may be **prompted at login** and are never
+stored on disk. For unattended runs, put `client_secret` in config so dropsh can
+re-mint tokens automatically; a purely prompted secret cannot be renewed and needs
+a fresh `dropsh auth login` when the token expires.
 
 ## Required Drupal module
 

package/dist/plugins/oauth2/src/provider.js

@@ -35,9 +35,13 @@ async function postToken(http, url, params, now) {
     }
 }
 export function oauth2Provider(cfg) {
+    // Profile identity is `cfg.id` (falling back to `cfg.type`); `cfg.type` stays
+    // purely the grant-flow selector used by login/renew/status below.
+    const id = cfg.id ?? cfg.type;
     return {
-        id: cfg.type,
-        displayName: DISPLAY[cfg.type],
+        id,
+        displayName: cfg.id ? `${DISPLAY[cfg.type]} [${cfg.id}]` : DISPLAY[cfg.type],
+        default: cfg.default === true,
         capabilities: { login: true, logout: true, status: true },
         async login(ctx) {
             if (cfg.type === "oauth2_authcode") {
@@ -54,7 +58,7 @@ export function oauth2Provider(cfg) {
                 });
             }
             const params = new URLSearchParams({ client_id: cfg.client_id });
-            const secret = await ctx.prompt({ label: "Client secret", secret: true });
+            const secret = cfg.client_secret ?? (await ctx.prompt({ label: "Client secret", secret: true }));
             params.set("client_secret", secret);
             if (cfg.type === "oauth2_password") {
                 const password = await ctx.prompt({ label: "Password", secret: true });
@@ -87,11 +91,11 @@ export function oauth2Provider(cfg) {
             return info;
         },
         createAdapter(session, rt) {
-            // Mutable reference to the live session, updated in place after a refresh
-            // so subsequent requests reuse the new token instead of re-refreshing.
+            // Mutable reference to the live session, updated in place after a renewal
+            // so subsequent requests reuse the new token instead of renewing again.
             let current = session;
-            let refreshing = null;
-            async function doRefresh(refreshToken) {
+            let inflight = null;
+            async function refreshAuthcode(refreshToken) {
                 const params = new URLSearchParams({
                     grant_type: "refresh_token",
                     refresh_token: refreshToken,
@@ -103,30 +107,63 @@ export function oauth2Provider(cfg) {
                 current = refreshed;
                 await rt.save(refreshed);
             }
+            // client_credentials is idempotent: re-mint from client_id + secret, no
+            // refresh_token needed. The secret is config-provided and kept in memory
+            // only — never written to the persisted session (rt.save stores the token).
+            async function mintClientCredentials(secret) {
+                const params = new URLSearchParams({
+                    grant_type: "client_credentials",
+                    client_id: cfg.client_id,
+                    client_secret: secret,
+                });
+                if (cfg.scope)
+                    params.set("scope", cfg.scope);
+                const minted = await postToken(rt.http, cfg.token_url, params, rt.now);
+                current = minted;
+                await rt.save(minted);
+            }
+            async function renewSession() {
+                if (cfg.type === "oauth2_authcode") {
+                    const refresh = current.refresh_token;
+                    if (typeof refresh !== "string")
+                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
+                    await refreshAuthcode(refresh);
+                    return;
+                }
+                if (cfg.type === "oauth2_client_credentials" && cfg.client_secret) {
+                    await mintClientCredentials(cfg.client_secret);
+                    return;
+                }
+                throw new AuthError("Session expired. Run 'dropsh auth login'.");
+            }
+            // Coalesce concurrent renewals so we hit the token endpoint once.
+            function coalescedRenew() {
+                if (!inflight)
+                    inflight = renewSession().finally(() => {
+                        inflight = null;
+                    });
+                return inflight;
+            }
             return {
                 async apply(req) {
                     const token = current.access_token;
                     const expiresAt = typeof current.expires_at === "number" ? current.expires_at : 0;
                     if (typeof token === "string" && expiresAt - 30_000 > rt.now())
                         return { ...req, headers: bearer(req, token) };
-                    // Only the authcode grant uses a public client (PKCE) and can refresh
-                    // with client_id alone. For oauth2_password / oauth2_client_credentials
-                    // the client is confidential and a refresh without client_secret would
-                    // 401; we do not persist the long-lived client_secret at rest, so a
-                    // re-login is required instead.
-                    if (cfg.type !== "oauth2_authcode")
-                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
-                    const refresh = current.refresh_token;
-                    if (typeof refresh !== "string")
-                        throw new AuthError("Session expired. Run 'dropsh auth login'.");
-                    // Coalesce concurrent refreshes so we exchange the token only once.
-                    if (!refreshing)
-                        refreshing = doRefresh(refresh).finally(() => {
-                            refreshing = null;
-                        });
-                    await refreshing;
+                    await coalescedRenew();
                     return { ...req, headers: bearer(req, current.access_token) };
                 },
+                // Reactive path: the server rejected the token (401). Try once to re-mint /
+                // refresh from the credentials we have; report whether the caller may retry.
+                async renew() {
+                    try {
+                        await coalescedRenew();
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
             };
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dropsh/plugin-oauth2",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "type": "module",
   "main": "./dist/plugins/oauth2/src/index.js",
   "exports": {
@@ -19,7 +19,7 @@
   "devDependencies": {
     "typescript": "^5.6.0",
     "vitest": "^4.1.8",
-    "dropsh": "0.2.0"
+    "dropsh": "0.3.1"
   },
   "scripts": {
     "build": "tsc",