@dropsh/plugin-oauth2 0.2.1 → 0.3.1

package/LICENSE

@@ -0,0 +1,51 @@
+drupal-cli is dual-licensed. You may use this software under the terms of
+either the MIT License or the GNU General Public License version 2 or any
+later version, at your option.
+
+SPDX-License-Identifier: (MIT OR GPL-2.0-or-later)
+
+================================================================================
+MIT License
+================================================================================
+
+Copyright (c) 2026 Christian Wiedemann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+GNU General Public License, version 2 or later
+================================================================================
+
+The full text of the GNU GPL v2 is available at:
+  https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
+
+The full text of any later GPL version is available at:
+  https://www.gnu.org/licenses/
+
+Copyright (C) 2026 Christian Wiedemann
+
+This program is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free Software
+Foundation; either version 2 of the License, or (at your option) any later
+version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+details.

package/README.md

@@ -45,22 +45,41 @@ dropsh auth login --provider oauth2_authcode
 dropsh auth status
 ```
 
+## Named profiles
+
+Every `oauth2Plugin` is one auth **profile**, identified by its `id`. `id` defaults
+to the grant `type`, but set it explicitly to run several profiles of the same
+grant flow side by side (e.g. two `client_credentials` with different scopes).
+Mark one profile `default: true` to make it the fallback when none is selected.
+
+```js
+oauth2Plugin({ id: "session", default: true, type: "oauth2_client_credentials",
+  client_id: "my-client", client_secret, token_url, scope: "some:scope" }),
+oauth2Plugin({ id: "pm", type: "oauth2_client_credentials",
+  client_id: "my-client", client_secret, token_url, scope: "other:scope" }),
+```
+
+See the [dropsh README](../../README.md#named-profiles--many-identities-per-host)
+for `auth use`, `--auth-profile`, and selection precedence.
+
 ## Grant types
 
-| `type`                        | Interactive login prompts        | Token refresh        |
-| ----------------------------- | -------------------------------- | -------------------- |
-| `oauth2_authcode`             | opens browser (PKCE, public client) | yes (refresh token) |
-| `oauth2_password`             | client secret + user password    | re-login on expiry   |
-| `oauth2_client_credentials`   | client secret                     | re-login on expiry   |
+| `type`                        | Interactive login prompts        | Auto-renew (proactive + on 401) |
+| ----------------------------- | -------------------------------- | ------------------------------- |
+| `oauth2_authcode`             | opens browser (PKCE, public client) | yes — via `refresh_token`     |
+| `oauth2_password`             | client secret + user password    | yes — if `client_secret` in config |
+| `oauth2_client_credentials`   | client secret                     | yes — if `client_secret` in config |
 
-Config fields per grant:
+Config fields per grant (all accept the shared `id` and `default`):
 
 - `oauth2_authcode` — `client_id`, `token_url`, optional `scope`, `redirect_port`
-- `oauth2_password` — `client_id`, `token_url`, `username`, optional `scope`
-- `oauth2_client_credentials` — `client_id`, `token_url`, optional `scope`
+- `oauth2_password` — `client_id`, `token_url`, `username`, optional `scope`, `client_secret`
+- `oauth2_client_credentials` — `client_id`, `token_url`, optional `scope`, `client_secret`
 
-`client_secret` and the user `password` are **prompted at login**, never stored
-in config.
+`client_secret` and the user `password` may be **prompted at login** and are never
+stored on disk. For unattended runs, put `client_secret` in config so dropsh can
+re-mint tokens automatically; a purely prompted secret cannot be renewed and needs
+a fresh `dropsh auth login` when the token expires.
 
 ## Required Drupal module
 

package/dist/plugins/oauth2/src/provider.js

@@ -35,9 +35,13 @@ async function postToken(http, url, params, now) {
     }
 }
 export function oauth2Provider(cfg) {
+    // Profile identity is `cfg.id` (falling back to `cfg.type`); `cfg.type` stays
+    // purely the grant-flow selector used by login/renew/status below.
+    const id = cfg.id ?? cfg.type;
     return {
-        id: cfg.type,
-        displayName: DISPLAY[cfg.type],
+        id,
+        displayName: cfg.id ? `${DISPLAY[cfg.type]} [${cfg.id}]` : DISPLAY[cfg.type],
+        default: cfg.default === true,
         capabilities: { login: true, logout: true, status: true },
         async login(ctx) {
             if (cfg.type === "oauth2_authcode") {
@@ -118,7 +122,7 @@ export function oauth2Provider(cfg) {
                 current = minted;
                 await rt.save(minted);
             }
-            async function renew() {
+            async function renewSession() {
                 if (cfg.type === "oauth2_authcode") {
                     const refresh = current.refresh_token;
                     if (typeof refresh !== "string")
@@ -132,20 +136,34 @@ export function oauth2Provider(cfg) {
                 }
                 throw new AuthError("Session expired. Run 'dropsh auth login'.");
             }
+            // Coalesce concurrent renewals so we hit the token endpoint once.
+            function coalescedRenew() {
+                if (!inflight)
+                    inflight = renewSession().finally(() => {
+                        inflight = null;
+                    });
+                return inflight;
+            }
             return {
                 async apply(req) {
                     const token = current.access_token;
                     const expiresAt = typeof current.expires_at === "number" ? current.expires_at : 0;
                     if (typeof token === "string" && expiresAt - 30_000 > rt.now())
                         return { ...req, headers: bearer(req, token) };
-                    // Coalesce concurrent renewals so we hit the token endpoint once.
-                    if (!inflight)
-                        inflight = renew().finally(() => {
-                            inflight = null;
-                        });
-                    await inflight;
+                    await coalescedRenew();
                     return { ...req, headers: bearer(req, current.access_token) };
                 },
+                // Reactive path: the server rejected the token (401). Try once to re-mint /
+                // refresh from the credentials we have; report whether the caller may retry.
+                async renew() {
+                    try {
+                        await coalescedRenew();
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
             };
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dropsh/plugin-oauth2",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "type": "module",
   "main": "./dist/plugins/oauth2/src/index.js",
   "exports": {
@@ -13,18 +13,17 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run --passWithNoTests",
-    "typecheck": "tsc --noEmit",
-    "prepublishOnly": "pnpm run build"
-  },
   "peerDependencies": {
     "dropsh": "*"
   },
   "devDependencies": {
-    "dropsh": "workspace:*",
     "typescript": "^5.6.0",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "dropsh": "0.3.1"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run --passWithNoTests",
+    "typecheck": "tsc --noEmit"
   }
-}
+}