@elevasis/core 0.7.1 → 0.8.2

package/src/integrations/oauth/api-schemas.ts

@@ -1,92 +1,92 @@
-/**
- * OAuth Domain - Zod Validation Schemas
- *
- * Validation schemas for OAuth flow endpoints.
- * Includes path params and query params for authorize/callback flows.
- *
- * Security:
- * - All schemas use .strict() to prevent mass assignment attacks
- * - Provider enum validation prevents invalid providers
- * - OAuth code and state length limits prevent DoS
- * - organizationId validation prevents injection
- * - CSRF protection via state parameter validation
- */
-
-import { z } from 'zod'
-import { OAuthProviderSchema, OAuthCodeSchema, OAuthStateParamSchema, CredentialNameSchema } from '../../platform/utils/validation'
-
-// ============================================================================
-// Path Parameters
-// ============================================================================
-
-/**
- * Validate OAuth provider in URL path
- * Used by: GET /oauth/authorize/:provider, GET /oauth/callback/:provider
- *
- * Security: Enum validation prevents bypass attacks with invalid providers
- */
-export const OAuthProviderParamSchema = z
-  .object({
-    provider: OAuthProviderSchema
-  })
-  .strict()
-
-// ============================================================================
-// Query Parameters - Authorize Flow
-// ============================================================================
-
-/**
- * OAuth authorize endpoint query parameters
- * GET /oauth/authorize/:provider?credentialName=...&organizationId=...
- *
- * Security:
- * - credentialName validated (alphanumeric + hyphens/underscores)
- * - organizationId required (public endpoint, can't use JWT)
- * - organizationId validated (string format for WorkOS/UUID)
- */
-export const AuthorizeQuerySchema = z
-  .object({
-    credentialName: CredentialNameSchema,
-    organizationId: z.string().min(1) // WorkOS org IDs or UUIDs
-  })
-  .strict()
-
-// ============================================================================
-// Query Parameters - Callback Flow
-// ============================================================================
-
-/**
- * OAuth callback endpoint query parameters
- * GET /oauth/callback/:provider?code=...&state=...&error=...
- *
- * Security:
- * - code length limited (10-1000 chars)
- * - state parameter validated (Base64-encoded JSON, max 2KB)
- * - error optional (provider-specific error codes)
- *
- * CSRF Protection:
- * - State parameter contains organizationId and credentialName
- * - State validated to ensure request originated from our authorize endpoint
- */
-export const CallbackQuerySchema = z
-  .object({
-    code: OAuthCodeSchema.optional(),
-    state: OAuthStateParamSchema.optional(),
-    error: z.string().max(100).optional() // OAuth error codes (access_denied, etc.)
-  })
-  .passthrough() // OAuth2 spec: "client MUST ignore unrecognized response parameters"
-  .refine(
-    (data) => data.code || data.error,
-    {
-      message: 'Either code or error parameter must be provided'
-    }
-  )
-
-// ============================================================================
-// TypeScript Type Exports
-// ============================================================================
-
-// Export inferred types for use in route handlers
-export type OAuthProviderParam = z.infer<typeof OAuthProviderParamSchema>
-export type AuthorizeQuery = z.infer<typeof AuthorizeQuerySchema>
-export type CallbackQuery = z.infer<typeof CallbackQuerySchema>
+/**
+ * OAuth Domain - Zod Validation Schemas
+ *
+ * Validation schemas for OAuth flow endpoints.
+ * Includes path params and query params for authorize/callback flows.
+ *
+ * Security:
+ * - All schemas use .strict() to prevent mass assignment attacks
+ * - Provider enum validation prevents invalid providers
+ * - OAuth code and state length limits prevent DoS
+ * - organizationId validation prevents injection
+ * - CSRF protection via state parameter validation
+ */
+
+import { z } from 'zod'
+import { OAuthProviderSchema, OAuthCodeSchema, OAuthStateParamSchema, CredentialNameSchema } from '../../platform/utils/validation'
+
+// ============================================================================
+// Path Parameters
+// ============================================================================
+
+/**
+ * Validate OAuth provider in URL path
+ * Used by: GET /oauth/authorize/:provider, GET /oauth/callback/:provider
+ *
+ * Security: Enum validation prevents bypass attacks with invalid providers
+ */
+export const OAuthProviderParamSchema = z
+  .object({
+    provider: OAuthProviderSchema
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters - Authorize Flow
+// ============================================================================
+
+/**
+ * OAuth authorize endpoint query parameters
+ * GET /oauth/authorize/:provider?credentialName=...&organizationId=...
+ *
+ * Security:
+ * - credentialName validated (alphanumeric + hyphens/underscores)
+ * - organizationId required (public endpoint, can't use JWT)
+ * - organizationId validated (string format for WorkOS/UUID)
+ */
+export const AuthorizeQuerySchema = z
+  .object({
+    credentialName: CredentialNameSchema,
+    organizationId: z.string().min(1) // WorkOS org IDs or UUIDs
+  })
+  .strict()
+
+// ============================================================================
+// Query Parameters - Callback Flow
+// ============================================================================
+
+/**
+ * OAuth callback endpoint query parameters
+ * GET /oauth/callback/:provider?code=...&state=...&error=...
+ *
+ * Security:
+ * - code length limited (10-1000 chars)
+ * - state parameter validated (Base64-encoded JSON, max 2KB)
+ * - error optional (provider-specific error codes)
+ *
+ * CSRF Protection:
+ * - State parameter contains organizationId and credentialName
+ * - State validated to ensure request originated from our authorize endpoint
+ */
+export const CallbackQuerySchema = z
+  .object({
+    code: OAuthCodeSchema.optional(),
+    state: OAuthStateParamSchema.optional(),
+    error: z.string().max(100).optional() // OAuth error codes (access_denied, etc.)
+  })
+  .passthrough() // OAuth2 spec: "client MUST ignore unrecognized response parameters"
+  .refine(
+    (data) => data.code || data.error,
+    {
+      message: 'Either code or error parameter must be provided'
+    }
+  )
+
+// ============================================================================
+// TypeScript Type Exports
+// ============================================================================
+
+// Export inferred types for use in route handlers
+export type OAuthProviderParam = z.infer<typeof OAuthProviderParamSchema>
+export type AuthorizeQuery = z.infer<typeof AuthorizeQuerySchema>
+export type CallbackQuery = z.infer<typeof CallbackQuerySchema>

package/src/integrations/oauth/index.ts

@@ -1,19 +1,19 @@
-/**
- * OAuth Integration Exports
- *
- * Browser-safe exports (types and provider registry)
- * Server-only exports (refresh functions with process.env) in ./server.ts
- */
-
-export * from './types'
-export * from './provider-registry'
-
-// Validation schemas
-export {
-  OAuthProviderParamSchema,
-  AuthorizeQuerySchema,
-  CallbackQuerySchema,
-  type OAuthProviderParam,
-  type AuthorizeQuery,
-  type CallbackQuery
-} from './api-schemas'
+/**
+ * OAuth Integration Exports
+ *
+ * Browser-safe exports (types and provider registry)
+ * Server-only exports (refresh functions with process.env) in ./server.ts
+ */
+
+export * from './types'
+export * from './provider-registry'
+
+// Validation schemas
+export {
+  OAuthProviderParamSchema,
+  AuthorizeQuerySchema,
+  CallbackQuerySchema,
+  type OAuthProviderParam,
+  type AuthorizeQuery,
+  type CallbackQuery
+} from './api-schemas'

package/src/integrations/oauth/provider-registry.ts

@@ -1,61 +1,61 @@
-import type { OAuthProviderConfig } from './types'
-
-/**
- * OAuth Provider Registry
- *
- * Add new integration = add config object here (no new code needed)
- *
- * Standard token exchange methods:
- * - basic-auth: client_id:client_secret in Authorization header
- * - form-encoded: credentials in URL-encoded body (Google)
- * - json-body: credentials in JSON body (most providers)
- *
- * Custom overrides for edge cases:
- * - customAuthFlow: Override authorization URL building
- * - customTokenExchange: Override token exchange logic
- */
-export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
-  'google-sheets': {
-    id: 'google-sheets',
-    name: 'Google Sheets',
-    authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
-    tokenUrl: 'https://oauth2.googleapis.com/token',
-    authParams: {
-      access_type: 'offline', // Required for refresh token
-      prompt: 'consent' // Force consent to get refresh token on reconnect
-    },
-    tokenExchange: 'form-encoded',
-    scopes: ['https://www.googleapis.com/auth/spreadsheets']
-  },
-
-  dropbox: {
-    id: 'dropbox',
-    name: 'Dropbox',
-    authUrl: 'https://www.dropbox.com/oauth2/authorize',
-    tokenUrl: 'https://api.dropboxapi.com/oauth2/token',
-    authParams: {
-      token_access_type: 'offline' // Required for refresh token
-    },
-    tokenExchange: 'form-encoded',
-    scopes: ['files.content.write', 'files.content.read', 'files.metadata.write']
-  }
-}
-
-/**
- * Get provider config by ID
- * @throws Error if provider not found
- */
-export function getProviderConfig(providerId: string): OAuthProviderConfig {
-  const config = OAUTH_PROVIDERS[providerId]
-  if (!config) {
-    throw new Error(`Unknown OAuth provider: ${providerId}`)
-  }
-  return config
-}
-
-/**
- * List all available providers (for frontend)
- */
-export function listProviders(): OAuthProviderConfig[] {
-  return Object.values(OAUTH_PROVIDERS)
-}
+import type { OAuthProviderConfig } from './types'
+
+/**
+ * OAuth Provider Registry
+ *
+ * Add new integration = add config object here (no new code needed)
+ *
+ * Standard token exchange methods:
+ * - basic-auth: client_id:client_secret in Authorization header
+ * - form-encoded: credentials in URL-encoded body (Google)
+ * - json-body: credentials in JSON body (most providers)
+ *
+ * Custom overrides for edge cases:
+ * - customAuthFlow: Override authorization URL building
+ * - customTokenExchange: Override token exchange logic
+ */
+export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
+  'google-sheets': {
+    id: 'google-sheets',
+    name: 'Google Sheets',
+    authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+    tokenUrl: 'https://oauth2.googleapis.com/token',
+    authParams: {
+      access_type: 'offline', // Required for refresh token
+      prompt: 'consent' // Force consent to get refresh token on reconnect
+    },
+    tokenExchange: 'form-encoded',
+    scopes: ['https://www.googleapis.com/auth/spreadsheets']
+  },
+
+  dropbox: {
+    id: 'dropbox',
+    name: 'Dropbox',
+    authUrl: 'https://www.dropbox.com/oauth2/authorize',
+    tokenUrl: 'https://api.dropboxapi.com/oauth2/token',
+    authParams: {
+      token_access_type: 'offline' // Required for refresh token
+    },
+    tokenExchange: 'form-encoded',
+    scopes: ['files.content.write', 'files.content.read', 'files.metadata.write']
+  }
+}
+
+/**
+ * Get provider config by ID
+ * @throws Error if provider not found
+ */
+export function getProviderConfig(providerId: string): OAuthProviderConfig {
+  const config = OAUTH_PROVIDERS[providerId]
+  if (!config) {
+    throw new Error(`Unknown OAuth provider: ${providerId}`)
+  }
+  return config
+}
+
+/**
+ * List all available providers (for frontend)
+ */
+export function listProviders(): OAuthProviderConfig[] {
+  return Object.values(OAUTH_PROVIDERS)
+}