@enfuce/nextgen-sdk 0.0.6 → 0.0.8

package/src/oauth/index.ts

@@ -22,6 +22,6 @@
  *
  * Server-side only — a client secret must never ship to a browser.
  */
-export { AccessToken, TokenFetcher, TokenManager } from './tokenManager';
-export { OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
+export { AccessToken, TokenFetcher, OAuthClientCredentialsManager } from './tokenManager';
+export { ClientCredentials, OAuthConfig, clientCredentials, clientCredentialsFetcher } from './clientCredentials';
 export { createOAuthAxios } from './axios';

package/src/oauth/tokenManager.ts

@@ -21,14 +21,14 @@ export type TokenFetcher = () => Promise<AccessToken>;
  * client's `Configuration`:
  *
  * ```ts
- * const tokens = new TokenManager(fetcher);
+ * const tokens = new OAuthClientCredentialsManager(fetcher);
  * const config = new card.Configuration({ accessToken: () => tokens.getToken() });
  * ```
  *
  * A token is considered expired once the clock passes `expiry - skew`. Concurrent
  * refreshes share a single in-flight promise, so the token endpoint is hit once.
  */
-export class TokenManager {
+export class OAuthClientCredentialsManager {
     private token?: string;
     private expiresAtMs?: number;
     private inflight?: Promise<string>;

package/src/pin/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   PINOperationsUsingPKIApi,
@@ -56,7 +56,7 @@ export class PinClient {
 export class PinClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -66,7 +66,7 @@ export class PinClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/threeds/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   ThreeDSApi,
@@ -50,7 +50,7 @@ export class ThreedsClient {
 export class ThreedsClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class ThreedsClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/threeds-oob/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   OOBAuthenticationChallengeWebhookNotificationApi,
@@ -50,7 +50,7 @@ export class ThreedsOobClient {
 export class ThreedsOobClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -60,7 +60,7 @@ export class ThreedsOobClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/src/wallet/client.ts

@@ -6,7 +6,7 @@
  * retry) to the module's Configuration and exposes each API. Nothing is shared across modules.
  */
 import globalAxios, { type AxiosInstance } from 'axios';
-import { createOAuthAxios, type TokenManager } from '../oauth';
+import { createOAuthAxios, type OAuthClientCredentialsManager } from '../oauth';
 import { Configuration } from './configuration';
 import {
   ActivateTokenApi,
@@ -92,7 +92,7 @@ export class WalletClient {
 export class WalletClientBuilder {
 
   private _baseUrl?: string;
-  private _tokens?: TokenManager;
+  private _tokens?: OAuthClientCredentialsManager;
   private _customizers: Array<(http: AxiosInstance) => void> = [];
 
   /** The module's host, e.g. `https://api.<tenant>.../issuer`. */
@@ -102,7 +102,7 @@ export class WalletClientBuilder {
   }
 
   /** Install OAuth: a fresh bearer token on every request + reactive 401 retry. */
-  oauth(tokens: TokenManager): this {
+  oauth(tokens: OAuthClientCredentialsManager): this {
     this._tokens = tokens;
     return this;
   }

package/test/clientCredentials.test.ts

@@ -0,0 +1,20 @@
+/** Tests for the ClientCredentials identity object and the clientCredentials overloads. */
+import { describe, expect, it } from 'vitest';
+import { oauth } from '../src';
+
+describe('ClientCredentials pairing', () => {
+  it('clientCredentials(tokenUrl, credentials) builds an OAuthClientCredentialsManager', () => {
+    const creds: oauth.ClientCredentials = { clientId: 'id', clientSecret: 'secret', scopes: ['s.read'] };
+    const mgr = oauth.clientCredentials('https://auth.example.com/oauth2/token', creds);
+    expect(mgr).toBeInstanceOf(oauth.OAuthClientCredentialsManager);
+  });
+
+  it('still accepts a full OAuthConfig', () => {
+    const mgr = oauth.clientCredentials({
+      tokenUrl: 'https://auth.example.com/oauth2/token',
+      clientId: 'id',
+      clientSecret: 'secret',
+    });
+    expect(mgr).toBeInstanceOf(oauth.OAuthClientCredentialsManager);
+  });
+});

package/test/config.test.ts

@@ -0,0 +1,33 @@
+/**
+ * Tests for the hand-written tenant/environment URL helper (src/config).
+ */
+import { describe, expect, it } from 'vitest';
+import { config } from '../src';
+
+const sandbox: config.TenantEnvironment = { tenant: 'swile', environment: 'ext-uat1-sandbox' };
+
+describe('config URL helpers', () => {
+  it('derives per-domain base URLs as api.<tenant>.<environment>.mycore.enfuce.com/<domain>', () => {
+    expect(config.apiBaseUrl(sandbox)).toBe('https://api.swile.ext-uat1-sandbox.mycore.enfuce.com');
+    expect(config.issuerBaseUrl(sandbox)).toBe('https://api.swile.ext-uat1-sandbox.mycore.enfuce.com/issuer');
+    expect(config.processorBaseUrl(sandbox)).toBe('https://api.swile.ext-uat1-sandbox.mycore.enfuce.com/processor');
+    expect(config.exchangeRateBaseUrl(sandbox)).toBe(
+      'https://api.swile.ext-uat1-sandbox.mycore.enfuce.com/exchange-rates-api',
+    );
+  });
+
+  it('derives the token URL from the auth host', () => {
+    expect(config.tokenUrl(sandbox)).toBe('https://auth.swile.ext-uat1-sandbox.mycore.enfuce.com/oauth2/token');
+  });
+
+  it('places a multi-segment environment verbatim', () => {
+    expect(config.issuerBaseUrl({ tenant: 'swile', environment: 'eu.live.prod' })).toBe(
+      'https://api.swile.eu.live.prod.mycore.enfuce.com/issuer',
+    );
+  });
+
+  it('rejects an empty tenant or environment', () => {
+    expect(() => config.issuerBaseUrl({ tenant: ' ', environment: 'env' })).toThrow();
+    expect(() => config.tokenUrl({ tenant: 'swile', environment: '' })).toThrow();
+  });
+});

package/test/oauth.test.ts

@@ -1,7 +1,7 @@
 /**
  * Tests for the hand-written OAuth token-management helper (src/oauth).
  *
- * Covers the TokenManager cache/refresh/single-flight logic, the client-credentials
+ * Covers the OAuthClientCredentialsManager cache/refresh/single-flight logic, the client-credentials
  * fetcher and the reactive 401-retry axios instance, using capturing axios adapters
  * so nothing hits the network.
  */
@@ -9,7 +9,7 @@ import axios, { type AxiosAdapter, type InternalAxiosRequestConfig } from 'axios
 import { describe, expect, it } from 'vitest';
 import { oauth } from '../src';
 
-const { TokenManager, clientCredentialsFetcher, clientCredentials, createOAuthAxios } = oauth;
+const { OAuthClientCredentialsManager, clientCredentialsFetcher, clientCredentials, createOAuthAxios } = oauth;
 
 function makeClock(start = 1000) {
   const state = { t: start };
@@ -25,11 +25,11 @@ function countingFetcher(expiresInSeconds = 300) {
   return { fetch, calls };
 }
 
-describe('TokenManager', () => {
+describe('OAuthClientCredentialsManager', () => {
   it('caches the token within its validity window', async () => {
     const { fetch, calls } = countingFetcher();
     const clock = makeClock();
-    const mgr = new TokenManager(fetch, 60, clock.now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, clock.now);
 
     expect(await mgr.getToken()).toBe('token-1');
     expect(await mgr.getToken()).toBe('token-1');
@@ -39,7 +39,7 @@ describe('TokenManager', () => {
   it('refreshes once past expiry minus skew', async () => {
     const { fetch, calls } = countingFetcher(300);
     const clock = makeClock();
-    const mgr = new TokenManager(fetch, 60, clock.now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, clock.now);
 
     expect(await mgr.getToken()).toBe('token-1');
     clock.advance(239_000);
@@ -53,7 +53,7 @@ describe('TokenManager', () => {
 
   it('refetches every call when lifetime is unknown', async () => {
     const { fetch, calls } = countingFetcher(0);
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken();
     await mgr.getToken();
     expect(calls.n).toBe(2);
@@ -61,7 +61,7 @@ describe('TokenManager', () => {
 
   it('shares a single in-flight fetch across concurrent callers', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     const results = await Promise.all([mgr.getToken(), mgr.getToken(), mgr.getToken()]);
 
@@ -71,7 +71,7 @@ describe('TokenManager', () => {
 
   it('forceRefresh is a no-op when the cached token already moved on', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     expect(await mgr.getToken()).toBe('token-1');
     expect(await mgr.forceRefresh('an-older-token')).toBe('token-1');
@@ -129,7 +129,7 @@ describe('clientCredentialsFetcher', () => {
     expect(captured.config?.auth).toBeUndefined();
   });
 
-  it('clientCredentials returns a caching TokenManager', async () => {
+  it('clientCredentials returns a caching OAuthClientCredentialsManager', async () => {
     const { instance } = capturingAxios({ access_token: 'abc', expires_in: 120 });
     const mgr = clientCredentials(
       { tokenUrl: 'https://auth.example.com/oauth/token', clientId: 'id', clientSecret: 's', axiosInstance: instance },
@@ -141,7 +141,7 @@ describe('clientCredentialsFetcher', () => {
 describe('createOAuthAxios', () => {
   it('proactively attaches a bearer token to a request that has no Authorization header', async () => {
     const { fetch, calls } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
 
     const seenAuth: (string | undefined)[] = [];
     const adapter: AxiosAdapter = async (config) => {
@@ -160,7 +160,7 @@ describe('createOAuthAxios', () => {
 
   it('retries the request with a refreshed token when the first call rejects with 401', async () => {
     const { fetch } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken(); // seed token-1
 
     const seenAuth: (string | undefined)[] = [];
@@ -196,7 +196,7 @@ describe('createOAuthAxios', () => {
 
   it('surfaces the error after a single retry (no infinite loop)', async () => {
     const { fetch } = countingFetcher();
-    const mgr = new TokenManager(fetch, 60, makeClock().now);
+    const mgr = new OAuthClientCredentialsManager(fetch, 60, makeClock().now);
     await mgr.getToken();
 
     let calls = 0;