@enterprisestandard/react 0.0.5-beta.20260115.1 → 0.0.5-beta.20260115.2

package/dist/tenant-server.js

@@ -0,0 +1,6 @@
+/**
+ * Server-side helper functions for tenant management.
+ * These functions provide a convenient way to parse tenant requests
+ * and send webhook updates.
+ */
+export { parseTenantRequest, sendTenantWebhook, TenantRequestError } from './tenant';

package/dist/tenant.js

@@ -0,0 +1,324 @@
+/**
+ * Tenant Management SDK
+ *
+ * Provides helper functions for applications to implement tenant creation endpoints
+ * that ESVS can test. Supports both synchronous (201) and asynchronous (202)
+ * tenant creation with webhook-based status updates.
+ */
+/**
+ * Error thrown when tenant request validation fails
+ */
+export class TenantRequestError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TenantRequestError';
+    }
+}
+/**
+ * Serializes an ESConfig or EnterpriseStandard instance to a JSON-serializable format
+ * by removing non-serializable properties like stores, validators, and functions.
+ *
+ * Since EnterpriseStandard now extends ESConfig, the config (including handler URLs)
+ * is accessible directly from the instance.
+ *
+ * @param configOrES - The ESConfig object or EnterpriseStandard instance to serialize
+ * @returns A JSON-serializable version of the config
+ */
+export function serializeESConfig(configOrES) {
+    // EnterpriseStandard now extends ESConfig, so we can access config directly
+    // Extract the config properties (sso, iam, workload, validation, defaultInstance)
+    // and exclude the service instances (vault, sso instance, iam instance, workload instance)
+    if (configOrES &&
+        typeof configOrES === 'object' &&
+        'sso' in configOrES &&
+        'workload' in configOrES &&
+        'iam' in configOrES) {
+        // It's an EnterpriseStandard instance
+        // Extract config from the service instances (they now extend their configs)
+        const config = {
+            defaultInstance: configOrES.defaultInstance,
+            sso: configOrES.sso ? serializeESConfig(configOrES.sso) : undefined,
+            iam: configOrES.iam ? serializeESConfig(configOrES.iam) : undefined,
+            workload: configOrES.workload ? serializeESConfig(configOrES.workload) : undefined,
+            validation: configOrES.validation,
+        };
+        return config;
+    }
+    // Otherwise, treat it as an ESConfig or service config
+    const config = configOrES;
+    if (config === null || config === undefined) {
+        return config;
+    }
+    // Handle primitives
+    if (typeof config !== 'object') {
+        return config;
+    }
+    // Handle arrays
+    if (Array.isArray(config)) {
+        return config.map((item) => serializeESConfig(item));
+    }
+    // Check if it's a store instance (has methods like get, set, create, delete, etc.)
+    const isStore = typeof config.get === 'function' ||
+        typeof config.set === 'function' ||
+        typeof config.create === 'function' ||
+        typeof config.delete === 'function' ||
+        typeof config.upsert === 'function' ||
+        typeof config.list === 'function';
+    // Check if it's a StandardSchemaV1 validator (has '~standard' property)
+    const isValidator = config['~standard'] !== undefined;
+    // Check if it's a function
+    if (typeof config === 'function' || isStore || isValidator) {
+        return undefined;
+    }
+    // Handle Date objects
+    if (config instanceof Date) {
+        return config.toISOString();
+    }
+    // Recursively serialize object properties
+    const serialized = {};
+    for (const key in config) {
+        if (Object.hasOwn(config, key)) {
+            // Skip non-serializable properties
+            if (key === 'session_store' ||
+                key === 'user_store' ||
+                key === 'token_store' ||
+                key === 'group_store' ||
+                key === 'validation' ||
+                key === 'vault' || // Skip vault instance
+                // Skip method properties from service instances
+                key === 'getUser' ||
+                key === 'getRequiredUser' ||
+                key === 'getJwt' ||
+                key === 'initiateLogin' ||
+                key === 'logout' ||
+                key === 'callbackHandler' ||
+                key === 'handler' ||
+                key === 'getToken' ||
+                key === 'refreshToken' ||
+                key === 'generateJWTAssertion' ||
+                key === 'revokeToken' ||
+                key === 'validateToken' ||
+                key === 'getWorkload' ||
+                key === 'parseJWT' ||
+                key === 'createUser' ||
+                key === 'getBaseUrl' ||
+                key === 'groups_outbound' ||
+                key === 'groups_inbound') {
+                continue;
+            }
+            const value = serializeESConfig(config[key]);
+            // Only include defined values
+            if (value !== undefined) {
+                serialized[key] = value;
+            }
+        }
+    }
+    return serialized;
+}
+/**
+ * Parse and validate a tenant creation request from an HTTP request.
+ *
+ * @param request - The HTTP request containing the tenant creation data
+ * @returns The validated tenant creation request
+ * @throws {TenantRequestError} If the request is invalid or missing required fields
+ *
+ * @example
+ * ```typescript
+ * app.post('/api/tenant', async (c) => {
+ *   try {
+ *     const tenantRequest = await parseTenantRequest(c.req.raw);
+ *     // Create tenant...
+ *   } catch (error) {
+ *     if (error instanceof TenantRequestError) {
+ *       return c.json({ error: error.message }, 400);
+ *     }
+ *     throw error;
+ *   }
+ * });
+ * ```
+ */
+export async function parseTenantRequest(request) {
+    if (request.method !== 'POST') {
+        throw new TenantRequestError('Only POST method is supported');
+    }
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch (_error) {
+        throw new TenantRequestError('Invalid JSON in request body');
+    }
+    if (typeof body !== 'object' || body === null) {
+        throw new TenantRequestError('Request body must be an object');
+    }
+    const tenantRequest = body;
+    // Validate required fields
+    if (!tenantRequest.appId) {
+        throw new TenantRequestError('Missing required field: appId');
+    }
+    if (!tenantRequest.companyId) {
+        throw new TenantRequestError('Missing required field: companyId');
+    }
+    if (!tenantRequest.companyName) {
+        throw new TenantRequestError('Missing required field: companyName');
+    }
+    if (!tenantRequest.environmentType) {
+        throw new TenantRequestError('Missing required field: environmentType');
+    }
+    if (!tenantRequest.email) {
+        throw new TenantRequestError('Missing required field: email');
+    }
+    if (!tenantRequest.webhookUrl) {
+        throw new TenantRequestError('Missing required field: webhookUrl');
+    }
+    // Validate environmentType enum
+    const validEnvironmentTypes = ['POC', 'DEV', 'QA', 'PROD'];
+    if (!validEnvironmentTypes.includes(tenantRequest.environmentType)) {
+        throw new TenantRequestError(`Invalid environmentType: ${tenantRequest.environmentType}. Must be one of: ${validEnvironmentTypes.join(', ')}`);
+    }
+    // Validate webhookUrl is a valid URL
+    try {
+        new URL(tenantRequest.webhookUrl);
+    }
+    catch {
+        throw new TenantRequestError('Invalid webhookUrl: must be a valid URL');
+    }
+    // At this point, all required fields are validated and non-null
+    // Extract them to satisfy TypeScript's type narrowing
+    const appId = tenantRequest.appId;
+    const companyId = tenantRequest.companyId;
+    const companyName = tenantRequest.companyName;
+    const environmentType = tenantRequest.environmentType;
+    const email = tenantRequest.email;
+    const webhookUrl = tenantRequest.webhookUrl;
+    return {
+        appId,
+        companyId,
+        companyName,
+        environmentType,
+        email,
+        webhookUrl,
+    };
+}
+/**
+ * Send a webhook update to ESVS with tenant creation status.
+ *
+ * @param webhookUrl - The webhook URL provided in the tenant creation request
+ * @param payload - The webhook payload with status and tenant information
+ * @throws Never throws - errors are logged but not propagated to avoid breaking tenant creation
+ *
+ * @example
+ * ```typescript
+ * // Send initial status
+ * await sendTenantWebhook(tenantRequest.webhookUrl, {
+ *   companyId: tenantRequest.companyId,
+ *   status: 'processing',
+ * });
+ *
+ * // Send completion status
+ * await sendTenantWebhook(tenantRequest.webhookUrl, {
+ *   companyId: tenantRequest.companyId,
+ *   status: 'completed',
+ *   tenantUrl: 'https://app.example.com/tenants/tenant-123',
+ * });
+ * ```
+ */
+export async function sendTenantWebhook(webhookUrl, payload) {
+    try {
+        const response = await fetch(webhookUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            console.error(`Failed to send webhook update: ${response.status} ${response.statusText}`);
+        }
+    }
+    catch (error) {
+        console.error('Failed to send webhook update:', error);
+        // Don't throw - webhook failures shouldn't break tenant creation
+    }
+}
+/**
+ * In-memory tenant store implementation using Maps.
+ *
+ * Suitable for:
+ * - Development and testing
+ * - Single-server deployments
+ * - Applications without high availability requirements
+ *
+ * NOT suitable for:
+ * - Multi-server deployments (tenants not shared)
+ * - High availability scenarios (tenants lost on restart)
+ * - Production applications with distributed architecture
+ *
+ * For production, implement TenantStore with Redis or a database.
+ *
+ * @template TExtended - Type-safe custom data that consumers can add to tenants
+ */
+export class InMemoryTenantStore {
+    constructor() {
+        /** Primary storage: appId -> tenant */
+        this.tenants = new Map();
+        /** Secondary index: companyId -> Set of appIds (since one company can have multiple apps) */
+        this.companyIdIndex = new Map();
+    }
+    async get(appId) {
+        return this.tenants.get(appId) ?? null;
+    }
+    async getByCompanyId(companyId) {
+        const appIds = this.companyIdIndex.get(companyId);
+        if (!appIds || appIds.size === 0)
+            return [];
+        const tenants = [];
+        for (const appId of appIds) {
+            const tenant = this.tenants.get(appId);
+            if (tenant) {
+                tenants.push(tenant);
+            }
+        }
+        return tenants;
+    }
+    async list() {
+        return Array.from(this.tenants.values());
+    }
+    async upsert(tenant) {
+        const existing = this.tenants.get(tenant.appId);
+        // Clean up old index if companyId changed
+        if (existing && existing.companyId !== tenant.companyId) {
+            const oldAppIds = this.companyIdIndex.get(existing.companyId);
+            if (oldAppIds) {
+                oldAppIds.delete(tenant.appId);
+                if (oldAppIds.size === 0) {
+                    this.companyIdIndex.delete(existing.companyId);
+                }
+            }
+        }
+        // Store the tenant
+        this.tenants.set(tenant.appId, tenant);
+        // Update index (companyId -> Set of appIds)
+        let appIds = this.companyIdIndex.get(tenant.companyId);
+        if (!appIds) {
+            appIds = new Set();
+            this.companyIdIndex.set(tenant.companyId, appIds);
+        }
+        appIds.add(tenant.appId);
+        return tenant;
+    }
+    async delete(appId) {
+        const tenant = this.tenants.get(appId);
+        if (tenant) {
+            // Clean up index
+            const appIds = this.companyIdIndex.get(tenant.companyId);
+            if (appIds) {
+                appIds.delete(appId);
+                if (appIds.size === 0) {
+                    this.companyIdIndex.delete(tenant.companyId);
+                }
+            }
+        }
+        this.tenants.delete(appId);
+    }
+}

package/dist/types/base-user.js

@@ -0,0 +1 @@
+export {};

package/dist/types/enterprise-user.js

@@ -0,0 +1 @@
+export {};

package/dist/types/oidc-schema.js

@@ -0,0 +1,328 @@
+/**
+ * Creates a StandardSchemaV1 for validating OIDC callback URL parameters.
+ * @param vendor - The name of the vendor creating this schema
+ * @returns A StandardSchemaV1 instance for OIDC callback parameters
+ */
+export function oidcCallbackSchema(vendor) {
+    return {
+        '~standard': {
+            version: 1,
+            vendor,
+            validate: (value) => {
+                if (typeof value !== 'object' || value === null) {
+                    return {
+                        issues: [
+                            {
+                                message: 'Expected an object',
+                            },
+                        ],
+                    };
+                }
+                const params = value;
+                const issues = [];
+                const result = {};
+                // Check required 'code' parameter
+                if ('code' in params) {
+                    if (typeof params.code === 'string') {
+                        result.code = params.code;
+                    }
+                    else {
+                        issues.push({
+                            message: 'code must be a string',
+                            path: ['code'],
+                        });
+                    }
+                }
+                else if (!('error' in params)) {
+                    // 'code' is required unless there's an error
+                    issues.push({
+                        message: 'code is required',
+                        path: ['code'],
+                    });
+                }
+                // Validate state if present
+                if ('state' in params) {
+                    if (typeof params.state === 'string' || params.state === undefined) {
+                        result.state = params.state;
+                    }
+                    else {
+                        issues.push({
+                            message: 'state must be a string',
+                            path: ['state'],
+                        });
+                    }
+                }
+                // Validate session_state if present
+                if ('session_state' in params) {
+                    if (typeof params.session_state === 'string' || params.session_state === undefined) {
+                        result.session_state = params.session_state;
+                    }
+                    else {
+                        issues.push({
+                            message: 'session_state must be a string',
+                            path: ['session_state'],
+                        });
+                    }
+                }
+                // Validate error related fields if present
+                if ('error' in params) {
+                    if (typeof params.error === 'string') {
+                        result.error = params.error;
+                    }
+                    else {
+                        issues.push({
+                            message: 'error must be a string',
+                            path: ['error'],
+                        });
+                    }
+                    if ('error_description' in params) {
+                        if (typeof params.error_description === 'string' || params.error_description === undefined) {
+                            result.error_description = params.error_description;
+                        }
+                        else {
+                            issues.push({
+                                message: 'error_description must be a string',
+                                path: ['error_description'],
+                            });
+                        }
+                    }
+                    if ('error_uri' in params) {
+                        if (typeof params.error_uri === 'string' || params.error_uri === undefined) {
+                            result.error_uri = params.error_uri;
+                        }
+                        else {
+                            issues.push({
+                                message: 'error_uri must be a string',
+                                path: ['error_uri'],
+                            });
+                        }
+                    }
+                }
+                // Validate iss if present
+                if ('iss' in params) {
+                    if (typeof params.iss === 'string' || params.iss === undefined) {
+                        result.iss = params.iss;
+                    }
+                    else {
+                        issues.push({
+                            message: 'iss must be a string',
+                            path: ['iss'],
+                        });
+                    }
+                }
+                if (issues.length > 0) {
+                    return { issues };
+                }
+                return { value: result };
+            },
+        },
+    };
+}
+/**
+ * Creates a StandardSchemaV1 for validating OIDC Token Responses.
+ * @param vendor - The name of the vendor creating this schema
+ * @returns A StandardSchemaV1 instance for Token Response validation
+ */
+export function tokenResponseSchema(vendor) {
+    return {
+        '~standard': {
+            version: 1,
+            vendor,
+            validate: (value) => {
+                if (typeof value !== 'object' || value === null) {
+                    return {
+                        issues: [
+                            {
+                                message: 'Expected an object',
+                            },
+                        ],
+                    };
+                }
+                const response = value;
+                const issues = [];
+                const result = {};
+                // Check required 'access_token' parameter
+                if ('access_token' in response) {
+                    if (typeof response.access_token === 'string') {
+                        result.access_token = response.access_token;
+                    }
+                    else {
+                        issues.push({
+                            message: 'access_token must be a string',
+                            path: ['access_token'],
+                        });
+                    }
+                }
+                else {
+                    issues.push({
+                        message: 'access_token is required',
+                        path: ['access_token'],
+                    });
+                }
+                // Check required 'id_token' parameter
+                if ('id_token' in response) {
+                    if (typeof response.id_token === 'string') {
+                        result.id_token = response.id_token;
+                    }
+                    else {
+                        issues.push({
+                            message: 'id_token must be a string',
+                            path: ['id_token'],
+                        });
+                    }
+                }
+                else {
+                    issues.push({
+                        message: 'id_token is required',
+                        path: ['id_token'],
+                    });
+                }
+                // Check required 'token_type' parameter
+                if ('token_type' in response) {
+                    if (typeof response.token_type === 'string') {
+                        result.token_type = response.token_type;
+                    }
+                    else {
+                        issues.push({
+                            message: 'token_type must be a string',
+                            path: ['token_type'],
+                        });
+                    }
+                }
+                else {
+                    issues.push({
+                        message: 'token_type is required',
+                        path: ['token_type'],
+                    });
+                }
+                // Optional string fields
+                if ('refresh_token' in response) {
+                    if (typeof response.refresh_token === 'string' || response.refresh_token === undefined) {
+                        result.refresh_token = response.refresh_token;
+                    }
+                    else {
+                        issues.push({
+                            message: 'refresh_token must be a string',
+                            path: ['refresh_token'],
+                        });
+                    }
+                }
+                if ('scope' in response) {
+                    if (typeof response.scope === 'string' || response.scope === undefined) {
+                        result.scope = response.scope;
+                    }
+                    else {
+                        issues.push({
+                            message: 'scope must be a string',
+                            path: ['scope'],
+                        });
+                    }
+                }
+                if ('session_state' in response) {
+                    if (typeof response.session_state === 'string' || response.session_state === undefined) {
+                        result.session_state = response.session_state;
+                    }
+                    else {
+                        issues.push({
+                            message: 'session_state must be a string',
+                            path: ['session_state'],
+                        });
+                    }
+                }
+                if ('expires' in response) {
+                    if (typeof response.expires === 'string' || response.expires === undefined) {
+                        result.expires = response.expires;
+                    }
+                    else {
+                        issues.push({
+                            message: 'expires must be a string',
+                            path: ['expires'],
+                        });
+                    }
+                }
+                // Optional number fields
+                if ('expires_in' in response) {
+                    if (typeof response.expires_in === 'number' || response.expires_in === undefined) {
+                        result.expires_in = response.expires_in;
+                    }
+                    else {
+                        issues.push({
+                            message: 'expires_in must be a number',
+                            path: ['expires_in'],
+                        });
+                    }
+                }
+                if ('refresh_expires_in' in response) {
+                    if (typeof response.refresh_expires_in === 'number' || response.refresh_expires_in === undefined) {
+                        result.refresh_expires_in = response.refresh_expires_in;
+                    }
+                    else {
+                        issues.push({
+                            message: 'refresh_expires_in must be a number',
+                            path: ['refresh_expires_in'],
+                        });
+                    }
+                }
+                if (issues.length > 0) {
+                    return { issues };
+                }
+                return { value: result };
+            },
+        },
+    };
+}
+/**
+ * Creates a StandardSchemaV1 for validating ID Token Claims.
+ * @param vendor - The name of the vendor creating this schema
+ * @returns A StandardSchemaV1 instance for ID Token Claims validation
+ */
+export function idTokenClaimsSchema(vendor) {
+    return {
+        '~standard': {
+            version: 1,
+            vendor,
+            validate: (value) => {
+                if (typeof value !== 'object' || value === null) {
+                    return {
+                        issues: [
+                            {
+                                message: 'Expected an object',
+                            },
+                        ],
+                    };
+                }
+                const claims = value;
+                const issues = [];
+                const result = { ...claims };
+                // Validate optional string fields
+                const stringFields = ['iss', 'aud', 'sub', 'sid', 'name', 'email', 'preferred_username', 'picture'];
+                for (const field of stringFields) {
+                    if (field in claims && claims[field] !== undefined) {
+                        if (typeof claims[field] !== 'string') {
+                            issues.push({
+                                message: `${field} must be a string`,
+                                path: [field],
+                            });
+                        }
+                    }
+                }
+                // Validate optional number fields
+                const numberFields = ['exp', 'iat'];
+                for (const field of numberFields) {
+                    if (field in claims && claims[field] !== undefined) {
+                        if (typeof claims[field] !== 'number') {
+                            issues.push({
+                                message: `${field} must be a number`,
+                                path: [field],
+                            });
+                        }
+                    }
+                }
+                if (issues.length > 0) {
+                    return { issues };
+                }
+                return { value: result };
+            },
+        },
+    };
+}