@every-app/sdk 0.2.0 → 0.3.0-rc.10

package/dist/internal/oauthClient.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The `oauth_client` capability's wire rules (docs/capabilities.md "OAuth
+ * clients"), shared by the gateway, which puts the operator's client on an
+ * app's token request, and the SDK's local-dev fallback, which puts the
+ * developer's own on it the same way.
+ */
+import { type CapabilitySettings, type OAuthClientCapability, type OAuthTokenEndpoint } from "./capabilities.js";
+/** The largest token request body the gateway reads: real ones are a few hundred bytes. */
+export declare const OAUTH_TOKEN_BODY_LIMIT: number;
+/** An OAuth client as the gateway (or `.dev.vars`) holds it. */
+export interface OAuthClientCredentials {
+    clientId: string;
+    /** Absent for a public client. */
+    clientSecret?: string;
+}
+/**
+ * The client `settings` hold for `capability`, or null until every setting
+ * it needs is set: the id, and the secret unless it is a public client.
+ */
+export declare function oauthClientCredentials(capability: OAuthClientCapability, settings: CapabilitySettings): OAuthClientCredentials | null;
+/** A token request: where it goes, its headers, its (buffered) body. */
+export interface TokenRequest {
+    url: URL;
+    headers: Headers;
+    body: string | null;
+}
+export type InjectedTokenRequest = ({
+    ok: true;
+} & TokenRequest) | {
+    ok: false;
+    problem: string;
+};
+/**
+ * `request` with `client` put where `rule` says (the form body or HTTP
+ * Basic), and every client credential the app sent removed wherever it
+ * was: the `Authorization` header, and `client_id`/`client_secret` (in any
+ * case) in the query string and the body. The body is re-serialised from
+ * its parsed values, so a crafted body can't carry a second secret past
+ * the parser. Token requests are form-encoded; anything else is refused.
+ */
+export declare function injectClientCredentials(request: TokenRequest, rule: OAuthTokenEndpoint, client: OAuthClientCredentials): InjectedTokenRequest;
+/**
+ * The grants the gateway completes: each ends in a user's own tokens. The
+ * client-credentials grant, and anything else a network serves on the same
+ * endpoint, would mint a token for the gateway's own application instead,
+ * which on many providers manages the application's settings, its
+ * webhooks and every tenant's tokens.
+ */
+export declare const USER_BOUND_GRANT_TYPES: ReadonlySet<string>;
+/**
+ * A token request's `grant_type` as the app sent it, from its body or query
+ * string, or null when it names none (Slack's code exchange). Never the
+ * request's other fields.
+ */
+export declare function requestedGrantType(request: TokenRequest): string | null;
+/**
+ * A token request's `grant_type` for logs: one of the known grant types,
+ * `other`, or null when it names none.
+ */
+export declare function tokenGrantType(request: TokenRequest): string | null;
+//# sourceMappingURL=oauthClient.d.ts.map

package/dist/internal/oauthClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B;AAMD,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,YAAY,CAAC,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,sBAAsB,GAC7B,oBAAoB,CAoDtB;AAUD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAIrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAQvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAInE"}

package/dist/internal/oauthClient.js

@@ -0,0 +1,133 @@
+/**
+ * The `oauth_client` capability's wire rules (docs/capabilities.md "OAuth
+ * clients"), shared by the gateway, which puts the operator's client on an
+ * app's token request, and the SDK's local-dev fallback, which puts the
+ * developer's own on it the same way.
+ */
+import { base64Utf8, } from "./capabilities.js";
+/** The largest token request body the gateway reads: real ones are a few hundred bytes. */
+export const OAUTH_TOKEN_BODY_LIMIT = 64 * 1024;
+/**
+ * The client `settings` hold for `capability`, or null until every setting
+ * it needs is set: the id, and the secret unless it is a public client.
+ */
+export function oauthClientCredentials(capability, settings) {
+    const clientId = settingValue(settings[capability.secrets.clientId]);
+    const secretName = capability.secrets.clientSecret;
+    const clientSecret = secretName
+        ? settingValue(settings[secretName])
+        : undefined;
+    if (!clientId || (secretName && !clientSecret))
+        return null;
+    return { clientId, ...(clientSecret ? { clientSecret } : {}) };
+}
+function settingValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+const FORM = "application/x-www-form-urlencoded";
+const isCredential = (name) => ["client_id", "client_secret"].includes(name.toLowerCase());
+/**
+ * `request` with `client` put where `rule` says (the form body or HTTP
+ * Basic), and every client credential the app sent removed wherever it
+ * was: the `Authorization` header, and `client_id`/`client_secret` (in any
+ * case) in the query string and the body. The body is re-serialised from
+ * its parsed values, so a crafted body can't carry a second secret past
+ * the parser. Token requests are form-encoded; anything else is refused.
+ */
+export function injectClientCredentials(request, rule, client) {
+    const fields = [
+        ["client_id", client.clientId],
+        ...(client.clientSecret
+            ? [["client_secret", client.clientSecret]]
+            : []),
+    ];
+    // The query keeps the app's other fields as they were sent.
+    const url = new URL(request.url);
+    url.search = url.search
+        .slice(1)
+        .split("&")
+        .filter((pair) => {
+        const [name] = new URLSearchParams(pair).keys();
+        return pair !== "" && !(name !== undefined && isCredential(name));
+    })
+        .join("&");
+    const headers = new Headers(request.headers);
+    headers.delete("authorization");
+    headers.delete("content-length");
+    if (rule.inject === "basic") {
+        headers.set("authorization", `Basic ${base64Utf8(`${client.clientId}:${client.clientSecret ?? ""}`)}`);
+    }
+    let body = request.body;
+    if (body === null || body === "") {
+        // Nothing the app sent; the form rule makes the body.
+        if (rule.inject === "form") {
+            headers.set("content-type", FORM);
+            body = new URLSearchParams(fields).toString();
+        }
+    }
+    else if (mediaType(headers.get("content-type")) === FORM) {
+        const params = new URLSearchParams(body);
+        for (const name of new Set([...params.keys()].filter(isCredential))) {
+            params.delete(name);
+        }
+        if (rule.inject === "form") {
+            for (const [name, value] of fields)
+                params.set(name, value);
+        }
+        body = params.toString();
+    }
+    else {
+        return {
+            ok: false,
+            problem: `A token request's body is form-encoded (${FORM}).`,
+        };
+    }
+    return { ok: true, url, headers, body };
+}
+/** The grant types logs may name; anything else is logged as `other`. */
+const GRANT_TYPES = new Set([
+    "authorization_code",
+    "refresh_token",
+    "client_credentials",
+    "urn:ietf:params:oauth:grant-type:token-exchange",
+]);
+/**
+ * The grants the gateway completes: each ends in a user's own tokens. The
+ * client-credentials grant, and anything else a network serves on the same
+ * endpoint, would mint a token for the gateway's own application instead,
+ * which on many providers manages the application's settings, its
+ * webhooks and every tenant's tokens.
+ */
+export const USER_BOUND_GRANT_TYPES = new Set([
+    "authorization_code",
+    "refresh_token",
+    "urn:ietf:params:oauth:grant-type:token-exchange",
+]);
+/**
+ * A token request's `grant_type` as the app sent it, from its body or query
+ * string, or null when it names none (Slack's code exchange). Never the
+ * request's other fields.
+ */
+export function requestedGrantType(request) {
+    let value = null;
+    const type = mediaType(request.headers.get("content-type"));
+    if (request.body && type === FORM) {
+        value = new URLSearchParams(request.body).get("grant_type");
+    }
+    value ??= request.url.searchParams.get("grant_type");
+    return typeof value === "string" && value ? value : null;
+}
+/**
+ * A token request's `grant_type` for logs: one of the known grant types,
+ * `other`, or null when it names none.
+ */
+export function tokenGrantType(request) {
+    const value = requestedGrantType(request);
+    if (value === null)
+        return null;
+    return GRANT_TYPES.has(value) ? value : "other";
+}
+/** A Content-Type's media type, lowercased and without parameters. */
+function mediaType(contentType) {
+    return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}

package/dist/internal/oauthPresets.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OAuth presets (docs/design/2026-10-oauth-providers.md section 4): ready
+ * `oauth2-user` specs, in the JSON shape `everyapp provider add` takes,
+ * for the providers people most often want a "Connect" button for. A
+ * preset becomes a `providers` row when added (`everyapp provider add
+ * --oauth github`, the Admin dialog, `everyapp_provider_add` with
+ * `preset`), so an operator may `provider show` and edit a copy; nothing
+ * here is a hidden catalog entry, and no gateway reserves a preset's
+ * setting names until it is added. Google, Microsoft and Slack are
+ * catalog clients with a `flow` and are offered in the same picker. The
+ * social networks' presets carry the tag `social`.
+ *
+ * Each preset parses with `parseProviderSpec` (oauthPresets.test.ts),
+ * names a console where the client is made, the API hosts the token is
+ * sent to, and scope sets an app declares under `scopes`. Scope strings
+ * are the providers' own, verified against their docs on 2026-10-25;
+ * the social presets' come from the catalog entries Postiz used, and
+ * none of them has been tried against a live connect yet.
+ */
+import { type RegistrableCapability } from "./providerSpec.js";
+/** A preset's spec as JSON: the shape of ./oauthSpec.ts. */
+export type OAuthPresetSpec = Readonly<Record<string, unknown>>;
+export declare const OAUTH_PRESETS: Readonly<Record<string, OAuthPresetSpec>>;
+/** The preset ids, in the order the picker shows them. */
+export declare function oauthPresetIds(): string[];
+/** A preset's parsed capability, for the picker's labels; throws for an unknown id (the test parses every preset). */
+export declare function oauthPreset(id: string): RegistrableCapability | null;
+/** Whether `capability` is an OAuth provider the Gateway runs the flow for. */
+export declare function isOAuthProvider(capability: {
+    mode: string;
+    flow?: unknown;
+} | undefined): boolean;
+//# sourceMappingURL=oauthPresets.d.ts.map

package/dist/internal/oauthPresets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPresets.d.ts","sourceRoot":"","sources":["../../src/internal/oauthPresets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAugCnE,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,sHAAsH;AACtH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAUpE;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,GACvD,OAAO,CAET"}