@every-app/sdk 0.3.0-rc.9 → 0.3.1

package/dist/internal/oauthClient.d.ts

@@ -1,13 +1,13 @@
 /**
- * The `oauth_client` capability's wire rules (docs/capabilities.md "OAuth
- * clients"), shared by the gateway, which puts the operator's client on an
- * app's token request, and the SDK's local-dev fallback, which puts the
- * developer's own on it the same way.
+ * An OAuth provider's client as the gateway holds it in its settings
+ * (`everyapp secret set <CLIENT_ID> <CLIENT_SECRET>`); one an owner or
+ * admin pasted under Manage workspace → Providers is the gateway's own
+ * D1 row instead.
  */
-import { type CapabilitySettings, type OAuthClientCapability, type OAuthTokenEndpoint } from "./capabilities.js";
-/** The largest token request body the gateway reads: real ones are a few hundred bytes. */
+import type { CapabilitySettings, OAuthClientCapability } from "./capabilities.js";
+/** The largest token answer the gateway reads: real ones are a few kilobytes. */
 export declare const OAUTH_TOKEN_BODY_LIMIT: number;
-/** An OAuth client as the gateway (or `.dev.vars`) holds it. */
+/** An OAuth client as the gateway holds it. */
 export interface OAuthClientCredentials {
     clientId: string;
     /** Absent for a public client. */
@@ -18,44 +18,36 @@ export interface OAuthClientCredentials {
  * it needs is set: the id, and the secret unless it is a public client.
  */
 export declare function oauthClientCredentials(capability: OAuthClientCapability, settings: CapabilitySettings): OAuthClientCredentials | null;
-/** A token request: where it goes, its headers, its (buffered) body. */
-export interface TokenRequest {
-    url: URL;
-    headers: Headers;
-    body: string | null;
+/** Where the client the gateway uses for an OAuth provider comes from. */
+export declare enum OAuthClientSource {
+    /** The Worker's settings, set from the terminal (`everyapp secret set`, `provider add`). */
+    Env = "env",
+    /** Pasted under Manage workspace → Providers: the gateway's sealed D1 row. */
+    Pasted = "d1"
+}
+/** What the gateway or the CLI knows of a pasted client, never its value. */
+export interface PastedOAuthClient {
+    /** The provider binding it was pasted for (`providerBindingKey`), or null for none recorded. */
+    boundTo: string | null;
+    hasSecret: boolean;
+    /** Whether its sealed copy opens with the gateway's secret; the CLI, which can't open it, says true. */
+    opens: boolean;
 }
-export type InjectedTokenRequest = ({
-    ok: true;
-} & TokenRequest) | {
-    ok: false;
-    problem: string;
-};
-/**
- * `request` with `client` put where `rule` says (the form body or HTTP
- * Basic), and every client credential the app sent removed wherever it
- * was: the `Authorization` header, and `client_id`/`client_secret` (in any
- * case) in the query string and the body. The body is re-serialised from
- * its parsed values, so a crafted body can't carry a second secret past
- * the parser. Token requests are form-encoded; anything else is refused.
- */
-export declare function injectClientCredentials(request: TokenRequest, rule: OAuthTokenEndpoint, client: OAuthClientCredentials): InjectedTokenRequest;
-/**
- * The grants the gateway completes: each ends in a user's own tokens. The
- * client-credentials grant, and anything else a network serves on the same
- * endpoint, would mint a token for the gateway's own application instead,
- * which on many providers manages the application's settings, its
- * webhooks and every tenant's tokens.
- */
-export declare const USER_BOUND_GRANT_TYPES: ReadonlySet<string>;
-/**
- * A token request's `grant_type` as the app sent it, from its body or query
- * string, or null when it names none (Slack's code exchange). Never the
- * request's other fields.
- */
-export declare function requestedGrantType(request: TokenRequest): string | null;
 /**
- * A token request's `grant_type` for logs: one of the known grant types,
- * `other`, or null when it names none.
+ * Which client the gateway uses for an OAuth provider, or null when it has
+ * none it may use (docs/design/2026-10-oauth-providers.md section 6): the
+ * Worker settings' while the registry may read them (`envBound`: a
+ * registered row bound to its hosts), else the pasted one while it was
+ * pasted for the provider as it is now, opens, and has its secret. One rule
+ * for every surface that asks: the gateway's client lookup, whether an app
+ * needs setup (the gate that opens it, the app lists) and the CLI's
+ * `status` and `deploy`.
  */
-export declare function tokenGrantType(request: TokenRequest): string | null;
+export declare function oauthClientSource(input: {
+    capability: OAuthClientCapability;
+    /** Every setting the Worker's client needs is set (`oauthClientCredentials`). */
+    envSet: boolean;
+    envBound: boolean;
+    pasted: PastedOAuthClient | null;
+}): OAuthClientSource | null;
 //# sourceMappingURL=oauthClient.d.ts.map

package/dist/internal/oauthClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B;AAMD,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,YAAY,CAAC,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,kBAAkB,EACxB,MAAM,EAAE,sBAAsB,GAC7B,oBAAoB,CAoDtB;AAUD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAIrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAQvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAInE"}
+{"version":3,"file":"oauthClient.d.ts","sourceRoot":"","sources":["../../src/internal/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAG3B,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,kBAAkB,GAC3B,sBAAsB,GAAG,IAAI,CAQ/B;AAED,0EAA0E;AAC1E,oBAAY,iBAAiB;IAC3B,4FAA4F;IAC5F,GAAG,QAAQ;IACX,8EAA8E;IAC9E,MAAM,OAAO;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,wGAAwG;IACxG,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,UAAU,EAAE,qBAAqB,CAAC;IAClC,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAClC,GAAG,iBAAiB,GAAG,IAAI,CAO3B"}

package/dist/internal/oauthClient.js

@@ -1,11 +1,5 @@
-/**
- * The `oauth_client` capability's wire rules (docs/capabilities.md "OAuth
- * clients"), shared by the gateway, which puts the operator's client on an
- * app's token request, and the SDK's local-dev fallback, which puts the
- * developer's own on it the same way.
- */
-import { base64Utf8, } from "./capabilities.js";
-/** The largest token request body the gateway reads: real ones are a few hundred bytes. */
+import { providerBindingKey } from "./providerRegistry.js";
+/** The largest token answer the gateway reads: real ones are a few kilobytes. */
 export const OAUTH_TOKEN_BODY_LIMIT = 64 * 1024;
 /**
  * The client `settings` hold for `capability`, or null until every setting
@@ -21,113 +15,36 @@ export function oauthClientCredentials(capability, settings) {
         return null;
     return { clientId, ...(clientSecret ? { clientSecret } : {}) };
 }
-function settingValue(value) {
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
-const FORM = "application/x-www-form-urlencoded";
-const isCredential = (name) => ["client_id", "client_secret"].includes(name.toLowerCase());
+/** Where the client the gateway uses for an OAuth provider comes from. */
+export var OAuthClientSource;
+(function (OAuthClientSource) {
+    /** The Worker's settings, set from the terminal (`everyapp secret set`, `provider add`). */
+    OAuthClientSource["Env"] = "env";
+    /** Pasted under Manage workspace → Providers: the gateway's sealed D1 row. */
+    OAuthClientSource["Pasted"] = "d1";
+})(OAuthClientSource || (OAuthClientSource = {}));
 /**
- * `request` with `client` put where `rule` says (the form body or HTTP
- * Basic), and every client credential the app sent removed wherever it
- * was: the `Authorization` header, and `client_id`/`client_secret` (in any
- * case) in the query string and the body. The body is re-serialised from
- * its parsed values, so a crafted body can't carry a second secret past
- * the parser. Token requests are form-encoded; anything else is refused.
+ * Which client the gateway uses for an OAuth provider, or null when it has
+ * none it may use (docs/design/2026-10-oauth-providers.md section 6): the
+ * Worker settings' while the registry may read them (`envBound`: a
+ * registered row bound to its hosts), else the pasted one while it was
+ * pasted for the provider as it is now, opens, and has its secret. One rule
+ * for every surface that asks: the gateway's client lookup, whether an app
+ * needs setup (the gate that opens it, the app lists) and the CLI's
+ * `status` and `deploy`.
  */
-export function injectClientCredentials(request, rule, client) {
-    const fields = [
-        ["client_id", client.clientId],
-        ...(client.clientSecret
-            ? [["client_secret", client.clientSecret]]
-            : []),
-    ];
-    // The query keeps the app's other fields as they were sent.
-    const url = new URL(request.url);
-    url.search = url.search
-        .slice(1)
-        .split("&")
-        .filter((pair) => {
-        const [name] = new URLSearchParams(pair).keys();
-        return pair !== "" && !(name !== undefined && isCredential(name));
-    })
-        .join("&");
-    const headers = new Headers(request.headers);
-    headers.delete("authorization");
-    headers.delete("content-length");
-    if (rule.inject === "basic") {
-        headers.set("authorization", `Basic ${base64Utf8(`${client.clientId}:${client.clientSecret ?? ""}`)}`);
-    }
-    let body = request.body;
-    if (body === null || body === "") {
-        // Nothing the app sent; the form rule makes the body.
-        if (rule.inject === "form") {
-            headers.set("content-type", FORM);
-            body = new URLSearchParams(fields).toString();
-        }
-    }
-    else if (mediaType(headers.get("content-type")) === FORM) {
-        const params = new URLSearchParams(body);
-        for (const name of new Set([...params.keys()].filter(isCredential))) {
-            params.delete(name);
-        }
-        if (rule.inject === "form") {
-            for (const [name, value] of fields)
-                params.set(name, value);
-        }
-        body = params.toString();
-    }
-    else {
-        return {
-            ok: false,
-            problem: `A token request's body is form-encoded (${FORM}).`,
-        };
-    }
-    return { ok: true, url, headers, body };
-}
-/** The grant types logs may name; anything else is logged as `other`. */
-const GRANT_TYPES = new Set([
-    "authorization_code",
-    "refresh_token",
-    "client_credentials",
-    "urn:ietf:params:oauth:grant-type:token-exchange",
-]);
-/**
- * The grants the gateway completes: each ends in a user's own tokens. The
- * client-credentials grant, and anything else a network serves on the same
- * endpoint, would mint a token for the gateway's own application instead,
- * which on many providers manages the application's settings, its
- * webhooks and every tenant's tokens.
- */
-export const USER_BOUND_GRANT_TYPES = new Set([
-    "authorization_code",
-    "refresh_token",
-    "urn:ietf:params:oauth:grant-type:token-exchange",
-]);
-/**
- * A token request's `grant_type` as the app sent it, from its body or query
- * string, or null when it names none (Slack's code exchange). Never the
- * request's other fields.
- */
-export function requestedGrantType(request) {
-    let value = null;
-    const type = mediaType(request.headers.get("content-type"));
-    if (request.body && type === FORM) {
-        value = new URLSearchParams(request.body).get("grant_type");
-    }
-    value ??= request.url.searchParams.get("grant_type");
-    return typeof value === "string" && value ? value : null;
-}
-/**
- * A token request's `grant_type` for logs: one of the known grant types,
- * `other`, or null when it names none.
- */
-export function tokenGrantType(request) {
-    const value = requestedGrantType(request);
-    if (value === null)
+export function oauthClientSource(input) {
+    if (input.envSet)
+        return input.envBound ? OAuthClientSource.Env : null;
+    const pasted = input.pasted;
+    if (!pasted || !pasted.opens)
         return null;
-    return GRANT_TYPES.has(value) ? value : "other";
+    if (pasted.boundTo !== providerBindingKey(input.capability))
+        return null;
+    if (input.capability.secrets.clientSecret && !pasted.hasSecret)
+        return null;
+    return OAuthClientSource.Pasted;
 }
-/** A Content-Type's media type, lowercased and without parameters. */
-function mediaType(contentType) {
-    return (contentType ?? "").split(";")[0].trim().toLowerCase();
+function settingValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }