@feelflow/ffid-sdk 5.18.0 → 5.21.0

package/dist/server/index.js

@@ -260,10 +260,12 @@ var OAUTH_INTROSPECT_ENDPOINT = "/api/v1/oauth/introspect";
 var CACHE_KEY_PREFIX = "ffid:introspect:";
 var HEX_BASE = 16;
 var HEX_BYTE_WIDTH = 2;
-var TOKEN_LOG_PREFIX_LENGTH = 8;
 function createVerifyAccessToken(deps) {
   const { authMode, baseUrl, serviceCode, serviceApiKey, verifyStrategy, logger, createError, errorCodes, cache, timeout } = deps;
   let jwtVerify2 = null;
+  let cacheReadFailureEscalated = false;
+  let cacheWriteFailureEscalated = false;
+  let missingSubtleCryptoLogged = false;
   function getJwtVerifier() {
     if (!jwtVerify2) {
       jwtVerify2 = createJwtVerifier({
@@ -323,8 +325,9 @@ function createVerifyAccessToken(deps) {
     }
     const url = `${baseUrl}${OAUTH_INTROSPECT_ENDPOINT}`;
     logger.debug("Verifying access token:", url);
-    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : "";
-    if (cache) {
+    const cacheKey = cache ? await buildCacheKey(accessToken, cacheKeySuffix) : null;
+    let verificationCacheDegraded = cache !== void 0 && cacheKey === null;
+    if (cache && cacheKey !== null) {
       try {
         const cached = await cache.adapter.get(cacheKey);
         if (cached && typeof cached === "object" && "sub" in cached) {
@@ -332,7 +335,16 @@ function createVerifyAccessToken(deps) {
           return { data: cached };
         }
       } catch (cacheError) {
-        logger.warn("Cache read failed, falling back to API call:", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheReadFailureEscalated) {
+          cacheReadFailureEscalated = true;
+          logger.error(
+            "Cache read failed \u2014 falling back to API call. Redis \u7B49\u306E cache adapter \u969C\u5BB3\u6642\u306F\u5168 verification \u304C introspect \u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache read failed, falling back to API call:", cacheError);
+        }
       }
     }
     const fetchOptions = {
@@ -427,31 +439,40 @@ function createVerifyAccessToken(deps) {
       }
     } : base;
     const userinfo = normalizeUserinfo(raw);
-    if (cache) {
+    if (cache && cacheKey !== null) {
       try {
         await cache.adapter.set(cacheKey, userinfo, cache.ttl);
       } catch (cacheError) {
-        logger.warn("Cache write failed (result still returned):", cacheError);
+        verificationCacheDegraded = true;
+        if (!cacheWriteFailureEscalated) {
+          cacheWriteFailureEscalated = true;
+          logger.error(
+            "Cache write failed \u2014 result still returned. cache adapter \u969C\u5BB3\u6642\u306F introspect \u7D50\u679C\u304C\u30AD\u30E3\u30C3\u30B7\u30E5\u3055\u308C\u305A\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B degrade \u3057\u307E\u3059\uFF08\u3053\u306E error \u306F instance \u3054\u3068\u306B\u521D\u56DE\u306E\u307F\u3001\u4EE5\u964D\u306F warn\uFF09:",
+            cacheError
+          );
+        } else {
+          logger.warn("Cache write failed (result still returned):", cacheError);
+        }
       }
     }
-    return { data: userinfo };
+    return verificationCacheDegraded ? { data: userinfo, meta: { verificationCacheDegraded: true } } : { data: userinfo };
   }
   async function buildCacheKey(token, suffix) {
-    let key;
-    if (typeof globalThis.crypto?.subtle?.digest === "function") {
-      const encoder = new TextEncoder();
-      const data = encoder.encode(token);
-      const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
-      key = CACHE_KEY_PREFIX + hashHex;
-    } else {
-      const tokenPrefix = token.length > TOKEN_LOG_PREFIX_LENGTH ? token.substring(0, TOKEN_LOG_PREFIX_LENGTH) + "..." : "***";
-      logger.warn(
-        `crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081\u3001\u30AD\u30E3\u30C3\u30B7\u30E5\u30AD\u30FC\u306B\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092\u4F7F\u7528\u3057\u307E\u3059 (token prefix: ${tokenPrefix})`
-      );
-      key = CACHE_KEY_PREFIX + token;
-    }
+    if (typeof globalThis.crypto?.subtle?.digest !== "function") {
+      if (!missingSubtleCryptoLogged) {
+        missingSubtleCryptoLogged = true;
+        logger.error(
+          "crypto.subtle \u304C\u5229\u7528\u3067\u304D\u306A\u3044\u305F\u3081 introspect \u7D50\u679C\u306E\u30AD\u30E3\u30C3\u30B7\u30E5\u3092\u7121\u52B9\u5316\u3057\u307E\u3057\u305F\uFF08\u30CF\u30C3\u30B7\u30E5\u5316\u3055\u308C\u3066\u3044\u306A\u3044\u30C8\u30FC\u30AF\u30F3\u3092 cache key \u306B\u4F7F\u308F\u306A\u3044\u305F\u3081\u306E\u63AA\u7F6E #4119\uFF09\u3002\u5168 verification \u304C API \u547C\u3073\u51FA\u3057\u306B\u306A\u308A\u307E\u3059"
+        );
+      }
+      return null;
+    }
+    const encoder = new TextEncoder();
+    const data = encoder.encode(token);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const hashHex = hashArray.map((b) => b.toString(HEX_BASE).padStart(HEX_BYTE_WIDTH, "0")).join("");
+    const key = CACHE_KEY_PREFIX + hashHex;
     return suffix ? `${key}:${suffix}` : key;
   }
   return verifyAccessToken;
@@ -869,6 +890,93 @@ function createMembersMethods(deps) {
   return { listMembers, addMember, updateMemberRole, removeMember };
 }
 
+// src/client/provisioning-methods.ts
+var USER_PROVISION_ENDPOINT = "/api/v1/ext/users/provision";
+var ORGANIZATION_PROVISION_ENDPOINT = "/api/v1/ext/organizations/provision";
+var MAX_PROVISION_MEMBERS = 100;
+var ASSIGNABLE_MEMBER_ROLES = {
+  admin: true,
+  member: true,
+  viewer: true
+};
+function isAssignableMemberRole(role) {
+  return Object.hasOwn(ASSIGNABLE_MEMBER_ROLES, role);
+}
+function createProvisioningMethods(deps) {
+  const { fetchWithAuth, createError, authMode } = deps;
+  function serviceKeyModeError() {
+    if (authMode === "service-key") return null;
+    return createError(
+      "VALIDATION_ERROR",
+      "provisionUser / provisionOrganization \u306F service-key \u8A8D\u8A3C\uFF08X-Service-Api-Key\uFF09\u3067\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002Bearer / cookie \u30E2\u30FC\u30C9\u3067\u306F\u547C\u3073\u51FA\u305B\u307E\u305B\u3093"
+    );
+  }
+  async function provisionUser(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.email || !params.email.trim()) {
+      return { error: createError("VALIDATION_ERROR", "email \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    const body = { email: params.email.trim() };
+    if (params.profile !== void 0) body.profile = params.profile;
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(USER_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  async function provisionOrganization(params) {
+    const modeError = serviceKeyModeError();
+    if (modeError) return { error: modeError };
+    if (!params.name || !params.name.trim()) {
+      return { error: createError("VALIDATION_ERROR", "name \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (!params.ownerEmail || !params.ownerEmail.trim()) {
+      return { error: createError("VALIDATION_ERROR", "ownerEmail \u306F\u5FC5\u9808\u3067\u3059") };
+    }
+    if (params.members) {
+      if (params.members.length > MAX_PROVISION_MEMBERS) {
+        return {
+          error: createError(
+            "VALIDATION_ERROR",
+            `members \u306F1\u30EA\u30AF\u30A8\u30B9\u30C8\u3042\u305F\u308A\u6700\u5927 ${MAX_PROVISION_MEMBERS} \u4EF6\u307E\u3067\u3067\u3059`
+          )
+        };
+      }
+      for (const member of params.members) {
+        if (!member.email || !member.email.trim()) {
+          return { error: createError("VALIDATION_ERROR", "members[].email \u306F\u5FC5\u9808\u3067\u3059") };
+        }
+        if (!isAssignableMemberRole(member.role)) {
+          return {
+            error: createError(
+              "VALIDATION_ERROR",
+              "members[].role \u306F admin\u3001member\u3001viewer \u306E\u3044\u305A\u308C\u304B\u3092\u6307\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044"
+            )
+          };
+        }
+      }
+    }
+    const body = {
+      name: params.name.trim(),
+      ownerEmail: params.ownerEmail.trim()
+    };
+    if (params.billingEmail !== void 0) body.billingEmail = params.billingEmail.trim();
+    if (params.members !== void 0) {
+      body.members = params.members.map((member) => ({
+        email: member.email.trim(),
+        role: member.role
+      }));
+    }
+    if (params.dryRun !== void 0) body.dryRun = params.dryRun;
+    return fetchWithAuth(ORGANIZATION_PROVISION_ENDPOINT, {
+      method: "POST",
+      body: JSON.stringify(body)
+    });
+  }
+  return { provisionUser, provisionOrganization };
+}
+
 // src/client/seat-methods.ts
 function seatsEndpoint(subscriptionId) {
   return `/api/v1/subscriptions/ext/${encodeURIComponent(subscriptionId)}/seats/assignments`;
@@ -1113,7 +1221,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.18.0";
+var SDK_VERSION = "5.21.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -1355,33 +1463,48 @@ function createOAuthTokenMethods(deps) {
   async function signOutToken() {
     const tokens = tokenStore.getTokens();
     tokenStore.clearTokens();
+    const allRevoked = {
+      revoked: true,
+      accessTokenRevoked: true,
+      refreshTokenRevoked: true
+    };
     if (!tokens) {
       logger.debug("No tokens to revoke");
-      return { data: void 0 };
+      return { data: allRevoked };
     }
-    const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
-    logger.debug("Revoking token:", url);
-    try {
-      const response = await fetch(url, {
-        method: "POST",
-        credentials: "omit",
-        headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
-        body: new URLSearchParams({
-          token: tokens.accessToken,
-          client_id: clientId
-        }).toString()
-      });
-      if (!response.ok) {
-        logger.warn(
-          "\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F:",
-          `status=${response.status}`
-        );
+    async function revokeOAuthToken(token, tokenTypeHint) {
+      const url = `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`;
+      try {
+        const response = await fetch(url, {
+          method: "POST",
+          credentials: "omit",
+          headers: { "Content-Type": "application/x-www-form-urlencoded", ...sdkHeaders() },
+          body: new URLSearchParams({
+            token,
+            client_id: clientId,
+            token_type_hint: tokenTypeHint
+          }).toString()
+        });
+        return response.ok;
+      } catch {
+        return false;
       }
-    } catch (error) {
-      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u306E\u30CD\u30C3\u30C8\u30EF\u30FC\u30AF\u30EA\u30AF\u30A8\u30B9\u30C8\u306B\u5931\u6557\u3057\u307E\u3057\u305F:", error);
+    }
+    logger.debug("Revoking tokens:", `${baseUrl}${OAUTH_REVOKE_ENDPOINT}`);
+    const accessTokenRevoked = await revokeOAuthToken(tokens.accessToken, "access_token");
+    if (!accessTokenRevoked) {
+      logger.warn("\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const refreshTokenRevoked = tokens.refreshToken ? await revokeOAuthToken(tokens.refreshToken, "refresh_token") : true;
+    if (tokens.refreshToken && !refreshTokenRevoked) {
+      logger.warn("\u30EA\u30D5\u30EC\u30C3\u30B7\u30E5\u30C8\u30FC\u30AF\u30F3\u306E\u7121\u52B9\u5316\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u30B5\u30FC\u30D0\u30FC\u3067\u5931\u6557\u3057\u307E\u3057\u305F");
+    }
+    const revoked = accessTokenRevoked && refreshTokenRevoked;
+    if (!revoked) {
+      logger.warn("\u30C8\u30FC\u30AF\u30F3\u7121\u52B9\u5316\u304C\u4E00\u90E8\u307E\u305F\u306F\u5168\u90E8\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u30ED\u30FC\u30AB\u30EB\u30C8\u30FC\u30AF\u30F3\u306F\u30AF\u30EA\u30A2\u6E08\u307F\uFF09");
     }
     logger.debug("Token sign-out completed");
-    return { data: void 0 };
+    return { data: { revoked, accessTokenRevoked, refreshTokenRevoked } };
   }
   return { exchangeCodeForTokens, refreshAccessToken, signOutToken };
 }
@@ -1545,7 +1668,7 @@ function createSessionMethods(deps) {
     }
     if (response.status === NO_CONTENT_STATUS) {
       logger.debug("Response: 204 No Content");
-      return { data: void 0 };
+      return { data: { revoked: true } };
     }
     if (!response.ok) {
       try {
@@ -1572,7 +1695,7 @@ function createSessionMethods(deps) {
       }
     }
     logger.debug("Response:", response.status);
-    return { data: void 0 };
+    return { data: { revoked: true } };
   }
   return { getSession, signOutCookie };
 }
@@ -1695,6 +1818,9 @@ var REDIRECT_LOOP_WINDOW_MS = 6e4;
 var REDIRECT_LOOP_THRESHOLD = 3;
 var storageReadFailureLogged = false;
 var storageWriteFailureLogged = false;
+function isLoopDetectionDegraded() {
+  return storageReadFailureLogged || storageWriteFailureLogged;
+}
 function logStorageReadFailure(logger, err) {
   if (storageReadFailureLogged) return;
   storageReadFailureLogged = true;
@@ -1839,9 +1965,16 @@ function createRedirectMethods(deps) {
     }
     const state = generateRandomState();
     if (!storeState(state, logger)) {
+      cleanupVerifierStorage(logger);
+      cleanupStateStorage(logger);
       logger.error(
-        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u30B3\u30FC\u30EB\u30D0\u30C3\u30AF\u3067\u306E CSRF \u691C\u8A3C\u304C\u5931\u6557\u3057\u307E\u3059"
+        "redirectToAuthorize: OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
       );
+      return {
+        success: false,
+        code: "state_persistence_failed",
+        error: "OAuth state \u3092\u4FDD\u5B58\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F\uFF08storage \u5229\u7528\u4E0D\u53EF\uFF09\u3002\u8A8D\u53EF\u30EA\u30C0\u30A4\u30EC\u30AF\u30C8\u3092\u4E2D\u6B62\u3057\u307E\u3057\u305F"
+      };
     }
     const redirectUri = resolvedRedirectUri ?? window.location.origin + window.location.pathname;
     const params = new URLSearchParams({
@@ -1876,7 +2009,7 @@ function createRedirectMethods(deps) {
       rollbackLastRedirectAttempt(authorizeKey, logger);
       throw err;
     }
-    return { success: true };
+    return isLoopDetectionDegraded() ? { success: true, loopDetectionDisabled: true } : { success: true };
   }
   async function redirectToLogin(options) {
     if (typeof window === "undefined") {
@@ -2954,6 +3087,11 @@ function createFFIDClient(config) {
     createError,
     serviceCode: config.serviceCode
   });
+  const { provisionUser, provisionOrganization } = createProvisioningMethods({
+    fetchWithAuth,
+    createError,
+    authMode
+  });
   const { getProfile, updateProfile } = createProfileMethods({
     fetchWithAuth,
     createError
@@ -3049,6 +3187,8 @@ function createFFIDClient(config) {
     addMember,
     updateMemberRole,
     removeMember,
+    provisionUser,
+    provisionOrganization,
     getProfile,
     updateProfile,
     // Non-contract ext API coverage (#3783)

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Cwk6cG3b.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BQPhm-XL.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-w8Twi5lD.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Bx8y4SwC.js';
 import '../../types-BeVl-z12.js';
 
 /**

package/dist/webhooks/index.cjs

@@ -89,7 +89,6 @@ function verifyWebhookSignature(rawBody, signatureHeader, secret, toleranceSecon
 }
 
 // src/webhooks/handler.ts
-var SDK_LOG_PREFIX = "[FFID Webhook SDK]";
 var HTTP_OK = 200;
 var HTTP_BAD_REQUEST = 400;
 var HTTP_INTERNAL_SERVER_ERROR = 500;
@@ -100,7 +99,8 @@ var noopLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 function createFFIDWebhookHandler(config) {
   if (!config.secret) {

package/dist/webhooks/index.js

@@ -87,7 +87,6 @@ function verifyWebhookSignature(rawBody, signatureHeader, secret, toleranceSecon
 }
 
 // src/webhooks/handler.ts
-var SDK_LOG_PREFIX = "[FFID Webhook SDK]";
 var HTTP_OK = 200;
 var HTTP_BAD_REQUEST = 400;
 var HTTP_INTERNAL_SERVER_ERROR = 500;
@@ -98,7 +97,8 @@ var noopLogger = {
   },
   warn: () => {
   },
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  error: () => {
+  }
 };
 function createFFIDWebhookHandler(config) {
   if (!config.secret) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.18.0",
+  "version": "5.21.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",