@flowselections/core 1.0.12 → 1.0.13

package/dist/server/index.d.ts

@@ -0,0 +1,3 @@
+export { getProviderToken } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, } from "./provider-token.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,2 @@
+export { getProviderToken } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, } from "./provider-token.js";

package/dist/server/provider-token.d.ts

@@ -0,0 +1,19 @@
+export declare class CentralAuthConfigError extends Error {
+    constructor(message: string);
+}
+export declare class ProviderNotConnectedError extends Error {
+    constructor(message: string);
+}
+export declare class ProviderUpstreamError extends Error {
+    constructor(message: string);
+}
+export declare class CentralAuthUnavailableError extends Error {
+    constructor(message: string);
+}
+export declare function getProviderToken(provider: string, opts?: {
+    environment?: "staging" | "live";
+}): Promise<{
+    accessToken: string;
+    expiresAt: Date;
+}>;
+//# sourceMappingURL=provider-token.d.ts.map

package/dist/server/provider-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAwGD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAuBnD"}

package/dist/server/provider-token.js

@@ -0,0 +1,117 @@
+export class CentralAuthConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CentralAuthConfigError";
+    }
+}
+export class ProviderNotConnectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProviderNotConnectedError";
+    }
+}
+export class ProviderUpstreamError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProviderUpstreamError";
+    }
+}
+export class CentralAuthUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CentralAuthUnavailableError";
+    }
+}
+const TIMEOUT_MS = 10000;
+const EXPIRY_BUFFER_MS = 60000;
+const cache = new Map();
+function isFresh(token) {
+    return token.expiresAt.getTime() - EXPIRY_BUFFER_MS > Date.now();
+}
+function logAuthFailure(provider, environment, status) {
+    console.error("[central-auth] provider token request failed", { provider, environment, status });
+}
+async function fetchProviderToken(provider, environment) {
+    const baseUrl = process.env.CENTRAL_AUTH_URL;
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!baseUrl || !secret) {
+        throw new CentralAuthConfigError("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/token/${encodeURIComponent(provider)}`;
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${secret}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ environment }),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
+        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (response.ok) {
+        let body;
+        try {
+            body = (await response.json());
+        }
+        catch {
+            logAuthFailure(provider, environment, response.status);
+            throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
+        }
+        return {
+            accessToken: body.access_token,
+            expiresAt: new Date(body.expires_at),
+        };
+    }
+    logAuthFailure(provider, environment, response.status);
+    switch (response.status) {
+        case 401:
+            throw new CentralAuthConfigError(`Central auth rejected credentials (provider=${provider}, environment=${environment}, status=401).`);
+        case 409:
+            throw new ProviderNotConnectedError(`Provider not connected (provider=${provider}, environment=${environment}, status=409).`);
+        case 400:
+            throw new CentralAuthConfigError(`Invalid request to central auth (provider=${provider}, environment=${environment}, status=400).`);
+        case 502:
+            throw new ProviderUpstreamError(`Upstream error from central auth (provider=${provider}, environment=${environment}, status=502).`);
+        default:
+            throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+}
+export async function getProviderToken(provider, opts) {
+    const environment = opts?.environment ?? "live";
+    const key = `${provider}:${environment}`;
+    const cached = cache.get(key);
+    if (cached) {
+        const token = await cached;
+        if (isFresh(token))
+            return token;
+        // Only the caller that observes the still-current stale entry evicts it —
+        // a concurrent caller may have already replaced it with a fresh in-flight fetch.
+        if (cache.get(key) === cached)
+            cache.delete(key);
+        return getProviderToken(provider, opts);
+    }
+    // No `await` above this line: a synchronous burst of callers must all see
+    // this Map entry before any of them proceeds to fetch, so they share one fetch.
+    const promise = fetchProviderToken(provider, environment);
+    cache.set(key, promise);
+    promise.catch(() => {
+        if (cache.get(key) === promise)
+            cache.delete(key);
+    });
+    return promise;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -10,6 +10,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
     }
   },
   "files": ["dist"],