@flowselections/core 1.0.12 → 1.0.14

package/dist/server/index.d.ts

@@ -0,0 +1,3 @@
+export { getProviderToken } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,2 @@
+export { getProviderToken } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";

package/dist/server/provider-token.d.ts

@@ -0,0 +1,23 @@
+export declare class CentralAuthConfigError extends Error {
+    constructor(message: string);
+}
+export declare class ProviderNotConnectedError extends Error {
+    constructor(message: string);
+}
+export declare class ProviderUpstreamError extends Error {
+    constructor(message: string);
+}
+export declare class CentralAuthUnavailableError extends Error {
+    constructor(message: string);
+}
+export declare class AmbiguousAccountError extends Error {
+    constructor(message: string);
+}
+export declare function getProviderToken(provider: string, opts?: {
+    environment?: "staging" | "live";
+    accountKey?: string;
+}): Promise<{
+    accessToken: string;
+    expiresAt: Date;
+}>;
+//# sourceMappingURL=provider-token.d.ts.map

package/dist/server/provider-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAkID,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA4BnD"}

package/dist/server/provider-token.js

@@ -0,0 +1,147 @@
+export class CentralAuthConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CentralAuthConfigError";
+    }
+}
+export class ProviderNotConnectedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProviderNotConnectedError";
+    }
+}
+export class ProviderUpstreamError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProviderUpstreamError";
+    }
+}
+export class CentralAuthUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CentralAuthUnavailableError";
+    }
+}
+export class AmbiguousAccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AmbiguousAccountError";
+    }
+}
+const TIMEOUT_MS = 10000;
+const EXPIRY_BUFFER_MS = 60000;
+const cache = new Map();
+function isFresh(token) {
+    return token.expiresAt.getTime() - EXPIRY_BUFFER_MS > Date.now();
+}
+function logAuthFailure(provider, environment, status) {
+    console.error("[central-auth] provider token request failed", { provider, environment, status });
+}
+async function fetchProviderToken(provider, environment, accountKey) {
+    const baseUrl = process.env.CENTRAL_AUTH_URL;
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!baseUrl || !secret) {
+        throw new CentralAuthConfigError("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/token/${encodeURIComponent(provider)}`;
+    const requestBody = { environment };
+    if (accountKey !== undefined)
+        requestBody.account_key = accountKey;
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${secret}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(requestBody),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
+        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (response.ok) {
+        let body;
+        try {
+            body = (await response.json());
+        }
+        catch {
+            logAuthFailure(provider, environment, response.status);
+            throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
+        }
+        return {
+            accessToken: body.access_token,
+            expiresAt: new Date(body.expires_at),
+        };
+    }
+    let errorCode;
+    try {
+        const text = await response.text();
+        const parsed = JSON.parse(text);
+        if (typeof parsed?.error === "string")
+            errorCode = parsed.error;
+    }
+    catch {
+        // body not readable or not valid JSON — fall back to status-only mapping below
+    }
+    logAuthFailure(provider, environment, response.status);
+    if (response.status === 400 && errorCode === "ambiguous_account") {
+        throw new AmbiguousAccountError(`Central auth reports multiple connected accounts for provider "${provider}"; accountKey is required to disambiguate (provider=${provider}, environment=${environment}).`);
+    }
+    if (response.status === 401 || errorCode === "unauthorized") {
+        throw new CentralAuthConfigError(`Central auth rejected credentials (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    if (response.status === 409 || errorCode === "not_connected") {
+        throw new ProviderNotConnectedError(`Provider not connected (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    if (response.status === 400) {
+        // errorCode is "invalid_request", missing, or unrecognized — same
+        // build-time-error classification the status-only mapping already used.
+        throw new CentralAuthConfigError(`Invalid request to central auth (provider=${provider}, environment=${environment}, status=400).`);
+    }
+    if (response.status === 502 || errorCode === "upstream_error") {
+        throw new ProviderUpstreamError(`Upstream error from central auth (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
+}
+export async function getProviderToken(provider, opts) {
+    const environment = opts?.environment ?? "live";
+    const accountKey = opts?.accountKey;
+    // accountKey is part of the key so two mailboxes on the same provider never
+    // share a cached token — omitting it would leak mailbox A's token to caller B.
+    const key = `${provider}:${environment}:${accountKey ?? ""}`;
+    const cached = cache.get(key);
+    if (cached) {
+        const token = await cached;
+        if (isFresh(token))
+            return token;
+        // Only the caller that observes the still-current stale entry evicts it —
+        // a concurrent caller may have already replaced it with a fresh in-flight fetch.
+        if (cache.get(key) === cached)
+            cache.delete(key);
+        return getProviderToken(provider, opts);
+    }
+    // No `await` above this line: a synchronous burst of callers must all see
+    // this Map entry before any of them proceeds to fetch, so they share one fetch.
+    const promise = fetchProviderToken(provider, environment, accountKey);
+    cache.set(key, promise);
+    // Generic, error-type-agnostic: this also evicts an AmbiguousAccountError
+    // rejection — an ambiguous-account failure must never be served from cache.
+    promise.catch(() => {
+        if (cache.get(key) === promise)
+            cache.delete(key);
+    });
+    return promise;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "private": false,
   "sideEffects": false,
   "type": "module",
@@ -10,6 +10,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
     }
   },
   "files": ["dist"],