@flowselections/core 1.0.13 → 1.0.14

package/dist/server/index.d.ts

@@ -1,3 +1,3 @@
 export { getProviderToken } from "./provider-token.js";
-export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -1,2 +1,2 @@
 export { getProviderToken } from "./provider-token.js";
-export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, } from "./provider-token.js";
+export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";

package/dist/server/provider-token.d.ts

@@ -10,8 +10,12 @@ export declare class ProviderUpstreamError extends Error {
 export declare class CentralAuthUnavailableError extends Error {
     constructor(message: string);
 }
+export declare class AmbiguousAccountError extends Error {
+    constructor(message: string);
+}
 export declare function getProviderToken(provider: string, opts?: {
     environment?: "staging" | "live";
+    accountKey?: string;
 }): Promise<{
     accessToken: string;
     expiresAt: Date;

package/dist/server/provider-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAwGD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAuBnD"}
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAkID,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA4BnD"}

package/dist/server/provider-token.js

@@ -22,6 +22,12 @@ export class CentralAuthUnavailableError extends Error {
         this.name = "CentralAuthUnavailableError";
     }
 }
+export class AmbiguousAccountError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AmbiguousAccountError";
+    }
+}
 const TIMEOUT_MS = 10000;
 const EXPIRY_BUFFER_MS = 60000;
 const cache = new Map();
@@ -31,13 +37,16 @@ function isFresh(token) {
 function logAuthFailure(provider, environment, status) {
     console.error("[central-auth] provider token request failed", { provider, environment, status });
 }
-async function fetchProviderToken(provider, environment) {
+async function fetchProviderToken(provider, environment, accountKey) {
     const baseUrl = process.env.CENTRAL_AUTH_URL;
     const secret = process.env.CENTRAL_AUTH_SECRET;
     if (!baseUrl || !secret) {
         throw new CentralAuthConfigError("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
     }
     const url = `${baseUrl.replace(/\/+$/, "")}/api/token/${encodeURIComponent(provider)}`;
+    const requestBody = { environment };
+    if (accountKey !== undefined)
+        requestBody.account_key = accountKey;
     const controller = new AbortController();
     let timedOut = false;
     const timeout = setTimeout(() => {
@@ -52,7 +61,7 @@ async function fetchProviderToken(provider, environment) {
                 Authorization: `Bearer ${secret}`,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ environment }),
+            body: JSON.stringify(requestBody),
             signal: controller.signal,
         });
     }
@@ -77,23 +86,42 @@ async function fetchProviderToken(provider, environment) {
             expiresAt: new Date(body.expires_at),
         };
     }
+    let errorCode;
+    try {
+        const text = await response.text();
+        const parsed = JSON.parse(text);
+        if (typeof parsed?.error === "string")
+            errorCode = parsed.error;
+    }
+    catch {
+        // body not readable or not valid JSON — fall back to status-only mapping below
+    }
     logAuthFailure(provider, environment, response.status);
-    switch (response.status) {
-        case 401:
-            throw new CentralAuthConfigError(`Central auth rejected credentials (provider=${provider}, environment=${environment}, status=401).`);
-        case 409:
-            throw new ProviderNotConnectedError(`Provider not connected (provider=${provider}, environment=${environment}, status=409).`);
-        case 400:
-            throw new CentralAuthConfigError(`Invalid request to central auth (provider=${provider}, environment=${environment}, status=400).`);
-        case 502:
-            throw new ProviderUpstreamError(`Upstream error from central auth (provider=${provider}, environment=${environment}, status=502).`);
-        default:
-            throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    if (response.status === 400 && errorCode === "ambiguous_account") {
+        throw new AmbiguousAccountError(`Central auth reports multiple connected accounts for provider "${provider}"; accountKey is required to disambiguate (provider=${provider}, environment=${environment}).`);
+    }
+    if (response.status === 401 || errorCode === "unauthorized") {
+        throw new CentralAuthConfigError(`Central auth rejected credentials (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    if (response.status === 409 || errorCode === "not_connected") {
+        throw new ProviderNotConnectedError(`Provider not connected (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    if (response.status === 400) {
+        // errorCode is "invalid_request", missing, or unrecognized — same
+        // build-time-error classification the status-only mapping already used.
+        throw new CentralAuthConfigError(`Invalid request to central auth (provider=${provider}, environment=${environment}, status=400).`);
+    }
+    if (response.status === 502 || errorCode === "upstream_error") {
+        throw new ProviderUpstreamError(`Upstream error from central auth (provider=${provider}, environment=${environment}, status=${response.status}).`);
     }
+    throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
 }
 export async function getProviderToken(provider, opts) {
     const environment = opts?.environment ?? "live";
-    const key = `${provider}:${environment}`;
+    const accountKey = opts?.accountKey;
+    // accountKey is part of the key so two mailboxes on the same provider never
+    // share a cached token — omitting it would leak mailbox A's token to caller B.
+    const key = `${provider}:${environment}:${accountKey ?? ""}`;
     const cached = cache.get(key);
     if (cached) {
         const token = await cached;
@@ -107,8 +135,10 @@ export async function getProviderToken(provider, opts) {
     }
     // No `await` above this line: a synchronous burst of callers must all see
     // this Map entry before any of them proceeds to fetch, so they share one fetch.
-    const promise = fetchProviderToken(provider, environment);
+    const promise = fetchProviderToken(provider, environment, accountKey);
     cache.set(key, promise);
+    // Generic, error-type-agnostic: this also evicts an AmbiguousAccountError
+    // rejection — an ambiguous-account failure must never be served from cache.
     promise.catch(() => {
         if (cache.get(key) === promise)
             cache.delete(key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "private": false,
   "sideEffects": false,
   "type": "module",