@flowselections/core 1.0.14 → 1.0.16

package/dist/server/index.d.ts

@@ -1,3 +1,4 @@
-export { getProviderToken } from "./provider-token.js";
+export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
+export type { ProviderAccount } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpG,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,qBAAqB,CAAC"}

package/dist/server/index.js

@@ -1,2 +1,2 @@
-export { getProviderToken } from "./provider-token.js";
+export { getProviderToken, listProviderAccounts, revokeProviderAccount } from "./provider-token.js";
 export { CentralAuthConfigError, ProviderNotConnectedError, ProviderUpstreamError, CentralAuthUnavailableError, AmbiguousAccountError, } from "./provider-token.js";

package/dist/server/provider-token.d.ts

@@ -13,6 +13,13 @@ export declare class CentralAuthUnavailableError extends Error {
 export declare class AmbiguousAccountError extends Error {
     constructor(message: string);
 }
+export interface ProviderAccount {
+    accountKey: string;
+    environment: "staging" | "live";
+    status: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
 export declare function getProviderToken(provider: string, opts?: {
     environment?: "staging" | "live";
     accountKey?: string;
@@ -20,4 +27,10 @@ export declare function getProviderToken(provider: string, opts?: {
     accessToken: string;
     expiresAt: Date;
 }>;
+export declare function listProviderAccounts(provider: string, opts?: {
+    environment?: "staging" | "live";
+}): Promise<ProviderAccount[]>;
+export declare function revokeProviderAccount(provider: string, accountKey: string, opts?: {
+    environment?: "staging" | "live";
+}): Promise<void>;
 //# sourceMappingURL=provider-token.d.ts.map

package/dist/server/provider-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAkID,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA4BnD"}
+{"version":3,"file":"provider-token.d.ts","sourceRoot":"","sources":["../../src/core/server/provider-token.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAOD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AA4LD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA6BnD;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,eAAe,EAAE,CAAC,CA4C5B;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,IAAI,CAAC,CA8Bf"}

package/dist/server/provider-token.js

@@ -30,6 +30,10 @@ export class AmbiguousAccountError extends Error {
 }
 const TIMEOUT_MS = 10000;
 const EXPIRY_BUFFER_MS = 60000;
+// Module-private by design: getProviderToken and revokeProviderAccount share
+// this Map (revoke invalidates entries it never wrote itself), so it must
+// never be exposed or passed around — the two functions' coupling through it
+// is intentional, but only within this file.
 const cache = new Map();
 function isFresh(token) {
     return token.expiresAt.getTime() - EXPIRY_BUFFER_MS > Date.now();
@@ -37,55 +41,24 @@ function isFresh(token) {
 function logAuthFailure(provider, environment, status) {
     console.error("[central-auth] provider token request failed", { provider, environment, status });
 }
-async function fetchProviderToken(provider, environment, accountKey) {
+function getCentralAuthConfig() {
     const baseUrl = process.env.CENTRAL_AUTH_URL;
     const secret = process.env.CENTRAL_AUTH_SECRET;
     if (!baseUrl || !secret) {
         throw new CentralAuthConfigError("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
     }
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/token/${encodeURIComponent(provider)}`;
-    const requestBody = { environment };
-    if (accountKey !== undefined)
-        requestBody.account_key = accountKey;
-    const controller = new AbortController();
-    let timedOut = false;
-    const timeout = setTimeout(() => {
-        timedOut = true;
-        controller.abort();
-    }, TIMEOUT_MS);
-    let response;
-    try {
-        response = await fetch(url, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${secret}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify(requestBody),
-            signal: controller.signal,
-        });
-    }
-    catch {
-        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
-        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-    if (response.ok) {
-        let body;
-        try {
-            body = (await response.json());
-        }
-        catch {
-            logAuthFailure(provider, environment, response.status);
-            throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
-        }
-        return {
-            accessToken: body.access_token,
-            expiresAt: new Date(body.expires_at),
-        };
-    }
+    return { baseUrl, secret };
+}
+// segment is always one of the three literals above, never caller input —
+// the URL path must never be built from anything a caller supplies.
+function buildCentralUrl(baseUrl, segment, provider, query) {
+    const base = `${baseUrl.replace(/\/+$/, "")}/api/${segment}/${encodeURIComponent(provider)}`;
+    if (!query)
+        return base;
+    const qs = new URLSearchParams(query).toString();
+    return qs ? `${base}?${qs}` : base;
+}
+async function mapCentralError(response, provider, environment, allowAmbiguousAccount) {
     let errorCode;
     try {
         const text = await response.text();
@@ -98,6 +71,14 @@ async function fetchProviderToken(provider, environment, accountKey) {
     }
     logAuthFailure(provider, environment, response.status);
     if (response.status === 400 && errorCode === "ambiguous_account") {
+        if (!allowAmbiguousAccount) {
+            // Only /api/token/ can legitimately return ambiguous_account. Any other
+            // endpoint returning it is an unexpected/malformed response from
+            // central, not a real ambiguity the caller can resolve — surfacing it
+            // as AmbiguousAccountError here would hand the caller a message about
+            // "multiple accounts" for an endpoint that never asked to disambiguate.
+            throw new CentralAuthUnavailableError(`Central auth returned an unexpected ambiguous_account error (provider=${provider}, environment=${environment}, status=400).`);
+        }
         throw new AmbiguousAccountError(`Central auth reports multiple connected accounts for provider "${provider}"; accountKey is required to disambiguate (provider=${provider}, environment=${environment}).`);
     }
     if (response.status === 401 || errorCode === "unauthorized") {
@@ -116,9 +97,62 @@ async function fetchProviderToken(provider, environment, accountKey) {
     }
     throw new CentralAuthUnavailableError(`Central auth unavailable (provider=${provider}, environment=${environment}, status=${response.status}).`);
 }
+async function requestCentral(segment, provider, environment, init, allowAmbiguousAccount) {
+    const { baseUrl, secret } = getCentralAuthConfig();
+    const url = buildCentralUrl(baseUrl, segment, provider, init.query);
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: init.method,
+            headers: {
+                Authorization: `Bearer ${secret}`,
+                ...(init.body !== undefined ? { "Content-Type": "application/json" } : {}),
+            },
+            ...(init.body !== undefined ? { body: JSON.stringify(init.body) } : {}),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        logAuthFailure(provider, environment, timedOut ? "timeout" : "network");
+        throw new CentralAuthUnavailableError(`Central auth request failed (provider=${provider}, environment=${environment}, reason=${timedOut ? "timeout" : "network"}).`);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!response.ok) {
+        await mapCentralError(response, provider, environment, allowAmbiguousAccount);
+    }
+    return response;
+}
+async function fetchProviderToken(provider, environment, accountKey) {
+    const requestBody = { environment };
+    if (accountKey !== undefined)
+        requestBody.account_key = accountKey;
+    const response = await requestCentral("token", provider, environment, { method: "POST", body: requestBody }, 
+    /* allowAmbiguousAccount */ true);
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        logAuthFailure(provider, environment, response.status);
+        throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${environment}, status=${response.status}).`);
+    }
+    return {
+        accessToken: body.access_token,
+        expiresAt: new Date(body.expires_at),
+    };
+}
 export async function getProviderToken(provider, opts) {
     const environment = opts?.environment ?? "live";
-    const accountKey = opts?.accountKey;
+    // Moet central's normalisatie in oauth-authcode.server.ts spiegelen (trim + toLowerCase).
+    const accountKey = opts?.accountKey?.trim().toLowerCase();
     // accountKey is part of the key so two mailboxes on the same provider never
     // share a cached token — omitting it would leak mailbox A's token to caller B.
     const key = `${provider}:${environment}:${accountKey ?? ""}`;
@@ -145,3 +179,55 @@ export async function getProviderToken(provider, opts) {
     });
     return promise;
 }
+export async function listProviderAccounts(provider, opts) {
+    // Filter: only sent to central when the caller explicitly asked for one
+    // environment. Omitting it must return accounts across all environments —
+    // defaulting it here would silently narrow every unfiltered call to "live".
+    const environmentFilter = opts?.environment;
+    // Context for error messages/logging only, never the query filter above.
+    // Defaults to "live" purely so log lines read "environment=live" instead of
+    // "environment=" when no filter was requested.
+    const logEnvironment = environmentFilter ?? "live";
+    const response = await requestCentral("accounts", provider, logEnvironment, { method: "GET", query: environmentFilter ? { environment: environmentFilter } : undefined }, 
+    /* allowAmbiguousAccount */ false);
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        logAuthFailure(provider, logEnvironment, response.status);
+        throw new CentralAuthUnavailableError(`Central auth returned an unparseable response (provider=${provider}, environment=${logEnvironment}, status=${response.status}).`);
+    }
+    // "revoked" rows are intentionally kept — the caller decides what to do with them.
+    return body.accounts.map((account) => ({
+        accountKey: account.account_key,
+        environment: account.environment,
+        status: account.status,
+        createdAt: new Date(account.created_at),
+        updatedAt: new Date(account.updated_at),
+    }));
+}
+export async function revokeProviderAccount(provider, accountKey, opts) {
+    const environment = opts?.environment ?? "live";
+    // Same normalisation as getProviderToken — a caller revoking "INFO@X.nl"
+    // must invalidate the exact cache entries getProviderToken would have used.
+    const normalizedAccountKey = accountKey.trim().toLowerCase();
+    if (!normalizedAccountKey) {
+        throw new CentralAuthConfigError("revokeProviderAccount requires a non-empty accountKey.");
+    }
+    await requestCentral("revoke", provider, environment, { method: "POST", body: { account_key: normalizedAccountKey, environment } }, 
+    /* allowAmbiguousAccount */ false);
+    // Cache-invalidatie na een geslaagde revoke: verwijder ALLE entries met
+    // prefix `${provider}:${environment}:`, niet alleen die van dit accountKey.
+    // Reden: de entry zonder accountKey (`${provider}:${environment}:`)
+    // resolveert naar "de enige actieve mailbox" — revoke je die mailbox, dan
+    // blijft een geldig token voor een ingetrokken account tot een uur in de
+    // cache staan. Revoke verandert bovendien de ambiguity-resolutie voor
+    // toekomstige aanroepen zonder accountKey. Alleen uitvoeren als de
+    // revoke-call zelf slaagde (requestCentral gooit hierboven bij een fout).
+    const prefix = `${provider}:${environment}:`;
+    for (const key of cache.keys()) {
+        if (key.startsWith(prefix))
+            cache.delete(key);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/core",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "private": false,
   "sideEffects": false,
   "type": "module",