@forestadmin/agent-bff 1.0.0 → 1.1.0

package/dist/cli-core.js

@@ -5,14 +5,63 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = runCli;
 exports.reportFatalError = reportFatalError;
+const bodyparser_1 = require("@koa/bodyparser");
 const console_logger_1 = __importDefault(require("./adapters/console-logger"));
 const env_config_1 = require("./config/env-config");
 const errors_1 = require("./errors");
 const bff_http_server_1 = __importDefault(require("./http/bff-http-server"));
+const forest_server_client_1 = __importDefault(require("./oauth/forest-server-client"));
+const oauth_routes_1 = __importDefault(require("./oauth/oauth-routes"));
+const session_store_1 = __importDefault(require("./oauth/session-store"));
+const token_cipher_1 = __importDefault(require("./oauth/token-cipher"));
 const version_1 = __importDefault(require("./version"));
+const BODY_LIMIT = '16kb';
+const SESSION_TTL_SECONDS = 24 * 60 * 60;
+function resolveOAuthConfig(config) {
+    const { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey } = config;
+    if (forestServerUrl &&
+        forestEnvSecret &&
+        forestAppUrl &&
+        forestAuthSecret &&
+        tokenEncryptionKey) {
+        return { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey };
+    }
+    return undefined;
+}
+async function buildOAuthMiddlewares(config, logger) {
+    const oauthConfig = resolveOAuthConfig(config);
+    if (!oauthConfig) {
+        logger('Warn', 'OAuth routes disabled: required configuration is missing');
+        return [];
+    }
+    const { forestServerUrl, forestEnvSecret, forestAppUrl, forestAuthSecret, tokenEncryptionKey } = oauthConfig;
+    const serverClient = new forest_server_client_1.default({ forestServerUrl, envSecret: forestEnvSecret });
+    const environmentId = await serverClient.fetchEnvironmentId();
+    const sessionStore = (0, session_store_1.default)({
+        cipher: (0, token_cipher_1.default)(tokenEncryptionKey),
+        now: () => Date.now(),
+        sessionTtlSeconds: SESSION_TTL_SECONDS,
+    });
+    const oauthRoutes = (0, oauth_routes_1.default)({
+        serverClient,
+        sessionStore,
+        forestAppUrl,
+        authSecret: forestAuthSecret,
+        environmentId,
+        logger,
+    });
+    return [(0, bodyparser_1.bodyParser)({ jsonLimit: BODY_LIMIT }), oauthRoutes];
+}
 async function runCli(env, logger = (0, console_logger_1.default)()) {
     const config = (0, env_config_1.parseConfig)(env);
-    const server = new bff_http_server_1.default({ port: config.httpPort, version: version_1.default, config, logger });
+    const middlewares = await buildOAuthMiddlewares(config, logger);
+    const server = new bff_http_server_1.default({
+        port: config.httpPort,
+        version: version_1.default,
+        config,
+        logger,
+        middlewares,
+    });
     await server.start();
     return server;
 }
@@ -20,4 +69,4 @@ function reportFatalError(err) {
     process.stderr.write(`Error: ${(0, errors_1.extractErrorMessage)(err)}\n`);
     process.exitCode = 1;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLWNvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2xpLWNvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFRQSx5QkFVQztBQUVELDRDQUdDO0FBckJELCtFQUE0RDtBQUM1RCxvREFBa0Q7QUFDbEQscUNBQStDO0FBQy9DLDZFQUFtRDtBQUNuRCx3REFBZ0M7QUFFakIsS0FBSyxVQUFVLE1BQU0sQ0FDbEMsR0FBc0IsRUFDdEIsU0FBaUIsSUFBQSx3QkFBbUIsR0FBRTtJQUV0QyxNQUFNLE1BQU0sR0FBRyxJQUFBLHdCQUFXLEVBQUMsR0FBRyxDQUFDLENBQUM7SUFDaEMsTUFBTSxNQUFNLEdBQUcsSUFBSSx5QkFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFQLGlCQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFFckYsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFFckIsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLEdBQVk7SUFDM0MsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3RCxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztBQUN2QixDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLWNvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2xpLWNvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUE2RUEseUJBaUJDO0FBRUQsNENBR0M7QUEvRkQsZ0RBQTZDO0FBRTdDLCtFQUE0RDtBQUM1RCxvREFBa0Q7QUFDbEQscUNBQStDO0FBQy9DLDZFQUFtRDtBQUNuRCx3RkFBOEQ7QUFDOUQsd0VBQXFEO0FBQ3JELDBFQUErRDtBQUMvRCx3RUFBcUQ7QUFDckQsd0RBQWdDO0FBRWhDLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQztBQUMxQixNQUFNLG1CQUFtQixHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDO0FBVXpDLFNBQVMsa0JBQWtCLENBQUMsTUFBaUI7SUFDM0MsTUFBTSxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLEdBQzVGLE1BQU0sQ0FBQztJQUVULElBQ0UsZUFBZTtRQUNmLGVBQWU7UUFDZixZQUFZO1FBQ1osZ0JBQWdCO1FBQ2hCLGtCQUFrQixFQUNsQixDQUFDO1FBQ0QsT0FBTyxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDbEcsQ0FBQztJQUVELE9BQU8sU0FBUyxDQUFDO0FBQ25CLENBQUM7QUFFRCxLQUFLLFVBQVUscUJBQXFCLENBQUMsTUFBaUIsRUFBRSxNQUFjO0lBQ3BFLE1BQU0sV0FBVyxHQUFHLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRS9DLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNqQixNQUFNLENBQUMsTUFBTSxFQUFFLDBEQUEwRCxDQUFDLENBQUM7UUFFM0UsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBRUQsTUFBTSxFQUFFLGVBQWUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLEdBQzVGLFdBQVcsQ0FBQztJQUVkLE1BQU0sWUFBWSxHQUFHLElBQUksOEJBQWtCLENBQUMsRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxDQUFDLENBQUM7SUFDN0YsTUFBTSxhQUFhLEdBQUcsTUFBTSxZQUFZLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztJQUU5RCxNQUFNLFlBQVksR0FBRyxJQUFBLHVCQUEwQixFQUFDO1FBQzlDLE1BQU0sRUFBRSxJQUFBLHNCQUFpQixFQUFDLGtCQUFrQixDQUFDO1FBQzdDLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO1FBQ3JCLGlCQUFpQixFQUFFLG1CQUFtQjtLQUN2QyxDQUFDLENBQUM7SUFFSCxNQUFNLFdBQVcsR0FBRyxJQUFBLHNCQUFpQixFQUFDO1FBQ3BDLFlBQVk7UUFDWixZQUFZO1FBQ1osWUFBWTtRQUNaLFVBQVUsRUFBRSxnQkFBZ0I7UUFDNUIsYUFBYTtRQUNiLE1BQU07S0FDUCxDQUFDLENBQUM7SUFFSCxPQUFPLENBQUMsSUFBQSx1QkFBVSxFQUFDLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFDOUQsQ0FBQztBQUVjLEtBQUssVUFBVSxNQUFNLENBQ2xDLEdBQXNCLEVBQ3RCLFNBQWlCLElBQUEsd0JBQW1CLEdBQUU7SUFFdEMsTUFBTSxNQUFNLEdBQUcsSUFBQSx3QkFBVyxFQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2hDLE1BQU0sV0FBVyxHQUFHLE1BQU0scUJBQXFCLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLElBQUkseUJBQWEsQ0FBQztRQUMvQixJQUFJLEVBQUUsTUFBTSxDQUFDLFFBQVE7UUFDckIsT0FBTyxFQUFQLGlCQUFPO1FBQ1AsTUFBTTtRQUNOLE1BQU07UUFDTixXQUFXO0tBQ1osQ0FBQyxDQUFDO0lBRUgsTUFBTSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFFckIsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLEdBQVk7SUFDM0MsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxJQUFBLDRCQUFtQixFQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM3RCxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztBQUN2QixDQUFDIn0=

package/dist/config/env-config.d.ts

@@ -7,6 +7,7 @@ export interface BFFConfig {
     forestServerUrl?: string;
     forestAppUrl?: string;
     agentUrl?: string;
+    tokenEncryptionKey?: string;
     httpPort: number;
     presence: PresenceMap;
     hasAllRequired: boolean;

package/dist/config/env-config.js

@@ -18,6 +18,8 @@ exports.REQUIRED_KEYS = [
 const URL_KEYS = ['FOREST_SERVER_URL', 'FOREST_APP_URL', 'AGENT_URL'];
 const DECIMAL_INTEGER = /^\d+$/;
 const MAX_PORT = 65535;
+const ENCRYPTION_KEY_BYTES = 32;
+const BASE64_PATTERN = /^[A-Za-z0-9+/]+={0,2}$/;
 const HTTP_URL_SCHEMA = zod_1.z.url({ protocol: /^https?$/ });
 function normalize(value) {
     return value === undefined || value.trim() === '' ? undefined : value;
@@ -35,6 +37,16 @@ function parsePort(raw) {
 function isHttpUrl(value) {
     return !/\s/.test(value) && HTTP_URL_SCHEMA.safeParse(value).success;
 }
+function isValidEncryptionKey(value) {
+    return BASE64_PATTERN.test(value) && Buffer.from(value, 'base64').length === ENCRYPTION_KEY_BYTES;
+}
+function parseEncryptionKey(raw) {
+    const value = normalize(raw);
+    if (value !== undefined && !isValidEncryptionKey(value)) {
+        throw new errors_1.ConfigurationError(`Invalid configuration: BFF_TOKEN_ENCRYPTION_KEY must be base64-encoded and exactly ${ENCRYPTION_KEY_BYTES} bytes (AES-256).`);
+    }
+    return value;
+}
 function parseConfig(env) {
     const normalized = Object.fromEntries(exports.REQUIRED_KEYS.map(key => [key, normalize(env[key])]));
     for (const key of URL_KEYS) {
@@ -44,15 +56,17 @@ function parseConfig(env) {
         }
     }
     const presence = Object.fromEntries(exports.REQUIRED_KEYS.map(key => [key, normalized[key] !== undefined]));
+    const tokenEncryptionKey = parseEncryptionKey(env.BFF_TOKEN_ENCRYPTION_KEY);
     return {
         forestAuthSecret: normalized.FOREST_AUTH_SECRET,
         forestEnvSecret: normalized.FOREST_ENV_SECRET,
         forestServerUrl: normalized.FOREST_SERVER_URL,
         forestAppUrl: normalized.FOREST_APP_URL,
         agentUrl: normalized.AGENT_URL,
+        tokenEncryptionKey,
         httpPort: parsePort(env.HTTP_PORT),
         presence,
-        hasAllRequired: exports.REQUIRED_KEYS.every(key => presence[key]),
+        hasAllRequired: exports.REQUIRED_KEYS.every(key => presence[key]) && tokenEncryptionKey !== undefined,
     };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25maWcvZW52LWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUF5REEsa0NBMkJDO0FBcEZELDZCQUF3QjtBQUV4QiwyREFBMkM7QUFDM0Msc0NBQStDO0FBRWxDLFFBQUEsYUFBYSxHQUFHO0lBQzNCLG9CQUFvQjtJQUNwQixtQkFBbUI7SUFDbkIsbUJBQW1CO0lBQ25CLGdCQUFnQjtJQUNoQixXQUFXO0NBQ0gsQ0FBQztBQUlYLE1BQU0sUUFBUSxHQUFHLENBQUMsbUJBQW1CLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFVLENBQUM7QUFlL0UsTUFBTSxlQUFlLEdBQUcsT0FBTyxDQUFDO0FBQ2hDLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQztBQUN2QixNQUFNLGVBQWUsR0FBRyxPQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7QUFFeEQsU0FBUyxTQUFTLENBQUMsS0FBeUI7SUFDMUMsT0FBTyxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO0FBQ3hFLENBQUM7QUFFRCxTQUFTLFNBQVMsQ0FBQyxHQUF1QjtJQUN4QyxNQUFNLE9BQU8sR0FBRyxHQUFHLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxFQUFFO1FBQUUsT0FBTyxrQkFBZ0IsQ0FBQztJQUVyRSxNQUFNLElBQUksR0FBRyxlQUFlLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztJQUVuRSxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxHQUFHLFFBQVEsRUFBRSxDQUFDO1FBQzFDLE1BQU0sSUFBSSwyQkFBa0IsQ0FDMUIscUVBQXFFLFFBQVEsR0FBRyxDQUNqRixDQUFDO0lBQ0osQ0FBQztJQUVELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUVELFNBQVMsU0FBUyxDQUFDLEtBQWE7SUFDOUIsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksZUFBZSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxPQUFPLENBQUM7QUFDdkUsQ0FBQztBQUVELFNBQWdCLFdBQVcsQ0FBQyxHQUFzQjtJQUNoRCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUNuQyxxQkFBYSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxFQUFFLFNBQVMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ1YsQ0FBQztJQUU3QyxLQUFLLE1BQU0sR0FBRyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUU5QixJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxNQUFNLElBQUksMkJBQWtCLENBQUMsMEJBQTBCLEdBQUcsK0JBQStCLENBQUMsQ0FBQztRQUM3RixDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQ2pDLHFCQUFhLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLEVBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQ2hELENBQUM7SUFFakIsT0FBTztRQUNMLGdCQUFnQixFQUFFLFVBQVUsQ0FBQyxrQkFBa0I7UUFDL0MsZUFBZSxFQUFFLFVBQVUsQ0FBQyxpQkFBaUI7UUFDN0MsZUFBZSxFQUFFLFVBQVUsQ0FBQyxpQkFBaUI7UUFDN0MsWUFBWSxFQUFFLFVBQVUsQ0FBQyxjQUFjO1FBQ3ZDLFFBQVEsRUFBRSxVQUFVLENBQUMsU0FBUztRQUM5QixRQUFRLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUM7UUFDbEMsUUFBUTtRQUNSLGNBQWMsRUFBRSxxQkFBYSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztLQUMxRCxDQUFDO0FBQ0osQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW52LWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25maWcvZW52LWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUE0RUEsa0NBOEJDO0FBMUdELDZCQUF3QjtBQUV4QiwyREFBMkM7QUFDM0Msc0NBQStDO0FBRWxDLFFBQUEsYUFBYSxHQUFHO0lBQzNCLG9CQUFvQjtJQUNwQixtQkFBbUI7SUFDbkIsbUJBQW1CO0lBQ25CLGdCQUFnQjtJQUNoQixXQUFXO0NBQ0gsQ0FBQztBQUlYLE1BQU0sUUFBUSxHQUFHLENBQUMsbUJBQW1CLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFVLENBQUM7QUFnQi9FLE1BQU0sZUFBZSxHQUFHLE9BQU8sQ0FBQztBQUNoQyxNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUM7QUFDdkIsTUFBTSxvQkFBb0IsR0FBRyxFQUFFLENBQUM7QUFDaEMsTUFBTSxjQUFjLEdBQUcsd0JBQXdCLENBQUM7QUFDaEQsTUFBTSxlQUFlLEdBQUcsT0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO0FBRXhELFNBQVMsU0FBUyxDQUFDLEtBQXlCO0lBQzFDLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQztBQUN4RSxDQUFDO0FBRUQsU0FBUyxTQUFTLENBQUMsR0FBdUI7SUFDeEMsTUFBTSxPQUFPLEdBQUcsR0FBRyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQzVCLElBQUksT0FBTyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssRUFBRTtRQUFFLE9BQU8sa0JBQWdCLENBQUM7SUFFckUsTUFBTSxJQUFJLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFFbkUsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksR0FBRyxRQUFRLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksMkJBQWtCLENBQzFCLHFFQUFxRSxRQUFRLEdBQUcsQ0FDakYsQ0FBQztJQUNKLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUM7QUFFRCxTQUFTLFNBQVMsQ0FBQyxLQUFhO0lBQzlCLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLGVBQWUsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxDQUFDO0FBQ3ZFLENBQUM7QUFFRCxTQUFTLG9CQUFvQixDQUFDLEtBQWE7SUFDekMsT0FBTyxjQUFjLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxvQkFBb0IsQ0FBQztBQUNwRyxDQUFDO0FBRUQsU0FBUyxrQkFBa0IsQ0FBQyxHQUF1QjtJQUNqRCxNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFN0IsSUFBSSxLQUFLLEtBQUssU0FBUyxJQUFJLENBQUMsb0JBQW9CLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN4RCxNQUFNLElBQUksMkJBQWtCLENBQzFCLHNGQUFzRixvQkFBb0IsbUJBQW1CLENBQzlILENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsU0FBZ0IsV0FBVyxDQUFDLEdBQXNCO0lBQ2hELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQ25DLHFCQUFhLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDVixDQUFDO0lBRTdDLEtBQUssTUFBTSxHQUFHLElBQUksUUFBUSxFQUFFLENBQUM7UUFDM0IsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBRTlCLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzdDLE1BQU0sSUFBSSwyQkFBa0IsQ0FBQywwQkFBMEIsR0FBRywrQkFBK0IsQ0FBQyxDQUFDO1FBQzdGLENBQUM7SUFDSCxDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FDakMscUJBQWEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxVQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FDaEQsQ0FBQztJQUVqQixNQUFNLGtCQUFrQixHQUFHLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBRTVFLE9BQU87UUFDTCxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsa0JBQWtCO1FBQy9DLGVBQWUsRUFBRSxVQUFVLENBQUMsaUJBQWlCO1FBQzdDLGVBQWUsRUFBRSxVQUFVLENBQUMsaUJBQWlCO1FBQzdDLFlBQVksRUFBRSxVQUFVLENBQUMsY0FBYztRQUN2QyxRQUFRLEVBQUUsVUFBVSxDQUFDLFNBQVM7UUFDOUIsa0JBQWtCO1FBQ2xCLFFBQVEsRUFBRSxTQUFTLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUNsQyxRQUFRO1FBQ1IsY0FBYyxFQUFFLHFCQUFhLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksa0JBQWtCLEtBQUssU0FBUztLQUM5RixDQUFDO0FBQ0osQ0FBQyJ9

package/dist/http/bff-http-server.d.ts

@@ -1,11 +1,13 @@
 import type { BFFConfig } from '../config/env-config';
 import type { Logger } from '../ports/logger-port';
+import type { Middleware } from 'koa';
 import http from 'http';
 export interface BFFHttpServerOptions {
     port: number;
     version: string;
     config: BFFConfig;
     logger?: Logger;
+    middlewares?: Middleware[];
 }
 export default class BFFHttpServer {
     private readonly app;

package/dist/http/bff-http-server.js

@@ -25,6 +25,9 @@ class BFFHttpServer {
             }
             await next();
         });
+        for (const middleware of this.options.middlewares ?? []) {
+            this.app.use(middleware);
+        }
     }
     async start() {
         if (this.server)
@@ -80,4 +83,4 @@ class BFFHttpServer {
     }
 }
 exports.default = BFFHttpServer;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLWh0dHAtc2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2h0dHAvYmZmLWh0dHAtc2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBSUEsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUV0QixnRkFBNkQ7QUFTN0QsTUFBcUIsYUFBYTtJQU1oQyxZQUFZLE9BQTZCO1FBRmpDLFdBQU0sR0FBa0IsSUFBSSxDQUFDO1FBR25DLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFBLHdCQUFtQixHQUFFLENBQUM7UUFDdEQsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLGFBQUcsRUFBRSxDQUFDO1FBRXJCLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsR0FBRyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3RELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDOUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO2dCQUN6QyxHQUFHLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUMvQyxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxFQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUUxRSxPQUFPO1lBQ1QsQ0FBQztZQUVELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsS0FBSztRQUNULElBQUksSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFFM0QsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxNQUFNLE1BQU0sR0FBRyxjQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztZQUN0RCxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztZQUNyQixJQUFJLE9BQStCLENBQUM7WUFFcEMsTUFBTSxXQUFXLEdBQUcsR0FBRyxFQUFFO2dCQUN2QixNQUFNLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztnQkFDeEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNqQyxNQUFNLElBQUksR0FBRyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDdkYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUVwRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQztxQkFDekQsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQztxQkFDakMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBRXZCLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDdkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsOERBQThELEVBQUU7d0JBQ2xGLE9BQU87cUJBQ1IsQ0FBQyxDQUFDO2dCQUNMLENBQUM7Z0JBRUQsT0FBTyxFQUFFLENBQUM7WUFDWixDQUFDLENBQUM7WUFFRixPQUFPLEdBQUcsQ0FBQyxLQUFZLEVBQUUsRUFBRTtnQkFDekIsTUFBTSxDQUFDLGNBQWMsQ0FBQyxXQUFXLEVBQUUsV0FBVyxDQUFDLENBQUM7Z0JBQ2hELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNO29CQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO2dCQUMvQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDaEIsQ0FBQyxDQUFDO1lBRUYsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDOUIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNoRCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSTtRQUNSLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakIsT0FBTyxFQUFFLENBQUM7Z0JBRVYsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtnQkFDdEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztvQkFDUixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2QsQ0FBQztxQkFBTSxDQUFDO29CQUNOLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO29CQUNuQixPQUFPLEVBQUUsQ0FBQztnQkFDWixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFJLFFBQVE7UUFDVixPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBekZELGdDQXlGQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLWh0dHAtc2VydmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2h0dHAvYmZmLWh0dHAtc2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBS0EsZ0RBQXdCO0FBQ3hCLDhDQUFzQjtBQUV0QixnRkFBNkQ7QUFVN0QsTUFBcUIsYUFBYTtJQU1oQyxZQUFZLE9BQTZCO1FBRmpDLFdBQU0sR0FBa0IsSUFBSSxDQUFDO1FBR25DLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFBLHdCQUFtQixHQUFFLENBQUM7UUFDdEQsSUFBSSxDQUFDLEdBQUcsR0FBRyxJQUFJLGFBQUcsRUFBRSxDQUFDO1FBRXJCLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsR0FBRyxDQUFDLEdBQUcsQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3RELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUU7WUFDL0IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDOUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDO2dCQUN6QyxHQUFHLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUMvQyxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxFQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUUxRSxPQUFPO1lBQ1QsQ0FBQztZQUVELE1BQU0sSUFBSSxFQUFFLENBQUM7UUFDZixDQUFDLENBQUMsQ0FBQztRQUVILEtBQUssTUFBTSxVQUFVLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLElBQUksRUFBRSxFQUFFLENBQUM7WUFDeEQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDM0IsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsS0FBSztRQUNULElBQUksSUFBSSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFFM0QsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNyQyxNQUFNLE1BQU0sR0FBRyxjQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztZQUN0RCxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztZQUNyQixJQUFJLE9BQStCLENBQUM7WUFFcEMsTUFBTSxXQUFXLEdBQUcsR0FBRyxFQUFFO2dCQUN2QixNQUFNLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztnQkFDeEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNqQyxNQUFNLElBQUksR0FBRyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDdkYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsb0JBQW9CLEVBQUUsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUVwRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQztxQkFDekQsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQztxQkFDakMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBRXZCLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDdkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsOERBQThELEVBQUU7d0JBQ2xGLE9BQU87cUJBQ1IsQ0FBQyxDQUFDO2dCQUNMLENBQUM7Z0JBRUQsT0FBTyxFQUFFLENBQUM7WUFDWixDQUFDLENBQUM7WUFFRixPQUFPLEdBQUcsQ0FBQyxLQUFZLEVBQUUsRUFBRTtnQkFDekIsTUFBTSxDQUFDLGNBQWMsQ0FBQyxXQUFXLEVBQUUsV0FBVyxDQUFDLENBQUM7Z0JBQ2hELElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNO29CQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO2dCQUMvQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDaEIsQ0FBQyxDQUFDO1lBRUYsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDOUIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNoRCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsSUFBSTtRQUNSLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakIsT0FBTyxFQUFFLENBQUM7Z0JBRVYsT0FBTztZQUNULENBQUM7WUFFRCxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRTtnQkFDdEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztvQkFDUixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2QsQ0FBQztxQkFBTSxDQUFDO29CQUNOLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO29CQUNuQixPQUFPLEVBQUUsQ0FBQztnQkFDWixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxJQUFJLFFBQVE7UUFDVixPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDN0IsQ0FBQztDQUNGO0FBN0ZELGdDQTZGQyJ9

package/dist/index.d.ts

@@ -7,4 +7,15 @@ export { default as DEFAULT_BFF_PORT } from './defaults';
 export { default as createConsoleLogger } from './adapters/console-logger';
 export type { Logger, LoggerLevel } from './ports/logger-port';
 export { default as version } from './version';
+export { default as ForestServerClient, OAuthExchangeError } from './oauth/forest-server-client';
+export type { ServerTokens, RegisteredClient, ExchangeCodeParams, } from './oauth/forest-server-client';
+export { default as createOAuthRoutes } from './oauth/oauth-routes';
+export { default as createInMemorySessionStore } from './oauth/session-store';
+export type { SessionStore, StoredSession, CreatedSession } from './oauth/session-store';
+export { default as createTokenCipher } from './oauth/token-cipher';
+export { default as ensureFreshServerAccess } from './oauth/session-lifecycle';
+export { issueBffAccessToken, BFF_ACCESS_TOKEN_TYPE } from './oauth/bff-token';
+export type { BffAccessTokenPayload } from './oauth/bff-token';
+export { createPkcePair } from './oauth/pkce';
+export { OAuthRequestError } from './oauth/oauth-error';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.version = exports.createConsoleLogger = exports.DEFAULT_BFF_PORT = exports.ConfigurationError = exports.runCli = exports.REQUIRED_KEYS = exports.parseConfig = exports.BFFHttpServer = void 0;
+exports.OAuthRequestError = exports.createPkcePair = exports.BFF_ACCESS_TOKEN_TYPE = exports.issueBffAccessToken = exports.ensureFreshServerAccess = exports.createTokenCipher = exports.createInMemorySessionStore = exports.createOAuthRoutes = exports.OAuthExchangeError = exports.ForestServerClient = exports.version = exports.createConsoleLogger = exports.DEFAULT_BFF_PORT = exports.ConfigurationError = exports.runCli = exports.REQUIRED_KEYS = exports.parseConfig = exports.BFFHttpServer = void 0;
 var bff_http_server_1 = require("./http/bff-http-server");
 Object.defineProperty(exports, "BFFHttpServer", { enumerable: true, get: function () { return __importDefault(bff_http_server_1).default; } });
 var env_config_1 = require("./config/env-config");
@@ -19,4 +19,22 @@ var console_logger_1 = require("./adapters/console-logger");
 Object.defineProperty(exports, "createConsoleLogger", { enumerable: true, get: function () { return __importDefault(console_logger_1).default; } });
 var version_1 = require("./version");
 Object.defineProperty(exports, "version", { enumerable: true, get: function () { return __importDefault(version_1).default; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsMERBQWtFO0FBQXpELGlJQUFBLE9BQU8sT0FBaUI7QUFDakMsa0RBQWlFO0FBQXhELHlHQUFBLFdBQVcsT0FBQTtBQUFFLDJHQUFBLGFBQWEsT0FBQTtBQUVuQyx1Q0FBK0M7QUFBdEMsbUhBQUEsT0FBTyxPQUFVO0FBQzFCLG1DQUE4QztBQUFyQyw0R0FBQSxrQkFBa0IsT0FBQTtBQUMzQix1Q0FBeUQ7QUFBaEQsNkhBQUEsT0FBTyxPQUFvQjtBQUNwQyw0REFBMkU7QUFBbEUsc0lBQUEsT0FBTyxPQUF1QjtBQUV2QyxxQ0FBK0M7QUFBdEMsbUhBQUEsT0FBTyxPQUFXIn0=
+var forest_server_client_1 = require("./oauth/forest-server-client");
+Object.defineProperty(exports, "ForestServerClient", { enumerable: true, get: function () { return __importDefault(forest_server_client_1).default; } });
+Object.defineProperty(exports, "OAuthExchangeError", { enumerable: true, get: function () { return forest_server_client_1.OAuthExchangeError; } });
+var oauth_routes_1 = require("./oauth/oauth-routes");
+Object.defineProperty(exports, "createOAuthRoutes", { enumerable: true, get: function () { return __importDefault(oauth_routes_1).default; } });
+var session_store_1 = require("./oauth/session-store");
+Object.defineProperty(exports, "createInMemorySessionStore", { enumerable: true, get: function () { return __importDefault(session_store_1).default; } });
+var token_cipher_1 = require("./oauth/token-cipher");
+Object.defineProperty(exports, "createTokenCipher", { enumerable: true, get: function () { return __importDefault(token_cipher_1).default; } });
+var session_lifecycle_1 = require("./oauth/session-lifecycle");
+Object.defineProperty(exports, "ensureFreshServerAccess", { enumerable: true, get: function () { return __importDefault(session_lifecycle_1).default; } });
+var bff_token_1 = require("./oauth/bff-token");
+Object.defineProperty(exports, "issueBffAccessToken", { enumerable: true, get: function () { return bff_token_1.issueBffAccessToken; } });
+Object.defineProperty(exports, "BFF_ACCESS_TOKEN_TYPE", { enumerable: true, get: function () { return bff_token_1.BFF_ACCESS_TOKEN_TYPE; } });
+var pkce_1 = require("./oauth/pkce");
+Object.defineProperty(exports, "createPkcePair", { enumerable: true, get: function () { return pkce_1.createPkcePair; } });
+var oauth_error_1 = require("./oauth/oauth-error");
+Object.defineProperty(exports, "OAuthRequestError", { enumerable: true, get: function () { return oauth_error_1.OAuthRequestError; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBQUEsMERBQWtFO0FBQXpELGlJQUFBLE9BQU8sT0FBaUI7QUFDakMsa0RBQWlFO0FBQXhELHlHQUFBLFdBQVcsT0FBQTtBQUFFLDJHQUFBLGFBQWEsT0FBQTtBQUVuQyx1Q0FBK0M7QUFBdEMsbUhBQUEsT0FBTyxPQUFVO0FBQzFCLG1DQUE4QztBQUFyQyw0R0FBQSxrQkFBa0IsT0FBQTtBQUMzQix1Q0FBeUQ7QUFBaEQsNkhBQUEsT0FBTyxPQUFvQjtBQUNwQyw0REFBMkU7QUFBbEUsc0lBQUEsT0FBTyxPQUF1QjtBQUV2QyxxQ0FBK0M7QUFBdEMsbUhBQUEsT0FBTyxPQUFXO0FBQzNCLHFFQUFpRztBQUF4RiwySUFBQSxPQUFPLE9BQXNCO0FBQUUsMEhBQUEsa0JBQWtCLE9BQUE7QUFNMUQscURBQW9FO0FBQTNELGtJQUFBLE9BQU8sT0FBcUI7QUFDckMsdURBQThFO0FBQXJFLDRJQUFBLE9BQU8sT0FBOEI7QUFFOUMscURBQW9FO0FBQTNELGtJQUFBLE9BQU8sT0FBcUI7QUFDckMsK0RBQStFO0FBQXRFLDZJQUFBLE9BQU8sT0FBMkI7QUFDM0MsK0NBQStFO0FBQXRFLGdIQUFBLG1CQUFtQixPQUFBO0FBQUUsa0hBQUEscUJBQXFCLE9BQUE7QUFFbkQscUNBQThDO0FBQXJDLHNHQUFBLGNBQWMsT0FBQTtBQUN2QixtREFBd0Q7QUFBL0MsZ0hBQUEsaUJBQWlCLE9BQUEifQ==

package/dist/oauth/bff-token.d.ts

@@ -0,0 +1,24 @@
+import type { UserInfo } from '@forestadmin/forestadmin-client';
+export declare const BFF_ACCESS_TOKEN_TYPE = "bff_access";
+export declare const BFF_ACCESS_TOKEN_MAX_EXPIRES_IN: number;
+export interface IssueBffAccessTokenParams {
+    sid: string;
+    user: UserInfo;
+    renderingId: number;
+    authSecret: string;
+    expiresInSeconds: number;
+}
+export interface BffAccessTokenPayload {
+    type: typeof BFF_ACCESS_TOKEN_TYPE;
+    sid: string;
+    id: number;
+    email: string;
+    first_name: string;
+    last_name: string;
+    team: string;
+    rendering_id: string;
+    permission_level: string;
+    tags: Record<string, string>;
+}
+export declare function issueBffAccessToken({ sid, user, renderingId, authSecret, expiresInSeconds, }: IssueBffAccessTokenParams): string;
+//# sourceMappingURL=bff-token.d.ts.map

package/dist/oauth/bff-token.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN = exports.BFF_ACCESS_TOKEN_TYPE = void 0;
+exports.issueBffAccessToken = issueBffAccessToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+exports.BFF_ACCESS_TOKEN_TYPE = 'bff_access';
+exports.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN = 15 * 60;
+function issueBffAccessToken({ sid, user, renderingId, authSecret, expiresInSeconds, }) {
+    const payload = {
+        type: exports.BFF_ACCESS_TOKEN_TYPE,
+        sid,
+        id: user.id,
+        email: user.email,
+        first_name: user.firstName,
+        last_name: user.lastName,
+        team: user.team,
+        rendering_id: String(renderingId),
+        permission_level: user.permissionLevel,
+        tags: user.tags ?? {},
+    };
+    return jsonwebtoken_1.default.sign(payload, authSecret, {
+        algorithm: 'HS256',
+        expiresIn: Math.min(expiresInSeconds, exports.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN),
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYmZmLXRva2VuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL2JmZi10b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUE0QkEsa0RBd0JDO0FBbERELGdFQUF3QztBQUUzQixRQUFBLHFCQUFxQixHQUFHLFlBQVksQ0FBQztBQUNyQyxRQUFBLCtCQUErQixHQUFHLEVBQUUsR0FBRyxFQUFFLENBQUM7QUF1QnZELFNBQWdCLG1CQUFtQixDQUFDLEVBQ2xDLEdBQUcsRUFDSCxJQUFJLEVBQ0osV0FBVyxFQUNYLFVBQVUsRUFDVixnQkFBZ0IsR0FDVTtJQUMxQixNQUFNLE9BQU8sR0FBMEI7UUFDckMsSUFBSSxFQUFFLDZCQUFxQjtRQUMzQixHQUFHO1FBQ0gsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO1FBQ1gsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO1FBQ2pCLFVBQVUsRUFBRSxJQUFJLENBQUMsU0FBUztRQUMxQixTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVE7UUFDeEIsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ2YsWUFBWSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDakMsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGVBQWU7UUFDdEMsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLElBQUksRUFBRTtLQUN0QixDQUFDO0lBRUYsT0FBTyxzQkFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsVUFBVSxFQUFFO1FBQzVDLFNBQVMsRUFBRSxPQUFPO1FBQ2xCLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLGdCQUFnQixFQUFFLHVDQUErQixDQUFDO0tBQ3ZFLENBQUMsQ0FBQztBQUNMLENBQUMifQ==

package/dist/oauth/forest-server-client.d.ts

@@ -0,0 +1,40 @@
+import type { UserInfo } from '@forestadmin/forestadmin-client';
+import OAuthExchangeError from './oauth-exchange-error';
+export { OAuthExchangeError };
+export interface RegisteredClient {
+    client_id: string;
+    client_name?: string;
+    redirect_uris?: string[];
+    grant_types?: string[];
+}
+export interface ServerTokens {
+    saasAccessToken: string;
+    saasRefreshToken: string;
+    renderingId: number;
+    expiresAt: number;
+}
+export interface ExchangeCodeParams {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    clientId: string;
+}
+export interface ForestServerClientOptions {
+    forestServerUrl: string;
+    envSecret: string;
+}
+export default class ForestServerClient {
+    private readonly forestServerUrl;
+    private readonly envSecret;
+    private readonly forestClient;
+    constructor({ forestServerUrl, envSecret }: ForestServerClientOptions);
+    private url;
+    fetchEnvironmentId(): Promise<number>;
+    getRegisteredClient(clientId: string): Promise<RegisteredClient | undefined>;
+    exchangeCode({ code, codeVerifier, redirectUri, clientId, }: ExchangeCodeParams): Promise<ServerTokens>;
+    refreshServerToken(saasRefreshToken: string): Promise<ServerTokens>;
+    private postToken;
+    private static toServerTokens;
+    getUserInfo(renderingId: number, saasAccessToken: string): Promise<UserInfo>;
+}
+//# sourceMappingURL=forest-server-client.d.ts.map

package/dist/oauth/forest-server-client.js

@@ -0,0 +1,104 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthExchangeError = void 0;
+const forestadmin_client_1 = __importDefault(require("@forestadmin/forestadmin-client"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const oauth_exchange_error_1 = __importDefault(require("./oauth-exchange-error"));
+exports.OAuthExchangeError = oauth_exchange_error_1.default;
+const DEFAULT_HEADERS = { 'Content-Type': 'application/json' };
+const REQUEST_TIMEOUT_MS = 60000;
+function fetchWithTimeout(url, init) {
+    return fetch(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+}
+class ForestServerClient {
+    constructor({ forestServerUrl, envSecret }) {
+        this.forestServerUrl = forestServerUrl;
+        this.envSecret = envSecret;
+        this.forestClient = (0, forestadmin_client_1.default)({ forestServerUrl, envSecret });
+    }
+    url(path) {
+        return new URL(path, this.forestServerUrl).toString();
+    }
+    async fetchEnvironmentId() {
+        const response = await fetchWithTimeout(this.url('/liana/environment'), {
+            method: 'GET',
+            headers: { ...DEFAULT_HEADERS, 'forest-secret-key': this.envSecret },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch environment: ${response.status} ${response.statusText}`);
+        }
+        const body = (await response.json());
+        const id = body.data?.id;
+        if (typeof id !== 'number' && (typeof id !== 'string' || !/^\d+$/.test(id))) {
+            throw new Error('Failed to parse environment id from the Forest server response');
+        }
+        const environmentId = Number(id);
+        if (!Number.isInteger(environmentId) || environmentId <= 0) {
+            throw new Error('Failed to parse environment id from the Forest server response');
+        }
+        return environmentId;
+    }
+    async getRegisteredClient(clientId) {
+        const response = await fetchWithTimeout(this.url(`/oauth/register/${encodeURIComponent(clientId)}`), {
+            method: 'GET',
+            headers: DEFAULT_HEADERS,
+        });
+        if (response.status === 404)
+            return undefined;
+        if (!response.ok) {
+            throw new Error(`Failed to fetch registered client: ${response.status} ${response.statusText}`);
+        }
+        return response.json();
+    }
+    async exchangeCode({ code, codeVerifier, redirectUri, clientId, }) {
+        return this.postToken({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: clientId,
+            code_verifier: codeVerifier,
+        }, true);
+    }
+    async refreshServerToken(saasRefreshToken) {
+        return this.postToken({ grant_type: 'refresh_token', refresh_token: saasRefreshToken }, false);
+    }
+    async postToken(payload, isInitialExchange) {
+        const response = await fetchWithTimeout(this.url('/oauth/token'), {
+            method: 'POST',
+            headers: { ...DEFAULT_HEADERS, 'forest-secret-key': this.envSecret },
+            body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+            const errorBody = (await response.json().catch(() => ({})));
+            throw new oauth_exchange_error_1.default(errorBody.error || 'server_error', errorBody.error_description || 'Failed to exchange token with the Forest server');
+        }
+        const tokens = (await response.json());
+        const saasRefreshToken = tokens.refresh_token ?? payload.refresh_token;
+        if (saasRefreshToken === undefined) {
+            throw new oauth_exchange_error_1.default('invalid_grant', 'The Forest server did not return a refresh token');
+        }
+        return ForestServerClient.toServerTokens(tokens.access_token, saasRefreshToken, isInitialExchange);
+    }
+    static toServerTokens(saasAccessToken, saasRefreshToken, requireRenderingId) {
+        const decoded = jsonwebtoken_1.default.decode(saasAccessToken);
+        const decodedRenderingId = Number(decoded?.meta?.renderingId);
+        const hasRenderingId = Number.isInteger(decodedRenderingId);
+        if (requireRenderingId && !hasRenderingId) {
+            throw new Error('Failed to decode renderingId from the Forest server access token');
+        }
+        return {
+            saasAccessToken,
+            saasRefreshToken,
+            renderingId: hasRenderingId ? decodedRenderingId : 0,
+            expiresAt: decoded?.exp ?? 0,
+        };
+    }
+    async getUserInfo(renderingId, saasAccessToken) {
+        return this.forestClient.authService.getUserInfo(renderingId, saasAccessToken);
+    }
+}
+exports.default = ForestServerClient;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZm9yZXN0LXNlcnZlci1jbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgvZm9yZXN0LXNlcnZlci1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7O0FBRUEseUZBQXNFO0FBQ3RFLGdFQUF3QztBQUV4QyxrRkFBd0Q7QUFFL0MsNkJBRkYsOEJBQWtCLENBRUU7QUE0QjNCLE1BQU0sZUFBZSxHQUFHLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFXLENBQUM7QUFDeEUsTUFBTSxrQkFBa0IsR0FBRyxLQUFNLENBQUM7QUFFbEMsU0FBUyxnQkFBZ0IsQ0FBQyxHQUFXLEVBQUUsSUFBaUI7SUFDdEQsT0FBTyxLQUFLLENBQUMsR0FBRyxFQUFFLEVBQUUsR0FBRyxJQUFJLEVBQUUsTUFBTSxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDbEYsQ0FBQztBQUVELE1BQXFCLGtCQUFrQjtJQUtyQyxZQUFZLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBNkI7UUFDbkUsSUFBSSxDQUFDLGVBQWUsR0FBRyxlQUFlLENBQUM7UUFDdkMsSUFBSSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDM0IsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFBLDRCQUF1QixFQUFDLEVBQUUsZUFBZSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUVPLEdBQUcsQ0FBQyxJQUFZO1FBQ3RCLE9BQU8sSUFBSSxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0lBRUQsS0FBSyxDQUFDLGtCQUFrQjtRQUN0QixNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsb0JBQW9CLENBQUMsRUFBRTtZQUN0RSxNQUFNLEVBQUUsS0FBSztZQUNiLE9BQU8sRUFBRSxFQUFFLEdBQUcsZUFBZSxFQUFFLG1CQUFtQixFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUU7U0FDckUsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxRQUFRLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7UUFFRCxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUF3QyxDQUFDO1FBQzVFLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBRXpCLElBQUksT0FBTyxFQUFFLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFFakMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksYUFBYSxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzNELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBRUQsT0FBTyxhQUFhLENBQUM7SUFDdkIsQ0FBQztJQUVELEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxRQUFnQjtRQUN4QyxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUNyQyxJQUFJLENBQUMsR0FBRyxDQUFDLG1CQUFtQixrQkFBa0IsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLEVBQzNEO1lBQ0UsTUFBTSxFQUFFLEtBQUs7WUFDYixPQUFPLEVBQUUsZUFBZTtTQUN6QixDQUNGLENBQUM7UUFFRixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssR0FBRztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBRTlDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDakIsTUFBTSxJQUFJLEtBQUssQ0FDYixzQ0FBc0MsUUFBUSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsVUFBVSxFQUFFLENBQy9FLENBQUM7UUFDSixDQUFDO1FBRUQsT0FBTyxRQUFRLENBQUMsSUFBSSxFQUErQixDQUFDO0lBQ3RELENBQUM7SUFFRCxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQ2pCLElBQUksRUFDSixZQUFZLEVBQ1osV0FBVyxFQUNYLFFBQVEsR0FDVztRQUNuQixPQUFPLElBQUksQ0FBQyxTQUFTLENBQ25CO1lBQ0UsVUFBVSxFQUFFLG9CQUFvQjtZQUNoQyxJQUFJO1lBQ0osWUFBWSxFQUFFLFdBQVc7WUFDekIsU0FBUyxFQUFFLFFBQVE7WUFDbkIsYUFBYSxFQUFFLFlBQVk7U0FDNUIsRUFDRCxJQUFJLENBQ0wsQ0FBQztJQUNKLENBQUM7SUFFRCxLQUFLLENBQUMsa0JBQWtCLENBQUMsZ0JBQXdCO1FBQy9DLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxlQUFlLEVBQUUsYUFBYSxFQUFFLGdCQUFnQixFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVPLEtBQUssQ0FBQyxTQUFTLENBQ3JCLE9BQStCLEVBQy9CLGlCQUEwQjtRQUUxQixNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLEVBQUU7WUFDaEUsTUFBTSxFQUFFLE1BQU07WUFDZCxPQUFPLEVBQUUsRUFBRSxHQUFHLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFO1lBQ3BFLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQztTQUM5QixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sU0FBUyxHQUFHLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FHekQsQ0FBQztZQUNGLE1BQU0sSUFBSSw4QkFBa0IsQ0FDMUIsU0FBUyxDQUFDLEtBQUssSUFBSSxjQUFjLEVBQ2pDLFNBQVMsQ0FBQyxpQkFBaUIsSUFBSSxpREFBaUQsQ0FDakYsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFxRCxDQUFDO1FBQzNGLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsYUFBYSxDQUFDO1FBRXZFLElBQUksZ0JBQWdCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFJLDhCQUFrQixDQUMxQixlQUFlLEVBQ2Ysa0RBQWtELENBQ25ELENBQUM7UUFDSixDQUFDO1FBRUQsT0FBTyxrQkFBa0IsQ0FBQyxjQUFjLENBQ3RDLE1BQU0sQ0FBQyxZQUFZLEVBQ25CLGdCQUFnQixFQUNoQixpQkFBaUIsQ0FDbEIsQ0FBQztJQUNKLENBQUM7SUFFTyxNQUFNLENBQUMsY0FBYyxDQUMzQixlQUF1QixFQUN2QixnQkFBd0IsRUFDeEIsa0JBQTJCO1FBRTNCLE1BQU0sT0FBTyxHQUFHLHNCQUFZLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FHM0MsQ0FBQztRQUVULE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxDQUFDLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDOUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBRTVELElBQUksa0JBQWtCLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUVELE9BQU87WUFDTCxlQUFlO1lBQ2YsZ0JBQWdCO1lBQ2hCLFdBQVcsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3BELFNBQVMsRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUM7U0FDN0IsQ0FBQztJQUNKLENBQUM7SUFFRCxLQUFLLENBQUMsV0FBVyxDQUFDLFdBQW1CLEVBQUUsZUFBdUI7UUFDNUQsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsV0FBVyxFQUFFLGVBQWUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7Q0FDRjtBQXJKRCxxQ0FxSkMifQ==

package/dist/oauth/oauth-error.d.ts

@@ -0,0 +1,18 @@
+export declare class OAuthRequestError extends Error {
+    readonly status: number;
+    readonly type: string;
+    constructor(status: number, type: string, message: string);
+}
+export interface OAuthErrorBody {
+    error: string;
+    error_description: string;
+}
+export declare function toErrorBody(error: OAuthRequestError): OAuthErrorBody;
+export declare function invalidRequest(message: string): OAuthRequestError;
+export declare function invalidClient(message: string): OAuthRequestError;
+export declare function invalidGrant(message: string): OAuthRequestError;
+export declare function unsupportedGrantType(message: string): OAuthRequestError;
+export declare function forestIdentityNotAllowed(message: string): OAuthRequestError;
+export declare function sessionExpired(message: string): OAuthRequestError;
+export declare function serverError(message: string): OAuthRequestError;
+//# sourceMappingURL=oauth-error.d.ts.map

package/dist/oauth/oauth-error.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthRequestError = void 0;
+exports.toErrorBody = toErrorBody;
+exports.invalidRequest = invalidRequest;
+exports.invalidClient = invalidClient;
+exports.invalidGrant = invalidGrant;
+exports.unsupportedGrantType = unsupportedGrantType;
+exports.forestIdentityNotAllowed = forestIdentityNotAllowed;
+exports.sessionExpired = sessionExpired;
+exports.serverError = serverError;
+class OAuthRequestError extends Error {
+    constructor(status, type, message) {
+        super(message);
+        this.name = 'OAuthRequestError';
+        this.status = status;
+        this.type = type;
+    }
+}
+exports.OAuthRequestError = OAuthRequestError;
+function toErrorBody(error) {
+    return { error: error.type, error_description: error.message };
+}
+function invalidRequest(message) {
+    return new OAuthRequestError(400, 'invalid_request', message);
+}
+function invalidClient(message) {
+    return new OAuthRequestError(400, 'invalid_client', message);
+}
+function invalidGrant(message) {
+    return new OAuthRequestError(400, 'invalid_grant', message);
+}
+function unsupportedGrantType(message) {
+    return new OAuthRequestError(400, 'unsupported_grant_type', message);
+}
+function forestIdentityNotAllowed(message) {
+    return new OAuthRequestError(403, 'forest_identity_not_allowed', message);
+}
+function sessionExpired(message) {
+    return new OAuthRequestError(401, 'session_expired', message);
+}
+function serverError(message) {
+    return new OAuthRequestError(502, 'server_error', message);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2F1dGgtZXJyb3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgvb2F1dGgtZXJyb3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBaUJBLGtDQUVDO0FBRUQsd0NBRUM7QUFFRCxzQ0FFQztBQUVELG9DQUVDO0FBRUQsb0RBRUM7QUFFRCw0REFFQztBQUVELHdDQUVDO0FBRUQsa0NBRUM7QUEvQ0QsTUFBYSxpQkFBa0IsU0FBUSxLQUFLO0lBSTFDLFlBQVksTUFBYyxFQUFFLElBQVksRUFBRSxPQUFlO1FBQ3ZELEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNmLElBQUksQ0FBQyxJQUFJLEdBQUcsbUJBQW1CLENBQUM7UUFDaEMsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLElBQUksR0FBRyxJQUFJLENBQUM7SUFDbkIsQ0FBQztDQUNGO0FBVkQsOENBVUM7QUFPRCxTQUFnQixXQUFXLENBQUMsS0FBd0I7SUFDbEQsT0FBTyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxFQUFFLGlCQUFpQixFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztBQUNqRSxDQUFDO0FBRUQsU0FBZ0IsY0FBYyxDQUFDLE9BQWU7SUFDNUMsT0FBTyxJQUFJLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxpQkFBaUIsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUNoRSxDQUFDO0FBRUQsU0FBZ0IsYUFBYSxDQUFDLE9BQWU7SUFDM0MsT0FBTyxJQUFJLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUMvRCxDQUFDO0FBRUQsU0FBZ0IsWUFBWSxDQUFDLE9BQWU7SUFDMUMsT0FBTyxJQUFJLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxlQUFlLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDOUQsQ0FBQztBQUVELFNBQWdCLG9CQUFvQixDQUFDLE9BQWU7SUFDbEQsT0FBTyxJQUFJLGlCQUFpQixDQUFDLEdBQUcsRUFBRSx3QkFBd0IsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUN2RSxDQUFDO0FBRUQsU0FBZ0Isd0JBQXdCLENBQUMsT0FBZTtJQUN0RCxPQUFPLElBQUksaUJBQWlCLENBQUMsR0FBRyxFQUFFLDZCQUE2QixFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQzVFLENBQUM7QUFFRCxTQUFnQixjQUFjLENBQUMsT0FBZTtJQUM1QyxPQUFPLElBQUksaUJBQWlCLENBQUMsR0FBRyxFQUFFLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBQ2hFLENBQUM7QUFFRCxTQUFnQixXQUFXLENBQUMsT0FBZTtJQUN6QyxPQUFPLElBQUksaUJBQWlCLENBQUMsR0FBRyxFQUFFLGNBQWMsRUFBRSxPQUFPLENBQUMsQ0FBQztBQUM3RCxDQUFDIn0=

package/dist/oauth/oauth-exchange-error.d.ts

@@ -0,0 +1,5 @@
+export default class OAuthExchangeError extends Error {
+    readonly error: string;
+    constructor(error: string, description: string);
+}
+//# sourceMappingURL=oauth-exchange-error.d.ts.map

package/dist/oauth/oauth-exchange-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+class OAuthExchangeError extends Error {
+    constructor(error, description) {
+        super(description);
+        this.name = 'OAuthExchangeError';
+        this.error = error;
+    }
+}
+exports.default = OAuthExchangeError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2F1dGgtZXhjaGFuZ2UtZXJyb3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgvb2F1dGgtZXhjaGFuZ2UtZXJyb3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSxNQUFxQixrQkFBbUIsU0FBUSxLQUFLO0lBR25ELFlBQVksS0FBYSxFQUFFLFdBQW1CO1FBQzVDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuQixJQUFJLENBQUMsSUFBSSxHQUFHLG9CQUFvQixDQUFDO1FBQ2pDLElBQUksQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO0lBQ3JCLENBQUM7Q0FDRjtBQVJELHFDQVFDIn0=

package/dist/oauth/oauth-routes.d.ts

@@ -0,0 +1,14 @@
+import type ForestServerClient from './forest-server-client';
+import type { SessionStore } from './session-store';
+import type { Logger } from '../ports/logger-port';
+import type { Middleware } from 'koa';
+export interface OAuthRoutesOptions {
+    serverClient: ForestServerClient;
+    sessionStore: SessionStore;
+    forestAppUrl: string;
+    authSecret: string;
+    environmentId: number;
+    logger: Logger;
+}
+export default function createOAuthRoutes(options: OAuthRoutesOptions): Middleware;
+//# sourceMappingURL=oauth-routes.d.ts.map

package/dist/oauth/oauth-routes.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createOAuthRoutes;
+const bff_token_1 = require("./bff-token");
+const forest_server_client_1 = require("./forest-server-client");
+const oauth_error_1 = require("./oauth-error");
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9\-._~]{43,128}$/;
+const S256_CODE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const SAFE_EXCHANGE_ERRORS = new Set([
+    'invalid_request',
+    'invalid_client',
+    'invalid_grant',
+    'unauthorized_client',
+    'unsupported_grant_type',
+    'invalid_scope',
+]);
+function getQueryParam(ctx, key) {
+    const value = ctx.query[key];
+    if (Array.isArray(value)) {
+        throw (0, oauth_error_1.invalidRequest)(`Parameter must appear at most once: ${key}`);
+    }
+    return value;
+}
+function requireBodyString(body, key) {
+    const value = body[key];
+    if (typeof value !== 'string' || value === '') {
+        throw (0, oauth_error_1.invalidRequest)(`Missing required parameter: ${key}`);
+    }
+    return value;
+}
+function assertValidCodeVerifier(codeVerifier) {
+    if (!CODE_VERIFIER_PATTERN.test(codeVerifier)) {
+        throw (0, oauth_error_1.invalidRequest)('code_verifier is malformed');
+    }
+}
+function assertRegisteredRedirectUri(redirectUris, redirectUri, onMismatch) {
+    if (!Array.isArray(redirectUris) || redirectUris.length === 0) {
+        throw (0, oauth_error_1.invalidRequest)('Client has no registered redirect_uri');
+    }
+    if (!redirectUris.includes(redirectUri)) {
+        throw onMismatch('redirect_uri does not match the registered client');
+    }
+}
+function toSafeExchangeError(saasError) {
+    if (SAFE_EXCHANGE_ERRORS.has(saasError)) {
+        return new oauth_error_1.OAuthRequestError(400, saasError, 'Authorization code exchange failed');
+    }
+    return new oauth_error_1.OAuthRequestError(502, 'server_error', 'Forest server rejected the authorization code');
+}
+function mapIdentityError(error) {
+    const name = error instanceof Error ? error.name : '';
+    if (name === 'ForbiddenError') {
+        return (0, oauth_error_1.forestIdentityNotAllowed)('Caller is not an active user for this rendering');
+    }
+    return new oauth_error_1.OAuthRequestError(502, 'identity_resolution_failed', 'Failed to resolve identity');
+}
+function redirectAuthorizeError(ctx, redirectUri, state, error) {
+    const target = new URL(redirectUri);
+    target.searchParams.set('error', error.type);
+    target.searchParams.set('error_description', error.message);
+    if (state !== undefined && state !== '')
+        target.searchParams.set('state', state);
+    ctx.redirect(target.toString());
+}
+async function handleAuthorize(ctx, options) {
+    // Validate client_id and redirect_uri first: until redirect_uri is confirmed
+    // against the registered client, errors must not redirect (RFC 6749 §10.15).
+    const clientId = getQueryParam(ctx, 'client_id');
+    if (clientId === undefined || clientId === '') {
+        throw (0, oauth_error_1.invalidRequest)('Missing required parameter: client_id');
+    }
+    const redirectUri = getQueryParam(ctx, 'redirect_uri');
+    if (redirectUri === undefined || redirectUri === '') {
+        throw (0, oauth_error_1.invalidRequest)('Missing required parameter: redirect_uri');
+    }
+    const client = await options.serverClient.getRegisteredClient(clientId);
+    if (!client) {
+        throw (0, oauth_error_1.invalidRequest)('Unknown client_id');
+    }
+    assertRegisteredRedirectUri(client.redirect_uris, redirectUri, oauth_error_1.invalidRequest);
+    // redirect_uri is now trusted: remaining validation errors redirect back to
+    // the client with error + state (RFC 6749 §4.1.2.1).
+    let state;
+    try {
+        state = getQueryParam(ctx, 'state');
+        const responseType = getQueryParam(ctx, 'response_type');
+        if (responseType !== 'code') {
+            throw (0, oauth_error_1.invalidRequest)('response_type must be "code"');
+        }
+        if (getQueryParam(ctx, 'code_challenge_method') !== 'S256') {
+            throw (0, oauth_error_1.invalidRequest)('code_challenge_method must be S256');
+        }
+        const codeChallenge = getQueryParam(ctx, 'code_challenge');
+        if (codeChallenge === undefined || !S256_CODE_CHALLENGE_PATTERN.test(codeChallenge)) {
+            throw (0, oauth_error_1.invalidRequest)('code_challenge is missing or malformed');
+        }
+        if (state === undefined || state === '') {
+            throw (0, oauth_error_1.invalidRequest)('Missing required parameter: state');
+        }
+        const appBase = new URL(options.forestAppUrl);
+        const authorizeUrl = new URL(`${appBase.pathname.replace(/\/$/, '')}/oauth/authorize`, appBase);
+        authorizeUrl.searchParams.set('client_id', clientId);
+        authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+        authorizeUrl.searchParams.set('response_type', 'code');
+        authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+        authorizeUrl.searchParams.set('code_challenge_method', 'S256');
+        authorizeUrl.searchParams.set('state', state);
+        authorizeUrl.searchParams.set('environmentId', String(options.environmentId));
+        ctx.redirect(authorizeUrl.toString());
+    }
+    catch (error) {
+        if (error instanceof oauth_error_1.OAuthRequestError) {
+            redirectAuthorizeError(ctx, redirectUri, state, error);
+            return;
+        }
+        throw error;
+    }
+}
+function computeExpiresIn(serverTokens) {
+    const saasRemaining = serverTokens.expiresAt - Math.floor(Date.now() / 1000);
+    if (saasRemaining <= 0) {
+        throw (0, oauth_error_1.invalidGrant)('The Forest server access token is already expired');
+    }
+    return Math.min(bff_token_1.BFF_ACCESS_TOKEN_MAX_EXPIRES_IN, saasRemaining);
+}
+async function parseTokenRequest(ctx, options) {
+    const { body } = ctx.request;
+    if (typeof body !== 'object' || body === null) {
+        throw (0, oauth_error_1.invalidRequest)('Missing request body');
+    }
+    const params = body;
+    if (params.grant_type !== 'authorization_code') {
+        throw (0, oauth_error_1.unsupportedGrantType)('Only authorization_code is supported');
+    }
+    const request = {
+        code: requireBodyString(params, 'code'),
+        clientId: requireBodyString(params, 'client_id'),
+        codeVerifier: requireBodyString(params, 'code_verifier'),
+        redirectUri: requireBodyString(params, 'redirect_uri'),
+    };
+    assertValidCodeVerifier(request.codeVerifier);
+    const client = await options.serverClient.getRegisteredClient(request.clientId);
+    if (!client) {
+        throw (0, oauth_error_1.invalidClient)('Unknown client_id');
+    }
+    assertRegisteredRedirectUri(client.redirect_uris, request.redirectUri, oauth_error_1.invalidGrant);
+    return request;
+}
+async function exchangeForServerTokens(request, options) {
+    try {
+        return await options.serverClient.exchangeCode(request);
+    }
+    catch (error) {
+        if (error instanceof forest_server_client_1.OAuthExchangeError) {
+            options.logger('Warn', 'Forest server code exchange rejected', { saasError: error.error });
+            throw toSafeExchangeError(error.error);
+        }
+        throw error;
+    }
+}
+function isRetriableExchangeError(error) {
+    return !(error instanceof oauth_error_1.OAuthRequestError) || error.status >= 500;
+}
+async function resolveIdentity(serverTokens, options) {
+    try {
+        return await options.serverClient.getUserInfo(serverTokens.renderingId, serverTokens.saasAccessToken);
+    }
+    catch (error) {
+        options.logger('Warn', 'Failed to resolve user info after exchange', {
+            renderingId: serverTokens.renderingId,
+        });
+        throw mapIdentityError(error);
+    }
+}
+async function handleToken(ctx, options) {
+    const request = await parseTokenRequest(ctx, options);
+    if (!options.sessionStore.claimAuthorizationCode(request.code)) {
+        throw (0, oauth_error_1.invalidGrant)('Authorization code has already been used');
+    }
+    let serverTokens;
+    try {
+        serverTokens = await exchangeForServerTokens(request, options);
+    }
+    catch (error) {
+        if (isRetriableExchangeError(error)) {
+            options.sessionStore.releaseAuthorizationCode(request.code);
+        }
+        throw error;
+    }
+    const expiresInSeconds = computeExpiresIn(serverTokens);
+    const user = await resolveIdentity(serverTokens, options);
+    const { sid, refreshToken } = options.sessionStore.create({
+        saasAccessToken: serverTokens.saasAccessToken,
+        saasRefreshToken: serverTokens.saasRefreshToken,
+        renderingId: serverTokens.renderingId,
+        userId: user.id,
+    });
+    const accessToken = (0, bff_token_1.issueBffAccessToken)({
+        sid,
+        user,
+        renderingId: serverTokens.renderingId,
+        authSecret: options.authSecret,
+        expiresInSeconds,
+    });
+    options.logger('Info', 'Issued BFF session token', {
+        renderingId: serverTokens.renderingId,
+        userId: user.id,
+    });
+    ctx.set('Cache-Control', 'no-store');
+    ctx.set('Pragma', 'no-cache');
+    ctx.status = 200;
+    ctx.body = {
+        access_token: accessToken,
+        token_type: 'Bearer',
+        expires_in: expiresInSeconds,
+        refresh_token: refreshToken,
+    };
+}
+function matchRoute(ctx) {
+    if (ctx.method === 'GET' && ctx.path === '/oauth/authorize')
+        return handleAuthorize;
+    if (ctx.method === 'POST' && ctx.path === '/oauth/token')
+        return handleToken;
+    return undefined;
+}
+function writeError(ctx, error, options) {
+    if (error instanceof oauth_error_1.OAuthRequestError) {
+        ctx.status = error.status;
+        ctx.body = (0, oauth_error_1.toErrorBody)(error);
+        return;
+    }
+    options.logger('Error', 'OAuth route failure', {
+        path: ctx.path,
+        cause: error instanceof Error ? `${error.name}: ${error.message}` : String(error),
+    });
+    ctx.status = 500;
+    ctx.body = { error: 'server_error', error_description: 'OAuth processing failed' };
+}
+function createOAuthRoutes(options) {
+    return async function oauthRoutes(ctx, next) {
+        const handler = matchRoute(ctx);
+        if (!handler) {
+            await next();
+            return;
+        }
+        try {
+            await handler(ctx, options);
+        }
+        catch (error) {
+            writeError(ctx, error, options);
+        }
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2F1dGgtcm91dGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL29hdXRoLXJvdXRlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQWdXQSxvQ0FnQkM7QUF6V0QsMkNBQW1GO0FBQ25GLGlFQUE0RDtBQUM1RCwrQ0FRdUI7QUFXdkIsTUFBTSxxQkFBcUIsR0FBRyw0QkFBNEIsQ0FBQztBQUMzRCxNQUFNLDJCQUEyQixHQUFHLHFCQUFxQixDQUFDO0FBRTFELE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxHQUFHLENBQUM7SUFDbkMsaUJBQWlCO0lBQ2pCLGdCQUFnQjtJQUNoQixlQUFlO0lBQ2YscUJBQXFCO0lBQ3JCLHdCQUF3QjtJQUN4QixlQUFlO0NBQ2hCLENBQUMsQ0FBQztBQUVILFNBQVMsYUFBYSxDQUFDLEdBQVksRUFBRSxHQUFXO0lBQzlDLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFN0IsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFBLDRCQUFjLEVBQUMsdUNBQXVDLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELFNBQVMsaUJBQWlCLENBQUMsSUFBNkIsRUFBRSxHQUFXO0lBQ25FLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUV4QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFBLDRCQUFjLEVBQUMsK0JBQStCLEdBQUcsRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUVELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELFNBQVMsdUJBQXVCLENBQUMsWUFBb0I7SUFDbkQsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDckQsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLDJCQUEyQixDQUNsQyxZQUFrQyxFQUNsQyxXQUFtQixFQUNuQixVQUFrRDtJQUVsRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzlELE1BQU0sSUFBQSw0QkFBYyxFQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVELElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxVQUFVLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN4RSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsbUJBQW1CLENBQUMsU0FBaUI7SUFDNUMsSUFBSSxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN4QyxPQUFPLElBQUksK0JBQWlCLENBQUMsR0FBRyxFQUFFLFNBQVMsRUFBRSxvQ0FBb0MsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxPQUFPLElBQUksK0JBQWlCLENBQzFCLEdBQUcsRUFDSCxjQUFjLEVBQ2QsK0NBQStDLENBQ2hELENBQUM7QUFDSixDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxLQUFjO0lBQ3RDLE1BQU0sSUFBSSxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUV0RCxJQUFJLElBQUksS0FBSyxnQkFBZ0IsRUFBRSxDQUFDO1FBQzlCLE9BQU8sSUFBQSxzQ0FBd0IsRUFBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxPQUFPLElBQUksK0JBQWlCLENBQUMsR0FBRyxFQUFFLDRCQUE0QixFQUFFLDRCQUE0QixDQUFDLENBQUM7QUFDaEcsQ0FBQztBQUVELFNBQVMsc0JBQXNCLENBQzdCLEdBQVksRUFDWixXQUFtQixFQUNuQixLQUF5QixFQUN6QixLQUF3QjtJQUV4QixNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNwQyxNQUFNLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzdDLE1BQU0sQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLG1CQUFtQixFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM1RCxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLEVBQUU7UUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFFakYsR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQztBQUNsQyxDQUFDO0FBRUQsS0FBSyxVQUFVLGVBQWUsQ0FBQyxHQUFZLEVBQUUsT0FBMkI7SUFDdEUsNkVBQTZFO0lBQzdFLDZFQUE2RTtJQUM3RSxNQUFNLFFBQVEsR0FBRyxhQUFhLENBQUMsR0FBRyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBRWpELElBQUksUUFBUSxLQUFLLFNBQVMsSUFBSSxRQUFRLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFBLDRCQUFjLEVBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBRUQsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDLEdBQUcsRUFBRSxjQUFjLENBQUMsQ0FBQztJQUV2RCxJQUFJLFdBQVcsS0FBSyxTQUFTLElBQUksV0FBVyxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ3BELE1BQU0sSUFBQSw0QkFBYyxFQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUVELE1BQU0sTUFBTSxHQUFHLE1BQU0sT0FBTyxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUV4RSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDWixNQUFNLElBQUEsNEJBQWMsRUFBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRCwyQkFBMkIsQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLFdBQVcsRUFBRSw0QkFBYyxDQUFDLENBQUM7SUFFL0UsNEVBQTRFO0lBQzVFLHFEQUFxRDtJQUNyRCxJQUFJLEtBQXlCLENBQUM7SUFFOUIsSUFBSSxDQUFDO1FBQ0gsS0FBSyxHQUFHLGFBQWEsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDcEMsTUFBTSxZQUFZLEdBQUcsYUFBYSxDQUFDLEdBQUcsRUFBRSxlQUFlLENBQUMsQ0FBQztRQUV6RCxJQUFJLFlBQVksS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUEsNEJBQWMsRUFBQyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFFRCxJQUFJLGFBQWEsQ0FBQyxHQUFHLEVBQUUsdUJBQXVCLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUMzRCxNQUFNLElBQUEsNEJBQWMsRUFBQyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxhQUFhLENBQUMsR0FBRyxFQUFFLGdCQUFnQixDQUFDLENBQUM7UUFFM0QsSUFBSSxhQUFhLEtBQUssU0FBUyxJQUFJLENBQUMsMkJBQTJCLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDcEYsTUFBTSxJQUFBLDRCQUFjLEVBQUMsd0NBQXdDLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBRUQsSUFBSSxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUN4QyxNQUFNLElBQUEsNEJBQWMsRUFBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDOUMsTUFBTSxZQUFZLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2hHLFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUNyRCxZQUFZLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsV0FBVyxDQUFDLENBQUM7UUFDM0QsWUFBWSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3ZELFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLGdCQUFnQixFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQy9ELFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLHVCQUF1QixFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQy9ELFlBQVksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztRQUM5QyxZQUFZLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBRTlFLEdBQUcsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSwrQkFBaUIsRUFBRSxDQUFDO1lBQ3ZDLHNCQUFzQixDQUFDLEdBQUcsRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBRXZELE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsWUFBMEI7SUFDbEQsTUFBTSxhQUFhLEdBQUcsWUFBWSxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztJQUU3RSxJQUFJLGFBQWEsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUEsMEJBQVksRUFBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRCxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsMkNBQStCLEVBQUUsYUFBYSxDQUFDLENBQUM7QUFDbEUsQ0FBQztBQVNELEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxHQUFZLEVBQUUsT0FBMkI7SUFDeEUsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLEdBQUcsQ0FBQyxPQUE2QixDQUFDO0lBRW5ELElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUM5QyxNQUFNLElBQUEsNEJBQWMsRUFBQyxzQkFBc0IsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxJQUErQixDQUFDO0lBRS9DLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxvQkFBb0IsRUFBRSxDQUFDO1FBQy9DLE1BQU0sSUFBQSxrQ0FBb0IsRUFBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBaUI7UUFDNUIsSUFBSSxFQUFFLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUM7UUFDdkMsUUFBUSxFQUFFLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUM7UUFDaEQsWUFBWSxFQUFFLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxlQUFlLENBQUM7UUFDeEQsV0FBVyxFQUFFLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxjQUFjLENBQUM7S0FDdkQsQ0FBQztJQUVGLHVCQUF1QixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUU5QyxNQUFNLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBRWhGLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNaLE1BQU0sSUFBQSwyQkFBYSxFQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVELDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSwwQkFBWSxDQUFDLENBQUM7SUFFckYsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQztBQUVELEtBQUssVUFBVSx1QkFBdUIsQ0FDcEMsT0FBcUIsRUFDckIsT0FBMkI7SUFFM0IsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVkseUNBQWtCLEVBQUUsQ0FBQztZQUN4QyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxzQ0FBc0MsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUMzRixNQUFNLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN6QyxDQUFDO1FBRUQsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsd0JBQXdCLENBQUMsS0FBYztJQUM5QyxPQUFPLENBQUMsQ0FBQyxLQUFLLFlBQVksK0JBQWlCLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQztBQUN0RSxDQUFDO0FBRUQsS0FBSyxVQUFVLGVBQWUsQ0FDNUIsWUFBMEIsRUFDMUIsT0FBMkI7SUFFM0IsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUMzQyxZQUFZLENBQUMsV0FBVyxFQUN4QixZQUFZLENBQUMsZUFBZSxDQUM3QixDQUFDO0lBQ0osQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSw0Q0FBNEMsRUFBRTtZQUNuRSxXQUFXLEVBQUUsWUFBWSxDQUFDLFdBQVc7U0FDdEMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNoQyxDQUFDO0FBQ0gsQ0FBQztBQUVELEtBQUssVUFBVSxXQUFXLENBQUMsR0FBWSxFQUFFLE9BQTJCO0lBQ2xFLE1BQU0sT0FBTyxHQUFHLE1BQU0saUJBQWlCLENBQUMsR0FBRyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBRXRELElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQy9ELE1BQU0sSUFBQSwwQkFBWSxFQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUVELElBQUksWUFBMEIsQ0FBQztJQUUvQixJQUFJLENBQUM7UUFDSCxZQUFZLEdBQUcsTUFBTSx1QkFBdUIsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDcEMsT0FBTyxDQUFDLFlBQVksQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUVELE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sZ0JBQWdCLEdBQUcsZ0JBQWdCLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDeEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxlQUFlLENBQUMsWUFBWSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBRTFELE1BQU0sRUFBRSxHQUFHLEVBQUUsWUFBWSxFQUFFLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUM7UUFDeEQsZUFBZSxFQUFFLFlBQVksQ0FBQyxlQUFlO1FBQzdDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxnQkFBZ0I7UUFDL0MsV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRTtLQUNoQixDQUFDLENBQUM7SUFFSCxNQUFNLFdBQVcsR0FBRyxJQUFBLCtCQUFtQixFQUFDO1FBQ3RDLEdBQUc7UUFDSCxJQUFJO1FBQ0osV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVTtRQUM5QixnQkFBZ0I7S0FDakIsQ0FBQyxDQUFDO0lBRUgsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsMEJBQTBCLEVBQUU7UUFDakQsV0FBVyxFQUFFLFlBQVksQ0FBQyxXQUFXO1FBQ3JDLE1BQU0sRUFBRSxJQUFJLENBQUMsRUFBRTtLQUNoQixDQUFDLENBQUM7SUFFSCxHQUFHLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNyQyxHQUFHLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUM5QixHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztJQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHO1FBQ1QsWUFBWSxFQUFFLFdBQVc7UUFDekIsVUFBVSxFQUFFLFFBQVE7UUFDcEIsVUFBVSxFQUFFLGdCQUFnQjtRQUM1QixhQUFhLEVBQUUsWUFBWTtLQUM1QixDQUFDO0FBQ0osQ0FBQztBQUlELFNBQVMsVUFBVSxDQUFDLEdBQVk7SUFDOUIsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsSUFBSSxLQUFLLGtCQUFrQjtRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ3BGLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksR0FBRyxDQUFDLElBQUksS0FBSyxjQUFjO1FBQUUsT0FBTyxXQUFXLENBQUM7SUFFN0UsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVELFNBQVMsVUFBVSxDQUFDLEdBQVksRUFBRSxLQUFjLEVBQUUsT0FBMkI7SUFDM0UsSUFBSSxLQUFLLFlBQVksK0JBQWlCLEVBQUUsQ0FBQztRQUN2QyxHQUFHLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDMUIsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFBLHlCQUFXLEVBQUMsS0FBSyxDQUFDLENBQUM7UUFFOUIsT0FBTztJQUNULENBQUM7SUFFRCxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsRUFBRTtRQUM3QyxJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7UUFDZCxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztLQUNsRixDQUFDLENBQUM7SUFDSCxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUcsQ0FBQztJQUNqQixHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSx5QkFBeUIsRUFBRSxDQUFDO0FBQ3JGLENBQUM7QUFFRCxTQUF3QixpQkFBaUIsQ0FBQyxPQUEyQjtJQUNuRSxPQUFPLEtBQUssVUFBVSxXQUFXLENBQUMsR0FBRyxFQUFFLElBQUk7UUFDekMsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBRWhDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxFQUFFLENBQUM7WUFFYixPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sT0FBTyxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLFVBQVUsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2xDLENBQUM7SUFDSCxDQUFDLENBQUM7QUFDSixDQUFDIn0=

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,8 @@
+export interface PkcePair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+export declare function createVerifier(): string;
+export declare function challengeFromVerifier(verifier: string): string;
+export declare function createPkcePair(): PkcePair;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.js

@@ -0,0 +1,23 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVerifier = createVerifier;
+exports.challengeFromVerifier = challengeFromVerifier;
+exports.createPkcePair = createPkcePair;
+const crypto_1 = __importDefault(require("crypto"));
+function base64url(buffer) {
+    return buffer.toString('base64url');
+}
+function createVerifier() {
+    return base64url(crypto_1.default.randomBytes(64));
+}
+function challengeFromVerifier(verifier) {
+    return base64url(crypto_1.default.createHash('sha256').update(verifier).digest());
+}
+function createPkcePair() {
+    const codeVerifier = createVerifier();
+    return { codeVerifier, codeChallenge: challengeFromVerifier(codeVerifier) };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGtjZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vYXV0aC9wa2NlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBV0Esd0NBRUM7QUFFRCxzREFFQztBQUVELHdDQUlDO0FBdkJELG9EQUE0QjtBQU81QixTQUFTLFNBQVMsQ0FBQyxNQUFjO0lBQy9CLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUN0QyxDQUFDO0FBRUQsU0FBZ0IsY0FBYztJQUM1QixPQUFPLFNBQVMsQ0FBQyxnQkFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQzNDLENBQUM7QUFFRCxTQUFnQixxQkFBcUIsQ0FBQyxRQUFnQjtJQUNwRCxPQUFPLFNBQVMsQ0FBQyxnQkFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQsU0FBZ0IsY0FBYztJQUM1QixNQUFNLFlBQVksR0FBRyxjQUFjLEVBQUUsQ0FBQztJQUV0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxxQkFBcUIsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO0FBQzlFLENBQUMifQ==

package/dist/oauth/session-lifecycle.d.ts

@@ -0,0 +1,9 @@
+import type ForestServerClient from './forest-server-client';
+import type { SessionStore } from './session-store';
+export interface EnsureFreshServerAccessParams {
+    sid: string;
+    store: SessionStore;
+    serverClient: ForestServerClient;
+}
+export default function ensureFreshServerAccess({ sid, store, serverClient, }: EnsureFreshServerAccessParams): Promise<string>;
+//# sourceMappingURL=session-lifecycle.d.ts.map

package/dist/oauth/session-lifecycle.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = ensureFreshServerAccess;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const forest_server_client_1 = require("./forest-server-client");
+const oauth_error_1 = require("./oauth-error");
+const CLIENT_ERROR_CODES = new Set(['invalid_grant', 'invalid_request', 'invalid_client']);
+const inFlightRefreshesBySid = new Map();
+function accessTokenExpiry(saasAccessToken) {
+    const decoded = jsonwebtoken_1.default.decode(saasAccessToken);
+    return decoded?.exp ?? 0;
+}
+async function refreshAndPersist(sid, store, serverClient) {
+    const currentRefresh = store.getSaasRefreshToken(sid);
+    if (currentRefresh === undefined) {
+        throw (0, oauth_error_1.sessionExpired)('Session not found or expired');
+    }
+    let rotated;
+    try {
+        rotated = await serverClient.refreshServerToken(currentRefresh);
+    }
+    catch (error) {
+        if (error instanceof forest_server_client_1.OAuthExchangeError && CLIENT_ERROR_CODES.has(error.error)) {
+            throw (0, oauth_error_1.sessionExpired)('The Forest server rejected the refresh token');
+        }
+        throw (0, oauth_error_1.serverError)('Failed to reach the Forest server to refresh the session');
+    }
+    if (!store.get(sid)) {
+        throw (0, oauth_error_1.sessionExpired)('Session expired during token refresh');
+    }
+    store.updateSaasTokens(sid, {
+        saasAccessToken: rotated.saasAccessToken,
+        saasRefreshToken: rotated.saasRefreshToken,
+    });
+    return rotated.saasAccessToken;
+}
+async function ensureFreshServerAccess({ sid, store, serverClient, }) {
+    const session = store.get(sid);
+    if (!session) {
+        throw (0, oauth_error_1.sessionExpired)('Session not found or expired');
+    }
+    if (accessTokenExpiry(session.saasAccessToken) > Math.floor(Date.now() / 1000)) {
+        return session.saasAccessToken;
+    }
+    const existing = inFlightRefreshesBySid.get(sid);
+    if (existing)
+        return existing;
+    const refresh = refreshAndPersist(sid, store, serverClient).finally(() => {
+        inFlightRefreshesBySid.delete(sid);
+    });
+    inFlightRefreshesBySid.set(sid, refresh);
+    return refresh;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbi1saWZlY3ljbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvb2F1dGgvc2Vzc2lvbi1saWZlY3ljbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUEyREEsMENBd0JDO0FBaEZELGdFQUF3QztBQUV4QyxpRUFBNEQ7QUFDNUQsK0NBQTREO0FBUTVELE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxlQUFlLEVBQUUsaUJBQWlCLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0FBRTNGLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxHQUFHLEVBQTJCLENBQUM7QUFFbEUsU0FBUyxpQkFBaUIsQ0FBQyxlQUF1QjtJQUNoRCxNQUFNLE9BQU8sR0FBRyxzQkFBWSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQTRCLENBQUM7SUFFaEYsT0FBTyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztBQUMzQixDQUFDO0FBRUQsS0FBSyxVQUFVLGlCQUFpQixDQUM5QixHQUFXLEVBQ1gsS0FBbUIsRUFDbkIsWUFBZ0M7SUFFaEMsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRXRELElBQUksY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQUksT0FBc0UsQ0FBQztJQUUzRSxJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsTUFBTSxZQUFZLENBQUMsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSx5Q0FBa0IsSUFBSSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDL0UsTUFBTSxJQUFBLDRCQUFjLEVBQUMsOENBQThDLENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBRUQsTUFBTSxJQUFBLHlCQUFXLEVBQUMsMERBQTBELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBRUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNwQixNQUFNLElBQUEsNEJBQWMsRUFBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFFRCxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxFQUFFO1FBQzFCLGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZTtRQUN4QyxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsZ0JBQWdCO0tBQzNDLENBQUMsQ0FBQztJQUVILE9BQU8sT0FBTyxDQUFDLGVBQWUsQ0FBQztBQUNqQyxDQUFDO0FBRWMsS0FBSyxVQUFVLHVCQUF1QixDQUFDLEVBQ3BELEdBQUcsRUFDSCxLQUFLLEVBQ0wsWUFBWSxHQUNrQjtJQUM5QixNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBRS9CLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNiLE1BQU0sSUFBQSw0QkFBYyxFQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELElBQUksaUJBQWlCLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxPQUFPLENBQUMsZUFBZSxDQUFDO0lBQ2pDLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakQsSUFBSSxRQUFRO1FBQUUsT0FBTyxRQUFRLENBQUM7SUFFOUIsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxZQUFZLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO1FBQ3ZFLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNyQyxDQUFDLENBQUMsQ0FBQztJQUNILHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFFekMsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyJ9

package/dist/oauth/session-store.d.ts

@@ -0,0 +1,42 @@
+import type { EncryptedBlob, TokenCipher } from './token-cipher';
+export interface CreateSessionInput {
+    saasAccessToken: string;
+    saasRefreshToken: string;
+    renderingId: number;
+    userId: number;
+}
+export interface StoredSession {
+    saasAccessToken: string;
+    saasRefreshTokenBlob: EncryptedBlob;
+    refreshTokenHash: string;
+    renderingId: number;
+    userId: number;
+    expiresAt: number;
+}
+export interface CreatedSession {
+    sid: string;
+    refreshToken: string;
+}
+export interface UpdateSaasTokensInput {
+    saasAccessToken: string;
+    saasRefreshToken: string;
+}
+export interface SessionStore {
+    create(input: CreateSessionInput): CreatedSession;
+    get(sid: string): StoredSession | undefined;
+    getSaasRefreshToken(sid: string): string | undefined;
+    updateSaasTokens(sid: string, tokens: UpdateSaasTokensInput): void;
+    claimAuthorizationCode(code: string): boolean;
+    releaseAuthorizationCode(code: string): void;
+    pendingClaimCount(): number;
+}
+export interface SessionStoreOptions {
+    cipher: TokenCipher;
+    now: () => number;
+    sessionTtlSeconds: number;
+    authCodeTtlSeconds?: number;
+    maxPendingCodes?: number;
+}
+export declare function createSid(): string;
+export default function createInMemorySessionStore({ cipher, now, sessionTtlSeconds, authCodeTtlSeconds, maxPendingCodes, }: SessionStoreOptions): SessionStore;
+//# sourceMappingURL=session-store.d.ts.map

package/dist/oauth/session-store.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSid = createSid;
+exports.default = createInMemorySessionStore;
+const crypto_1 = __importDefault(require("crypto"));
+const DEFAULT_AUTH_CODE_TTL_SECONDS = 5 * 60;
+const DEFAULT_MAX_PENDING_CODES = 10000;
+function createSid() {
+    return crypto_1.default.randomBytes(32).toString('base64url');
+}
+function createOpaqueToken() {
+    return crypto_1.default.randomBytes(32).toString('base64url');
+}
+function hashToken(token) {
+    return crypto_1.default.createHash('sha256').update(token).digest('base64url');
+}
+function createInMemorySessionStore({ cipher, now, sessionTtlSeconds, authCodeTtlSeconds = DEFAULT_AUTH_CODE_TTL_SECONDS, maxPendingCodes = DEFAULT_MAX_PENDING_CODES, }) {
+    const sessions = new Map();
+    const usedCodes = new Map();
+    function purgeExpiredCodes() {
+        const current = now();
+        for (const [code, expiresAt] of usedCodes) {
+            if (current >= expiresAt)
+                usedCodes.delete(code);
+        }
+    }
+    function purgeExpiredSessions() {
+        const current = now();
+        for (const [sid, session] of sessions) {
+            if (current >= session.expiresAt)
+                sessions.delete(sid);
+        }
+    }
+    function liveSession(sid) {
+        const session = sessions.get(sid);
+        if (!session)
+            return undefined;
+        if (now() >= session.expiresAt) {
+            sessions.delete(sid);
+            return undefined;
+        }
+        return session;
+    }
+    return {
+        create(input) {
+            purgeExpiredSessions();
+            const sid = createSid();
+            const refreshToken = createOpaqueToken();
+            sessions.set(sid, {
+                saasAccessToken: input.saasAccessToken,
+                saasRefreshTokenBlob: cipher.encrypt(input.saasRefreshToken),
+                refreshTokenHash: hashToken(refreshToken),
+                renderingId: input.renderingId,
+                userId: input.userId,
+                expiresAt: now() + sessionTtlSeconds * 1000,
+            });
+            return { sid, refreshToken };
+        },
+        get(sid) {
+            const session = liveSession(sid);
+            return session ? { ...session } : undefined;
+        },
+        getSaasRefreshToken(sid) {
+            const session = liveSession(sid);
+            return session ? cipher.decrypt(session.saasRefreshTokenBlob) : undefined;
+        },
+        updateSaasTokens(sid, tokens) {
+            const session = liveSession(sid);
+            if (!session)
+                return;
+            session.saasAccessToken = tokens.saasAccessToken;
+            session.saasRefreshTokenBlob = cipher.encrypt(tokens.saasRefreshToken);
+        },
+        claimAuthorizationCode(code) {
+            purgeExpiredCodes();
+            if (usedCodes.has(code))
+                return false;
+            if (usedCodes.size >= maxPendingCodes)
+                return false;
+            usedCodes.set(code, now() + authCodeTtlSeconds * 1000);
+            return true;
+        },
+        releaseAuthorizationCode(code) {
+            usedCodes.delete(code);
+        },
+        pendingClaimCount() {
+            purgeExpiredCodes();
+            return usedCodes.size;
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbi1zdG9yZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9vYXV0aC9zZXNzaW9uLXN0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBbURBLDhCQUVDO0FBVUQsNkNBa0dDO0FBL0pELG9EQUE0QjtBQThDNUIsTUFBTSw2QkFBNkIsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDO0FBQzdDLE1BQU0seUJBQXlCLEdBQUcsS0FBTSxDQUFDO0FBRXpDLFNBQWdCLFNBQVM7SUFDdkIsT0FBTyxnQkFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7QUFDdEQsQ0FBQztBQUVELFNBQVMsaUJBQWlCO0lBQ3hCLE9BQU8sZ0JBQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3RELENBQUM7QUFFRCxTQUFTLFNBQVMsQ0FBQyxLQUFhO0lBQzlCLE9BQU8sZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztBQUN2RSxDQUFDO0FBRUQsU0FBd0IsMEJBQTBCLENBQUMsRUFDakQsTUFBTSxFQUNOLEdBQUcsRUFDSCxpQkFBaUIsRUFDakIsa0JBQWtCLEdBQUcsNkJBQTZCLEVBQ2xELGVBQWUsR0FBRyx5QkFBeUIsR0FDdkI7SUFDcEIsTUFBTSxRQUFRLEdBQUcsSUFBSSxHQUFHLEVBQXlCLENBQUM7SUFDbEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFFNUMsU0FBUyxpQkFBaUI7UUFDeEIsTUFBTSxPQUFPLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFFdEIsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQzFDLElBQUksT0FBTyxJQUFJLFNBQVM7Z0JBQUUsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNuRCxDQUFDO0lBQ0gsQ0FBQztJQUVELFNBQVMsb0JBQW9CO1FBQzNCLE1BQU0sT0FBTyxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBRXRCLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUN0QyxJQUFJLE9BQU8sSUFBSSxPQUFPLENBQUMsU0FBUztnQkFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3pELENBQUM7SUFDSCxDQUFDO0lBRUQsU0FBUyxXQUFXLENBQUMsR0FBVztRQUM5QixNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxPQUFPO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFFL0IsSUFBSSxHQUFHLEVBQUUsSUFBSSxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDL0IsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUVyQixPQUFPLFNBQVMsQ0FBQztRQUNuQixDQUFDO1FBRUQsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVELE9BQU87UUFDTCxNQUFNLENBQUMsS0FBSztZQUNWLG9CQUFvQixFQUFFLENBQUM7WUFDdkIsTUFBTSxHQUFHLEdBQUcsU0FBUyxFQUFFLENBQUM7WUFDeEIsTUFBTSxZQUFZLEdBQUcsaUJBQWlCLEVBQUUsQ0FBQztZQUV6QyxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRTtnQkFDaEIsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO2dCQUN0QyxvQkFBb0IsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztnQkFDNUQsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQztnQkFDekMsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2dCQUM5QixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07Z0JBQ3BCLFNBQVMsRUFBRSxHQUFHLEVBQUUsR0FBRyxpQkFBaUIsR0FBRyxJQUFJO2FBQzVDLENBQUMsQ0FBQztZQUVILE9BQU8sRUFBRSxHQUFHLEVBQUUsWUFBWSxFQUFFLENBQUM7UUFDL0IsQ0FBQztRQUVELEdBQUcsQ0FBQyxHQUFHO1lBQ0wsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBRWpDLE9BQU8sT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUM5QyxDQUFDO1FBRUQsbUJBQW1CLENBQUMsR0FBRztZQUNyQixNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7WUFFakMsT0FBTyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUM1RSxDQUFDO1FBRUQsZ0JBQWdCLENBQUMsR0FBRyxFQUFFLE1BQU07WUFDMUIsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2pDLElBQUksQ0FBQyxPQUFPO2dCQUFFLE9BQU87WUFFckIsT0FBTyxDQUFDLGVBQWUsR0FBRyxNQUFNLENBQUMsZUFBZSxDQUFDO1lBQ2pELE9BQU8sQ0FBQyxvQkFBb0IsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFFRCxzQkFBc0IsQ0FBQyxJQUFJO1lBQ3pCLGlCQUFpQixFQUFFLENBQUM7WUFDcEIsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQztnQkFBRSxPQUFPLEtBQUssQ0FBQztZQUV0QyxJQUFJLFNBQVMsQ0FBQyxJQUFJLElBQUksZUFBZTtnQkFBRSxPQUFPLEtBQUssQ0FBQztZQUVwRCxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxrQkFBa0IsR0FBRyxJQUFJLENBQUMsQ0FBQztZQUV2RCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCx3QkFBd0IsQ0FBQyxJQUFJO1lBQzNCLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekIsQ0FBQztRQUVELGlCQUFpQjtZQUNmLGlCQUFpQixFQUFFLENBQUM7WUFFcEIsT0FBTyxTQUFTLENBQUMsSUFBSSxDQUFDO1FBQ3hCLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyJ9

package/dist/oauth/token-cipher.d.ts

@@ -0,0 +1,11 @@
+export interface EncryptedBlob {
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+}
+export interface TokenCipher {
+    encrypt(plaintext: string): EncryptedBlob;
+    decrypt(blob: EncryptedBlob): string;
+}
+export default function createTokenCipher(base64Key: string): TokenCipher;
+//# sourceMappingURL=token-cipher.d.ts.map

package/dist/oauth/token-cipher.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = createTokenCipher;
+const crypto_1 = __importDefault(require("crypto"));
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+function bytes(value) {
+    return new Uint8Array(typeof value === 'string' ? Buffer.from(value, 'base64') : value);
+}
+function toBase64(value) {
+    return Buffer.from(value).toString('base64');
+}
+function createTokenCipher(base64Key) {
+    const key = bytes(base64Key);
+    return {
+        encrypt(plaintext) {
+            const iv = new Uint8Array(crypto_1.default.randomBytes(IV_BYTES));
+            const cipher = crypto_1.default.createCipheriv(ALGORITHM, key, iv);
+            const ciphertext = new Uint8Array(Buffer.concat([
+                new Uint8Array(cipher.update(plaintext, 'utf8')),
+                new Uint8Array(cipher.final()),
+            ]));
+            return {
+                iv: toBase64(iv),
+                authTag: toBase64(new Uint8Array(cipher.getAuthTag())),
+                ciphertext: toBase64(ciphertext),
+            };
+        },
+        decrypt({ iv, authTag, ciphertext }) {
+            const decipher = crypto_1.default.createDecipheriv(ALGORITHM, key, bytes(iv));
+            decipher.setAuthTag(bytes(authTag));
+            return Buffer.concat([
+                new Uint8Array(decipher.update(bytes(ciphertext))),
+                new Uint8Array(decipher.final()),
+            ]).toString('utf8');
+        },
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW4tY2lwaGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL29hdXRoL3Rva2VuLWNpcGhlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQXdCQSxvQ0E4QkM7QUF0REQsb0RBQTRCO0FBRTVCLE1BQU0sU0FBUyxHQUFHLGFBQWEsQ0FBQztBQUNoQyxNQUFNLFFBQVEsR0FBRyxFQUFFLENBQUM7QUFhcEIsU0FBUyxLQUFLLENBQUMsS0FBMEI7SUFDdkMsT0FBTyxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMxRixDQUFDO0FBRUQsU0FBUyxRQUFRLENBQUMsS0FBaUI7SUFDakMsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMvQyxDQUFDO0FBRUQsU0FBd0IsaUJBQWlCLENBQUMsU0FBaUI7SUFDekQsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBRTdCLE9BQU87UUFDTCxPQUFPLENBQUMsU0FBUztZQUNmLE1BQU0sRUFBRSxHQUFHLElBQUksVUFBVSxDQUFDLGdCQUFNLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDeEQsTUFBTSxNQUFNLEdBQUcsZ0JBQU0sQ0FBQyxjQUFjLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUN6RCxNQUFNLFVBQVUsR0FBRyxJQUFJLFVBQVUsQ0FDL0IsTUFBTSxDQUFDLE1BQU0sQ0FBQztnQkFDWixJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDaEQsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO2FBQy9CLENBQUMsQ0FDSCxDQUFDO1lBRUYsT0FBTztnQkFDTCxFQUFFLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDaEIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztnQkFDdEQsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVLENBQUM7YUFDakMsQ0FBQztRQUNKLENBQUM7UUFDRCxPQUFPLENBQUMsRUFBRSxFQUFFLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRTtZQUNqQyxNQUFNLFFBQVEsR0FBRyxnQkFBTSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDcEUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUVwQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7Z0JBQ25CLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7Z0JBQ2xELElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQzthQUNqQyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3RCLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent-bff",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "main": "dist/index.js",
   "bin": {
     "forest-bff": "dist/cli.js"
@@ -31,10 +31,14 @@
     "test": "jest"
   },
   "dependencies": {
+    "@forestadmin/forestadmin-client": "1.40.3",
+    "@koa/bodyparser": "^6.1.0",
+    "jsonwebtoken": "^9.0.3",
     "koa": "^3.0.1",
     "zod": "4.3.6"
   },
   "devDependencies": {
+    "@types/jsonwebtoken": "^9.0.1",
     "@types/koa": "^2.13.5",
     "@types/supertest": "^6.0.2",
     "supertest": "^7.1.3"