@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js

@@ -1,234 +1,155 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
+import { trace } from "../../../utils/decorators/log.js";
+import __decorate from "../../../_virtual/@oxc-project+runtime/helpers/esm/decorate.js";
+import { Emitter } from "../../../utils/event.js";
+import { isSupportedCloudIntegrationId } from "./models.js";
+import { areDomainsOnSameHost } from "../utils/domain.utils.js";
+import { isNonExpiringZeroTokenIntegrationId, isSelfManagedHostIntegrationId } from "../utils/integration.utils.js";
+//#region ../plus/integrations/src/authentication/integrationAuthenticationProvider.ts
+const maxSmallIntegerV8 = 2 ** 30 - 1;
+var IntegrationAuthenticationProviderBase = class {
+	authenticationService;
+	configuredIntegrationService;
+	disposables = [];
+	constructor(authenticationService, configuredIntegrationService) {
+		this.authenticationService = authenticationService;
+		this.configuredIntegrationService = configuredIntegrationService;
+	}
+	dispose() {
+		this.disposables.forEach((d) => d.dispose());
+	}
+	_onDidChange = new Emitter();
+	get onDidChange() {
+		return this._onDidChange.event;
+	}
+	async deleteSession(descriptor, options) {
+		const domain = isSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : void 0;
+		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, { domain });
+		await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, {
+			...descriptor,
+			cloud: true
+		}, true, { preserveConfigured: options?.preserveConfigured ?? true });
+		if (configured?.length) this.fireChange();
+	}
+	async deleteAllSessions(descriptor) {
+		const domain = isSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : void 0;
+		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, { domain });
+		await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, void 0, domain);
+		if (configured?.length) this.fireChange();
+	}
+	async getSession(descriptor, options) {
+		let session;
+		let previousToken;
+		if (options?.forceNewSession) await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, {
+			...descriptor,
+			cloud: true
+		}, true);
+		else {
+			session = await this.configuredIntegrationService.getStoredSession(this.authProviderId, options?.sync ? {
+				...descriptor,
+				cloud: true
+			} : descriptor);
+			previousToken = session?.accessToken;
+		}
+		const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
+		const refreshRejectedToken = options?.refreshRejectedToken === true && session != null;
+		if (session == null || isExpiredSession || refreshRejectedToken) {
+			session = await this.getNewSession(descriptor, {
+				...options,
+				refreshIfExpired: isExpiredSession,
+				refreshRejectedToken
+			});
+			if (session != null) await this.configuredIntegrationService.storeSession(this.authProviderId, session);
+		}
+		if (previousToken !== session?.accessToken) this.fireChange();
+		return session;
+	}
+	fireChange() {
+		queueMicrotask(() => this._onDidChange.fire());
+	}
 };
-import { trace } from '../../../utils/decorators/log.js';
-import { Emitter } from '../../../utils/event.js';
-import { areDomainsOnSameHost } from '../utils/domain.utils.js';
-import { isGitSelfManagedHostIntegrationId, isNonExpiringZeroTokenIntegrationId } from '../utils/integration.utils.js';
-import { isSupportedCloudIntegrationId } from './models.js';
-const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
-class IntegrationAuthenticationProviderBase {
-    authenticationService;
-    configuredIntegrationService;
-    disposables = [];
-    constructor(authenticationService, configuredIntegrationService) {
-        this.authenticationService = authenticationService;
-        this.configuredIntegrationService = configuredIntegrationService;
-    }
-    dispose() {
-        this.disposables.forEach(d => d.dispose());
-    }
-    _onDidChange = new Emitter();
-    get onDidChange() {
-        return this._onDidChange.event;
-    }
-    async deleteSession(descriptor, options) {
-        const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
-        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
-            domain: domain,
-        });
-        // Scope the descriptor to cloud so resolveConnectionId targets the cloud variant's id: this is a
-        // cloud-only delete, and a mixed local+cloud connection whose local descriptor is primary would
-        // otherwise resolve the local id and leave the cloud secret intact.
-        await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, { ...descriptor, cloud: true }, true, { preserveConfigured: options?.preserveConfigured ?? true });
-        if (configured?.length) {
-            this.fireChange();
-        }
-    }
-    async deleteAllSessions(descriptor) {
-        // Self-managed providers group every host under one provider id, so scope the clear to this
-        // descriptor's host when given; for cloud providers the domain stays undefined here, clearing every account.
-        const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
-        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
-            domain: domain,
-        });
-        await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined, domain);
-        if (configured?.length) {
-            this.fireChange();
-        }
-    }
-    async getSession(descriptor, options) {
-        let session;
-        let previousToken;
-        if (options?.forceNewSession) {
-            // Cloud-only delete (see deleteSession): scope to cloud so the cloud variant's id is cleared even
-            // when a mixed local+cloud connection's local descriptor is primary.
-            await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, { ...descriptor, cloud: true }, true);
-        }
-        else {
-            session = await this.configuredIntegrationService.getStoredSession(this.authProviderId, options?.sync ? { ...descriptor, cloud: true } : descriptor);
-            previousToken = session?.accessToken;
-        }
-        const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
-        // A rejected token has to re-resolve even when the stored session looks perfectly healthy: that is
-        // the whole point — the provider refused it while its expiry still says valid. Without this the
-        // stored session short-circuits here and the refresh below is never reached.
-        const refreshRejectedToken = options?.refreshRejectedToken === true && session != null;
-        if (session == null || isExpiredSession || refreshRejectedToken) {
-            session = await this.getNewSession(descriptor, {
-                ...options,
-                refreshIfExpired: isExpiredSession,
-                refreshRejectedToken: refreshRejectedToken,
-            });
-            if (session != null) {
-                await this.configuredIntegrationService.storeSession(this.authProviderId, session);
-            }
-        }
-        if (previousToken !== session?.accessToken) {
-            this.fireChange();
-        }
-        return session;
-    }
-    fireChange() {
-        queueMicrotask(() => this._onDidChange.fire());
-    }
-}
-__decorate([
-    trace()
-], IntegrationAuthenticationProviderBase.prototype, "deleteSession", null);
-__decorate([
-    trace()
-], IntegrationAuthenticationProviderBase.prototype, "deleteAllSessions", null);
-__decorate([
-    trace()
-], IntegrationAuthenticationProviderBase.prototype, "getSession", null);
-export class CloudIntegrationAuthenticationProvider extends IntegrationAuthenticationProviderBase {
-    _authProviderId;
-    constructor(authenticationService, configuredIntegrationService, _authProviderId) {
-        super(authenticationService, configuredIntegrationService);
-        this._authProviderId = _authProviderId;
-    }
-    get authProviderId() {
-        return this._authProviderId;
-    }
-    async getNewSession(descriptor, options) {
-        if (options?.forceNewSession) {
-            if ((await this.disconnectCloudSession()) === 'failure') {
-                return undefined;
-            }
-            void this.connectCloudSession(false, options?.source);
-            return undefined;
-        }
-        // TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
-        // Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
-        // make the call or not.
-        // `refreshRejectedToken` joins the list for the same reason `refreshIfExpired` is on it: both mean the
-        // session in hand is known-unusable, so skipping the cloud round trip would just re-serve it.
-        let session = options?.refreshIfExpired ||
-            options?.refreshRejectedToken ||
-            options?.createIfNeeded ||
-            options?.forceNewSession ||
-            options?.sync
-            ? await this.getCloudSession(descriptor, { refreshRejectedToken: options?.refreshRejectedToken })
-            : undefined;
-        const shouldCreateSession = options?.createIfNeeded && session == null;
-        if (shouldCreateSession) {
-            const connected = await this.connectCloudSession(true, options?.source);
-            if (!connected)
-                return undefined;
-            // This should get us the session we just created with connectCloudSession, because a syncCloudIntegrations run from
-            // integration service should have resulted in it being created and stored by this provider
-            session = await this.getSession(descriptor, { source: options?.source });
-        }
-        return session;
-    }
-    connectCloudSession(skipIfConnected, source) {
-        // Capture in a const so the type guard narrows it to `SupportedCloudIntegrationIds` (a getter
-        // access wouldn't narrow), letting us call the service directly without a cast.
-        const id = this.authProviderId;
-        if (isSupportedCloudIntegrationId(id)) {
-            return this.authenticationService.connectCloudIntegrations({ integrationIds: [id], skipIfConnected: skipIfConnected, skipPreSync: true }, {
-                source: source ?? 'integrations',
-                detail: {
-                    action: 'connect',
-                    integration: id,
-                },
-            });
-        }
-        return Promise.resolve(false);
-    }
-    async getCloudSession(descriptor, options) {
-        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
-        if (!loggedIn)
-            return undefined;
-        const cloudIntegrations = this.authenticationService.cloudIntegrations;
-        // An unscoped descriptor (no explicit connectionId) would fetch the provider-global primary via
-        // `v1/provider-tokens/<provider>`. For a self-managed provider spanning multiple hosts that primary
-        // can belong to a different host, so a forced sync of host A would hydrate host B's token here (before
-        // reconcile corrects storage). Scope to this host's own configured connection when we have one; fall
-        // through to the provider-scoped path only when nothing is configured yet (legacy/first sync).
-        const connectionId = descriptor.connectionId ??
-            (isGitSelfManagedHostIntegrationId(this.authProviderId)
-                ? this.configuredIntegrationService.getConfiguredConnectionId(this.authProviderId, descriptor.domain, true)
-                : undefined);
-        let session = await cloudIntegrations.getConnectionSession(this.authProviderId, undefined, connectionId);
-        if (session != null &&
-            isGitSelfManagedHostIntegrationId(this.authProviderId) &&
-            !areDomainsOnSameHost(session.domain, descriptor.domain)) {
-            return undefined;
-        }
-        // GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a token that never
-        // expires; left as 0 the session would be built with `expiresAt = now` and rejected as expired on the
-        // next resolution. Map it to the maximum expiry so it isn't refreshed frequently.
-        if (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) {
-            session.expiresIn = maxSmallIntegerV8; // maximum expiration length
-        }
-        // `expiresIn < 60` is a PREDICTION that the token is about to lapse, and it is the only trigger the
-        // refresh used to have. It cannot see a token the provider has already refused while the backend
-        // still believes it is valid — a revoked grant, retired scopes, an app removed from the org — where
-        // `expiresIn` stays high and the doomed token is re-sent on every read. `refreshRejectedToken` is
-        // the observed counterpart: the caller saw the provider reject this exact token, so refresh it
-        // regardless of what its expiry claims.
-        if (session != null && (session.expiresIn < 60 || options?.refreshRejectedToken)) {
-            session = await cloudIntegrations.getConnectionSession(this.authProviderId, session.accessToken, connectionId);
-            if (session != null &&
-                isGitSelfManagedHostIntegrationId(this.authProviderId) &&
-                !areDomainsOnSameHost(session.domain, descriptor.domain)) {
-                return undefined;
-            }
-        }
-        if (!session)
-            return undefined;
-        let sessionProtocol;
-        // Only derive a protocol from a domain carrying an explicit scheme; a bare `host:port` (e.g. a
-        // self-managed `ghe.example.com:8443`) parses the host as the protocol, corrupting the value.
-        if (/^[a-z][a-z\d+\-.]*:\/\//i.test(session.domain)) {
-            try {
-                sessionProtocol = new URL(session.domain).protocol;
-            }
-            catch {
-                sessionProtocol = undefined;
-            }
-        }
-        return {
-            // Prefer the backend's per-connection token id (multi-account); fall back to the resolved
-            // primary/legacy connection id so existing single-connection storage keys are preserved.
-            id: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),
-            accessToken: session.accessToken,
-            scopes: descriptor.scopes,
-            account: {
-                id: '',
-                label: '',
-            },
-            cloud: true,
-            type: session.type,
-            expiresAt: new Date(session.expiresIn * 1000 + Date.now()),
-            // Note: do not use the session's domain, because the format is different than in our model
-            domain: descriptor.domain,
-            protocol: sessionProtocol ?? undefined,
-            // Carried for providers whose client needs an app key alongside the token (e.g. Trello).
-            appKey: session.appKey,
-        };
-    }
-    async disconnectCloudSession() {
-        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
-        if (!loggedIn)
-            return 'skip';
-        const cloudIntegrations = this.authenticationService.cloudIntegrations;
-        return (await cloudIntegrations.disconnect(this.authProviderId)) ? 'success' : 'failure';
-    }
-}
+__decorate([trace()], IntegrationAuthenticationProviderBase.prototype, "deleteSession", null);
+__decorate([trace()], IntegrationAuthenticationProviderBase.prototype, "deleteAllSessions", null);
+__decorate([trace()], IntegrationAuthenticationProviderBase.prototype, "getSession", null);
+var CloudIntegrationAuthenticationProvider = class extends IntegrationAuthenticationProviderBase {
+	_authProviderId;
+	constructor(authenticationService, configuredIntegrationService, _authProviderId) {
+		super(authenticationService, configuredIntegrationService);
+		this._authProviderId = _authProviderId;
+	}
+	get authProviderId() {
+		return this._authProviderId;
+	}
+	async getNewSession(descriptor, options) {
+		if (options?.forceNewSession) {
+			if (await this.disconnectCloudSession() === "failure") return;
+			this.connectCloudSession(false, options?.source);
+			return;
+		}
+		let session = options?.refreshIfExpired || options?.refreshRejectedToken || options?.createIfNeeded || options?.forceNewSession || options?.sync ? await this.getCloudSession(descriptor, { refreshRejectedToken: options?.refreshRejectedToken }) : void 0;
+		if (options?.createIfNeeded && session == null) {
+			if (!await this.connectCloudSession(true, options?.source)) return void 0;
+			session = await this.getSession(descriptor, { source: options?.source });
+		}
+		return session;
+	}
+	connectCloudSession(skipIfConnected, source) {
+		const id = this.authProviderId;
+		if (isSupportedCloudIntegrationId(id)) return this.authenticationService.connectCloudIntegrations({
+			integrationIds: [id],
+			skipIfConnected,
+			skipPreSync: true
+		}, {
+			source: source ?? "integrations",
+			detail: {
+				action: "connect",
+				integration: id
+			}
+		});
+		return Promise.resolve(false);
+	}
+	async getCloudSession(descriptor, options) {
+		if (!(await this.authenticationService.ctx.account.getAccount() != null)) return void 0;
+		const cloudIntegrations = this.authenticationService.cloudIntegrations;
+		const connectionId = descriptor.connectionId ?? (isSelfManagedHostIntegrationId(this.authProviderId) ? this.configuredIntegrationService.getConfiguredConnectionId(this.authProviderId, descriptor.domain, true) : void 0);
+		const scopedToThisHost = this.configuredIntegrationService.isConnectionConfiguredForHost(this.authProviderId, connectionId, descriptor.domain);
+		const isForAnotherHost = (session) => session != null && isSelfManagedHostIntegrationId(this.authProviderId) && (!scopedToThisHost || Boolean(session.domain?.trim())) && !areDomainsOnSameHost(session.domain, descriptor.domain);
+		let session = await cloudIntegrations.getConnectionSession(this.authProviderId, void 0, connectionId);
+		if (isForAnotherHost(session)) return void 0;
+		if (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) session.expiresIn = maxSmallIntegerV8;
+		if (session != null && (session.expiresIn < 60 || options?.refreshRejectedToken)) {
+			session = await cloudIntegrations.getConnectionSession(this.authProviderId, session.accessToken, connectionId);
+			if (isForAnotherHost(session)) return void 0;
+		}
+		if (!session) return void 0;
+		let sessionProtocol;
+		if (/^[a-z][a-z\d+\-.]*:\/\//i.test(session.domain)) try {
+			sessionProtocol = new URL(session.domain).protocol;
+		} catch {
+			sessionProtocol = void 0;
+		}
+		return {
+			id: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),
+			accessToken: session.accessToken,
+			scopes: descriptor.scopes,
+			account: {
+				id: "",
+				label: ""
+			},
+			cloud: true,
+			type: session.type,
+			expiresAt: new Date(session.expiresIn * 1e3 + Date.now()),
+			domain: descriptor.domain,
+			baseUrl: session.domain || this.configuredIntegrationService.getConfiguredBaseUrl(this.authProviderId, connectionId, descriptor.domain),
+			protocol: sessionProtocol ?? void 0,
+			appKey: session.appKey
+		};
+	}
+	async disconnectCloudSession() {
+		if (!(await this.authenticationService.ctx.account.getAccount() != null)) return "skip";
+		return await this.authenticationService.cloudIntegrations.disconnect(this.authProviderId) ? "success" : "failure";
+	}
+};
+//#endregion
+export { CloudIntegrationAuthenticationProvider };
+
 //# sourceMappingURL=integrationAuthenticationProvider.js.map

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrationAuthenticationProvider.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/integrationAuthenticationProvider.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAGzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGlD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,8DAA8D;AA8ErG,MAAe,qCAAqC;IAM/B,qBAAqB;IACrB,4BAA4B;IAJ7B,WAAW,GAAiB,EAAE,CAAC;IAElD,YACoB,qBAAuD,EACvD,4BAA0D;qCAD1D,qBAAqB;4CACrB,4BAA4B;IAC7C,CAAC;IAEJ,OAAO;QACN,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEgB,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACpD,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IAChC,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CAClB,UAAsD,EACtD,OAA0C;QAE1C,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,MAAM,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,iGAAiG;QACjG,gGAAgG;QAChG,oEAAoE;QACpE,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAC3D,IAAI,CAAC,cAAc,EACnB,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAC9B,IAAI,EACJ,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,IAAI,EAAE,CAC3D,CAAC;QAEF,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB,CAAC,UAAuD;QAC9E,4FAA4F;QAC5F,6GAA6G;QAC7G,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,MAAM,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,4BAA4B,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAExG,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CACf,UAAsD,EACtD,OAA2B;QAE3B,IAAI,OAAO,CAAC;QACZ,IAAI,aAAa,CAAC;QAClB,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,kGAAkG;YAClG,qEAAqE;YACrE,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAC3D,IAAI,CAAC,cAAc,EACnB,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAC9B,IAAI,CACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,gBAAgB,CACjE,IAAI,CAAC,cAAc,EACnB,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAC3D,CAAC;YACF,aAAa,GAAG,OAAO,EAAE,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1G,mGAAmG;QACnG,gGAAgG;QAChG,6EAA6E;QAC7E,MAAM,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC;QACvF,IAAI,OAAO,IAAI,IAAI,IAAI,gBAAgB,IAAI,oBAAoB,EAAE,CAAC;YACjE,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC9C,GAAG,OAAO;gBACV,gBAAgB,EAAE,gBAAgB;gBAClC,oBAAoB,EAAE,oBAAoB;aAC1C,CAAC,CAAC;YAEH,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;QAED,IAAI,aAAa,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAOS,UAAU;QACnB,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;CACD;AA/FM;IADL,KAAK,EAAE;0EAuBP;AAGK;IADL,KAAK,EAAE;8EAcP;AAGK;IADL,KAAK,EAAE;uEA6CP;AAYF,MAAM,OAAO,sCAEX,SAAQ,qCAAyC;IAIhC,eAAe;IAHjC,YACC,qBAAuD,EACvD,4BAA0D,EACzC,eAAmB;QAEpC,KAAK,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;+BAF1C,eAAe;IAGjC,CAAC;IAED,IAAc,cAAc;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC7B,CAAC;IAEkB,KAAK,CAAC,aAAa,CACrC,UAAsD,EACtD,OAA8B;QAE9B,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,0GAA0G;QAC1G,6GAA6G;QAC7G,wBAAwB;QACxB,uGAAuG;QACvG,8FAA8F;QAC9F,IAAI,OAAO,GACV,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,IAAI;YACZ,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;YACjG,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,mBAAmB,GAAG,OAAO,EAAE,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEjC,oHAAoH;YACpH,2FAA2F;YAC3F,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,mBAAmB,CAAC,eAAwB,EAAE,MAA2B;QAChF,8FAA8F;QAC9F,gFAAgF;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CACzD,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,EAC7E;gBACC,MAAM,EAAE,MAAM,IAAI,cAAc;gBAChC,MAAM,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,EAAE;iBACf;aACD,CACD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,UAAsD,EACtD,OAA4C;QAE5C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,gGAAgG;QAChG,oGAAoG;QACpG,uGAAuG;QACvG,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY;YACvB,CAAC,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,yBAAyB,CAC3D,IAAI,CAAC,cAAc,EACnB,UAAU,CAAC,MAAM,EACjB,IAAI,CACJ;gBACF,CAAC,CAAC,SAAS,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzG,IACC,OAAO,IAAI,IAAI;YACf,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;YACtD,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EACvD,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,gGAAgG;QAChG,sGAAsG;QACtG,kFAAkF;QAClF,IAAI,OAAO,EAAE,SAAS,KAAK,CAAC,IAAI,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC,4BAA4B;QACpE,CAAC;QAED,oGAAoG;QACpG,iGAAiG;QACjG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,wCAAwC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CACrD,IAAI,CAAC,cAAc,EACnB,OAAO,CAAC,WAAW,EACnB,YAAY,CACZ,CAAC;YACF,IACC,OAAO,IAAI,IAAI;gBACf,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtD,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EACvD,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,IAAI,eAAe,CAAC;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACJ,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACR,eAAe,GAAG,SAAS,CAAC;YAC7B,CAAC;QACF,CAAC;QAED,OAAO;YACN,0FAA0F;YAC1F,yFAAyF;YACzF,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC;YACxG,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,EAAE,EAAE,EAAE;gBACN,KAAK,EAAE,EAAE;aACT;YACD,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1D,2FAA2F;YAC3F,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,eAAe,IAAI,SAAS;YACtC,yFAAyF;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB;QACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC;QAE7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,OAAO,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;CACD"}
+{"version":3,"file":"integrationAuthenticationProvider.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/integrationAuthenticationProvider.ts"],"sourcesContent":["import { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport type { Event } from '@gitlens/utils/event.js';\nimport { Emitter } from '@gitlens/utils/event.js';\nimport type { IntegrationIds } from '../constants.js';\nimport type { Sources } from '../telemetry.js';\nimport { areDomainsOnSameHost } from '../utils/domain.utils.js';\nimport { isNonExpiringZeroTokenIntegrationId, isSelfManagedHostIntegrationId } from '../utils/integration.utils.js';\nimport type { ConfiguredIntegrationService } from './configuredIntegrationService.js';\nimport type { IntegrationAuthenticationService } from './integrationAuthenticationService.js';\nimport type { ProviderAuthenticationSession } from './models.js';\nimport { isSupportedCloudIntegrationId } from './models.js';\n\nconst maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)\n\nexport interface IntegrationAuthenticationProviderDescriptor {\n\tid: IntegrationIds;\n\tscopes: string[];\n}\n\nexport interface IntegrationAuthenticationSessionDescriptor {\n\tdomain: string;\n\tscopes: string[];\n\t/** When set, reads/deletes only the matching storage variant. */\n\tcloud?: boolean;\n\t/**\n\t * Targets a specific connection when a provider has multiple accounts connected. When omitted,\n\t * operations resolve to the provider's primary connection (see\n\t * {@link ConfiguredIntegrationService.resolveConnectionId}).\n\t */\n\tconnectionId?: string;\n\t[key: string]: unknown;\n}\n\n/**\n * Options for {@link IntegrationAuthenticationProvider.getSession}. The two variants keep `sync` exclusive\n * with the interactive flags: a sync resolves whatever the cloud already has, so it must never open a connect\n * window.\n *\n * `refreshRejectedToken` marks the stored token as known-refused by the provider (an `AuthenticationError` on\n * a previous read), which forces a cloud `/refresh` even when the token's expiry still claims it is valid —\n * the case a purely time-based refresh cannot see. The refresh token itself never reaches the client: the GK\n * cloud performs the exchange server-side.\n */\nexport type GetSessionOptions =\n\t| {\n\t\t\tcreateIfNeeded?: boolean;\n\t\t\tforceNewSession?: boolean;\n\t\t\tsync?: never;\n\t\t\trefreshRejectedToken?: boolean;\n\t\t\tsource?: Sources;\n\t  }\n\t| {\n\t\t\tcreateIfNeeded?: never;\n\t\t\tforceNewSession?: never;\n\t\t\tsync: boolean;\n\t\t\trefreshRejectedToken?: boolean;\n\t\t\tsource?: Sources;\n\t  };\n\n/**\n * What {@link IntegrationAuthenticationProviderBase.getSession} passes down once it has decided the stored\n * session can't be served as-is. `refreshIfExpired` is its own conclusion, not a caller's option.\n */\ntype GetNewSessionOptions = GetSessionOptions & { refreshIfExpired?: boolean };\n\nexport interface IntegrationAuthenticationProvider extends Disposable {\n\t/**\n\t * Clears the stored secret for one connection only (never the whole provider). Unlike\n\t * {@link deleteAllSessions}, this by default leaves the descriptor in `integrations:configured` — its\n\t * primary caller is a forced re-sync, which needs `getConfigured()` to keep reporting the connection\n\t * while a fresh session is fetched to replace the deleted secret. Implementers should not treat this as\n\t * a full disconnect. Pass `preserveConfigured: false` to also drop the descriptor (e.g. when the\n\t * re-sync's replacement fetch failed and the connection should no longer be reported as connected).\n\t */\n\tdeleteSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: { preserveConfigured?: boolean },\n\t): Promise<void>;\n\tdeleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;\n\t/**\n\t * Resolves the session for `descriptor`, from storage when it is still usable and from the cloud\n\t * otherwise. See {@link GetSessionOptions}.\n\t */\n\tgetSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: GetSessionOptions,\n\t): Promise<ProviderAuthenticationSession | undefined>;\n\tget onDidChange(): Event<void>;\n}\n\nabstract class IntegrationAuthenticationProviderBase<\n\tID extends IntegrationIds = IntegrationIds,\n> implements IntegrationAuthenticationProvider {\n\tprotected readonly disposables: Disposable[] = [];\n\n\tconstructor(\n\t\tprotected readonly authenticationService: IntegrationAuthenticationService,\n\t\tprotected readonly configuredIntegrationService: ConfiguredIntegrationService,\n\t) {}\n\n\tdispose(): void {\n\t\tthis.disposables.forEach(d => d.dispose());\n\t}\n\n\tprivate readonly _onDidChange = new Emitter<void>();\n\tget onDidChange(): Event<void> {\n\t\treturn this._onDidChange.event;\n\t}\n\n\tprotected abstract get authProviderId(): ID;\n\n\t@trace()\n\tasync deleteSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: { preserveConfigured?: boolean },\n\t): Promise<void> {\n\t\tconst domain = isSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;\n\t\tconst configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {\n\t\t\tdomain: domain,\n\t\t});\n\n\t\t// Scope the descriptor to cloud so resolveConnectionId targets the cloud variant's id: this is a\n\t\t// cloud-only delete, and a mixed local+cloud connection whose local descriptor is primary would\n\t\t// otherwise resolve the local id and leave the cloud secret intact.\n\t\tawait this.configuredIntegrationService.deleteStoredSessions(\n\t\t\tthis.authProviderId,\n\t\t\t{ ...descriptor, cloud: true },\n\t\t\ttrue,\n\t\t\t{ preserveConfigured: options?.preserveConfigured ?? true },\n\t\t);\n\n\t\tif (configured?.length) {\n\t\t\tthis.fireChange();\n\t\t}\n\t}\n\n\t@trace()\n\tasync deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void> {\n\t\t// Self-managed providers group every host under one provider id, so scope the clear to this\n\t\t// descriptor's host when given; for cloud providers the domain stays undefined here, clearing every account.\n\t\tconst domain = isSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;\n\t\tconst configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {\n\t\t\tdomain: domain,\n\t\t});\n\n\t\tawait this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined, domain);\n\n\t\tif (configured?.length) {\n\t\t\tthis.fireChange();\n\t\t}\n\t}\n\n\t@trace()\n\tasync getSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: GetSessionOptions,\n\t): Promise<ProviderAuthenticationSession | undefined> {\n\t\tlet session;\n\t\tlet previousToken;\n\t\tif (options?.forceNewSession) {\n\t\t\t// Cloud-only delete (see deleteSession): scope to cloud so the cloud variant's id is cleared even\n\t\t\t// when a mixed local+cloud connection's local descriptor is primary.\n\t\t\tawait this.configuredIntegrationService.deleteStoredSessions(\n\t\t\t\tthis.authProviderId,\n\t\t\t\t{ ...descriptor, cloud: true },\n\t\t\t\ttrue,\n\t\t\t);\n\t\t} else {\n\t\t\tsession = await this.configuredIntegrationService.getStoredSession(\n\t\t\t\tthis.authProviderId,\n\t\t\t\toptions?.sync ? { ...descriptor, cloud: true } : descriptor,\n\t\t\t);\n\t\t\tpreviousToken = session?.accessToken;\n\t\t}\n\n\t\tconst isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();\n\t\t// A rejected token has to re-resolve even when the stored session looks perfectly healthy: that is\n\t\t// the whole point — the provider refused it while its expiry still says valid. Without this the\n\t\t// stored session short-circuits here and the refresh below is never reached.\n\t\tconst refreshRejectedToken = options?.refreshRejectedToken === true && session != null;\n\t\tif (session == null || isExpiredSession || refreshRejectedToken) {\n\t\t\tsession = await this.getNewSession(descriptor, {\n\t\t\t\t...options,\n\t\t\t\trefreshIfExpired: isExpiredSession,\n\t\t\t\trefreshRejectedToken: refreshRejectedToken,\n\t\t\t});\n\n\t\t\tif (session != null) {\n\t\t\t\tawait this.configuredIntegrationService.storeSession(this.authProviderId, session);\n\t\t\t}\n\t\t}\n\n\t\tif (previousToken !== session?.accessToken) {\n\t\t\tthis.fireChange();\n\t\t}\n\n\t\treturn session;\n\t}\n\n\tprotected abstract getNewSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: GetNewSessionOptions,\n\t): Promise<ProviderAuthenticationSession | undefined>;\n\n\tprotected fireChange(): void {\n\t\tqueueMicrotask(() => this._onDidChange.fire());\n\t}\n}\n\nexport class CloudIntegrationAuthenticationProvider<\n\tID extends IntegrationIds = IntegrationIds,\n> extends IntegrationAuthenticationProviderBase<ID> {\n\tconstructor(\n\t\tauthenticationService: IntegrationAuthenticationService,\n\t\tconfiguredIntegrationService: ConfiguredIntegrationService,\n\t\tprivate readonly _authProviderId: ID,\n\t) {\n\t\tsuper(authenticationService, configuredIntegrationService);\n\t}\n\n\tprotected get authProviderId(): ID {\n\t\treturn this._authProviderId;\n\t}\n\n\tprotected override async getNewSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: GetNewSessionOptions,\n\t): Promise<ProviderAuthenticationSession | undefined> {\n\t\tif (options?.forceNewSession) {\n\t\t\tif ((await this.disconnectCloudSession()) === 'failure') {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\tvoid this.connectCloudSession(false, options?.source);\n\t\t\treturn undefined;\n\t\t}\n\n\t\t// TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.\n\t\t// Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should\n\t\t// make the call or not.\n\t\t// `refreshRejectedToken` joins the list for the same reason `refreshIfExpired` is on it: both mean the\n\t\t// session in hand is known-unusable, so skipping the cloud round trip would just re-serve it.\n\t\tlet session =\n\t\t\toptions?.refreshIfExpired ||\n\t\t\toptions?.refreshRejectedToken ||\n\t\t\toptions?.createIfNeeded ||\n\t\t\toptions?.forceNewSession ||\n\t\t\toptions?.sync\n\t\t\t\t? await this.getCloudSession(descriptor, { refreshRejectedToken: options?.refreshRejectedToken })\n\t\t\t\t: undefined;\n\n\t\tconst shouldCreateSession = options?.createIfNeeded && session == null;\n\t\tif (shouldCreateSession) {\n\t\t\tconst connected = await this.connectCloudSession(true, options?.source);\n\t\t\tif (!connected) return undefined;\n\n\t\t\t// This should get us the session we just created with connectCloudSession, because a syncCloudIntegrations run from\n\t\t\t// integration service should have resulted in it being created and stored by this provider\n\t\t\tsession = await this.getSession(descriptor, { source: options?.source });\n\t\t}\n\t\treturn session;\n\t}\n\n\tprivate connectCloudSession(skipIfConnected: boolean, source: Sources | undefined): Promise<boolean> {\n\t\t// Capture in a const so the type guard narrows it to `SupportedCloudIntegrationIds` (a getter\n\t\t// access wouldn't narrow), letting us call the service directly without a cast.\n\t\tconst id = this.authProviderId;\n\t\tif (isSupportedCloudIntegrationId(id)) {\n\t\t\treturn this.authenticationService.connectCloudIntegrations(\n\t\t\t\t{ integrationIds: [id], skipIfConnected: skipIfConnected, skipPreSync: true },\n\t\t\t\t{\n\t\t\t\t\tsource: source ?? 'integrations',\n\t\t\t\t\tdetail: {\n\t\t\t\t\t\taction: 'connect',\n\t\t\t\t\t\tintegration: id,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\treturn Promise.resolve(false);\n\t}\n\n\tprivate async getCloudSession(\n\t\tdescriptor: IntegrationAuthenticationSessionDescriptor,\n\t\toptions?: { refreshRejectedToken?: boolean },\n\t): Promise<ProviderAuthenticationSession | undefined> {\n\t\tconst loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;\n\t\tif (!loggedIn) return undefined;\n\n\t\tconst cloudIntegrations = this.authenticationService.cloudIntegrations;\n\t\t// An unscoped descriptor (no explicit connectionId) would fetch the provider-global primary via\n\t\t// `v1/provider-tokens/<provider>`. For a self-managed provider spanning multiple hosts that primary\n\t\t// can belong to a different host, so a forced sync of host A would hydrate host B's token here (before\n\t\t// reconcile corrects storage). Scope to this host's own configured connection when we have one; fall\n\t\t// through to the provider-scoped path only when nothing is configured yet (legacy/first sync).\n\t\tconst connectionId =\n\t\t\tdescriptor.connectionId ??\n\t\t\t(isSelfManagedHostIntegrationId(this.authProviderId)\n\t\t\t\t? this.configuredIntegrationService.getConfiguredConnectionId(\n\t\t\t\t\t\tthis.authProviderId,\n\t\t\t\t\t\tdescriptor.domain,\n\t\t\t\t\t\ttrue,\n\t\t\t\t\t)\n\t\t\t\t: undefined);\n\t\t// Refuses a session issued for a DIFFERENT host than the one this connection is keyed by, which would\n\t\t// otherwise let host B's token serve host A.\n\t\t//\n\t\t// A session that names no host is accepted ONLY when it was fetched by a connection id WE have stored\n\t\t// for this host. That descriptor is what ties the token to the host, so an absent domain then means the\n\t\t// backend did not say rather than that the token belongs elsewhere, and refusing it would strand the\n\t\t// refresh.\n\t\t//\n\t\t// A non-null id is not enough on its own: `descriptor.connectionId` can come from the caller, and with\n\t\t// no id at all the fetch goes to the provider-GLOBAL primary endpoint whose token can belong to any\n\t\t// configured host. In both of those cases a domainless response must be refused, or a token would be\n\t\t// bound to — and sent to — a host it was never issued for.\n\t\tconst scopedToThisHost = this.configuredIntegrationService.isConnectionConfiguredForHost(\n\t\t\tthis.authProviderId,\n\t\t\tconnectionId,\n\t\t\tdescriptor.domain,\n\t\t);\n\t\tconst isForAnotherHost = (session: { domain: string } | undefined) =>\n\t\t\tsession != null &&\n\t\t\tisSelfManagedHostIntegrationId(this.authProviderId) &&\n\t\t\t(!scopedToThisHost || Boolean(session.domain?.trim())) &&\n\t\t\t!areDomainsOnSameHost(session.domain, descriptor.domain);\n\n\t\tlet session = await cloudIntegrations.getConnectionSession(this.authProviderId, undefined, connectionId);\n\t\tif (isForAnotherHost(session)) return undefined;\n\n\t\t// GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a token that never\n\t\t// expires; left as 0 the session would be built with `expiresAt = now` and rejected as expired on the\n\t\t// next resolution. Map it to the maximum expiry so it isn't refreshed frequently.\n\t\tif (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) {\n\t\t\tsession.expiresIn = maxSmallIntegerV8; // maximum expiration length\n\t\t}\n\n\t\t// `expiresIn < 60` is a PREDICTION that the token is about to lapse, and it is the only trigger the\n\t\t// refresh used to have. It cannot see a token the provider has already refused while the backend\n\t\t// still believes it is valid — a revoked grant, retired scopes, an app removed from the org — where\n\t\t// `expiresIn` stays high and the doomed token is re-sent on every read. `refreshRejectedToken` is\n\t\t// the observed counterpart: the caller saw the provider reject this exact token, so refresh it\n\t\t// regardless of what its expiry claims.\n\t\tif (session != null && (session.expiresIn < 60 || options?.refreshRejectedToken)) {\n\t\t\tsession = await cloudIntegrations.getConnectionSession(\n\t\t\t\tthis.authProviderId,\n\t\t\t\tsession.accessToken,\n\t\t\t\tconnectionId,\n\t\t\t);\n\t\t\tif (isForAnotherHost(session)) return undefined;\n\t\t}\n\n\t\tif (!session) return undefined;\n\n\t\tlet sessionProtocol;\n\t\t// Only derive a protocol from a domain carrying an explicit scheme; a bare `host:port` (e.g. a\n\t\t// self-managed `ghe.example.com:8443`) parses the host as the protocol, corrupting the value.\n\t\tif (/^[a-z][a-z\\d+\\-.]*:\\/\\//i.test(session.domain)) {\n\t\t\ttry {\n\t\t\t\tsessionProtocol = new URL(session.domain).protocol;\n\t\t\t} catch {\n\t\t\t\tsessionProtocol = undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\t// Prefer the backend's per-connection token id (multi-account); fall back to the resolved\n\t\t\t// primary/legacy connection id so existing single-connection storage keys are preserved.\n\t\t\tid: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),\n\t\t\taccessToken: session.accessToken,\n\t\t\tscopes: descriptor.scopes,\n\t\t\taccount: {\n\t\t\t\tid: '',\n\t\t\t\tlabel: '',\n\t\t\t},\n\t\t\tcloud: true,\n\t\t\ttype: session.type,\n\t\t\texpiresAt: new Date(session.expiresIn * 1000 + Date.now()),\n\t\t\t// Note: do not use the session's domain, because the format is different than in our model\n\t\t\tdomain: descriptor.domain,\n\t\t\t// That format difference is exactly what `baseUrl` is for: the descriptor's domain is the\n\t\t\t// normalized host this connection is keyed by, so a context path only survives on the wire value.\n\t\t\t// When the backend reports no domain at all, KEEP the address already configured rather than\n\t\t\t// writing `undefined` — `writeSecret` mirrors this onto the descriptor, so falling back to the\n\t\t\t// bare host here would drop a context path the user never changed on the next refresh.\n\t\t\tbaseUrl:\n\t\t\t\tsession.domain ||\n\t\t\t\tthis.configuredIntegrationService.getConfiguredBaseUrl(\n\t\t\t\t\tthis.authProviderId,\n\t\t\t\t\tconnectionId,\n\t\t\t\t\tdescriptor.domain,\n\t\t\t\t),\n\t\t\tprotocol: sessionProtocol ?? undefined,\n\t\t\t// Carried for providers whose client needs an app key alongside the token (e.g. Trello).\n\t\t\tappKey: session.appKey,\n\t\t};\n\t}\n\n\tprivate async disconnectCloudSession(): Promise<'skip' | 'success' | 'failure'> {\n\t\tconst loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;\n\t\tif (!loggedIn) return 'skip';\n\n\t\tconst cloudIntegrations = this.authenticationService.cloudIntegrations;\n\t\treturn (await cloudIntegrations.disconnect(this.authProviderId)) ? 'success' : 'failure';\n\t}\n}\n"],"mappings":";;;;;;;AAaA,MAAM,oBAAoB,KAAK,KAAK;AA8EpC,IAAe,wCAAf,MAE+C;CAI1B;CACA;CAJpB,cAA+C,CAAC;CAEhD,YACC,uBACA,8BACC;EAFkB,KAAA,wBAAA;EACA,KAAA,+BAAA;CACjB;CAEH,UAAgB;EACf,KAAK,YAAY,SAAQ,MAAK,EAAE,QAAQ,CAAC;CAC1C;CAEA,eAAgC,IAAI,QAAc;CAClD,IAAI,cAA2B;EAC9B,OAAO,KAAK,aAAa;CAC1B;CAIA,MACM,cACL,YACA,SACgB;EAChB,MAAM,SAAS,+BAA+B,KAAK,cAAc,IAAI,YAAY,SAAS,KAAA;EAC1F,MAAM,aAAa,KAAK,6BAA6B,cAAc,KAAK,gBAAgB,EAC/E,OACT,CAAC;EAKD,MAAM,KAAK,6BAA6B,qBACvC,KAAK,gBACL;GAAE,GAAG;GAAY,OAAO;EAAK,GAC7B,MACA,EAAE,oBAAoB,SAAS,sBAAsB,KAAK,CAC3D;EAEA,IAAI,YAAY,QACf,KAAK,WAAW;CAElB;CAEA,MACM,kBAAkB,YAAwE;EAG/F,MAAM,SAAS,+BAA+B,KAAK,cAAc,IAAI,YAAY,SAAS,KAAA;EAC1F,MAAM,aAAa,KAAK,6BAA6B,cAAc,KAAK,gBAAgB,EAC/E,OACT,CAAC;EAED,MAAM,KAAK,6BAA6B,wBAAwB,KAAK,gBAAgB,KAAA,GAAW,MAAM;EAEtG,IAAI,YAAY,QACf,KAAK,WAAW;CAElB;CAEA,MACM,WACL,YACA,SACqD;EACrD,IAAI;EACJ,IAAI;EACJ,IAAI,SAAS,iBAGZ,MAAM,KAAK,6BAA6B,qBACvC,KAAK,gBACL;GAAE,GAAG;GAAY,OAAO;EAAK,GAC7B,IACD;OACM;GACN,UAAU,MAAM,KAAK,6BAA6B,iBACjD,KAAK,gBACL,SAAS,OAAO;IAAE,GAAG;IAAY,OAAO;GAAK,IAAI,UAClD;GACA,gBAAgB,SAAS;EAC1B;EAEA,MAAM,mBAAmB,SAAS,aAAa,QAAQ,IAAI,KAAK,QAAQ,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;EAIxG,MAAM,uBAAuB,SAAS,yBAAyB,QAAQ,WAAW;EAClF,IAAI,WAAW,QAAQ,oBAAoB,sBAAsB;GAChE,UAAU,MAAM,KAAK,cAAc,YAAY;IAC9C,GAAG;IACH,kBAAkB;IACI;GACvB,CAAC;GAED,IAAI,WAAW,MACd,MAAM,KAAK,6BAA6B,aAAa,KAAK,gBAAgB,OAAO;EAEnF;EAEA,IAAI,kBAAkB,SAAS,aAC9B,KAAK,WAAW;EAGjB,OAAO;CACR;CAOA,aAA6B;EAC5B,qBAAqB,KAAK,aAAa,KAAK,CAAC;CAC9C;AACD;AAhGE,WAAA,CAAA,MAAM,CAAA,GAAA,sCAAA,WAAA,iBAAA,IAAA;AAyBN,WAAA,CAAA,MAAM,CAAA,GAAA,sCAAA,WAAA,qBAAA,IAAA;AAgBN,WAAA,CAAA,MAAM,CAAA,GAAA,sCAAA,WAAA,cAAA,IAAA;AAyDR,IAAa,yCAAb,cAEU,sCAA0C;CAIjC;CAHlB,YACC,uBACA,8BACA,iBACC;EACD,MAAM,uBAAuB,4BAA4B;EAFxC,KAAA,kBAAA;CAGlB;CAEA,IAAc,iBAAqB;EAClC,OAAO,KAAK;CACb;CAEA,MAAyB,cACxB,YACA,SACqD;EACrD,IAAI,SAAS,iBAAiB;GAC7B,IAAK,MAAM,KAAK,uBAAuB,MAAO,WAC7C;GAGD,KAAU,oBAAoB,OAAO,SAAS,MAAM;GACpD;EACD;EAOA,IAAI,UACH,SAAS,oBACT,SAAS,wBACT,SAAS,kBACT,SAAS,mBACT,SAAS,OACN,MAAM,KAAK,gBAAgB,YAAY,EAAE,sBAAsB,SAAS,qBAAqB,CAAC,IAC9F,KAAA;EAGJ,IAD4B,SAAS,kBAAkB,WAAW,MACzC;GAExB,IAAI,CAAC,MADmB,KAAK,oBAAoB,MAAM,SAAS,MAAM,GACtD,OAAO,KAAA;GAIvB,UAAU,MAAM,KAAK,WAAW,YAAY,EAAE,QAAQ,SAAS,OAAO,CAAC;EACxE;EACA,OAAO;CACR;CAEA,oBAA4B,iBAA0B,QAA+C;EAGpG,MAAM,KAAK,KAAK;EAChB,IAAI,8BAA8B,EAAE,GACnC,OAAO,KAAK,sBAAsB,yBACjC;GAAE,gBAAgB,CAAC,EAAE;GAAoB;GAAiB,aAAa;EAAK,GAC5E;GACC,QAAQ,UAAU;GAClB,QAAQ;IACP,QAAQ;IACR,aAAa;GACd;EACD,CACD;EAGD,OAAO,QAAQ,QAAQ,KAAK;CAC7B;CAEA,MAAc,gBACb,YACA,SACqD;EAErD,IAAI,EADc,MAAM,KAAK,sBAAsB,IAAI,QAAQ,WAAW,KAAM,OACjE,OAAO,KAAA;EAEtB,MAAM,oBAAoB,KAAK,sBAAsB;EAMrD,MAAM,eACL,WAAW,iBACV,+BAA+B,KAAK,cAAc,IAChD,KAAK,6BAA6B,0BAClC,KAAK,gBACL,WAAW,QACX,IACD,IACC,KAAA;EAaJ,MAAM,mBAAmB,KAAK,6BAA6B,8BAC1D,KAAK,gBACL,cACA,WAAW,MACZ;EACA,MAAM,oBAAoB,YACzB,WAAW,QACX,+BAA+B,KAAK,cAAc,MACjD,CAAC,oBAAoB,QAAQ,QAAQ,QAAQ,KAAK,CAAC,MACpD,CAAC,qBAAqB,QAAQ,QAAQ,WAAW,MAAM;EAExD,IAAI,UAAU,MAAM,kBAAkB,qBAAqB,KAAK,gBAAgB,KAAA,GAAW,YAAY;EACvG,IAAI,iBAAiB,OAAO,GAAG,OAAO,KAAA;EAKtC,IAAI,SAAS,cAAc,KAAK,oCAAoC,KAAK,cAAc,GACtF,QAAQ,YAAY;EASrB,IAAI,WAAW,SAAS,QAAQ,YAAY,MAAM,SAAS,uBAAuB;GACjF,UAAU,MAAM,kBAAkB,qBACjC,KAAK,gBACL,QAAQ,aACR,YACD;GACA,IAAI,iBAAiB,OAAO,GAAG,OAAO,KAAA;EACvC;EAEA,IAAI,CAAC,SAAS,OAAO,KAAA;EAErB,IAAI;EAGJ,IAAI,2BAA2B,KAAK,QAAQ,MAAM,GACjD,IAAI;GACH,kBAAkB,IAAI,IAAI,QAAQ,MAAM,CAAC,CAAC;EAC3C,QAAQ;GACP,kBAAkB,KAAA;EACnB;EAGD,OAAO;GAGN,IAAI,QAAQ,MAAM,KAAK,6BAA6B,oBAAoB,KAAK,gBAAgB,UAAU;GACvG,aAAa,QAAQ;GACrB,QAAQ,WAAW;GACnB,SAAS;IACR,IAAI;IACJ,OAAO;GACR;GACA,OAAO;GACP,MAAM,QAAQ;GACd,WAAW,IAAI,KAAK,QAAQ,YAAY,MAAO,KAAK,IAAI,CAAC;GAEzD,QAAQ,WAAW;GAMnB,SACC,QAAQ,UACR,KAAK,6BAA6B,qBACjC,KAAK,gBACL,cACA,WAAW,MACZ;GACD,UAAU,mBAAmB,KAAA;GAE7B,QAAQ,QAAQ;EACjB;CACD;CAEA,MAAc,yBAAkE;EAE/E,IAAI,EADc,MAAM,KAAK,sBAAsB,IAAI,QAAQ,WAAW,KAAM,OACjE,OAAO;EAGtB,OAAQ,MADkB,KAAK,sBAAsB,kBACrB,WAAW,KAAK,cAAc,IAAK,YAAY;CAChF;AACD"}

package/dist/plus/integrations/authentication/integrationAuthenticationService.d.ts

@@ -1,62 +1,64 @@
-import type { GitRemote } from '../../../git/models/remote.js';
-import type { Disposable } from '../../../utils/disposable.js';
-import type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';
-import type { IntegrationServiceContext } from '../context.js';
-import type { IntegrationService } from '../integrationService.js';
-import type { GitHostIntegration } from '../models/gitHostIntegration.js';
-import type { ApiClients } from '../providers/apiClients.js';
-import type { Source } from '../telemetry.js';
-import type { CloudIntegrationService } from './cloudIntegrationService.js';
-import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
-import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+import { Disposable } from "../../../utils/disposable.js";
+import { GitRemote } from "../../../git/models/remote.js";
+import { IntegrationIds, SupportedCloudIntegrationIds } from "../constants.js";
+import { Source } from "../telemetry.js";
+import { ConfiguredIntegrationService } from "./configuredIntegrationService.js";
+import { GitHostIntegration } from "../models/gitHostIntegration.js";
+import { ApiClients } from "../providers/apiClients.js";
+import { IntegrationService } from "../integrationService.js";
+import { IntegrationAuthenticationProvider } from "./integrationAuthenticationProvider.js";
+import { IntegrationServiceContext } from "../context.js";
+import { CloudIntegrationService } from "./cloudIntegrationService.js";
+//#region ../plus/integrations/src/authentication/integrationAuthenticationService.d.ts
 export declare class IntegrationAuthenticationService implements Disposable {
-    private readonly configuredIntegrationService;
-    readonly ctx: IntegrationServiceContext;
-    /**
-     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
-     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
-     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
-     */
-    private readonly getIntegrationService;
-    /** The package's cloud token-exchange client, constructed by the composition root. */
-    readonly cloudIntegrations: CloudIntegrationService;
-    private readonly providers;
-    constructor(configuredIntegrationService: ConfiguredIntegrationService, ctx: IntegrationServiceContext, 
-    /**
-     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
-     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
-     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
-     */
-    getIntegrationService: () => IntegrationService, 
-    /** The package's cloud token-exchange client, constructed by the composition root. */
-    cloudIntegrations: CloudIntegrationService);
-    dispose(): void;
-    /**
-     * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
-     * this when they need a session that doesn't exist yet (see
-     * {@link CloudIntegrationAuthenticationProvider}).
-     */
-    connectCloudIntegrations(connect: {
-        integrationIds: SupportedCloudIntegrationIds[];
-        skipIfConnected?: boolean;
-        skipPreSync?: boolean;
-    }, source?: Source): Promise<boolean>;
-    /**
-     * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
-     * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
-     * host round-trip.
-     */
-    getByRemote(remote: GitRemote): Promise<GitHostIntegration | undefined>;
-    /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
-    ignoreSSLErrors(integration: GitHostIntegration | {
-        id: IntegrationIds;
-        domain?: string;
-    }): boolean | 'force';
-    /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
-    get apis(): ApiClients;
-    get(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider>;
-    reset(): Promise<void>;
-    supports(providerId: string): boolean;
-    private ensureProvider;
+  private readonly configuredIntegrationService;
+  readonly ctx: IntegrationServiceContext;
+  /**
+   * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+   * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+   * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+   */
+  private readonly getIntegrationService;
+  /** The package's cloud token-exchange client, constructed by the composition root. */
+  readonly cloudIntegrations: CloudIntegrationService;
+  private readonly providers;
+  constructor(configuredIntegrationService: ConfiguredIntegrationService, ctx: IntegrationServiceContext,
+  /**
+   * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+   * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+   * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+   */
+  getIntegrationService: () => IntegrationService,
+  /** The package's cloud token-exchange client, constructed by the composition root. */
+  cloudIntegrations: CloudIntegrationService);
+  dispose(): void;
+  /**
+   * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+   * this when they need a session that doesn't exist yet (see
+   * {@link CloudIntegrationAuthenticationProvider}).
+   */
+  connectCloudIntegrations(connect: {
+    integrationIds: SupportedCloudIntegrationIds[];
+    skipIfConnected?: boolean;
+    skipPreSync?: boolean;
+  }, source?: Source): Promise<boolean>;
+  /**
+   * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+   * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+   * host round-trip.
+   */
+  getByRemote(remote: GitRemote): Promise<GitHostIntegration | undefined>;
+  /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+  ignoreSSLErrors(integration: GitHostIntegration | {
+    id: IntegrationIds;
+    domain?: string;
+  }): boolean | 'force';
+  /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+  get apis(): ApiClients;
+  get(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider>;
+  reset(): Promise<void>;
+  supports(providerId: string): boolean;
+  private ensureProvider;
 }
+//#endregion
 //# sourceMappingURL=integrationAuthenticationService.d.ts.map