@hibanacloud/core 0.3.15

package/dist/src/oauth/oauthClient.js

@@ -0,0 +1,233 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { generatePKCEPair, generateState } from './pkce.js';
+import https from 'node:https';
+import http from 'node:http';
+export class HibanaOAuthClient {
+    config;
+    oauthBaseUrl;
+    frontendBaseUrl;
+    clientId = null;
+    pkce = null;
+    state = null;
+    constructor(config) {
+        this.config = config;
+        this.oauthBaseUrl = config.oauthBaseUrl.replace(/\/$/, '');
+        this.frontendBaseUrl = config.frontendBaseUrl.replace(/\/$/, '');
+        // apiBaseUrl is stored in config for use when making API calls, not used by OAuth client
+    }
+    /**
+     * Helper method to make HTTP/HTTPS requests with proper SSL handling
+     */
+    async makeRequest(url, options) {
+        return new Promise((resolve, reject) => {
+            const urlObj = new URL(url);
+            const isHttps = urlObj.protocol === 'https:';
+            const isLocalhost = urlObj.hostname === 'localhost' || urlObj.hostname === '127.0.0.1';
+            // Allow disabling SSL verification via environment variable for development
+            const disableSslVerification = process.env['HIBANA_DISABLE_SSL_VERIFY'] === 'true';
+            const requestOptions = {
+                method: options.method,
+                headers: options.headers || {},
+                // Disable SSL verification for localhost or if explicitly disabled via env var
+                rejectUnauthorized: !isLocalhost && !disableSslVerification,
+            };
+            const lib = isHttps ? https : http;
+            const req = lib.request(url, requestOptions, (res) => {
+                let data = '';
+                res.on('data', (chunk) => {
+                    data += chunk;
+                });
+                res.on('end', () => {
+                    resolve({
+                        status: res.statusCode || 500,
+                        ok: (res.statusCode || 500) >= 200 && (res.statusCode || 500) < 300,
+                        statusText: res.statusMessage || '',
+                        json: async () => JSON.parse(data),
+                        text: async () => data,
+                    });
+                });
+            });
+            req.on('error', (error) => {
+                reject(error);
+            });
+            if (options.body) {
+                req.write(options.body);
+            }
+            req.end();
+        });
+    }
+    /**
+     * Step 1: Register OAuth client with backend
+     */
+    async registerClient() {
+        const redirectUri = `http://localhost:${this.config.redirectPort}/oauth/callback`;
+        const requestBody = {
+            clientName: this.config.clientName,
+            redirectUris: [redirectUri],
+            grantTypes: ['authorization_code'],
+            responseTypes: ['code'],
+            codeChallengeMethods: ['S256'],
+        };
+        console.log('Registration request body:', JSON.stringify(requestBody, null, 2));
+        const registrationUrl = `${this.oauthBaseUrl}/oauth/register`;
+        console.log('Registering client at:', registrationUrl);
+        let response;
+        try {
+            response = await this.makeRequest(registrationUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(requestBody),
+            });
+        }
+        catch (fetchError) {
+            console.error('Request failed:', fetchError);
+            console.error('Error details:', {
+                message: fetchError.message,
+                cause: fetchError.cause,
+                code: fetchError.code,
+                errno: fetchError.errno,
+                syscall: fetchError.syscall,
+            });
+            throw new Error(`Failed to connect to OAuth server at ${registrationUrl}. ` +
+                `Make sure the backend is running and accessible. ` +
+                `Error: ${fetchError.message}${fetchError.code ? ` (${fetchError.code})` : ''}`);
+        }
+        console.log('Registration response status:', response.status);
+        if (!response.ok) {
+            const error = await response.json();
+            console.log('Registration error response:', JSON.stringify(error, null, 2));
+            throw new Error(error.error_description || 'Client registration failed');
+        }
+        const data = await response.json();
+        console.log('Registration success response:', JSON.stringify(data, null, 2));
+        this.clientId = data.client_id;
+        return this.clientId;
+    }
+    /**
+     * Step 2: Build authorization URL for user
+     */
+    buildAuthorizationUrl() {
+        if (!this.clientId) {
+            throw new Error('Client not registered. Call registerClient() first.');
+        }
+        // Generate PKCE and state
+        this.pkce = generatePKCEPair();
+        this.state = generateState();
+        const redirectUri = `http://localhost:${this.config.redirectPort}/oauth/callback`;
+        const params = new URLSearchParams({
+            client_id: this.clientId,
+            response_type: 'code',
+            redirect_uri: redirectUri,
+            state: this.state,
+            code_challenge: this.pkce.codeChallenge,
+            code_challenge_method: 'S256',
+            scope: 'openid profile api:access',
+        });
+        // Frontend authorization page (user sees this in browser)
+        return `${this.frontendBaseUrl}/oauth/authorize?${params.toString()}`;
+    }
+    /**
+     * Step 3: Exchange authorization code for tokens
+     */
+    async exchangeCodeForTokens(code, receivedState) {
+        if (!this.clientId || !this.pkce || !this.state) {
+            throw new Error('OAuth flow not initialized properly');
+        }
+        // Verify state for CSRF protection
+        if (receivedState !== this.state) {
+            throw new Error('Invalid state parameter - possible CSRF attack');
+        }
+        const redirectUri = `http://localhost:${this.config.redirectPort}/oauth/callback`;
+        const params = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: this.clientId,
+            code: code,
+            code_verifier: this.pkce.codeVerifier,
+            redirect_uri: redirectUri,
+        });
+        console.log('Exchanging authorization code for tokens...');
+        console.log('Token endpoint:', `${this.oauthBaseUrl}/oauth/token`);
+        console.log('Request params:', params.toString());
+        const response = await this.makeRequest(`${this.oauthBaseUrl}/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params.toString(),
+        });
+        console.log('Token response status:', response.status, response.statusText);
+        if (!response.ok) {
+            const errorText = await response.text();
+            console.error('Token exchange error response:', errorText);
+            let error;
+            try {
+                error = JSON.parse(errorText);
+            }
+            catch {
+                throw new Error(`Token exchange failed (${response.status}): ${errorText}`);
+            }
+            const errorMsg = error.error_description || error.error || 'Token exchange failed';
+            console.error('Parsed error:', error);
+            throw new Error(`${errorMsg} (${error.error || 'unknown_error'})`);
+        }
+        const data = await response.json();
+        console.log('Token response received:', {
+            hasAccessToken: !!data.access_token,
+            hasRefreshToken: !!data.refresh_token,
+            hasApiKey: !!data.api_key
+        });
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresIn: data.expires_in,
+            tokenType: data.token_type,
+            scope: data.scope,
+            apiKey: data.api_key, // API key for LLM API access
+        };
+    }
+    /**
+     * Step 4: Refresh access token using refresh token
+     */
+    async refreshAccessToken(refreshToken) {
+        if (!this.clientId) {
+            throw new Error('Client not registered');
+        }
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: this.clientId,
+            refresh_token: refreshToken,
+        });
+        const response = await this.makeRequest(`${this.oauthBaseUrl}/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params.toString(),
+        });
+        if (!response.ok) {
+            const error = await response.json();
+            throw new Error(error.error_description || 'Token refresh failed');
+        }
+        const data = await response.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken, // May return same refresh token
+            expiresIn: data.expires_in,
+            tokenType: data.token_type,
+            scope: data.scope,
+        };
+    }
+    /**
+     * Get client ID
+     */
+    getClientId() {
+        return this.clientId;
+    }
+    /**
+     * Set client ID (for loading from storage)
+     */
+    setClientId(clientId) {
+        this.clientId = clientId;
+    }
+}
+//# sourceMappingURL=oauthClient.js.map

package/dist/src/oauth/oauthClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthClient.js","sourceRoot":"","sources":["../../../src/oauth/oauthClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,IAAI,MAAM,WAAW,CAAC;AAmB7B,MAAM,OAAO,iBAAiB;IAOR;IANZ,YAAY,CAAS;IACrB,eAAe,CAAS;IACxB,QAAQ,GAAkB,IAAI,CAAC;IAC/B,IAAI,GAA2D,IAAI,CAAC;IACpE,KAAK,GAAkB,IAAI,CAAC;IAEpC,YAAoB,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QAC3C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,yFAAyF;IAC3F,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,OAIC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;YAEvF,4EAA4E;YAC5E,MAAM,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,KAAK,MAAM,CAAC;YAEnF,MAAM,cAAc,GAAyB;gBAC3C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;gBAC9B,+EAA+E;gBAC/E,kBAAkB,EAAE,CAAC,WAAW,IAAI,CAAC,sBAAsB;aAC5D,CAAC;YAEF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAEnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnD,IAAI,IAAI,GAAG,EAAE,CAAC;gBAEd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBACvB,IAAI,IAAI,KAAK,CAAC;gBAChB,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACjB,OAAO,CAAC;wBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG;wBAC7B,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,GAAG;wBACnE,UAAU,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE;wBACnC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;qBACvB,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAU,EAAE,EAAE;gBAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAED,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,YAAY,iBAAiB,CAAC;QAElF,MAAM,WAAW,GAAG;YAClB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,YAAY,EAAE,CAAC,WAAW,CAAC;YAC3B,UAAU,EAAE,CAAC,oBAAoB,CAAC;YAClC,aAAa,EAAE,CAAC,MAAM,CAAC;YACvB,oBAAoB,EAAE,CAAC,MAAM,CAAC;SAC/B,CAAC;QAEF,OAAO,CAAC,GAAG,CACT,4BAA4B,EAC5B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CACrC,CAAC;QAEF,MAAM,eAAe,GAAG,GAAG,IAAI,CAAC,YAAY,iBAAiB,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;QAEvD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAe,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBAC9B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,wCAAwC,eAAe,IAAI;gBACzD,mDAAmD;gBACnD,UAAU,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,IAAI,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,aAAa,EAAE,CAAC;QAE7B,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,YAAY,iBAAiB,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,MAAM;YACrB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACvC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,2BAA2B;SACnC,CAAC,CAAC;QAEH,0DAA0D;QAC1D,OAAO,GAAG,IAAI,CAAC,eAAe,oBAAoB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,aAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,WAAW,GAAG,oBAAoB,IAAI,CAAC,MAAM,CAAC,YAAY,iBAAiB,CAAC;QAElF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,IAAI,EAAE,IAAI;YACV,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACrC,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,YAAY,cAAc,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CACrC,GAAG,IAAI,CAAC,YAAY,cAAc,EAClC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CACF,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,SAAS,CAAC,CAAC;YAE3D,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;YAC9E,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,IAAI,uBAAuB,CAAC;YACnF,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE;YACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY;YACnC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa;YACrC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO;SAC1B,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,6BAA6B;SACpD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CACrC,GAAG,IAAI,CAAC,YAAY,cAAc,EAClC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,YAAY,EAAE,gCAAgC;YAClF,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}

package/dist/src/oauth/pkce.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export interface PKCEPair {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/**
+ * Generate code verifier (43-128 characters, base64url encoded)
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generate code challenge from verifier using S256 method
+ */
+export declare function generateCodeChallenge(verifier: string): string;
+/**
+ * Generate PKCE pair (verifier + challenge)
+ */
+export declare function generatePKCEPair(): PKCEPair;
+/**
+ * Generate random state parameter for CSRF protection
+ */
+export declare function generateState(): string;

package/dist/src/oauth/pkce.js

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import crypto from 'crypto';
+/**
+ * Generate code verifier (43-128 characters, base64url encoded)
+ */
+export function generateCodeVerifier() {
+    const randomBytes = crypto.randomBytes(32);
+    return base64URLEncode(randomBytes);
+}
+/**
+ * Generate code challenge from verifier using S256 method
+ */
+export function generateCodeChallenge(verifier) {
+    const hash = crypto.createHash('sha256').update(verifier).digest();
+    return base64URLEncode(hash);
+}
+/**
+ * Generate PKCE pair (verifier + challenge)
+ */
+export function generatePKCEPair() {
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    return { codeVerifier, codeChallenge };
+}
+/**
+ * Base64 URL encode (RFC 7636)
+ */
+function base64URLEncode(buffer) {
+    return buffer
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Generate random state parameter for CSRF protection
+ */
+export function generateState() {
+    return base64URLEncode(crypto.randomBytes(32));
+}
+//# sourceMappingURL=pkce.js.map

package/dist/src/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAO5B;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC1D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM;SACV,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/src/oauth/tokenManager.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { OAuthCredentials } from '../mcp/token-storage/types.js';
+import { HibanaOAuthClient, type OAuthTokens } from './oauthClient.js';
+export declare class OAuthTokenManager {
+    private oauthClient;
+    private storage;
+    private credentials;
+    constructor(oauthClient: HibanaOAuthClient);
+    /**
+     * Save tokens to secure storage
+     */
+    saveTokens(tokens: OAuthTokens, clientId: string): Promise<void>;
+    /**
+     * Load tokens from secure storage
+     */
+    loadTokens(): Promise<OAuthCredentials | null>;
+    /**
+     * Get valid access token (auto-refresh if expired)
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Refresh access token using refresh token
+     */
+    private refreshToken;
+    /**
+     * Clear stored tokens
+     */
+    clearTokens(): Promise<void>;
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated(): Promise<boolean>;
+}

package/dist/src/oauth/tokenManager.js

@@ -0,0 +1,110 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { HybridTokenStorage } from '../mcp/token-storage/hybrid-token-storage.js';
+import { HibanaOAuthClient } from './oauthClient.js';
+const SERVER_NAME = 'hibana-oauth';
+export class OAuthTokenManager {
+    oauthClient;
+    storage;
+    credentials = null;
+    constructor(oauthClient) {
+        this.oauthClient = oauthClient;
+        this.storage = new HybridTokenStorage('hibana-cli-oauth');
+    }
+    /**
+     * Save tokens to secure storage
+     */
+    async saveTokens(tokens, clientId) {
+        const expiresAt = Date.now() + tokens.expiresIn * 1000;
+        this.credentials = {
+            serverName: SERVER_NAME,
+            token: {
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                expiresAt,
+                tokenType: tokens.tokenType,
+                scope: tokens.scope,
+            },
+            clientId,
+            updatedAt: Date.now(),
+        };
+        await this.storage.setCredentials(this.credentials);
+    }
+    /**
+     * Load tokens from secure storage
+     */
+    async loadTokens() {
+        try {
+            const stored = await this.storage.getCredentials(SERVER_NAME);
+            if (stored) {
+                this.credentials = stored;
+                return this.credentials;
+            }
+        }
+        catch (error) {
+            console.error('Failed to load OAuth tokens:', error);
+        }
+        return null;
+    }
+    /**
+     * Get valid access token (auto-refresh if expired)
+     */
+    async getAccessToken() {
+        if (!this.credentials) {
+            await this.loadTokens();
+        }
+        if (!this.credentials) {
+            throw new Error('No OAuth tokens found. Please authenticate first.');
+        }
+        // Check if token is expired or will expire in next 5 minutes
+        const fiveMinutesFromNow = Date.now() + 5 * 60 * 1000;
+        const expiresAt = this.credentials.token.expiresAt || 0;
+        if (expiresAt < fiveMinutesFromNow) {
+            console.log('Access token expired, refreshing...');
+            await this.refreshToken();
+        }
+        return this.credentials.token.accessToken;
+    }
+    /**
+     * Refresh access token using refresh token
+     */
+    async refreshToken() {
+        if (!this.credentials) {
+            throw new Error('No tokens to refresh');
+        }
+        try {
+            // Set client ID if not already set
+            if (!this.oauthClient.getClientId() && this.credentials.clientId) {
+                this.oauthClient.setClientId(this.credentials.clientId);
+            }
+            if (!this.credentials.token.refreshToken) {
+                throw new Error('No refresh token available');
+            }
+            const newTokens = await this.oauthClient.refreshAccessToken(this.credentials.token.refreshToken);
+            await this.saveTokens(newTokens, this.credentials.clientId || '');
+            console.log('Access token refreshed successfully');
+        }
+        catch (error) {
+            console.error('Token refresh failed:', error);
+            throw new Error('Token refresh failed. Please re-authenticate.');
+        }
+    }
+    /**
+     * Clear stored tokens
+     */
+    async clearTokens() {
+        this.credentials = null;
+        await this.storage.deleteCredentials(SERVER_NAME);
+    }
+    /**
+     * Check if user is authenticated
+     */
+    async isAuthenticated() {
+        const tokens = await this.loadTokens();
+        return tokens !== null;
+    }
+}
+//# sourceMappingURL=tokenManager.js.map

package/dist/src/oauth/tokenManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenManager.js","sourceRoot":"","sources":["../../../src/oauth/tokenManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAElF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,kBAAkB,CAAC;AAEvE,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC,MAAM,OAAO,iBAAiB;IAIR;IAHZ,OAAO,CAAqB;IAC5B,WAAW,GAA4B,IAAI,CAAC;IAEpD,YAAoB,WAA8B;QAA9B,gBAAW,GAAX,WAAW,CAAmB;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAmB,EAAE,QAAgB;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAEvD,IAAI,CAAC,WAAW,GAAG;YACjB,UAAU,EAAE,WAAW;YACvB,KAAK,EAAE;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS;gBACT,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAC9D,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;gBAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,6DAA6D;QAC7D,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QACxD,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,WAAY,CAAC,KAAK,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACH,mCAAmC;YACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBACjE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CACzD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CACpC,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/src/output/json-formatter.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { SessionMetrics } from '../telemetry/uiTelemetry.js';
+import type { JsonError } from './types.js';
+export declare class JsonFormatter {
+    format(response?: string, stats?: SessionMetrics, error?: JsonError): string;
+    formatError(error: Error, code?: string | number): string;
+}

package/dist/src/output/json-formatter.js

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import stripAnsi from 'strip-ansi';
+export class JsonFormatter {
+    format(response, stats, error) {
+        const output = {};
+        if (response !== undefined) {
+            output.response = stripAnsi(response);
+        }
+        if (stats) {
+            output.stats = stats;
+        }
+        if (error) {
+            output.error = error;
+        }
+        return JSON.stringify(output, null, 2);
+    }
+    formatError(error, code) {
+        const jsonError = {
+            type: error.constructor.name,
+            message: stripAnsi(error.message),
+            ...(code && { code }),
+        };
+        return this.format(undefined, undefined, jsonError);
+    }
+}
+//# sourceMappingURL=json-formatter.js.map

package/dist/src/output/json-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-formatter.js","sourceRoot":"","sources":["../../../src/output/json-formatter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,SAAS,MAAM,YAAY,CAAC;AAInC,MAAM,OAAO,aAAa;IACxB,MAAM,CAAC,QAAiB,EAAE,KAAsB,EAAE,KAAiB;QACjE,MAAM,MAAM,GAAe,EAAE,CAAC;QAE9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACvB,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACvB,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,WAAW,CAAC,KAAY,EAAE,IAAsB;QAC9C,MAAM,SAAS,GAAc;YAC3B,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;YAC5B,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;YACjC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;SACtB,CAAC;QAEF,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/src/output/json-formatter.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};