@hubspot/app-connect-sdk 1.0.0-alpha.2 → 1.0.0-alpha.21

package/src/server/hono/hubspot-connect-routes/auth-callback.test.ts

@@ -1,225 +0,0 @@
-import { Hono } from 'hono';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import { EXPIRES_AT_URL_PARAM } from '../../../shared/constants.ts';
-import {
-  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
-  HUBSPOT_REFRESH_COOKIE_PREFIX,
-  TEMP_COOKIE_OAUTH_STATE,
-  TEMP_COOKIE_PKCE_VERIFIER,
-} from '../../constants.ts';
-import { handleAuthCallback } from './auth-callback.ts';
-import type { HubSpotConnectRoutesEnvClientSecret } from './load-hubspot-connect-routes-env.ts';
-import type { HubSpotConnectOAuthRouteOptions } from './types.ts';
-
-const hubspotConnectEnv = {
-  hubspotAuthorizationEndpoint: 'https://auth.example.test/oauth/authorize',
-  hubspotOAuthApiOrigin: 'https://auth.example.test',
-  isCimdEnabled: false,
-  isDpopEnabled: false,
-  isAppPrivateKeyRequired: false,
-  hubspotClientId: 'test-client-id',
-  hubspotClientSecret: 'test-client-secret',
-} satisfies HubSpotConnectRoutesEnvClientSecret;
-
-const BASE_PATH = '/functions/v1/hubspot-connect';
-
-function buildOAuthRouteOptions(): HubSpotConnectOAuthRouteOptions {
-  return {
-    appKeys: null,
-    refreshCookiePath: `${BASE_PATH}/auth`,
-    logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
-    basePath: BASE_PATH,
-    hubspotConnectEnv,
-    cimdClientMetadata: { scope: { required: ['crm.objects.contacts.read'] } },
-  };
-}
-
-function base64urlEncode(input: string): string {
-  let binary = '';
-  const bytes = new TextEncoder().encode(input);
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-
-function buildCallbackFixture(
-  returnPath: string,
-  sid = 'test-session-id-hash'
-): { stateValue: string; cookieHeader: string } {
-  const stateValue = base64urlEncode(
-    JSON.stringify({ return_path: returnPath, sid })
-  );
-  const cookieHeader = [
-    `${TEMP_COOKIE_OAUTH_STATE}=${encodeURIComponent(stateValue)}`,
-    `${TEMP_COOKIE_PKCE_VERIFIER}=${encodeURIComponent('test-pkce-verifier')}`,
-  ].join('; ');
-  return { stateValue, cookieHeader };
-}
-
-function buildCallbackUrl(stateValue: string, code = 'test-auth-code'): string {
-  const url = new URL(`http://localhost${BASE_PATH}/auth/callback`);
-  url.searchParams.set('code', code);
-  url.searchParams.set('state', stateValue);
-  return url.toString();
-}
-
-describe('handleAuthCallback', () => {
-  afterEach(() => {
-    vi.restoreAllMocks();
-  });
-
-  it('returns 400 when code is missing', async () => {
-    const app = new Hono();
-    app.get('/auth/callback', (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const res = await app.request(`http://localhost/auth/callback?state=abc`, {
-      method: 'GET',
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Missing code or state');
-  });
-
-  it('returns 400 when state is missing', async () => {
-    const app = new Hono();
-    app.get('/auth/callback', (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const res = await app.request(`http://localhost/auth/callback?code=abc`, {
-      method: 'GET',
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Missing code or state');
-  });
-
-  it('returns 403 when state cookie is missing', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-    });
-    expect(res.status).toBe(403);
-    expect(await res.text()).toContain('State mismatch');
-  });
-
-  it('returns 403 when state does not match cookie', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl('wrong-state-value'), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(403);
-  });
-
-  it('returns 400 when state payload has invalid return_path', async () => {
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } =
-      buildCallbackFixture('//evil.example.com');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(400);
-    expect(await res.text()).toContain('Invalid return path');
-  });
-
-  it('returns 502 when upstream token exchange fails', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response('{"error":"invalid_grant"}', {
-        status: 400,
-        statusText: 'Bad Request',
-      })
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(502);
-    expect(await res.text()).toContain('Token exchange failed');
-  });
-
-  it('returns 502 when token response is missing refresh_token', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(JSON.stringify({ access_token: 'at', expires_in: 1800 }), {
-        status: 200,
-      })
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-    expect(res.status).toBe(502);
-    expect(await res.text()).toContain('refresh_token');
-  });
-
-  it('redirects and sets cookies on success', async () => {
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      new Response(
-        JSON.stringify({
-          access_token: 'new-access-token',
-          refresh_token: 'new-refresh-token',
-          expires_in: 1800,
-        }),
-        { status: 200 }
-      )
-    );
-    const app = new Hono();
-    app.get(`${BASE_PATH}/auth/callback`, (c) =>
-      handleAuthCallback(c, buildOAuthRouteOptions())
-    );
-    const { stateValue, cookieHeader } = buildCallbackFixture(
-      '/dashboard',
-      'abc123sid'
-    );
-    const res = await app.request(buildCallbackUrl(stateValue), {
-      method: 'GET',
-      headers: { Cookie: cookieHeader },
-    });
-
-    expect(res.status).toBe(302);
-    const location = res.headers.get('location') ?? '';
-    expect(location).toContain('/dashboard');
-    expect(location).toContain(EXPIRES_AT_URL_PARAM);
-
-    const setCookies = res.headers.getSetCookie();
-    const accessCookie = setCookies.find((h) =>
-      h.startsWith(`${HUBSPOT_ACCESS_TOKEN_COOKIE_NAME}=`)
-    );
-    expect(accessCookie).toContain('new-access-token');
-
-    const refreshCookie = setCookies.find((h) =>
-      h.startsWith(`${HUBSPOT_REFRESH_COOKIE_PREFIX}`)
-    );
-    expect(refreshCookie).toContain('new-refresh-token');
-
-    const pkceCleared = setCookies.find((h) =>
-      h.startsWith(`${TEMP_COOKIE_PKCE_VERIFIER}=`)
-    );
-    expect(pkceCleared).toContain('Max-Age=0');
-
-    const stateCleared = setCookies.find((h) =>
-      h.startsWith(`${TEMP_COOKIE_OAUTH_STATE}=`)
-    );
-    expect(stateCleared).toContain('Max-Age=0');
-  });
-});

package/src/server/proxy.test.ts

@@ -1,80 +0,0 @@
-import {
-  afterEach,
-  beforeAll,
-  beforeEach,
-  describe,
-  expect,
-  it,
-  vi,
-} from 'vitest';
-
-import { createTestAppKeys } from './utils/test-fixtures.ts';
-
-describe('createHubSpotProxy', () => {
-  let createHubSpotProxy: typeof import('./proxy.ts').createHubSpotProxy;
-
-  beforeAll(async () => {
-    vi.stubEnv('HUBSPOT_API_ORIGIN', 'https://api.example.test');
-    ({ createHubSpotProxy } = await import('./proxy.ts'));
-  });
-
-  beforeEach(() => {
-    vi.stubEnv('HUBSPOT_API_ORIGIN', 'https://api.example.test');
-    vi.stubEnv('HUBSPOT_DPOP_ENABLED', 'false');
-  });
-
-  afterEach(() => {
-    vi.unstubAllEnvs();
-  });
-
-  it('throws when DPoP is enabled and appKeys is null', () => {
-    vi.stubEnv('HUBSPOT_DPOP_ENABLED', 'true');
-    expect(() =>
-      createHubSpotProxy({
-        userCredentials: { accessToken: 't', sessionId: 's' },
-        appKeys: null,
-      })
-    ).toThrow(
-      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'
-    );
-  });
-
-  it('uses Bearer when DPoP is disabled and appKeys is null', async () => {
-    const fetchSpy = vi
-      .spyOn(globalThis, 'fetch')
-      .mockResolvedValue(new Response('{}'));
-    const proxy = createHubSpotProxy({
-      userCredentials: { accessToken: 'tok', sessionId: 'sid' },
-      appKeys: null,
-    });
-    expect(proxy.authenticated).toBe(true);
-    await proxy.fetch({ path: '/crm/v3/objects/contacts' });
-    expect(fetchSpy).toHaveBeenCalledWith(
-      'https://api.example.test/crm/v3/objects/contacts',
-      expect.objectContaining({
-        headers: expect.objectContaining({
-          Authorization: 'Bearer tok',
-        }),
-      })
-    );
-    fetchSpy.mockRestore();
-  });
-
-  it('sends DPoP when enabled and appKeys are provided', async () => {
-    vi.stubEnv('HUBSPOT_DPOP_ENABLED', 'true');
-    const fetchSpy = vi
-      .spyOn(globalThis, 'fetch')
-      .mockResolvedValue(new Response('{}'));
-    const appKeys = await createTestAppKeys();
-    const proxy = createHubSpotProxy({
-      userCredentials: { accessToken: 'tok', sessionId: 'sid' },
-      appKeys,
-    });
-    await proxy.fetch({ path: '/x' });
-    const init = fetchSpy.mock.calls[0]?.[1] as RequestInit;
-    const headers = init.headers as Record<string, string>;
-    expect(headers.Authorization).toMatch(/^DPoP /);
-    expect(headers.DPoP).toBeDefined();
-    fetchSpy.mockRestore();
-  });
-});

package/src/server/proxy.ts

@@ -1,116 +0,0 @@
-import { noopLogger, type Logger } from '../shared/logger.ts';
-import {
-  type AppKeys,
-  type HubSpotProxy,
-  type HubSpotProxyRequest,
-  type UserCredentials,
-} from './types.ts';
-import { sha256base64url } from './utils/crypto-utils.ts';
-import { signDpopProof } from './utils/dpop-utils.ts';
-import { isHubspotDpopEnabled, requireEnv } from './utils/env-utils.ts';
-
-const HUBSPOT_API_ORIGIN = requireEnv('HUBSPOT_API_ORIGIN');
-
-/**
- * Options accepted by {@link createHubSpotProxy}.
- */
-export interface CreateHubSpotProxyOptions {
-  /**
-   * User session context from the incoming browser request.
-   */
-  userCredentials: UserCredentials;
-
-  /**
-   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP
-   * are both disabled.
-   */
-  appKeys: AppKeys | null;
-  /** Optional logger. Defaults to a no-op logger. */
-  logger?: Logger;
-}
-
-const notAuthenticated: HubSpotProxy = {
-  authenticated: false,
-  fetch: async (): Promise<Response> => {
-    return new Response(null, {
-      status: 401,
-      statusText: 'Unauthorized',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-    });
-  },
-};
-
-const EMPTY_HEADERS = {};
-
-export function createHubSpotProxy(
-  options: CreateHubSpotProxyOptions
-): HubSpotProxy {
-  const { userCredentials, appKeys, logger = noopLogger } = options;
-
-  if (isHubspotDpopEnabled() && appKeys === null) {
-    throw new Error(
-      'createHubSpotProxy: appKeys is required when HUBSPOT_DPOP_ENABLED is not false'
-    );
-  }
-
-  const { accessToken, sessionId } = userCredentials;
-
-  if (!accessToken || !sessionId) {
-    logger.debug(
-      'createHubSpotProxy: returning unauthenticated proxy (missing cookies)'
-    );
-    return notAuthenticated;
-  }
-
-  async function proxyFetch(request: HubSpotProxyRequest): Promise<Response> {
-    const { path, method = 'GET', headers = EMPTY_HEADERS, body } = request;
-
-    const targetUrl = `${HUBSPOT_API_ORIGIN}${path}`;
-    const useDpop = isHubspotDpopEnabled();
-
-    let authorizationHeaders: Record<string, string>;
-    if (useDpop) {
-      const ath = await sha256base64url(accessToken!);
-      const sid = await sha256base64url(sessionId!);
-      const dpopProof = await signDpopProof({
-        appKeys: appKeys!,
-        claims: {
-          htm: method,
-          htu: targetUrl,
-          jti: crypto.randomUUID(),
-          iat: Math.floor(Date.now() / 1000),
-          ath,
-          sid,
-        },
-      });
-      authorizationHeaders = {
-        Authorization: `DPoP ${accessToken}`,
-        DPoP: dpopProof,
-      };
-    } else {
-      authorizationHeaders = {
-        Authorization: `Bearer ${accessToken}`,
-      };
-    }
-
-    const finalHeaders = { ...headers, ...authorizationHeaders };
-
-    const requestInit: RequestInit = {
-      headers: finalHeaders,
-      method,
-    };
-
-    if (body != null) {
-      requestInit.body = body;
-    }
-
-    return fetch(targetUrl, requestInit);
-  }
-
-  return {
-    authenticated: true,
-    fetch: proxyFetch,
-  };
-}