@hubspot/app-connect-sdk 1.0.0-alpha.3 → 1.0.0-alpha.4

package/dist/server/api-client-core/plugins/fetch-transport.js

@@ -1,76 +0,0 @@
-import { isBinaryData } from "../binary-data.js";
-//#region src/server/api-client-core/plugins/fetch-transport.ts
-const BASE_URL = "https://api.hubapi.com";
-function appendRecordToUrlSearchParams(params, record) {
-	for (const [key, value] of Object.entries(record)) {
-		if (value == null) continue;
-		if (Array.isArray(value)) for (const item of value) params.append(key, String(item));
-		else params.append(key, String(value));
-	}
-}
-/**
-* Transport plugin that executes HTTP requests using the Fetch API.
-*
-* This is the terminal middleware in the chain — it builds the actual HTTP
-* request from the operation descriptor and returns a normalized response.
-* It handles path-parameter interpolation, query-string serialization,
-* Bearer-token auth, and content-type negotiation (JSON, form-urlencoded, multipart).
-*/
-function fetchTransportPlugin(options) {
-	return { activate(api) {
-		api.addMiddleware(async (ctx) => {
-			const { operation } = ctx;
-			let url = `${BASE_URL}${operation.path}`;
-			if (operation.pathParams) for (const [key, value] of Object.entries(operation.pathParams)) url = url.replace(`{${key}}`, encodeURIComponent(String(value)));
-			if (operation.queryParams) {
-				const params = new URLSearchParams();
-				appendRecordToUrlSearchParams(params, operation.queryParams);
-				const qs = params.toString();
-				if (qs) url += `?${qs}`;
-			}
-			const headers = {
-				...operation.headers ?? {},
-				Authorization: `Bearer ${options.getAccessToken()}`
-			};
-			const init = {
-				method: operation.method.toUpperCase(),
-				headers
-			};
-			if (operation.contentType === "multipart/form-data" && operation.body) {
-				const formData = new FormData();
-				for (const [key, value] of Object.entries(operation.body)) {
-					if (value == null) continue;
-					if (isBinaryData(value)) formData.append(key, value.source);
-					else formData.append(key, String(value));
-				}
-				init.body = formData;
-			} else if (operation.contentType === "application/x-www-form-urlencoded") {
-				headers["Content-Type"] = "application/x-www-form-urlencoded";
-				if (operation.body) {
-					const params = new URLSearchParams();
-					appendRecordToUrlSearchParams(params, operation.body);
-					const encoded = params.toString();
-					if (encoded) init.body = encoded;
-				}
-			} else {
-				headers["Content-Type"] = "application/json";
-				if (operation.body) init.body = JSON.stringify(operation.body);
-			}
-			const response = await fetch(url, init);
-			const responseHeaders = Object.create(null);
-			response.headers.forEach((value, key) => {
-				responseHeaders[key] = value;
-			});
-			return {
-				status: response.status,
-				statusText: response.statusText,
-				headers: responseHeaders,
-				bodyJson: response.status === 204 ? void 0 : await response.json()
-			};
-		});
-	} };
-}
-//#endregion
-export { fetchTransportPlugin };
-
-//# sourceMappingURL=fetch-transport.js.map

package/dist/server/api-client-core/plugins/fetch-transport.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch-transport.js","names":[],"sources":["../../../../src/server/api-client-core/plugins/fetch-transport.ts"],"sourcesContent":["import { isBinaryData } from '../binary-data.ts';\nimport type { Plugin } from '../types.ts';\n\nconst BASE_URL = 'https://api.hubapi.com';\n\nexport interface FetchTransportPluginOptions {\n  getAccessToken: () => string;\n}\n\nfunction appendRecordToUrlSearchParams(\n  params: URLSearchParams,\n  record: Record<string, unknown>\n): void {\n  for (const [key, value] of Object.entries(record)) {\n    if (value == null) continue;\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        params.append(key, String(item as string));\n      }\n    } else {\n      params.append(key, String(value));\n    }\n  }\n}\n\n/**\n * Transport plugin that executes HTTP requests using the Fetch API.\n *\n * This is the terminal middleware in the chain — it builds the actual HTTP\n * request from the operation descriptor and returns a normalized response.\n * It handles path-parameter interpolation, query-string serialization,\n * Bearer-token auth, and content-type negotiation (JSON, form-urlencoded, multipart).\n */\nexport function fetchTransportPlugin(\n  options: FetchTransportPluginOptions\n): Plugin {\n  return {\n    activate(api) {\n      api.addMiddleware(async (ctx) => {\n        const { operation } = ctx;\n\n        // Interpolate path parameters (e.g. \"/contacts/{contactId}\" → \"/contacts/123\")\n        let url = `${BASE_URL}${operation.path}`;\n        if (operation.pathParams) {\n          for (const [key, value] of Object.entries(operation.pathParams)) {\n            url = url.replace(`{${key}}`, encodeURIComponent(String(value)));\n          }\n        }\n\n        // Serialize query parameters, supporting repeated keys for array values\n        if (operation.queryParams) {\n          const params = new URLSearchParams();\n          appendRecordToUrlSearchParams(params, operation.queryParams);\n          const qs = params.toString();\n          if (qs) url += `?${qs}`;\n        }\n\n        const headers: Record<string, string> = {\n          ...(operation.headers ?? {}),\n          Authorization: `Bearer ${options.getAccessToken()}`,\n        };\n\n        const init: RequestInit = {\n          method: operation.method.toUpperCase(),\n          headers,\n        };\n\n        // For file uploads the API expects multipart/form-data; BinaryData\n        // values are appended as Blobs while everything else is stringified.\n        // Form bodies use application/x-www-form-urlencoded. Otherwise JSON.\n        if (operation.contentType === 'multipart/form-data' && operation.body) {\n          const formData = new FormData();\n          for (const [key, value] of Object.entries(\n            operation.body as Record<string, unknown>\n          )) {\n            if (value == null) continue;\n            if (isBinaryData(value)) {\n              formData.append(key, value.source as Blob);\n            } else {\n              formData.append(key, String(value));\n            }\n          }\n          init.body = formData;\n        } else if (\n          operation.contentType === 'application/x-www-form-urlencoded'\n        ) {\n          headers['Content-Type'] = 'application/x-www-form-urlencoded';\n          if (operation.body) {\n            const params = new URLSearchParams();\n            appendRecordToUrlSearchParams(\n              params,\n              operation.body as Record<string, unknown>\n            );\n            const encoded = params.toString();\n            if (encoded) init.body = encoded;\n          }\n        } else {\n          headers['Content-Type'] = 'application/json';\n          if (operation.body) {\n            init.body = JSON.stringify(operation.body);\n          }\n        }\n        const response = await fetch(url, init);\n        const responseHeaders: Record<string, string> = Object.create(null);\n        response.headers.forEach((value, key) => {\n          responseHeaders[key] = value;\n        });\n\n        return {\n          status: response.status,\n          statusText: response.statusText,\n          headers: responseHeaders,\n          // 204 No Content responses have no body to parse\n          bodyJson: response.status === 204 ? undefined : await response.json(),\n        };\n      });\n    },\n  };\n}\n"],"mappings":";;AAGA,MAAM,WAAW;AAMjB,SAAS,8BACP,QACA,QACM;CACN,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,EAAE;EACjD,IAAI,SAAS,MAAM;EACnB,IAAI,MAAM,QAAQ,MAAM,EACtB,KAAK,MAAM,QAAQ,OACjB,OAAO,OAAO,KAAK,OAAO,KAAe,CAAC;OAG5C,OAAO,OAAO,KAAK,OAAO,MAAM,CAAC;;;;;;;;;;;AAavC,SAAgB,qBACd,SACQ;CACR,OAAO,EACL,SAAS,KAAK;EACZ,IAAI,cAAc,OAAO,QAAQ;GAC/B,MAAM,EAAE,cAAc;GAGtB,IAAI,MAAM,GAAG,WAAW,UAAU;GAClC,IAAI,UAAU,YACZ,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,WAAW,EAC7D,MAAM,IAAI,QAAQ,IAAI,IAAI,IAAI,mBAAmB,OAAO,MAAM,CAAC,CAAC;GAKpE,IAAI,UAAU,aAAa;IACzB,MAAM,SAAS,IAAI,iBAAiB;IACpC,8BAA8B,QAAQ,UAAU,YAAY;IAC5D,MAAM,KAAK,OAAO,UAAU;IAC5B,IAAI,IAAI,OAAO,IAAI;;GAGrB,MAAM,UAAkC;IACtC,GAAI,UAAU,WAAW,EAAE;IAC3B,eAAe,UAAU,QAAQ,gBAAgB;IAClD;GAED,MAAM,OAAoB;IACxB,QAAQ,UAAU,OAAO,aAAa;IACtC;IACD;GAKD,IAAI,UAAU,gBAAgB,yBAAyB,UAAU,MAAM;IACrE,MAAM,WAAW,IAAI,UAAU;IAC/B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAChC,UAAU,KACX,EAAE;KACD,IAAI,SAAS,MAAM;KACnB,IAAI,aAAa,MAAM,EACrB,SAAS,OAAO,KAAK,MAAM,OAAe;UAE1C,SAAS,OAAO,KAAK,OAAO,MAAM,CAAC;;IAGvC,KAAK,OAAO;UACP,IACL,UAAU,gBAAgB,qCAC1B;IACA,QAAQ,kBAAkB;IAC1B,IAAI,UAAU,MAAM;KAClB,MAAM,SAAS,IAAI,iBAAiB;KACpC,8BACE,QACA,UAAU,KACX;KACD,MAAM,UAAU,OAAO,UAAU;KACjC,IAAI,SAAS,KAAK,OAAO;;UAEtB;IACL,QAAQ,kBAAkB;IAC1B,IAAI,UAAU,MACZ,KAAK,OAAO,KAAK,UAAU,UAAU,KAAK;;GAG9C,MAAM,WAAW,MAAM,MAAM,KAAK,KAAK;GACvC,MAAM,kBAA0C,OAAO,OAAO,KAAK;GACnE,SAAS,QAAQ,SAAS,OAAO,QAAQ;IACvC,gBAAgB,OAAO;KACvB;GAEF,OAAO;IACL,QAAQ,SAAS;IACjB,YAAY,SAAS;IACrB,SAAS;IAET,UAAU,SAAS,WAAW,MAAM,KAAA,IAAY,MAAM,SAAS,MAAM;IACtE;IACD;IAEL"}

package/dist/server/constants.js

@@ -1,73 +0,0 @@
-//#region src/server/constants.ts
-/**
-* Cookie name carrying the DPoP-bound access token. Uses the
-* `__Host-` prefix so the browser only accepts it from a `Secure`
-* response with `Path=/` — a defense-in-depth against subdomain
-* cookie injection.
-*/
-const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = "__Host-hs_access_token";
-/**
-* Cookie carrying the opaque app-session ID. Hashed before being put
-* on the wire as a DPoP `sid` claim.
-*/
-const HUBSPOT_APP_SID_COOKIE_NAME = "__Host-hs_app_sid";
-/**
-* Cookie pinning the browser-facing app origin (e.g.
-* `https://app.example.com`) for the lifetime of an app session.
-* Set by `auth/init-session` from the request's `Origin` header and
-* read by:
-*
-* - The CORS middleware to emit a credentialed
-*   `Access-Control-Allow-Origin` value (`*` is forbidden when
-*   `Access-Control-Allow-Credentials: true`).
-* - `auth/complete` to rebuild the OAuth `redirect_uri` it sent to
-*   HubSpot during `init-session` (the token endpoint validates that
-*   the two values match).
-*
-* `__Host-` prefixed (Path=/, Secure, no Domain), so the same
-* function host can serve both `hubspot-connect` and `api` routes
-* and read the cookie from either.
-*/
-const HUBSPOT_APP_ORIGIN_COOKIE_NAME = "__Host-hs_app_origin";
-/**
-* Prefix used for refresh-token cookies. Each session gets its own
-* cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can
-* coexist without overwriting each other's refresh tokens.
-*/
-const HUBSPOT_REFRESH_COOKIE_PREFIX = "hs_refresh_";
-const PROTECTED_COOKIE_NAMES = new Set([
-	HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
-	HUBSPOT_APP_SID_COOKIE_NAME,
-	HUBSPOT_APP_ORIGIN_COOKIE_NAME
-]);
-/**
-* Returns `true` for cookies the SDK manages internally
-* (access token, session ID, any refresh-token cookie). The
-* `sanitizeRequest` helper uses this to strip these cookies from the
-* request before user code sees it, ensuring user route handlers
-* cannot accidentally leak them in logs or proxy them upstream.
-*/
-function isProtectedCookieName(cookieName) {
-	return PROTECTED_COOKIE_NAMES.has(cookieName) || cookieName.startsWith("hs_refresh_");
-}
-/**
-* Cookie carrying the PKCE code verifier between `init-session` and
-* `auth/complete`. Set with `SameSite=None; Secure; Partitioned` so the
-* frontend's credentialed cross-site `POST /auth/complete` (made from
-* the OAuth callback page on the app origin to the SDK's edge function
-* origin) carries it through. `Lax` would silently drop it on that
-* fetch, breaking every successful HubSpot redirect.
-*/
-const TEMP_COOKIE_PKCE_VERIFIER = "__hs_pkce_verifier";
-/**
-* Cookie carrying the OAuth `state` value between `init-session` and
-* `auth/complete`. Compared against the `state` query parameter as the
-* primary CSRF defense. Same `SameSite=None; Secure; Partitioned`
-* attributes as `TEMP_COOKIE_PKCE_VERIFIER` for the same cross-site
-* `POST /auth/complete` reason.
-*/
-const TEMP_COOKIE_OAUTH_STATE = "__hs_oauth_state";
-//#endregion
-export { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER, isProtectedCookieName };
-
-//# sourceMappingURL=constants.js.map

package/dist/server/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../../src/server/constants.ts"],"sourcesContent":["/**\n * Cookie name carrying the DPoP-bound access token. Uses the\n * `__Host-` prefix so the browser only accepts it from a `Secure`\n * response with `Path=/` — a defense-in-depth against subdomain\n * cookie injection.\n */\nexport const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = '__Host-hs_access_token';\n\n/**\n * Cookie carrying the opaque app-session ID. Hashed before being put\n * on the wire as a DPoP `sid` claim.\n */\nexport const HUBSPOT_APP_SID_COOKIE_NAME = '__Host-hs_app_sid';\n\n/**\n * Cookie pinning the browser-facing app origin (e.g.\n * `https://app.example.com`) for the lifetime of an app session.\n * Set by `auth/init-session` from the request's `Origin` header and\n * read by:\n *\n * - The CORS middleware to emit a credentialed\n *   `Access-Control-Allow-Origin` value (`*` is forbidden when\n *   `Access-Control-Allow-Credentials: true`).\n * - `auth/complete` to rebuild the OAuth `redirect_uri` it sent to\n *   HubSpot during `init-session` (the token endpoint validates that\n *   the two values match).\n *\n * `__Host-` prefixed (Path=/, Secure, no Domain), so the same\n * function host can serve both `hubspot-connect` and `api` routes\n * and read the cookie from either.\n */\nexport const HUBSPOT_APP_ORIGIN_COOKIE_NAME = '__Host-hs_app_origin';\n\n/**\n * Prefix used for refresh-token cookies. Each session gets its own\n * cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can\n * coexist without overwriting each other's refresh tokens.\n */\nexport const HUBSPOT_REFRESH_COOKIE_PREFIX = 'hs_refresh_';\n\nconst PROTECTED_COOKIE_NAMES = new Set([\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n]);\n\n/**\n * Returns `true` for cookies the SDK manages internally\n * (access token, session ID, any refresh-token cookie). The\n * `sanitizeRequest` helper uses this to strip these cookies from the\n * request before user code sees it, ensuring user route handlers\n * cannot accidentally leak them in logs or proxy them upstream.\n */\nexport function isProtectedCookieName(cookieName: string): boolean {\n  return (\n    PROTECTED_COOKIE_NAMES.has(cookieName) ||\n    cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)\n  );\n}\n\n/**\n * Cookie carrying the PKCE code verifier between `init-session` and\n * `auth/complete`. Set with `SameSite=None; Secure; Partitioned` so the\n * frontend's credentialed cross-site `POST /auth/complete` (made from\n * the OAuth callback page on the app origin to the SDK's edge function\n * origin) carries it through. `Lax` would silently drop it on that\n * fetch, breaking every successful HubSpot redirect.\n */\nexport const TEMP_COOKIE_PKCE_VERIFIER = '__hs_pkce_verifier';\n\n/**\n * Cookie carrying the OAuth `state` value between `init-session` and\n * `auth/complete`. Compared against the `state` query parameter as the\n * primary CSRF defense. Same `SameSite=None; Secure; Partitioned`\n * attributes as `TEMP_COOKIE_PKCE_VERIFIER` for the same cross-site\n * `POST /auth/complete` reason.\n */\nexport const TEMP_COOKIE_OAUTH_STATE = '__hs_oauth_state';\n"],"mappings":";;;;;;;AAMA,MAAa,mCAAmC;;;;;AAMhD,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;AAmB3C,MAAa,iCAAiC;;;;;;AAO9C,MAAa,gCAAgC;AAE7C,MAAM,yBAAyB,IAAI,IAAI;CACrC;CACA;CACA;CACD,CAAC;;;;;;;;AASF,SAAgB,sBAAsB,YAA6B;CACjE,OACE,uBAAuB,IAAI,WAAW,IACtC,WAAW,WAAA,cAAyC;;;;;;;;;;AAYxD,MAAa,4BAA4B;;;;;;;;AASzC,MAAa,0BAA0B"}

package/dist/server/deno/start.d.ts

@@ -1,12 +0,0 @@
-import { SecureStartContext, SecureStartLoader } from "../secure-start-core.js";
-
-//#region src/server/deno/start.d.ts
-/**
- * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`
- * when CIMD or DPoP is enabled, imports the supplied loader, and invokes
- * `start` with `AppKeys` or `null`.
- */
-declare function secureStart(loader: SecureStartLoader): Promise<void>;
-//#endregion
-export { secureStart };
-//# sourceMappingURL=start.d.ts.map

package/dist/server/deno/start.js

@@ -1,21 +0,0 @@
-import { runSecureStart } from "../secure-start-core.js";
-//#region src/server/deno/start.ts
-const denoSecureStartAdapter = {
-	readEnv: (key) => Deno.env.get(key),
-	deleteEnv: (key) => {
-		Deno.env.delete(key);
-	},
-	exit: (code) => Deno.exit(code)
-};
-/**
-* Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`
-* when CIMD or DPoP is enabled, imports the supplied loader, and invokes
-* `start` with `AppKeys` or `null`.
-*/
-function secureStart(loader) {
-	return runSecureStart(loader, denoSecureStartAdapter);
-}
-//#endregion
-export { secureStart };
-
-//# sourceMappingURL=start.js.map

package/dist/server/deno/start.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"start.js","names":[],"sources":["../../../src/server/deno/start.ts"],"sourcesContent":["import {\n  runSecureStart,\n  type SecureStartAdapter,\n  type SecureStartContext,\n  type SecureStartLoader,\n} from '../secure-start-core.ts';\n\nexport type { SecureStartContext, SecureStartLoader };\n\nconst denoSecureStartAdapter: SecureStartAdapter = {\n  readEnv: (key) => Deno.env.get(key),\n  deleteEnv: (key) => {\n    Deno.env.delete(key);\n  },\n  exit: (code) => Deno.exit(code),\n};\n\n/**\n * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`\n * when CIMD or DPoP is enabled, imports the supplied loader, and invokes\n * `start` with `AppKeys` or `null`.\n */\nexport function secureStart(loader: SecureStartLoader): Promise<void> {\n  return runSecureStart(loader, denoSecureStartAdapter);\n}\n"],"mappings":";;AASA,MAAM,yBAA6C;CACjD,UAAU,QAAQ,KAAK,IAAI,IAAI,IAAI;CACnC,YAAY,QAAQ;EAClB,KAAK,IAAI,OAAO,IAAI;;CAEtB,OAAO,SAAS,KAAK,KAAK,KAAK;CAChC;;;;;;AAOD,SAAgB,YAAY,QAA0C;CACpE,OAAO,eAAe,QAAQ,uBAAuB"}

package/dist/server/hono/hono-request-handler.js

@@ -1,59 +0,0 @@
-import { createHubSpotClient } from "../api-client-core/client.js";
-import { noopLogger } from "../shared/logger.js";
-import { fetchTransportPlugin } from "../api-client-core/plugins/fetch-transport.js";
-import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME } from "../constants.js";
-import { createHubSpotProxy } from "../proxy.js";
-import { parseCookies } from "../utils/cookie-utils.js";
-import { sanitizeRequest } from "../sanitize-request.js";
-import { corsMiddleware } from "./utils/cors-middleware.js";
-import { Hono } from "hono";
-//#region src/server/hono/hono-request-handler.ts
-/**
-* Wraps a Hono app so its `fetch` handler additionally:
-*
-* - Strips SDK-managed cookies (access token, refresh, sid) from the
-*   request before the app sees them, via `sanitizeRequest`.
-* - Exposes a `hubSpotProxy` on the Hono context so route handlers
-*   can issue authenticated calls to HubSpot's API on behalf of the
-*   browser session.
-*/
-function createAppConnectRequestHandler(options) {
-	const { registerRoutes, appKeys, logger = noopLogger } = options;
-	const app = new Hono();
-	app.use("*", corsMiddleware());
-	app.use("*", async (c, next) => {
-		const { authenticated } = c.env.hubSpot;
-		if (!authenticated) return c.json({ error: "Unauthorized" }, 401);
-		await next();
-	});
-	registerRoutes(app);
-	return (request) => {
-		const cookie = request.headers.get("Cookie");
-		if (!cookie) throw new Error("Missing auth cookies");
-		const cookies = parseCookies(cookie);
-		const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];
-		const proxy = createHubSpotProxy({
-			userCredentials: {
-				accessToken,
-				sessionId: cookies[HUBSPOT_APP_SID_COOKIE_NAME]
-			},
-			appKeys,
-			logger
-		});
-		const client = createHubSpotClient({ plugins: [fetchTransportPlugin({ getAccessToken: () => {
-			if (!accessToken) throw new Error("Missing access token");
-			return accessToken;
-		} })] });
-		const sanitizedRequest = sanitizeRequest(request);
-		const honoBindings = { hubSpot: {
-			proxy,
-			client,
-			authenticated: proxy.authenticated
-		} };
-		return app.fetch(sanitizedRequest, honoBindings);
-	};
-}
-//#endregion
-export { createAppConnectRequestHandler };
-
-//# sourceMappingURL=hono-request-handler.js.map

package/dist/server/hono/hono-request-handler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hono-request-handler.js","names":[],"sources":["../../../src/server/hono/hono-request-handler.ts"],"sourcesContent":["import { Hono } from 'hono';\n\nimport { noopLogger, type Logger } from '../../shared/logger.ts';\nimport { createHubSpotClient } from '../api-client-core/client.ts';\nimport { fetchTransportPlugin } from '../api-client-core/plugins/fetch-transport.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n} from '../constants.ts';\nimport { createHubSpotProxy } from '../proxy.ts';\nimport { sanitizeRequest } from '../sanitize-request.ts';\nimport type { AppKeys, UserCredentials } from '../types.ts';\nimport { parseCookies } from '../utils/cookie-utils.ts';\nimport type { AppConnectHonoBindings, AppConnectHonoEnv } from './types.ts';\nimport { corsMiddleware } from './utils/cors-middleware.ts';\n\n/**\n * Web-standard fetch handler signature returned by\n * {@link createAppConnectRequestHandler}.\n */\nexport type AppConnectFetchHandler = (\n  request: Request\n) => Response | Promise<Response>;\n\n/**\n * Callback used to attach application routes to the SDK-owned Hono\n * app instance.\n */\nexport type RegisterAppConnectRoutesFunction = (\n  app: Hono<AppConnectHonoEnv>\n) => void;\n\n/**\n * Options accepted by {@link createAppConnectRequestHandler}.\n */\nexport interface CreateAppConnectRequestHandlerOptions {\n  /** Registers application routes on the SDK-owned Hono app. */\n  registerRoutes: RegisterAppConnectRoutesFunction;\n  /**\n   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP\n   * are both disabled.\n   */\n  appKeys: AppKeys | null;\n  /**\n   * Optional logger. When omitted the SDK uses a no-op logger so\n   * server-side state never leaks into the host application's\n   * console.\n   */\n  logger?: Logger;\n}\n\n/**\n * Wraps a Hono app so its `fetch` handler additionally:\n *\n * - Strips SDK-managed cookies (access token, refresh, sid) from the\n *   request before the app sees them, via `sanitizeRequest`.\n * - Exposes a `hubSpotProxy` on the Hono context so route handlers\n *   can issue authenticated calls to HubSpot's API on behalf of the\n *   browser session.\n */\nexport function createAppConnectRequestHandler(\n  options: CreateAppConnectRequestHandlerOptions\n): AppConnectFetchHandler {\n  const { registerRoutes, appKeys, logger = noopLogger } = options;\n  const app = new Hono<AppConnectHonoEnv>();\n  // Credentialed CORS first: preflights short-circuit with 204\n  // before the auth check runs, and 401 responses still carry\n  // `Access-Control-Allow-*` headers (the browser drops responses\n  // without them on credentialed cross-site fetches).\n  app.use('*', corsMiddleware());\n\n  // Auth gate: every non-OPTIONS request must arrive with the\n  // SDK-managed access-token + session-id cookies. The CORS\n  // middleware above short-circuits OPTIONS, so this only runs on\n  // real requests; missing cookies now surface as a normal 401 with\n  // CORS headers attached on the way back out (the previous\n  // implementation threw on a missing `Cookie` header before any\n  // middleware ran, which broke browser preflights).\n  app.use('*', async (c, next) => {\n    const { authenticated } = c.env.hubSpot;\n    if (!authenticated) {\n      return c.json({ error: 'Unauthorized' }, 401);\n    }\n\n    await next();\n    return;\n  });\n\n  registerRoutes(app);\n\n  return (request: Request) => {\n    const cookie = request.headers.get('Cookie');\n    if (!cookie) {\n      throw new Error('Missing auth cookies');\n    }\n    const cookies = parseCookies(cookie);\n    const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];\n    const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];\n\n    const userCredentials: UserCredentials = { accessToken, sessionId };\n\n    const proxy = createHubSpotProxy({\n      userCredentials,\n      appKeys,\n      logger,\n    });\n\n    const client = createHubSpotClient({\n      plugins: [\n        fetchTransportPlugin({\n          getAccessToken: () => {\n            if (!accessToken) {\n              throw new Error('Missing access token');\n            }\n            return accessToken;\n          },\n        }),\n      ],\n    });\n\n    const sanitizedRequest = sanitizeRequest(request);\n\n    const honoBindings: AppConnectHonoBindings = {\n      hubSpot: {\n        proxy,\n        client,\n        authenticated: proxy.authenticated,\n      },\n    };\n\n    return app.fetch(sanitizedRequest, honoBindings);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA4DA,SAAgB,+BACd,SACwB;CACxB,MAAM,EAAE,gBAAgB,SAAS,SAAS,eAAe;CACzD,MAAM,MAAM,IAAI,MAAyB;CAKzC,IAAI,IAAI,KAAK,gBAAgB,CAAC;CAS9B,IAAI,IAAI,KAAK,OAAO,GAAG,SAAS;EAC9B,MAAM,EAAE,kBAAkB,EAAE,IAAI;EAChC,IAAI,CAAC,eACH,OAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,EAAE,IAAI;EAG/C,MAAM,MAAM;GAEZ;CAEF,eAAe,IAAI;CAEnB,QAAQ,YAAqB;EAC3B,MAAM,SAAS,QAAQ,QAAQ,IAAI,SAAS;EAC5C,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,uBAAuB;EAEzC,MAAM,UAAU,aAAa,OAAO;EACpC,MAAM,cAAc,QAAQ;EAK5B,MAAM,QAAQ,mBAAmB;GAC/B,iBAAA;IAHyC;IAAa,WAFtC,QAAQ;IAKT;GACf;GACA;GACD,CAAC;EAEF,MAAM,SAAS,oBAAoB,EACjC,SAAS,CACP,qBAAqB,EACnB,sBAAsB;GACpB,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,uBAAuB;GAEzC,OAAO;KAEV,CAAC,CACH,EACF,CAAC;EAEF,MAAM,mBAAmB,gBAAgB,QAAQ;EAEjD,MAAM,eAAuC,EAC3C,SAAS;GACP;GACA;GACA,eAAe,MAAM;GACtB,EACF;EAED,OAAO,IAAI,MAAM,kBAAkB,aAAa"}

package/dist/server/hono/hubspot-connect-routes/auth-complete.js

@@ -1,154 +0,0 @@
-import { base64urlDecode } from "../../shared/encoding/base64.js";
-import { HUBSPOT_ACCESS_TOKEN_COOKIE_NAME, HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_REFRESH_COOKIE_PREFIX, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
-import { parseCookies } from "../../utils/cookie-utils.js";
-import { AUTH_COMPLETE_CODE_PARAM, AUTH_COMPLETE_STATE_PARAM } from "../../shared/constants.js";
-import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
-import { REFRESH_COOKIE_MAX_AGE_SEC } from "./constants.js";
-import { buildClientAssertion, buildClientAssertionFormParams, buildClientSecretFormParams, buildTokenEndpointDpopProof, requestOAuthToken } from "./oauth-client.js";
-import { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, clearTempCookie, isPositiveFiniteNumber, isSafeReturnPath, parseAppOriginHeader } from "./utils.js";
-//#region src/server/hono/hubspot-connect-routes/auth-complete.ts
-/**
-* Cross-origin OAuth completion endpoint.
-*
-* Called from the React app on the frontend OAuth callback path
-* (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the
-* browser back with `?code` + `?state`. The browser POSTs both
-* values here as a credentialed cross-site fetch — same partition as
-* `init-session`, so the temp PKCE/state cookies are visible — and
-* the SDK:
-*
-* 1. Validates `state` against the temp `__hs_oauth_state` cookie.
-* 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.
-* 3. Rebuilds the same `redirect_uri` it sent to HubSpot during
-*    `init-session` (frontend origin + the fixed callback path);
-*    the OAuth token endpoint requires the two values to match.
-* 4. Exchanges `code` for an access + refresh token (with DPoP /
-*    CIMD client-assertion when enabled).
-* 5. Sets the durable session cookies (access token, refresh) with
-*    `SameSite=None; Secure; Partitioned` so they live in the
-*    `(frontend, edge)` partition where subsequent API fetches will
-*    read them.
-* 6. Clears the temp cookies.
-* 7. Returns `{ expires_at, return_path }` so the controller can
-*    update its session-storage expiry tracking and navigate back to
-*    the page the user started the connect flow from.
-*/
-async function handleAuthComplete(c, options) {
-	const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;
-	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
-	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
-	const requestHostHeader = c.req.header("host") ?? void 0;
-	const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);
-	const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);
-	if (!code || !state) return c.json({ error: "Missing code or state" }, 400);
-	if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) return c.json({ error: "Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled" }, 500);
-	const cookies = parseCookies(c.req.header("Cookie"));
-	const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];
-	const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];
-	const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];
-	if (!expectedState || state !== decodeURIComponent(expectedState)) return c.json({ error: "State mismatch" }, 403);
-	if (!codeVerifier) return c.json({ error: "Missing PKCE verifier" }, 400);
-	const appOrigin = parseAppOriginHeader(appOriginCookie);
-	if (!appOrigin) return c.json({ error: "Missing app origin cookie" }, 400);
-	let statePayload;
-	try {
-		statePayload = JSON.parse(new TextDecoder().decode(base64urlDecode(decodeURIComponent(state))));
-	} catch {
-		return c.json({ error: "Malformed state value" }, 400);
-	}
-	const returnPath = statePayload.return_path;
-	if (!returnPath || !isSafeReturnPath(returnPath)) return c.json({ error: "Invalid return path in state" }, 400);
-	const sessionId = statePayload.sid;
-	if (!sessionId) return c.json({ error: "Missing app session cookie" }, 400);
-	const decodedCodeVerifier = decodeURIComponent(codeVerifier);
-	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
-		requestUrl: c.req.url,
-		basePath: options.basePath,
-		xForwardedProto,
-		xForwardedHost,
-		requestHostHeader
-	}) : hubspotConnectEnv.hubspotClientId;
-	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
-	const tokenEndpointUrl = new URL("/oauth/v1/token", hubspotConnectEnv.hubspotOAuthApiOrigin).href;
-	let dpopProof;
-	if (hubspotConnectEnv.isDpopEnabled) dpopProof = await buildTokenEndpointDpopProof({
-		appKeys,
-		tokenEndpointUrl,
-		sessionIdHash: sessionId
-	});
-	let formParams;
-	if (hubspotConnectEnv.isCimdEnabled) formParams = {
-		grant_type: "authorization_code",
-		code,
-		code_verifier: decodedCodeVerifier,
-		redirect_uri: redirectUri,
-		...buildClientAssertionFormParams({
-			clientId,
-			clientAssertion: await buildClientAssertion({
-				appKeys,
-				clientId,
-				audience: tokenEndpointUrl
-			})
-		})
-	};
-	else formParams = {
-		grant_type: "authorization_code",
-		code,
-		code_verifier: decodedCodeVerifier,
-		redirect_uri: redirectUri,
-		...buildClientSecretFormParams({
-			clientId,
-			clientSecret: hubspotConnectEnv.hubspotClientSecret
-		})
-	};
-	const tokenResult = await requestOAuthToken({
-		tokenEndpointUrl,
-		isDpopEnabled: hubspotConnectEnv.isDpopEnabled,
-		...dpopProof !== void 0 ? { dpopProof } : {},
-		formParams
-	});
-	if (!tokenResult.ok) return c.json({ error: `Token exchange failed: ${tokenResult.errorText}` }, 502);
-	const { access_token: accessToken, refresh_token: refreshToken, expires_in } = tokenResult.body;
-	if (!refreshToken) return c.json({ error: "Token response missing refresh_token" }, 502);
-	if (!isPositiveFiniteNumber(expires_in)) return c.json({ error: "Token response missing or invalid expires_in" }, 502);
-	const expiresAt = Date.now() + expires_in * 1e3;
-	const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
-			value: accessToken,
-			path: "/",
-			sameSite: "None",
-			partitioned: true,
-			maxAge: expires_in
-		})
-	});
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: refreshCookieName,
-			value: refreshToken,
-			path: refreshCookiePath,
-			sameSite: "None",
-			partitioned: true,
-			maxAge: REFRESH_COOKIE_MAX_AGE_SEC
-		})
-	});
-	setResponseCookie({
-		c,
-		value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER)
-	});
-	setResponseCookie({
-		c,
-		value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE)
-	});
-	return c.json({
-		expires_at: expiresAt,
-		return_path: returnPath
-	});
-}
-//#endregion
-export { handleAuthComplete };
-
-//# sourceMappingURL=auth-complete.js.map

package/dist/server/hono/hubspot-connect-routes/auth-complete.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-complete.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-complete.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  AUTH_COMPLETE_CODE_PARAM,\n  AUTH_COMPLETE_STATE_PARAM,\n} from '../../../shared/constants.ts';\nimport {\n  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n  HUBSPOT_REFRESH_COOKIE_PREFIX,\n  TEMP_COOKIE_OAUTH_STATE,\n  TEMP_COOKIE_PKCE_VERIFIER,\n} from '../../constants.ts';\nimport { base64urlDecode } from '../../utils/base64-utils.ts';\nimport { parseCookies } from '../../utils/cookie-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { REFRESH_COOKIE_MAX_AGE_SEC } from './constants.ts';\nimport {\n  buildClientAssertion,\n  buildClientAssertionFormParams,\n  buildClientSecretFormParams,\n  buildTokenEndpointDpopProof,\n  requestOAuthToken,\n} from './oauth-client.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  buildFrontendOAuthRedirectUri,\n  clearTempCookie,\n  isPositiveFiniteNumber,\n  isSafeReturnPath,\n  parseAppOriginHeader,\n} from './utils.ts';\n\ninterface OAuthStatePayload {\n  return_path?: string;\n  sid?: string;\n}\n\n/**\n * Cross-origin OAuth completion endpoint.\n *\n * Called from the React app on the frontend OAuth callback path\n * (`HUBSPOT_FRONTEND_CALLBACK_PATH`) once HubSpot has redirected the\n * browser back with `?code` + `?state`. The browser POSTs both\n * values here as a credentialed cross-site fetch — same partition as\n * `init-session`, so the temp PKCE/state cookies are visible — and\n * the SDK:\n *\n * 1. Validates `state` against the temp `__hs_oauth_state` cookie.\n * 2. Pulls the PKCE verifier from `__hs_pkce_verifier`.\n * 3. Rebuilds the same `redirect_uri` it sent to HubSpot during\n *    `init-session` (frontend origin + the fixed callback path);\n *    the OAuth token endpoint requires the two values to match.\n * 4. Exchanges `code` for an access + refresh token (with DPoP /\n *    CIMD client-assertion when enabled).\n * 5. Sets the durable session cookies (access token, refresh) with\n *    `SameSite=None; Secure; Partitioned` so they live in the\n *    `(frontend, edge)` partition where subsequent API fetches will\n *    read them.\n * 6. Clears the temp cookies.\n * 7. Returns `{ expires_at, return_path }` so the controller can\n *    update its session-storage expiry tracking and navigate back to\n *    the page the user started the connect flow from.\n */\nexport async function handleAuthComplete(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { appKeys, refreshCookiePath, hubspotConnectEnv } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const code = c.req.query(AUTH_COMPLETE_CODE_PARAM);\n  const state = c.req.query(AUTH_COMPLETE_STATE_PARAM);\n\n  if (!code || !state) {\n    return c.json({ error: 'Missing code or state' }, 400);\n  }\n\n  if (hubspotConnectEnv.isAppPrivateKeyRequired && !appKeys) {\n    return c.json(\n      {\n        error:\n          'Server misconfiguration: HUBSPOT_APP_PRIVATE_KEY is required when CIMD or DPoP is enabled',\n      },\n      500\n    );\n  }\n\n  const cookies = parseCookies(c.req.header('Cookie'));\n  const expectedState = cookies[TEMP_COOKIE_OAUTH_STATE];\n  const codeVerifier = cookies[TEMP_COOKIE_PKCE_VERIFIER];\n  const appOriginCookie = cookies[HUBSPOT_APP_ORIGIN_COOKIE_NAME];\n\n  if (!expectedState || state !== decodeURIComponent(expectedState)) {\n    return c.json({ error: 'State mismatch' }, 403);\n  }\n  if (!codeVerifier) {\n    return c.json({ error: 'Missing PKCE verifier' }, 400);\n  }\n  // The redirect_uri the OAuth token endpoint validates must equal\n  // the one we sent during init-session. We rebuild it from the\n  // pinned origin cookie so that value is anchored server-side, not\n  // taken from the (caller-controlled) request `Origin` on this call.\n  const appOrigin = parseAppOriginHeader(appOriginCookie);\n  if (!appOrigin) {\n    return c.json({ error: 'Missing app origin cookie' }, 400);\n  }\n\n  let statePayload: OAuthStatePayload;\n  try {\n    statePayload = JSON.parse(\n      new TextDecoder().decode(base64urlDecode(decodeURIComponent(state)))\n    ) as OAuthStatePayload;\n  } catch {\n    return c.json({ error: 'Malformed state value' }, 400);\n  }\n  const returnPath = statePayload.return_path;\n  if (!returnPath || !isSafeReturnPath(returnPath)) {\n    return c.json({ error: 'Invalid return path in state' }, 400);\n  }\n\n  const sessionId = statePayload.sid;\n  if (!sessionId) {\n    return c.json({ error: 'Missing app session cookie' }, 400);\n  }\n\n  const decodedCodeVerifier = decodeURIComponent(codeVerifier);\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath: options.basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);\n\n  const tokenEndpointUrl = new URL(\n    '/oauth/v1/token',\n    hubspotConnectEnv.hubspotOAuthApiOrigin\n  ).href;\n\n  let dpopProof: string | undefined;\n  if (hubspotConnectEnv.isDpopEnabled) {\n    dpopProof = await buildTokenEndpointDpopProof({\n      appKeys: appKeys!,\n      tokenEndpointUrl,\n      sessionIdHash: sessionId,\n    });\n  }\n\n  let formParams: Record<string, string>;\n  if (hubspotConnectEnv.isCimdEnabled) {\n    const clientAssertion = await buildClientAssertion({\n      appKeys: appKeys!,\n      clientId,\n      audience: tokenEndpointUrl,\n    });\n    formParams = {\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: decodedCodeVerifier,\n      redirect_uri: redirectUri,\n      ...buildClientAssertionFormParams({ clientId, clientAssertion }),\n    };\n  } else {\n    formParams = {\n      grant_type: 'authorization_code',\n      code,\n      code_verifier: decodedCodeVerifier,\n      redirect_uri: redirectUri,\n      ...buildClientSecretFormParams({\n        clientId,\n        clientSecret: hubspotConnectEnv.hubspotClientSecret,\n      }),\n    };\n  }\n\n  const tokenResult = await requestOAuthToken({\n    tokenEndpointUrl,\n    isDpopEnabled: hubspotConnectEnv.isDpopEnabled,\n    ...(dpopProof !== undefined ? { dpopProof } : {}),\n    formParams,\n  });\n  if (!tokenResult.ok) {\n    return c.json(\n      { error: `Token exchange failed: ${tokenResult.errorText}` },\n      502\n    );\n  }\n\n  const {\n    access_token: accessToken,\n    refresh_token: refreshToken,\n    expires_in,\n  } = tokenResult.body;\n  if (!refreshToken) {\n    return c.json({ error: 'Token response missing refresh_token' }, 502);\n  }\n  if (!isPositiveFiniteNumber(expires_in)) {\n    return c.json(\n      { error: 'Token response missing or invalid expires_in' },\n      502\n    );\n  }\n\n  const expiresAt = Date.now() + expires_in * 1000;\n  const refreshCookieName = `${HUBSPOT_REFRESH_COOKIE_PREFIX}${sessionId}`;\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,\n      value: accessToken,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: expires_in,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: refreshCookieName,\n      value: refreshToken,\n      path: refreshCookiePath,\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: REFRESH_COOKIE_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({ c, value: clearTempCookie(TEMP_COOKIE_PKCE_VERIFIER) });\n  setResponseCookie({ c, value: clearTempCookie(TEMP_COOKIE_OAUTH_STATE) });\n\n  return c.json({ expires_at: expiresAt, return_path: returnPath });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,mBACpB,GACA,SACA;CACA,MAAM,EAAE,SAAS,mBAAmB,sBAAsB;CAC1D,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAClD,MAAM,OAAO,EAAE,IAAI,MAAM,yBAAyB;CAClD,MAAM,QAAQ,EAAE,IAAI,MAAM,0BAA0B;CAEpD,IAAI,CAAC,QAAQ,CAAC,OACZ,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAGxD,IAAI,kBAAkB,2BAA2B,CAAC,SAChD,OAAO,EAAE,KACP,EACE,OACE,6FACH,EACD,IACD;CAGH,MAAM,UAAU,aAAa,EAAE,IAAI,OAAO,SAAS,CAAC;CACpD,MAAM,gBAAgB,QAAQ;CAC9B,MAAM,eAAe,QAAQ;CAC7B,MAAM,kBAAkB,QAAQ;CAEhC,IAAI,CAAC,iBAAiB,UAAU,mBAAmB,cAAc,EAC/D,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,EAAE,IAAI;CAEjD,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;CAMxD,MAAM,YAAY,qBAAqB,gBAAgB;CACvD,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,6BAA6B,EAAE,IAAI;CAG5D,IAAI;CACJ,IAAI;EACF,eAAe,KAAK,MAClB,IAAI,aAAa,CAAC,OAAO,gBAAgB,mBAAmB,MAAM,CAAC,CAAC,CACrE;SACK;EACN,OAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;;CAExD,MAAM,aAAa,aAAa;CAChC,IAAI,CAAC,cAAc,CAAC,iBAAiB,WAAW,EAC9C,OAAO,EAAE,KAAK,EAAE,OAAO,gCAAgC,EAAE,IAAI;CAG/D,MAAM,YAAY,aAAa;CAC/B,IAAI,CAAC,WACH,OAAO,EAAE,KAAK,EAAE,OAAO,8BAA8B,EAAE,IAAI;CAG7D,MAAM,sBAAsB,mBAAmB,aAAa;CAE5D,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,cAAc,8BAA8B,UAAU;CAE5D,MAAM,mBAAmB,IAAI,IAC3B,mBACA,kBAAkB,sBACnB,CAAC;CAEF,IAAI;CACJ,IAAI,kBAAkB,eACpB,YAAY,MAAM,4BAA4B;EACnC;EACT;EACA,eAAe;EAChB,CAAC;CAGJ,IAAI;CACJ,IAAI,kBAAkB,eAMpB,aAAa;EACX,YAAY;EACZ;EACA,eAAe;EACf,cAAc;EACd,GAAG,+BAA+B;GAAE;GAAU,iBAAA,MAVlB,qBAAqB;IACxC;IACT;IACA,UAAU;IACX,CAAC;GAM+D,CAAC;EACjE;MAED,aAAa;EACX,YAAY;EACZ;EACA,eAAe;EACf,cAAc;EACd,GAAG,4BAA4B;GAC7B;GACA,cAAc,kBAAkB;GACjC,CAAC;EACH;CAGH,MAAM,cAAc,MAAM,kBAAkB;EAC1C;EACA,eAAe,kBAAkB;EACjC,GAAI,cAAc,KAAA,IAAY,EAAE,WAAW,GAAG,EAAE;EAChD;EACD,CAAC;CACF,IAAI,CAAC,YAAY,IACf,OAAO,EAAE,KACP,EAAE,OAAO,0BAA0B,YAAY,aAAa,EAC5D,IACD;CAGH,MAAM,EACJ,cAAc,aACd,eAAe,cACf,eACE,YAAY;CAChB,IAAI,CAAC,cACH,OAAO,EAAE,KAAK,EAAE,OAAO,wCAAwC,EAAE,IAAI;CAEvE,IAAI,CAAC,uBAAuB,WAAW,EACrC,OAAO,EAAE,KACP,EAAE,OAAO,gDAAgD,EACzD,IACD;CAGH,MAAM,YAAY,KAAK,KAAK,GAAG,aAAa;CAC5C,MAAM,oBAAoB,GAAG,gCAAgC;CAE7D,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAAE;EAAG,OAAO,gBAAgB,0BAA0B;EAAE,CAAC;CAC3E,kBAAkB;EAAE;EAAG,OAAO,gBAAgB,wBAAwB;EAAE,CAAC;CAEzE,OAAO,EAAE,KAAK;EAAE,YAAY;EAAW,aAAa;EAAY,CAAC"}

package/dist/server/hono/hubspot-connect-routes/auth-init-session.js

@@ -1,101 +0,0 @@
-import { base64url } from "../../shared/encoding/base64.js";
-import { sha256base64url } from "../../shared/encoding/sha256.js";
-import { HUBSPOT_APP_ORIGIN_COOKIE_NAME, HUBSPOT_APP_SID_COOKIE_NAME, TEMP_COOKIE_OAUTH_STATE, TEMP_COOKIE_PKCE_VERIFIER } from "../../constants.js";
-import { serializeCookie, setResponseCookie } from "../utils/cookie-utils.js";
-import { OAUTH_TEMP_MAX_AGE_SEC, SESSION_MAX_AGE_SEC } from "./constants.js";
-import { buildCimdClientIdUrlFromRequest, buildFrontendOAuthRedirectUri, isSafeReturnPath, parseAppOriginHeader } from "./utils.js";
-import { deriveHubSpotAuthorizeScopesFromClientMetadata } from "./fetch-hubspot-client-metadata.js";
-//#region src/server/hono/hubspot-connect-routes/auth-init-session.ts
-async function handleAuthInitSession(c, options) {
-	const { hubspotConnectEnv, cimdClientMetadata } = options;
-	const xForwardedProto = c.req.header("x-forwarded-proto") ?? void 0;
-	const xForwardedHost = c.req.header("x-forwarded-host") ?? void 0;
-	const requestHostHeader = c.req.header("host") ?? void 0;
-	const returnPath = new URL(c.req.url).searchParams.get("return_path") ?? "/";
-	if (!isSafeReturnPath(returnPath)) return c.text("Invalid return_path", 400);
-	const appOrigin = parseAppOriginHeader(c.req.header("Origin"));
-	if (!appOrigin) return c.text("Missing or invalid Origin header; init-session must be called from a browser", 400);
-	const sessionIdBytes = new Uint8Array(32);
-	crypto.getRandomValues(sessionIdBytes);
-	const sessionId = base64url(sessionIdBytes);
-	const sessionIdHash = await sha256base64url(sessionId);
-	const codeVerifierBytes = new Uint8Array(32);
-	crypto.getRandomValues(codeVerifierBytes);
-	const codeVerifier = base64url(codeVerifierBytes);
-	const codeChallenge = await sha256base64url(codeVerifier);
-	const stateValue = base64url(new TextEncoder().encode(JSON.stringify({
-		return_path: returnPath,
-		sid: sessionIdHash
-	})));
-	const clientId = hubspotConnectEnv.isCimdEnabled ? buildCimdClientIdUrlFromRequest({
-		requestUrl: c.req.url,
-		basePath: options.basePath,
-		xForwardedProto,
-		xForwardedHost,
-		requestHostHeader
-	}) : hubspotConnectEnv.hubspotClientId;
-	const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);
-	const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);
-	authorizeUrl.searchParams.set("response_type", "code");
-	authorizeUrl.searchParams.set("client_id", clientId);
-	authorizeUrl.searchParams.set("redirect_uri", redirectUri);
-	authorizeUrl.searchParams.set("code_challenge", codeChallenge);
-	authorizeUrl.searchParams.set("code_challenge_method", "S256");
-	authorizeUrl.searchParams.set("state", stateValue);
-	authorizeUrl.searchParams.set("sid", sessionIdHash);
-	if (!hubspotConnectEnv.isCimdEnabled) {
-		const scopesResult = deriveHubSpotAuthorizeScopesFromClientMetadata(cimdClientMetadata);
-		if (!scopesResult.ok) return c.text(scopesResult.message, scopesResult.status);
-		authorizeUrl.searchParams.set("scope", scopesResult.scope);
-		if (scopesResult.optionalScope !== void 0) authorizeUrl.searchParams.set("optional_scope", scopesResult.optionalScope);
-	}
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,
-			value: appOrigin,
-			path: "/",
-			sameSite: "None",
-			partitioned: true,
-			maxAge: SESSION_MAX_AGE_SEC
-		})
-	});
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: HUBSPOT_APP_SID_COOKIE_NAME,
-			value: sessionId,
-			path: "/",
-			sameSite: "None",
-			partitioned: true,
-			maxAge: SESSION_MAX_AGE_SEC
-		})
-	});
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: TEMP_COOKIE_PKCE_VERIFIER,
-			value: encodeURIComponent(codeVerifier),
-			path: "/",
-			sameSite: "None",
-			partitioned: true,
-			maxAge: OAUTH_TEMP_MAX_AGE_SEC
-		})
-	});
-	setResponseCookie({
-		c,
-		value: serializeCookie({
-			name: TEMP_COOKIE_OAUTH_STATE,
-			value: encodeURIComponent(stateValue),
-			path: "/",
-			sameSite: "None",
-			partitioned: true,
-			maxAge: OAUTH_TEMP_MAX_AGE_SEC
-		})
-	});
-	return c.json({ authorization_url: authorizeUrl.toString() });
-}
-//#endregion
-export { handleAuthInitSession };
-
-//# sourceMappingURL=auth-init-session.js.map

package/dist/server/hono/hubspot-connect-routes/auth-init-session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-init-session.js","names":[],"sources":["../../../../src/server/hono/hubspot-connect-routes/auth-init-session.ts"],"sourcesContent":["import type { Context } from 'hono';\n\nimport {\n  HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n  HUBSPOT_APP_SID_COOKIE_NAME,\n  TEMP_COOKIE_OAUTH_STATE,\n  TEMP_COOKIE_PKCE_VERIFIER,\n} from '../../constants.ts';\nimport { base64url } from '../../utils/base64-utils.ts';\nimport { sha256base64url } from '../../utils/crypto-utils.ts';\nimport { serializeCookie, setResponseCookie } from '../utils/cookie-utils.ts';\nimport { OAUTH_TEMP_MAX_AGE_SEC, SESSION_MAX_AGE_SEC } from './constants.ts';\nimport { deriveHubSpotAuthorizeScopesFromClientMetadata } from './fetch-hubspot-client-metadata.ts';\nimport type { HubSpotConnectOAuthRouteOptions } from './types.ts';\nimport {\n  buildCimdClientIdUrlFromRequest,\n  buildFrontendOAuthRedirectUri,\n  isSafeReturnPath,\n  parseAppOriginHeader,\n} from './utils.ts';\n\nexport async function handleAuthInitSession(\n  c: Context,\n  options: HubSpotConnectOAuthRouteOptions\n) {\n  const { hubspotConnectEnv, cimdClientMetadata } = options;\n  const xForwardedProto = c.req.header('x-forwarded-proto') ?? undefined;\n  const xForwardedHost = c.req.header('x-forwarded-host') ?? undefined;\n  const requestHostHeader = c.req.header('host') ?? undefined;\n  const url = new URL(c.req.url);\n  const returnPath = url.searchParams.get('return_path') ?? '/';\n  if (!isSafeReturnPath(returnPath)) {\n    return c.text('Invalid return_path', 400);\n  }\n\n  // The app origin pins the OAuth `redirect_uri` (which lands on the\n  // frontend, not on this edge function) and, via the persisted\n  // `__Host-hs_app_origin` cookie, drives credentialed\n  // `Access-Control-Allow-Origin` on every subsequent SDK response.\n  const appOrigin = parseAppOriginHeader(c.req.header('Origin'));\n  if (!appOrigin) {\n    return c.text(\n      'Missing or invalid Origin header; init-session must be called from a browser',\n      400\n    );\n  }\n\n  const sessionIdBytes = new Uint8Array(32);\n  crypto.getRandomValues(sessionIdBytes);\n  const sessionId = base64url(sessionIdBytes);\n  const sessionIdHash = await sha256base64url(sessionId);\n\n  const codeVerifierBytes = new Uint8Array(32);\n  crypto.getRandomValues(codeVerifierBytes);\n  const codeVerifier = base64url(codeVerifierBytes);\n  const codeChallenge = await sha256base64url(codeVerifier);\n\n  const stateValue = base64url(\n    new TextEncoder().encode(\n      JSON.stringify({\n        return_path: returnPath,\n        sid: sessionIdHash,\n      })\n    )\n  );\n\n  const clientId = hubspotConnectEnv.isCimdEnabled\n    ? buildCimdClientIdUrlFromRequest({\n        requestUrl: c.req.url,\n        basePath: options.basePath,\n        xForwardedProto,\n        xForwardedHost,\n        requestHostHeader,\n      })\n    : hubspotConnectEnv.hubspotClientId;\n\n  const redirectUri = buildFrontendOAuthRedirectUri(appOrigin);\n\n  const authorizeUrl = new URL(hubspotConnectEnv.hubspotAuthorizationEndpoint);\n  authorizeUrl.searchParams.set('response_type', 'code');\n  authorizeUrl.searchParams.set('client_id', clientId);\n  authorizeUrl.searchParams.set('redirect_uri', redirectUri);\n  authorizeUrl.searchParams.set('code_challenge', codeChallenge);\n  authorizeUrl.searchParams.set('code_challenge_method', 'S256');\n  authorizeUrl.searchParams.set('state', stateValue);\n  authorizeUrl.searchParams.set('sid', sessionIdHash);\n\n  if (!hubspotConnectEnv.isCimdEnabled) {\n    const scopesResult =\n      deriveHubSpotAuthorizeScopesFromClientMetadata(cimdClientMetadata);\n    if (!scopesResult.ok) {\n      return c.text(scopesResult.message, scopesResult.status as 500 | 502);\n    }\n    authorizeUrl.searchParams.set('scope', scopesResult.scope);\n    if (scopesResult.optionalScope !== undefined) {\n      authorizeUrl.searchParams.set(\n        'optional_scope',\n        scopesResult.optionalScope\n      );\n    }\n  }\n\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_ORIGIN_COOKIE_NAME,\n      value: appOrigin,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: SESSION_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: HUBSPOT_APP_SID_COOKIE_NAME,\n      value: sessionId,\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: SESSION_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_PKCE_VERIFIER,\n      value: encodeURIComponent(codeVerifier),\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n  setResponseCookie({\n    c,\n    value: serializeCookie({\n      name: TEMP_COOKIE_OAUTH_STATE,\n      value: encodeURIComponent(stateValue),\n      path: '/',\n      sameSite: 'None',\n      partitioned: true,\n      maxAge: OAUTH_TEMP_MAX_AGE_SEC,\n    }),\n  });\n\n  return c.json({ authorization_url: authorizeUrl.toString() });\n}\n"],"mappings":";;;;;;;;AAqBA,eAAsB,sBACpB,GACA,SACA;CACA,MAAM,EAAE,mBAAmB,uBAAuB;CAClD,MAAM,kBAAkB,EAAE,IAAI,OAAO,oBAAoB,IAAI,KAAA;CAC7D,MAAM,iBAAiB,EAAE,IAAI,OAAO,mBAAmB,IAAI,KAAA;CAC3D,MAAM,oBAAoB,EAAE,IAAI,OAAO,OAAO,IAAI,KAAA;CAElD,MAAM,aAAa,IADH,IAAI,EAAE,IAAI,IACJ,CAAC,aAAa,IAAI,cAAc,IAAI;CAC1D,IAAI,CAAC,iBAAiB,WAAW,EAC/B,OAAO,EAAE,KAAK,uBAAuB,IAAI;CAO3C,MAAM,YAAY,qBAAqB,EAAE,IAAI,OAAO,SAAS,CAAC;CAC9D,IAAI,CAAC,WACH,OAAO,EAAE,KACP,gFACA,IACD;CAGH,MAAM,iBAAiB,IAAI,WAAW,GAAG;CACzC,OAAO,gBAAgB,eAAe;CACtC,MAAM,YAAY,UAAU,eAAe;CAC3C,MAAM,gBAAgB,MAAM,gBAAgB,UAAU;CAEtD,MAAM,oBAAoB,IAAI,WAAW,GAAG;CAC5C,OAAO,gBAAgB,kBAAkB;CACzC,MAAM,eAAe,UAAU,kBAAkB;CACjD,MAAM,gBAAgB,MAAM,gBAAgB,aAAa;CAEzD,MAAM,aAAa,UACjB,IAAI,aAAa,CAAC,OAChB,KAAK,UAAU;EACb,aAAa;EACb,KAAK;EACN,CAAC,CACH,CACF;CAED,MAAM,WAAW,kBAAkB,gBAC/B,gCAAgC;EAC9B,YAAY,EAAE,IAAI;EAClB,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC,GACF,kBAAkB;CAEtB,MAAM,cAAc,8BAA8B,UAAU;CAE5D,MAAM,eAAe,IAAI,IAAI,kBAAkB,6BAA6B;CAC5E,aAAa,aAAa,IAAI,iBAAiB,OAAO;CACtD,aAAa,aAAa,IAAI,aAAa,SAAS;CACpD,aAAa,aAAa,IAAI,gBAAgB,YAAY;CAC1D,aAAa,aAAa,IAAI,kBAAkB,cAAc;CAC9D,aAAa,aAAa,IAAI,yBAAyB,OAAO;CAC9D,aAAa,aAAa,IAAI,SAAS,WAAW;CAClD,aAAa,aAAa,IAAI,OAAO,cAAc;CAEnD,IAAI,CAAC,kBAAkB,eAAe;EACpC,MAAM,eACJ,+CAA+C,mBAAmB;EACpE,IAAI,CAAC,aAAa,IAChB,OAAO,EAAE,KAAK,aAAa,SAAS,aAAa,OAAoB;EAEvE,aAAa,aAAa,IAAI,SAAS,aAAa,MAAM;EAC1D,IAAI,aAAa,kBAAkB,KAAA,GACjC,aAAa,aAAa,IACxB,kBACA,aAAa,cACd;;CAIL,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,aAAa;GACvC,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CACF,kBAAkB;EAChB;EACA,OAAO,gBAAgB;GACrB,MAAM;GACN,OAAO,mBAAmB,WAAW;GACrC,MAAM;GACN,UAAU;GACV,aAAa;GACb,QAAQ;GACT,CAAC;EACH,CAAC;CAEF,OAAO,EAAE,KAAK,EAAE,mBAAmB,aAAa,UAAU,EAAE,CAAC"}