@incorta/auth 1.0.0 → 1.1.1

package/README.md

@@ -8,7 +8,7 @@ guide; this is the API surface.
 
 | Import                  | What's in it                                                        |
 | ----------------------- | ------------------------------------------------------------------- |
-| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, types (`IncortaUser`, `AuthSession`, …) |
+| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, `getClient`, `updateClientRedirectUris`, types (`IncortaUser`, `AuthSession`, …) |
 | `@incorta/auth/react`   | `IncortaAuthProvider`, `useAuth`, `useUser`, `SignedIn`, `SignedOut`, `Protect`, `RedirectToLogin` |
 | `@incorta/auth/express` | `incortaAuth(auth)` middleware, `requireAuth(auth, options?)`        |
 | `@incorta/auth/node`    | `toNodeHandler(auth)`, `toWebRequest`, `sendWebResponse`, `getNodeSession` |
@@ -49,10 +49,17 @@ tokens. Nothing is stored server-side.
 ```bash
 incorta-auth register --url http://localhost:8080/incorta --tenant demo \
   --name "My App" --redirect https://myapp.example.com/auth/callback [--json]
+
+incorta-auth show --url ... --tenant ... --client <id> --rat <token> [--json]
+
+incorta-auth update-redirects --url ... --tenant ... --client <id> --rat <token> \
+  --redirect <url> [--redirect ...] [--replace] [--json]
 ```
 
-Registers the OAuth client via RFC 7591 dynamic registration and prints the
-`.env` entries.
+`register` creates the OAuth client via RFC 7591 dynamic registration and
+prints the `.env` entries (keep the registration access token). `show` and
+`update-redirects` manage the registered client's allowed callback URLs —
+adding by default, replacing the whole set with `--replace`.
 
 ## Testing
 

package/dist/cli.js

@@ -4,6 +4,26 @@
 import { randomBytes } from "crypto";
 
 // src/core/register.ts
+function registrationEndpoint(incortaUrl, tenant, clientId) {
+  const base = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  return clientId ? `${base}/${clientId}` : base;
+}
+async function readJson(response, what) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `[incorta-auth] ${what} failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return body;
+}
 async function registerClient(options) {
   const {
     incortaUrl,
@@ -17,8 +37,7 @@ async function registerClient(options) {
   if (!redirectUris.length) {
     throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
   }
-  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
-  const response = await fetchImpl(endpoint, {
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
@@ -29,17 +48,10 @@ async function registerClient(options) {
       token_endpoint_auth_method: "client_secret_basic"
     })
   });
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const body = await readJson(response, "Client registration");
+  if (!body.client_id || !body.client_secret) {
     throw new Error(
-      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
-    );
-  }
-  if (!response.ok || !body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
     );
   }
   return {
@@ -49,6 +61,63 @@ async function registerClient(options) {
     registrationClientUri: body.registration_client_uri
   };
 }
+function toClientInfo(body, fallbackClientId) {
+  return {
+    clientId: body.client_id ?? fallbackClientId,
+    name: body.client_name,
+    redirectUris: body.redirect_uris ?? [],
+    grantTypes: body.grant_types ?? [],
+    scope: body.scope
+  };
+}
+async function getClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  const body = await readJson(response, "Reading the client");
+  return toClientInfo(body, clientId);
+}
+async function updateClientRedirectUris(options) {
+  const {
+    incortaUrl,
+    tenant,
+    clientId,
+    registrationAccessToken,
+    redirectUris,
+    mode = "add",
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] updateClientRedirectUris requires at least one redirect URI.");
+  }
+  const current = await getClient(options);
+  const nextUris = mode === "add" ? [.../* @__PURE__ */ new Set([...current.redirectUris, ...redirectUris])] : redirectUris;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "PUT",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    },
+    // RFC 7592 update: client_id + full metadata. Incorta applies
+    // redirect_uris only, but nimbus-side parsing wants the full shape.
+    body: JSON.stringify({
+      client_id: clientId,
+      redirect_uris: nextUris,
+      grant_types: current.grantTypes,
+      scope: current.scope,
+      client_name: current.name
+    })
+  });
+  if (!response.ok) {
+    await readJson(response, "Updating the client");
+  }
+  return getClient(options);
+}
 
 // src/cli.ts
 var HELP = `incorta-auth \u2014 IncortaAuth SDK helper
@@ -58,8 +127,22 @@ Usage:
                         --redirect <callbackUrl> [--redirect <callbackUrl> ...] \\
                         [--scope "openid profile email"] [--json]
 
-Registers an OAuth client in Incorta (RFC 7591 dynamic registration) and prints
-the .env entries your app needs.
+  incorta-auth show --url <incortaUrl> --tenant <tenant> \\
+                    --client <clientId> --rat <registrationAccessToken> [--json]
+
+  incorta-auth update-redirects --url <incortaUrl> --tenant <tenant> \\
+                                --client <clientId> --rat <registrationAccessToken> \\
+                                --redirect <callbackUrl> [--redirect ...] \\
+                                [--replace] [--json]
+
+register          Registers an OAuth client in Incorta (RFC 7591 dynamic
+                  registration) and prints the .env entries your app needs.
+                  Keep the printed registration access token \u2014 it is the key
+                  for show/update-redirects later.
+show              Prints a registered client's current metadata.
+update-redirects  Adds the given callback URLs to the client's allowed set
+                  (or replaces the whole set with --replace, which is also how
+                  URLs are removed).
 
 Example:
   incorta-auth register \\
@@ -69,7 +152,7 @@ Example:
     --redirect http://localhost:4000/auth/callback
 `;
 function parseArgs(argv) {
-  const args = { redirects: [], json: false };
+  const args = { redirects: [], replace: false, json: false };
   for (let i = 0; i < argv.length; i++) {
     const flag = argv[i];
     const next = () => {
@@ -90,9 +173,18 @@ function parseArgs(argv) {
       case "--scope":
         args.scope = next();
         break;
+      case "--client":
+        args.client = next();
+        break;
+      case "--rat":
+        args.rat = next();
+        break;
       case "--redirect":
         args.redirects.push(next());
         break;
+      case "--replace":
+        args.replace = true;
+        break;
       case "--json":
         args.json = true;
         break;
@@ -102,36 +194,12 @@ function parseArgs(argv) {
   }
   return args;
 }
-async function main() {
-  const [command, ...rest] = process.argv.slice(2);
-  if (!command || command === "help" || command === "--help" || command === "-h") {
-    console.log(HELP);
-    return command ? 0 : 1;
-  }
-  if (command !== "register") {
-    console.error(`Unknown command: ${command}
-`);
-    console.log(HELP);
-    return 1;
-  }
-  let args;
-  try {
-    args = parseArgs(rest);
-  } catch (error) {
-    console.error(`${error.message}
-`);
-    console.log(HELP);
-    return 1;
-  }
-  const missing = ["url", "tenant", "name"].filter((key) => !args[key]);
-  if (missing.length || !args.redirects.length) {
-    console.error(
-      `Missing required flag(s): ${[...missing.map((m) => `--${m}`), ...args.redirects.length ? [] : ["--redirect"]].join(", ")}
-`
-    );
-    console.log(HELP);
-    return 1;
-  }
+function requireFlags(args, flags, needsRedirect) {
+  const missing = flags.filter((key) => !args[key]).map((key) => `--${key}`);
+  if (needsRedirect && !args.redirects.length) missing.push("--redirect");
+  return missing;
+}
+async function runRegister(args) {
   const client = await registerClient({
     incortaUrl: args.url,
     tenant: args.tenant,
@@ -141,7 +209,7 @@ async function main() {
   });
   if (args.json) {
     console.log(JSON.stringify(client, null, 2));
-    return 0;
+    return;
   }
   const authSecret = randomBytes(32).toString("base64url");
   console.log(`Client registered successfully.
@@ -156,10 +224,84 @@ async function main() {
   if (client.registrationAccessToken) {
     console.log(
       `
-# Keep these to manage the registration later (PUT/DELETE ${client.registrationClientUri ?? "the registration endpoint"}):`
+# Keep this token \u2014 it manages the registration later (incorta-auth show / update-redirects):`
     );
     console.log(`# registration_access_token: ${client.registrationAccessToken}`);
   }
+}
+async function runShow(args) {
+  const info = await getClient({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    clientId: args.client,
+    registrationAccessToken: args.rat
+  });
+  if (args.json) {
+    console.log(JSON.stringify(info, null, 2));
+    return;
+  }
+  console.log(`Client:      ${info.clientId}`);
+  if (info.name) console.log(`Name:        ${info.name}`);
+  if (info.scope) console.log(`Scope:       ${info.scope}`);
+  console.log(`Grant types: ${info.grantTypes.join(", ")}`);
+  console.log(`Redirect URIs:`);
+  for (const uri of info.redirectUris) console.log(`  - ${uri}`);
+}
+async function runUpdateRedirects(args) {
+  const info = await updateClientRedirectUris({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    clientId: args.client,
+    registrationAccessToken: args.rat,
+    redirectUris: args.redirects,
+    mode: args.replace ? "replace" : "add"
+  });
+  if (args.json) {
+    console.log(JSON.stringify(info, null, 2));
+    return;
+  }
+  console.log(`Redirect URIs ${args.replace ? "replaced" : "updated"}. Current set:`);
+  for (const uri of info.redirectUris) console.log(`  - ${uri}`);
+}
+var COMMANDS = {
+  register: { required: ["url", "tenant", "name"], needsRedirect: true, run: runRegister },
+  show: { required: ["url", "tenant", "client", "rat"], needsRedirect: false, run: runShow },
+  "update-redirects": {
+    required: ["url", "tenant", "client", "rat"],
+    needsRedirect: true,
+    run: runUpdateRedirects
+  }
+};
+async function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return command ? 0 : 1;
+  }
+  const spec = COMMANDS[command];
+  if (!spec) {
+    console.error(`Unknown command: ${command}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  let args;
+  try {
+    args = parseArgs(rest);
+  } catch (error) {
+    console.error(`${error.message}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  const missing = requireFlags(args, spec.required, spec.needsRedirect);
+  if (missing.length) {
+    console.error(`Missing required flag(s): ${missing.join(", ")}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  await spec.run(args);
   return 0;
 }
 main().then((code) => {

package/dist/index.cjs

@@ -22,7 +22,9 @@ var src_exports = {};
 __export(src_exports, {
   IncortaAuthError: () => IncortaAuthError,
   createIncortaAuth: () => createIncortaAuth,
-  registerClient: () => registerClient
+  getClient: () => getClient,
+  registerClient: () => registerClient,
+  updateClientRedirectUris: () => updateClientRedirectUris
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -581,6 +583,26 @@ function createHandler(config) {
 }
 
 // src/core/register.ts
+function registrationEndpoint(incortaUrl, tenant, clientId) {
+  const base = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  return clientId ? `${base}/${clientId}` : base;
+}
+async function readJson(response, what) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] ${what} returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `[incorta-auth] ${what} failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return body;
+}
 async function registerClient(options) {
   const {
     incortaUrl,
@@ -594,8 +616,7 @@ async function registerClient(options) {
   if (!redirectUris.length) {
     throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
   }
-  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
-  const response = await fetchImpl(endpoint, {
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant), {
     method: "POST",
     headers: { "content-type": "application/json", accept: "application/json" },
     body: JSON.stringify({
@@ -606,17 +627,10 @@ async function registerClient(options) {
       token_endpoint_auth_method: "client_secret_basic"
     })
   });
-  let body;
-  try {
-    body = await response.json();
-  } catch {
+  const body = await readJson(response, "Client registration");
+  if (!body.client_id || !body.client_secret) {
     throw new Error(
-      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
-    );
-  }
-  if (!response.ok || !body.client_id || !body.client_secret) {
-    throw new Error(
-      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+      `[incorta-auth] Client registration failed: response is missing client_id/client_secret.`
     );
   }
   return {
@@ -626,6 +640,63 @@ async function registerClient(options) {
     registrationClientUri: body.registration_client_uri
   };
 }
+function toClientInfo(body, fallbackClientId) {
+  return {
+    clientId: body.client_id ?? fallbackClientId,
+    name: body.client_name,
+    redirectUris: body.redirect_uris ?? [],
+    grantTypes: body.grant_types ?? [],
+    scope: body.scope
+  };
+}
+async function getClient(options) {
+  const { incortaUrl, tenant, clientId, registrationAccessToken, fetchImpl = fetch } = options;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    }
+  });
+  const body = await readJson(response, "Reading the client");
+  return toClientInfo(body, clientId);
+}
+async function updateClientRedirectUris(options) {
+  const {
+    incortaUrl,
+    tenant,
+    clientId,
+    registrationAccessToken,
+    redirectUris,
+    mode = "add",
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] updateClientRedirectUris requires at least one redirect URI.");
+  }
+  const current = await getClient(options);
+  const nextUris = mode === "add" ? [.../* @__PURE__ */ new Set([...current.redirectUris, ...redirectUris])] : redirectUris;
+  const response = await fetchImpl(registrationEndpoint(incortaUrl, tenant, clientId), {
+    method: "PUT",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      authorization: `Bearer ${registrationAccessToken}`
+    },
+    // RFC 7592 update: client_id + full metadata. Incorta applies
+    // redirect_uris only, but nimbus-side parsing wants the full shape.
+    body: JSON.stringify({
+      client_id: clientId,
+      redirect_uris: nextUris,
+      grant_types: current.grantTypes,
+      scope: current.scope,
+      client_name: current.name
+    })
+  });
+  if (!response.ok) {
+    await readJson(response, "Updating the client");
+  }
+  return getClient(options);
+}
 
 // src/index.ts
 function createIncortaAuth(config = {}) {
@@ -637,6 +708,8 @@ function createIncortaAuth(config = {}) {
 0 && (module.exports = {
   IncortaAuthError,
   createIncortaAuth,
-  registerClient
+  getClient,
+  registerClient,
+  updateClientRedirectUris
 });
 //# sourceMappingURL=index.cjs.map