@invect/core 0.0.1

package/dist/services/credentials/oauth2-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-providers.js","names":[],"sources":["../../../src/services/credentials/oauth2-providers.ts"],"sourcesContent":["/**\n * OAuth2 Provider Definitions\n *\n * Registry of OAuth2 providers with their configuration.\n * Each provider defines the URLs, scopes, and parameters needed for OAuth2 flow.\n *\n * Scopes and configurations verified against FlowiseAI/Flowise repository:\n * https://github.com/FlowiseAI/Flowise/tree/main/packages/components/credentials\n */\n\nexport interface OAuth2ProviderDefinition {\n  /** Unique provider identifier */\n  id: string;\n  /** Human-readable name */\n  name: string;\n  /** Description of what this provider is for */\n  description: string;\n  /** Icon name (lucide icon) */\n  icon?: string;\n  /** OAuth2 authorization endpoint */\n  authorizationUrl: string;\n  /** OAuth2 token endpoint */\n  tokenUrl: string;\n  /** Default scopes for this provider */\n  defaultScopes: string[];\n  /** Additional query parameters for authorization request */\n  additionalAuthParams?: Record<string, string>;\n  /** Whether this provider supports refresh tokens */\n  supportsRefresh: boolean;\n  /** Separator for scopes in the authorization URL (default: \" \"). Linear uses \",\". */\n  scopeSeparator?: string;\n  /** Documentation URL for setup instructions */\n  docsUrl?: string;\n  /** Category for grouping in UI - based on product function, not company */\n  category:\n    | 'productivity' // Docs, spreadsheets, office suites\n    | 'storage' // Cloud file storage and sync\n    | 'communication' // Email, messaging, video conferencing\n    | 'development' // Code repos, version control, CI/CD\n    | 'project_management' // Task tracking, issue tracking, project tools\n    | 'crm_sales' // Customer relationship management, sales pipelines\n    | 'marketing' // Email marketing, social media, analytics\n    | 'payments' // Payment processing, billing\n    | 'support' // Customer support, helpdesk, ticketing\n    | 'design' // Design tools, creative software\n    | 'other';\n}\n\n/**\n * Built-in OAuth2 provider definitions\n * Verified against FlowiseAI credential definitions\n */\nexport const OAUTH2_PROVIDERS: Record<string, OAuth2ProviderDefinition> = {\n  // =============================================================================\n  // GOOGLE PROVIDERS\n  // =============================================================================\n\n  // Google Docs - Verified from FlowiseAI GoogleDocsOAuth2.credential.ts\n  google_docs: {\n    id: 'google_docs',\n    name: 'Google Docs',\n    description: 'Access Google Docs for document creation and editing',\n    icon: 'FileText',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    defaultScopes: [\n      'https://www.googleapis.com/auth/documents',\n      'https://www.googleapis.com/auth/drive',\n      'https://www.googleapis.com/auth/drive.file',\n    ],\n    additionalAuthParams: {\n      access_type: 'offline',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developers.google.com/docs/api/quickstart',\n    category: 'productivity',\n  },\n\n  // Google Sheets - Verified from FlowiseAI GoogleSheetsOAuth2.credential.ts\n  google_sheets: {\n    id: 'google_sheets',\n    name: 'Google Sheets',\n    description: 'Access Google Sheets for spreadsheet operations',\n    icon: 'Sheet',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    defaultScopes: [\n      'https://www.googleapis.com/auth/drive.file',\n      'https://www.googleapis.com/auth/spreadsheets',\n      'https://www.googleapis.com/auth/drive.metadata',\n    ],\n    additionalAuthParams: {\n      access_type: 'offline',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developers.google.com/sheets/api/quickstart',\n    category: 'productivity',\n  },\n\n  // Google Drive - Verified from FlowiseAI GoogleDriveOAuth2.credential.ts\n  google_drive: {\n    id: 'google_drive',\n    name: 'Google Drive',\n    description: 'Access Google Drive for file management',\n    icon: 'HardDrive',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    defaultScopes: [\n      'https://www.googleapis.com/auth/drive',\n      'https://www.googleapis.com/auth/drive.appdata',\n      'https://www.googleapis.com/auth/drive.photos.readonly',\n    ],\n    additionalAuthParams: {\n      access_type: 'offline',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developers.google.com/drive/api/quickstart',\n    category: 'storage',\n  },\n\n  // Gmail - Verified from FlowiseAI GmailOAuth2.credential.ts\n  // Updated scopes to match Flowise: gmail.readonly, gmail.compose, gmail.modify, gmail.labels\n  google_gmail: {\n    id: 'google_gmail',\n    name: 'Gmail',\n    description: 'Access Gmail for email operations',\n    icon: 'Mail',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    defaultScopes: [\n      'https://www.googleapis.com/auth/gmail.readonly',\n      'https://www.googleapis.com/auth/gmail.compose',\n      'https://www.googleapis.com/auth/gmail.modify',\n      'https://www.googleapis.com/auth/gmail.labels',\n    ],\n    additionalAuthParams: {\n      access_type: 'offline',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developers.google.com/gmail/api/quickstart',\n    category: 'communication',\n  },\n\n  // Google Calendar - Verified from FlowiseAI GoogleCalendarOAuth2.credential.ts\n  google_calendar: {\n    id: 'google_calendar',\n    name: 'Google Calendar',\n    description: 'Access Google Calendar for event management',\n    icon: 'Calendar',\n    authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',\n    tokenUrl: 'https://oauth2.googleapis.com/token',\n    defaultScopes: [\n      'https://www.googleapis.com/auth/calendar',\n      'https://www.googleapis.com/auth/calendar.events',\n    ],\n    additionalAuthParams: {\n      access_type: 'offline',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developers.google.com/calendar/api/quickstart',\n    category: 'productivity',\n  },\n\n  // =============================================================================\n  // MICROSOFT PROVIDERS\n  // =============================================================================\n\n  // Microsoft 365 (General) - Base Microsoft OAuth2 / Graph API\n  microsoft: {\n    id: 'microsoft',\n    name: 'Microsoft 365',\n    description:\n      'Access Microsoft 365 services via Graph API — calendars, mail, meetings, and more',\n    icon: 'Cloud',\n    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    defaultScopes: [\n      'openid',\n      'profile',\n      'email',\n      'offline_access',\n      'User.Read',\n      'Calendars.Read',\n      'Mail.Read',\n      'Mail.ReadBasic',\n      'OnlineMeetings.Read',\n      'OnlineMeetingTranscript.Read.All',\n    ],\n    supportsRefresh: true,\n    docsUrl:\n      'https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow',\n    category: 'productivity',\n  },\n\n  // Microsoft Outlook - Verified from FlowiseAI MicrosoftOutlookOAuth2.credential.ts\n  microsoft_outlook: {\n    id: 'microsoft_outlook',\n    name: 'Microsoft Outlook',\n    description: 'Access Outlook for email, calendar, and contacts',\n    icon: 'Mail',\n    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    defaultScopes: [\n      'openid',\n      'offline_access',\n      'Contacts.Read',\n      'Contacts.ReadWrite',\n      'Calendars.Read',\n      'Calendars.Read.Shared',\n      'Calendars.ReadWrite',\n      'Mail.Read',\n      'Mail.ReadWrite',\n      'Mail.ReadWrite.Shared',\n      'Mail.Send',\n      'Mail.Send.Shared',\n      'MailboxSettings.Read',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://docs.microsoft.com/en-us/graph/api/resources/mail-api-overview',\n    category: 'communication',\n  },\n\n  // Microsoft Teams - Verified from FlowiseAI MicrosoftTeamsOAuth2.credential.ts\n  microsoft_teams: {\n    id: 'microsoft_teams',\n    name: 'Microsoft Teams',\n    description: 'Access Microsoft Teams for messaging and collaboration',\n    icon: 'Users',\n    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    defaultScopes: [\n      // Basic authentication\n      'openid',\n      'offline_access',\n      // User permissions\n      'User.Read',\n      'User.ReadWrite.All',\n      // Teams and Groups\n      'Group.ReadWrite.All',\n      'Team.ReadBasic.All',\n      'Team.Create',\n      'TeamMember.ReadWrite.All',\n      // Channels\n      'Channel.ReadBasic.All',\n      'Channel.Create',\n      'Channel.Delete.All',\n      'ChannelMember.ReadWrite.All',\n      // Chat operations\n      'Chat.ReadWrite',\n      'Chat.Create',\n      'ChatMember.ReadWrite',\n      // Messages\n      'ChatMessage.Send',\n      'ChatMessage.Read',\n      'ChannelMessage.Send',\n      'ChannelMessage.Read.All',\n      // Reactions and advanced features\n      'TeamsActivity.Send',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://docs.microsoft.com/en-us/graph/api/resources/teams-api-overview',\n    category: 'communication',\n  },\n\n  // Microsoft OneDrive\n  microsoft_onedrive: {\n    id: 'microsoft_onedrive',\n    name: 'Microsoft OneDrive',\n    description: 'Access OneDrive for file storage and management',\n    icon: 'HardDrive',\n    authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',\n    tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',\n    defaultScopes: [\n      'openid',\n      'offline_access',\n      'Files.Read',\n      'Files.Read.All',\n      'Files.ReadWrite',\n      'Files.ReadWrite.All',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://docs.microsoft.com/en-us/onedrive/developer/rest-api/',\n    category: 'storage',\n  },\n\n  // =============================================================================\n  // DEVELOPMENT\n  // =============================================================================\n\n  // GitHub - Verified from FlowiseAI (uses API tokens, not full OAuth2 in Flowise)\n  github: {\n    id: 'github',\n    name: 'GitHub',\n    description: 'Access GitHub repositories and issues',\n    icon: 'Github',\n    authorizationUrl: 'https://github.com/login/oauth/authorize',\n    tokenUrl: 'https://github.com/login/oauth/access_token',\n    defaultScopes: ['repo', 'read:user', 'user:email'],\n    supportsRefresh: false, // GitHub tokens don't expire by default\n    docsUrl: 'https://docs.github.com/en/apps/oauth-apps',\n    category: 'development',\n  },\n\n  // =============================================================================\n  // COMMUNICATION\n  // =============================================================================\n\n  // Slack - Based on FlowiseAI SlackApi.credential.ts (uses bot tokens)\n  slack: {\n    id: 'slack',\n    name: 'Slack',\n    description: 'Access Slack for messaging and channel operations',\n    icon: 'MessageSquare',\n    authorizationUrl: 'https://slack.com/oauth/v2/authorize',\n    tokenUrl: 'https://slack.com/api/oauth.v2.access',\n    defaultScopes: [\n      'channels:read',\n      'channels:write',\n      'chat:write',\n      'users:read',\n      'im:read',\n      'im:write',\n      'groups:read',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://api.slack.com/authentication/oauth-v2',\n    category: 'communication',\n  },\n\n  // =============================================================================\n  // PROJECT MANAGEMENT\n  // =============================================================================\n\n  // Jira (Atlassian Cloud) - Verified from FlowiseAI JiraApi.credential.ts\n  jira: {\n    id: 'jira',\n    name: 'Jira',\n    description: 'Access Jira for issue tracking and project management',\n    icon: 'Bug',\n    authorizationUrl: 'https://auth.atlassian.com/authorize',\n    tokenUrl: 'https://auth.atlassian.com/oauth/token',\n    defaultScopes: ['read:jira-work', 'write:jira-work', 'read:jira-user', 'offline_access'],\n    additionalAuthParams: {\n      audience: 'api.atlassian.com',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/',\n    category: 'project_management',\n  },\n\n  // Confluence Cloud - Based on FlowiseAI ConfluenceCloudApi.credential.ts\n  confluence: {\n    id: 'confluence',\n    name: 'Confluence',\n    description: 'Access Confluence for documentation and wiki pages',\n    icon: 'BookOpen',\n    authorizationUrl: 'https://auth.atlassian.com/authorize',\n    tokenUrl: 'https://auth.atlassian.com/oauth/token',\n    defaultScopes: [\n      'read:confluence-content.all',\n      'read:confluence-space.summary',\n      'write:confluence-content',\n      'offline_access',\n    ],\n    additionalAuthParams: {\n      audience: 'api.atlassian.com',\n      prompt: 'consent',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/',\n    category: 'productivity',\n  },\n\n  // =============================================================================\n  // OTHER PROVIDERS\n  // =============================================================================\n\n  // Notion - Verified (Notion uses internal OAuth, no traditional scopes)\n  notion: {\n    id: 'notion',\n    name: 'Notion',\n    description: 'Access Notion workspaces and pages',\n    icon: 'FileText',\n    authorizationUrl: 'https://api.notion.com/v1/oauth/authorize',\n    tokenUrl: 'https://api.notion.com/v1/oauth/token',\n    defaultScopes: [], // Notion doesn't use scopes, permissions are set during integration setup\n    additionalAuthParams: {\n      owner: 'user',\n    },\n    supportsRefresh: false,\n    docsUrl: 'https://developers.notion.com/docs/authorization',\n    category: 'productivity',\n  },\n\n  // Linear - Verified\n  linear: {\n    id: 'linear',\n    name: 'Linear',\n    description: 'Access Linear for issue tracking and project management',\n    icon: 'CheckSquare',\n    authorizationUrl: 'https://linear.app/oauth/authorize',\n    tokenUrl: 'https://api.linear.app/oauth/token',\n    defaultScopes: ['read', 'write', 'issues:create', 'comments:create'],\n    scopeSeparator: ',',\n    supportsRefresh: true,\n    docsUrl: 'https://developers.linear.app/docs/oauth/authentication',\n    category: 'project_management',\n  },\n\n  // Airtable - Verified\n  airtable: {\n    id: 'airtable',\n    name: 'Airtable',\n    description: 'Access Airtable bases and records',\n    icon: 'Table',\n    authorizationUrl: 'https://airtable.com/oauth2/v1/authorize',\n    tokenUrl: 'https://airtable.com/oauth2/v1/token',\n    defaultScopes: [\n      'data.records:read',\n      'data.records:write',\n      'schema.bases:read',\n      'schema.bases:write',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://airtable.com/developers/web/api/oauth-reference',\n    category: 'productivity',\n  },\n\n  // Figma - Based on FlowiseAI FigmaApi.credential.ts\n  figma: {\n    id: 'figma',\n    name: 'Figma',\n    description: 'Access Figma for design files and collaboration',\n    icon: 'Figma',\n    authorizationUrl: 'https://www.figma.com/oauth',\n    tokenUrl: 'https://www.figma.com/api/oauth/token',\n    defaultScopes: ['files:read', 'file_comments:write'],\n    supportsRefresh: true,\n    docsUrl: 'https://www.figma.com/developers/api#authentication',\n    category: 'design',\n  },\n\n  // Dropbox\n  dropbox: {\n    id: 'dropbox',\n    name: 'Dropbox',\n    description: 'Access Dropbox for file storage and sharing',\n    icon: 'Cloud',\n    authorizationUrl: 'https://www.dropbox.com/oauth2/authorize',\n    tokenUrl: 'https://api.dropboxapi.com/oauth2/token',\n    defaultScopes: [\n      'account_info.read',\n      'files.content.read',\n      'files.content.write',\n      'files.metadata.read',\n      'files.metadata.write',\n    ],\n    additionalAuthParams: {\n      token_access_type: 'offline',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://www.dropbox.com/developers/documentation/http/documentation',\n    category: 'storage',\n  },\n\n  // HubSpot\n  hubspot: {\n    id: 'hubspot',\n    name: 'HubSpot',\n    description: 'Access HubSpot CRM for contacts, deals, and marketing',\n    icon: 'Users',\n    authorizationUrl: 'https://app.hubspot.com/oauth/authorize',\n    tokenUrl: 'https://api.hubapi.com/oauth/v1/token',\n    defaultScopes: [\n      'crm.objects.contacts.read',\n      'crm.objects.contacts.write',\n      'crm.objects.companies.read',\n      'crm.objects.deals.read',\n      'crm.objects.deals.write',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://developers.hubspot.com/docs/api/oauth-quickstart-guide',\n    category: 'crm_sales',\n  },\n\n  // Salesforce\n  salesforce: {\n    id: 'salesforce',\n    name: 'Salesforce',\n    description: 'Access Salesforce CRM for sales and customer data',\n    icon: 'Cloud',\n    authorizationUrl: 'https://login.salesforce.com/services/oauth2/authorize',\n    tokenUrl: 'https://login.salesforce.com/services/oauth2/token',\n    defaultScopes: ['api', 'refresh_token', 'offline_access'],\n    supportsRefresh: true,\n    docsUrl:\n      'https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_oauth_and_connected_apps.htm',\n    category: 'crm_sales',\n  },\n\n  // Asana\n  asana: {\n    id: 'asana',\n    name: 'Asana',\n    description: 'Access Asana for task and project management',\n    icon: 'CheckSquare',\n    authorizationUrl: 'https://app.asana.com/-/oauth_authorize',\n    tokenUrl: 'https://app.asana.com/-/oauth_token',\n    defaultScopes: ['default'], // Asana uses 'default' scope for full access\n    supportsRefresh: true,\n    docsUrl: 'https://developers.asana.com/docs/oauth',\n    category: 'project_management',\n  },\n\n  // Trello\n  trello: {\n    id: 'trello',\n    name: 'Trello',\n    description: 'Access Trello boards, cards, and lists',\n    icon: 'Layout',\n    authorizationUrl: 'https://trello.com/1/authorize',\n    tokenUrl: 'https://trello.com/1/OAuthGetAccessToken',\n    defaultScopes: ['read', 'write'],\n    additionalAuthParams: {\n      expiration: 'never',\n      name: 'Invect',\n    },\n    supportsRefresh: false, // Trello uses OAuth 1.0a style with non-expiring tokens\n    docsUrl: 'https://developer.atlassian.com/cloud/trello/guides/rest-api/authorization/',\n    category: 'project_management',\n  },\n\n  // Zoom\n  zoom: {\n    id: 'zoom',\n    name: 'Zoom',\n    description: 'Access Zoom for meetings and webinars',\n    icon: 'Video',\n    authorizationUrl: 'https://zoom.us/oauth/authorize',\n    tokenUrl: 'https://zoom.us/oauth/token',\n    defaultScopes: ['meeting:read', 'meeting:write', 'user:read', 'webinar:read', 'webinar:write'],\n    supportsRefresh: true,\n    docsUrl: 'https://developers.zoom.us/docs/integrations/oauth/',\n    category: 'communication',\n  },\n\n  // Discord\n  discord: {\n    id: 'discord',\n    name: 'Discord',\n    description: 'Access Discord for messaging and server management',\n    icon: 'MessageSquare',\n    authorizationUrl: 'https://discord.com/api/oauth2/authorize',\n    tokenUrl: 'https://discord.com/api/oauth2/token',\n    defaultScopes: ['identify', 'email', 'guilds', 'guilds.members.read', 'bot', 'messages.read'],\n    supportsRefresh: true,\n    docsUrl: 'https://discord.com/developers/docs/topics/oauth2',\n    category: 'communication',\n  },\n\n  // Twitter/X\n  twitter: {\n    id: 'twitter',\n    name: 'Twitter / X',\n    description: 'Access Twitter/X for tweets and user data',\n    icon: 'Twitter',\n    authorizationUrl: 'https://twitter.com/i/oauth2/authorize',\n    tokenUrl: 'https://api.twitter.com/2/oauth2/token',\n    defaultScopes: ['tweet.read', 'tweet.write', 'users.read', 'offline.access'],\n    additionalAuthParams: {\n      code_challenge_method: 'S256',\n    },\n    supportsRefresh: true,\n    docsUrl: 'https://developer.twitter.com/en/docs/authentication/oauth-2-0',\n    category: 'marketing',\n  },\n\n  // Spotify\n  spotify: {\n    id: 'spotify',\n    name: 'Spotify',\n    description: 'Access Spotify for music and playlist management',\n    icon: 'Music',\n    authorizationUrl: 'https://accounts.spotify.com/authorize',\n    tokenUrl: 'https://accounts.spotify.com/api/token',\n    defaultScopes: [\n      'user-read-email',\n      'user-read-private',\n      'playlist-read-private',\n      'playlist-modify-public',\n      'playlist-modify-private',\n    ],\n    supportsRefresh: true,\n    docsUrl: 'https://developer.spotify.com/documentation/web-api/tutorials/code-flow',\n    category: 'other',\n  },\n\n  // Shopify\n  shopify: {\n    id: 'shopify',\n    name: 'Shopify',\n    description: 'Access Shopify for e-commerce store management',\n    icon: 'ShoppingBag',\n    authorizationUrl: 'https://{shop}.myshopify.com/admin/oauth/authorize',\n    tokenUrl: 'https://{shop}.myshopify.com/admin/oauth/access_token',\n    defaultScopes: [\n      'read_products',\n      'write_products',\n      'read_orders',\n      'write_orders',\n      'read_customers',\n    ],\n    supportsRefresh: false, // Shopify tokens don't expire\n    docsUrl: 'https://shopify.dev/docs/apps/auth/oauth',\n    category: 'other', // ecommerce\n  },\n\n  // Intercom\n  intercom: {\n    id: 'intercom',\n    name: 'Intercom',\n    description: 'Access Intercom for customer messaging and support',\n    icon: 'MessageCircle',\n    authorizationUrl: 'https://app.intercom.com/oauth',\n    tokenUrl: 'https://api.intercom.io/auth/eagle/token',\n    defaultScopes: [], // Intercom doesn't use scopes in OAuth flow\n    supportsRefresh: false,\n    docsUrl: 'https://developers.intercom.com/building-apps/docs/setting-up-oauth',\n    category: 'support',\n  },\n\n  // Zendesk\n  zendesk: {\n    id: 'zendesk',\n    name: 'Zendesk',\n    description: 'Access Zendesk for customer support and ticketing',\n    icon: 'Headphones',\n    authorizationUrl: 'https://{subdomain}.zendesk.com/oauth/authorizations/new',\n    tokenUrl: 'https://{subdomain}.zendesk.com/oauth/tokens',\n    defaultScopes: ['read', 'write'],\n    supportsRefresh: true,\n    docsUrl: 'https://developer.zendesk.com/documentation/live-chat/getting-started/auth/',\n    category: 'support',\n  },\n\n  // Box\n  box: {\n    id: 'box',\n    name: 'Box',\n    description: 'Access Box for file storage and collaboration',\n    icon: 'Box',\n    authorizationUrl: 'https://account.box.com/api/oauth2/authorize',\n    tokenUrl: 'https://api.box.com/oauth2/token',\n    defaultScopes: [], // Box doesn't use scopes in authorization\n    supportsRefresh: true,\n    docsUrl: 'https://developer.box.com/guides/authentication/oauth2/',\n    category: 'storage',\n  },\n\n  // Pipedrive\n  pipedrive: {\n    id: 'pipedrive',\n    name: 'Pipedrive',\n    description: 'Access Pipedrive CRM for sales pipeline management',\n    icon: 'TrendingUp',\n    authorizationUrl: 'https://oauth.pipedrive.com/oauth/authorize',\n    tokenUrl: 'https://oauth.pipedrive.com/oauth/token',\n    defaultScopes: [], // Pipedrive uses app-level permissions, not OAuth scopes\n    supportsRefresh: true,\n    docsUrl: 'https://pipedrive.readme.io/docs/marketplace-oauth-authorization',\n    category: 'crm_sales',\n  },\n\n  // Monday.com\n  monday: {\n    id: 'monday',\n    name: 'Monday.com',\n    description: 'Access Monday.com for work management',\n    icon: 'Calendar',\n    authorizationUrl: 'https://auth.monday.com/oauth2/authorize',\n    tokenUrl: 'https://auth.monday.com/oauth2/token',\n    defaultScopes: ['me:read', 'boards:read', 'boards:write'],\n    supportsRefresh: true,\n    docsUrl: 'https://developer.monday.com/apps/docs/oauth',\n    category: 'project_management',\n  },\n\n  // ClickUp\n  clickup: {\n    id: 'clickup',\n    name: 'ClickUp',\n    description: 'Access ClickUp for project and task management',\n    icon: 'CheckCircle',\n    authorizationUrl: 'https://app.clickup.com/api',\n    tokenUrl: 'https://api.clickup.com/api/v2/oauth/token',\n    defaultScopes: [], // ClickUp doesn't use OAuth scopes\n    supportsRefresh: true,\n    docsUrl: 'https://clickup.com/api/developer-portal/authentication/',\n    category: 'project_management',\n  },\n\n  // Freshdesk\n  freshdesk: {\n    id: 'freshdesk',\n    name: 'Freshdesk',\n    description: 'Access Freshdesk for customer support ticketing',\n    icon: 'Headphones',\n    authorizationUrl: 'https://{domain}.freshdesk.com/oauth/authorize',\n    tokenUrl: 'https://{domain}.freshdesk.com/oauth/token',\n    defaultScopes: [], // Freshdesk uses API key or OAuth without scopes\n    supportsRefresh: true,\n    docsUrl: 'https://developers.freshdesk.com/api/#authentication',\n    category: 'support',\n  },\n\n  // QuickBooks\n  quickbooks: {\n    id: 'quickbooks',\n    name: 'QuickBooks',\n    description: 'Access QuickBooks for accounting and financial data',\n    icon: 'DollarSign',\n    authorizationUrl: 'https://appcenter.intuit.com/connect/oauth2',\n    tokenUrl: 'https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer',\n    defaultScopes: ['com.intuit.quickbooks.accounting'],\n    supportsRefresh: true,\n    docsUrl:\n      'https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0',\n    category: 'payments', // accounting/finance\n  },\n\n  // Mailchimp\n  mailchimp: {\n    id: 'mailchimp',\n    name: 'Mailchimp',\n    description: 'Access Mailchimp for email marketing and audiences',\n    icon: 'Mail',\n    authorizationUrl: 'https://login.mailchimp.com/oauth2/authorize',\n    tokenUrl: 'https://login.mailchimp.com/oauth2/token',\n    defaultScopes: [], // Mailchimp doesn't use OAuth scopes\n    supportsRefresh: false, // Mailchimp tokens don't expire\n    docsUrl: 'https://mailchimp.com/developer/marketing/guides/access-user-data-oauth-2/',\n    category: 'marketing',\n  },\n\n  // Stripe\n  stripe: {\n    id: 'stripe',\n    name: 'Stripe',\n    description: 'Access Stripe for payment processing',\n    icon: 'CreditCard',\n    authorizationUrl: 'https://connect.stripe.com/oauth/authorize',\n    tokenUrl: 'https://connect.stripe.com/oauth/token',\n    defaultScopes: ['read_write'],\n    supportsRefresh: true,\n    docsUrl: 'https://stripe.com/docs/connect/oauth-reference',\n    category: 'payments',\n  },\n\n  // PayPal\n  paypal: {\n    id: 'paypal',\n    name: 'PayPal',\n    description: 'Access PayPal for payment processing',\n    icon: 'DollarSign',\n    authorizationUrl: 'https://www.paypal.com/signin/authorize',\n    tokenUrl: 'https://api.paypal.com/v1/oauth2/token',\n    defaultScopes: ['openid', 'email'],\n    supportsRefresh: true,\n    docsUrl: 'https://developer.paypal.com/docs/log-in-with-paypal/integrate/',\n    category: 'payments',\n  },\n};\n\n/**\n * Get a provider definition by ID\n */\nexport function getOAuth2Provider(providerId: string): OAuth2ProviderDefinition | undefined {\n  return OAUTH2_PROVIDERS[providerId];\n}\n\n/**\n * Get all provider definitions\n */\nexport function getAllOAuth2Providers(): OAuth2ProviderDefinition[] {\n  return Object.values(OAUTH2_PROVIDERS);\n}\n\n/**\n * Get providers by category\n */\nexport function getOAuth2ProvidersByCategory(\n  category: OAuth2ProviderDefinition['category'],\n): OAuth2ProviderDefinition[] {\n  return Object.values(OAUTH2_PROVIDERS).filter((p) => p.category === category);\n}\n"],"mappings":";;;;;AAoDA,MAAa,mBAA6D;CAMxE,aAAa;EACX,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACD;EACD,sBAAsB;GACpB,aAAa;GACb,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,eAAe;EACb,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACD;EACD,sBAAsB;GACpB,aAAa;GACb,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,cAAc;EACZ,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACD;EACD,sBAAsB;GACpB,aAAa;GACb,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAID,cAAc;EACZ,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACD;EACD,sBAAsB;GACpB,aAAa;GACb,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,iBAAiB;EACf,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CACb,4CACA,kDACD;EACD,sBAAsB;GACpB,aAAa;GACb,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAOD,WAAW;EACT,IAAI;EACJ,MAAM;EACN,aACE;EACF,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SACE;EACF,UAAU;EACX;CAGD,mBAAmB;EACjB,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,iBAAiB;EACf,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAEb;GACA;GAEA;GACA;GAEA;GACA;GACA;GACA;GAEA;GACA;GACA;GACA;GAEA;GACA;GACA;GAEA;GACA;GACA;GACA;GAEA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,oBAAoB;EAClB,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAOD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAQ;GAAa;GAAa;EAClD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAOD,OAAO;EACL,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAOD,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAkB;GAAmB;GAAkB;GAAiB;EACxF,sBAAsB;GACpB,UAAU;GACV,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,YAAY;EACV,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACD;EACD,sBAAsB;GACpB,UAAU;GACV,QAAQ;GACT;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAOD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,sBAAsB,EACpB,OAAO,QACR;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAQ;GAAS;GAAiB;GAAkB;EACpE,gBAAgB;EAChB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,UAAU;EACR,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,OAAO;EACL,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,cAAc,sBAAsB;EACpD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACD;EACD,sBAAsB,EACpB,mBAAmB,WACpB;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,YAAY;EACV,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAO;GAAiB;GAAiB;EACzD,iBAAiB;EACjB,SACE;EACF,UAAU;EACX;CAGD,OAAO;EACL,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,UAAU;EAC1B,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,QAAQ,QAAQ;EAChC,sBAAsB;GACpB,YAAY;GACZ,MAAM;GACP;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,MAAM;EACJ,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAgB;GAAiB;GAAa;GAAgB;GAAgB;EAC9F,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAY;GAAS;GAAU;GAAuB;GAAO;GAAgB;EAC7F,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAc;GAAe;GAAc;GAAiB;EAC5E,sBAAsB,EACpB,uBAAuB,QACxB;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GACb;GACA;GACA;GACA;GACA;GACD;EACD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,UAAU;EACR,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,QAAQ,QAAQ;EAChC,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,KAAK;EACH,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,WAAW;EACT,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe;GAAC;GAAW;GAAe;GAAe;EACzD,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,SAAS;EACP,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,WAAW;EACT,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,YAAY;EACV,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,mCAAmC;EACnD,iBAAiB;EACjB,SACE;EACF,UAAU;EACX;CAGD,WAAW;EACT,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,EAAE;EACjB,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,aAAa;EAC7B,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CAGD,QAAQ;EACN,IAAI;EACJ,MAAM;EACN,aAAa;EACb,MAAM;EACN,kBAAkB;EAClB,UAAU;EACV,eAAe,CAAC,UAAU,QAAQ;EAClC,iBAAiB;EACjB,SAAS;EACT,UAAU;EACX;CACF;;;;AAKD,SAAgB,kBAAkB,YAA0D;AAC1F,QAAO,iBAAiB;;;;;AAM1B,SAAgB,wBAAoD;AAClE,QAAO,OAAO,OAAO,iBAAiB"}

package/dist/services/credentials/oauth2.service.cjs

@@ -0,0 +1,252 @@
+require("../../_virtual/_rolldown/runtime.cjs");
+const require_oauth2_providers = require("./oauth2-providers.cjs");
+let crypto = require("crypto");
+//#region src/services/credentials/oauth2.service.ts
+/**
+* OAuth2 Service
+*
+* Handles OAuth2 authorization flow:
+* 1. Generate authorization URL with state
+* 2. Exchange authorization code for tokens
+* 3. Refresh access tokens when expired
+*/
+const pendingStates = /* @__PURE__ */ new Map();
+const STATE_EXPIRY_MS = 600 * 1e3;
+function cleanupExpiredStates() {
+	const now = Date.now();
+	for (const [state, pending] of pendingStates.entries()) if (now - pending.createdAt > STATE_EXPIRY_MS) pendingStates.delete(state);
+}
+setInterval(cleanupExpiredStates, 300 * 1e3);
+/**
+* OAuth2 Service for handling authorization flows
+*/
+var OAuth2Service = class {
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/**
+	* Get all available OAuth2 providers
+	*/
+	getProviders() {
+		return require_oauth2_providers.getAllOAuth2Providers();
+	}
+	/**
+	* Get a specific OAuth2 provider
+	*/
+	getProvider(providerId) {
+		return require_oauth2_providers.getOAuth2Provider(providerId);
+	}
+	/**
+	* Start an OAuth2 authorization flow
+	*
+	* @param providerId - The OAuth2 provider ID
+	* @param appConfig - OAuth app credentials and redirect URI
+	* @param options - Additional options
+	* @returns Authorization URL and state to redirect user to
+	*/
+	startAuthorizationFlow(providerId, appConfig, options = {}) {
+		const provider = require_oauth2_providers.getOAuth2Provider(providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${providerId}`);
+		const state = (0, crypto.randomBytes)(32).toString("hex");
+		const codeVerifier = (0, crypto.randomBytes)(32).toString("base64url");
+		const codeChallenge = (0, crypto.createHash)("sha256").update(codeVerifier).digest("base64url");
+		const params = new URLSearchParams({
+			client_id: appConfig.clientId,
+			redirect_uri: appConfig.redirectUri,
+			response_type: "code",
+			state,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256"
+		});
+		const scopes = options.scopes ?? provider.defaultScopes;
+		if (scopes.length > 0) {
+			const separator = provider.scopeSeparator ?? " ";
+			params.set("scope", scopes.join(separator));
+		}
+		if (provider.additionalAuthParams) for (const [key, value] of Object.entries(provider.additionalAuthParams)) params.set(key, value);
+		const authorizationUrl = `${provider.authorizationUrl}?${params.toString()}`;
+		const pendingState = {
+			state,
+			providerId,
+			codeVerifier,
+			returnUrl: options.returnUrl,
+			credentialName: options.credentialName,
+			createdAt: Date.now()
+		};
+		pendingStates.set(state, pendingState);
+		this.logger.debug("Started OAuth2 flow", {
+			providerId,
+			state
+		});
+		return {
+			authorizationUrl,
+			state,
+			codeVerifier
+		};
+	}
+	/**
+	* Get pending OAuth2 state
+	*/
+	getPendingState(state) {
+		return pendingStates.get(state);
+	}
+	/**
+	* Remove pending OAuth2 state (after successful exchange)
+	*/
+	removePendingState(state) {
+		pendingStates.delete(state);
+	}
+	/**
+	* Exchange authorization code for tokens
+	*
+	* @param code - Authorization code from callback
+	* @param state - State parameter for verification
+	* @param appConfig - OAuth app credentials
+	* @returns OAuth2 tokens
+	*/
+	async exchangeCodeForTokens(code, state, appConfig) {
+		const pendingState = pendingStates.get(state);
+		if (!pendingState) throw new Error("Invalid or expired OAuth state. Please try again.");
+		const provider = require_oauth2_providers.getOAuth2Provider(pendingState.providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${pendingState.providerId}`);
+		const params = new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: appConfig.redirectUri,
+			client_id: appConfig.clientId,
+			client_secret: appConfig.clientSecret
+		});
+		if (pendingState.codeVerifier) params.set("code_verifier", pendingState.codeVerifier);
+		this.logger.debug("Exchanging code for tokens", { providerId: pendingState.providerId });
+		const response = await fetch(provider.tokenUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: params.toString()
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			this.logger.error("Token exchange failed", {
+				status: response.status,
+				error: errorText
+			});
+			throw new Error(`Token exchange failed: ${errorText}`);
+		}
+		const data = await response.json();
+		const tokens = {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token,
+			tokenType: data.token_type || "Bearer",
+			expiresIn: data.expires_in,
+			scope: data.scope,
+			raw: data
+		};
+		pendingStates.delete(state);
+		this.logger.info("OAuth2 tokens obtained", {
+			providerId: pendingState.providerId,
+			hasRefreshToken: !!tokens.refreshToken,
+			expiresIn: tokens.expiresIn
+		});
+		return {
+			tokens,
+			pendingState
+		};
+	}
+	/**
+	* Refresh an expired access token
+	*
+	* @param refreshToken - The refresh token
+	* @param providerId - The OAuth2 provider ID
+	* @param appConfig - OAuth app credentials
+	* @returns New OAuth2 tokens
+	*/
+	async refreshAccessToken(refreshToken, providerId, appConfig) {
+		const provider = require_oauth2_providers.getOAuth2Provider(providerId);
+		if (!provider) throw new Error(`Unknown OAuth2 provider: ${providerId}`);
+		if (!provider.supportsRefresh) throw new Error(`Provider ${providerId} does not support token refresh`);
+		const params = new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: appConfig.clientId,
+			client_secret: appConfig.clientSecret
+		});
+		this.logger.debug("Refreshing access token", { providerId });
+		const response = await fetch(provider.tokenUrl, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded",
+				Accept: "application/json"
+			},
+			body: params.toString()
+		});
+		if (!response.ok) {
+			const errorText = await response.text();
+			this.logger.error("Token refresh failed", {
+				status: response.status,
+				error: errorText
+			});
+			throw new Error(`Token refresh failed: ${errorText}`);
+		}
+		const data = await response.json();
+		const tokens = {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token || refreshToken,
+			tokenType: data.token_type || "Bearer",
+			expiresIn: data.expires_in,
+			scope: data.scope,
+			raw: data
+		};
+		this.logger.info("Access token refreshed", {
+			providerId,
+			expiresIn: tokens.expiresIn
+		});
+		return tokens;
+	}
+	/**
+	* Build a CredentialConfig from OAuth2 tokens
+	*/
+	buildCredentialConfig(tokens, providerId, appConfig) {
+		const now = /* @__PURE__ */ new Date();
+		const expiresAt = tokens.expiresIn ? new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString() : void 0;
+		return {
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken,
+			tokenType: tokens.tokenType,
+			scope: tokens.scope,
+			expiresAt,
+			oauth2Provider: providerId,
+			clientId: appConfig.clientId,
+			clientSecret: appConfig.clientSecret
+		};
+	}
+	/**
+	* Check if a credential's access token is expired or about to expire
+	*
+	* @param config - The credential config
+	* @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)
+	*/
+	isTokenExpired(config, bufferSeconds = 300) {
+		if (!config.expiresAt) return false;
+		const expiresAt = new Date(config.expiresAt);
+		const bufferMs = bufferSeconds * 1e3;
+		return expiresAt.getTime() - bufferMs < Date.now();
+	}
+	/**
+	* Check if a credential can be refreshed
+	*/
+	canRefresh(config) {
+		return !!(config.refreshToken && config.oauth2Provider);
+	}
+};
+/**
+* Create OAuth2 service instance
+*/
+function createOAuth2Service(logger) {
+	return new OAuth2Service(logger);
+}
+//#endregion
+exports.createOAuth2Service = createOAuth2Service;
+
+//# sourceMappingURL=oauth2.service.cjs.map

package/dist/services/credentials/oauth2.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.service.cjs","names":["getAllOAuth2Providers","getOAuth2Provider"],"sources":["../../../src/services/credentials/oauth2.service.ts"],"sourcesContent":["/**\n * OAuth2 Service\n *\n * Handles OAuth2 authorization flow:\n * 1. Generate authorization URL with state\n * 2. Exchange authorization code for tokens\n * 3. Refresh access tokens when expired\n */\n\nimport { randomBytes, createHash } from 'crypto';\nimport type { Logger } from 'src/types/schemas';\nimport type { CredentialConfig } from 'src/database/schema-sqlite';\nimport {\n  getOAuth2Provider,\n  getAllOAuth2Providers,\n  type OAuth2ProviderDefinition,\n} from './oauth2-providers';\n\n/**\n * OAuth2 configuration for the Invect application\n */\nexport interface OAuth2AppConfig {\n  /** Client ID from the OAuth provider */\n  clientId: string;\n  /** Client secret from the OAuth provider */\n  clientSecret: string;\n  /** Redirect URI registered with the provider */\n  redirectUri: string;\n}\n\n/**\n * Result of starting an OAuth2 flow\n */\nexport interface OAuth2StartResult {\n  /** URL to redirect the user to */\n  authorizationUrl: string;\n  /** State parameter for CSRF protection (store and verify on callback) */\n  state: string;\n  /** Code verifier for PKCE (store and use during token exchange) */\n  codeVerifier?: string;\n}\n\n/**\n * OAuth2 tokens received from provider\n */\nexport interface OAuth2Tokens {\n  accessToken: string;\n  refreshToken?: string;\n  tokenType: string;\n  expiresIn?: number; // seconds until expiry\n  scope?: string;\n  /** Additional provider-specific data */\n  raw?: Record<string, unknown>;\n}\n\n/**\n * Pending OAuth2 flow state\n * Store this temporarily during the OAuth flow\n */\nexport interface OAuth2PendingState {\n  state: string;\n  providerId: string;\n  codeVerifier?: string;\n  /** Original URL to redirect back to after OAuth completes */\n  returnUrl?: string;\n  /** Custom credential name */\n  credentialName?: string;\n  /** Timestamp when this state was created */\n  createdAt: number;\n}\n\n// In-memory store for pending OAuth states (should use Redis in production)\nconst pendingStates = new Map<string, OAuth2PendingState>();\n\n// Clean up expired states (older than 10 minutes)\nconst STATE_EXPIRY_MS = 10 * 60 * 1000;\n\nfunction cleanupExpiredStates() {\n  const now = Date.now();\n  for (const [state, pending] of pendingStates.entries()) {\n    if (now - pending.createdAt > STATE_EXPIRY_MS) {\n      pendingStates.delete(state);\n    }\n  }\n}\n\n// Run cleanup every 5 minutes\nsetInterval(cleanupExpiredStates, 5 * 60 * 1000);\n\n/**\n * OAuth2 Service for handling authorization flows\n */\nexport class OAuth2Service {\n  constructor(private readonly logger: Logger) {}\n\n  /**\n   * Get all available OAuth2 providers\n   */\n  getProviders(): OAuth2ProviderDefinition[] {\n    return getAllOAuth2Providers();\n  }\n\n  /**\n   * Get a specific OAuth2 provider\n   */\n  getProvider(providerId: string): OAuth2ProviderDefinition | undefined {\n    return getOAuth2Provider(providerId);\n  }\n\n  /**\n   * Start an OAuth2 authorization flow\n   *\n   * @param providerId - The OAuth2 provider ID\n   * @param appConfig - OAuth app credentials and redirect URI\n   * @param options - Additional options\n   * @returns Authorization URL and state to redirect user to\n   */\n  startAuthorizationFlow(\n    providerId: string,\n    appConfig: OAuth2AppConfig,\n    options: {\n      scopes?: string[];\n      returnUrl?: string;\n      credentialName?: string;\n    } = {},\n  ): OAuth2StartResult {\n    const provider = getOAuth2Provider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${providerId}`);\n    }\n\n    // Generate cryptographically secure state\n    const state = randomBytes(32).toString('hex');\n\n    // Generate PKCE code verifier and challenge\n    const codeVerifier = randomBytes(32).toString('base64url');\n    const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      client_id: appConfig.clientId,\n      redirect_uri: appConfig.redirectUri,\n      response_type: 'code',\n      state,\n      code_challenge: codeChallenge,\n      code_challenge_method: 'S256',\n    });\n\n    // Add scopes\n    const scopes = options.scopes ?? provider.defaultScopes;\n    if (scopes.length > 0) {\n      const separator = provider.scopeSeparator ?? ' ';\n      params.set('scope', scopes.join(separator));\n    }\n\n    // Add provider-specific additional params\n    if (provider.additionalAuthParams) {\n      for (const [key, value] of Object.entries(provider.additionalAuthParams)) {\n        params.set(key, value);\n      }\n    }\n\n    const authorizationUrl = `${provider.authorizationUrl}?${params.toString()}`;\n\n    // Store pending state\n    const pendingState: OAuth2PendingState = {\n      state,\n      providerId,\n      codeVerifier,\n      returnUrl: options.returnUrl,\n      credentialName: options.credentialName,\n      createdAt: Date.now(),\n    };\n    pendingStates.set(state, pendingState);\n\n    this.logger.debug('Started OAuth2 flow', { providerId, state });\n\n    return {\n      authorizationUrl,\n      state,\n      codeVerifier,\n    };\n  }\n\n  /**\n   * Get pending OAuth2 state\n   */\n  getPendingState(state: string): OAuth2PendingState | undefined {\n    return pendingStates.get(state);\n  }\n\n  /**\n   * Remove pending OAuth2 state (after successful exchange)\n   */\n  removePendingState(state: string): void {\n    pendingStates.delete(state);\n  }\n\n  /**\n   * Exchange authorization code for tokens\n   *\n   * @param code - Authorization code from callback\n   * @param state - State parameter for verification\n   * @param appConfig - OAuth app credentials\n   * @returns OAuth2 tokens\n   */\n  async exchangeCodeForTokens(\n    code: string,\n    state: string,\n    appConfig: OAuth2AppConfig,\n  ): Promise<{ tokens: OAuth2Tokens; pendingState: OAuth2PendingState }> {\n    // Verify and retrieve pending state\n    const pendingState = pendingStates.get(state);\n    if (!pendingState) {\n      throw new Error('Invalid or expired OAuth state. Please try again.');\n    }\n\n    const provider = getOAuth2Provider(pendingState.providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${pendingState.providerId}`);\n    }\n\n    // Build token request\n    const params = new URLSearchParams({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: appConfig.redirectUri,\n      client_id: appConfig.clientId,\n      client_secret: appConfig.clientSecret,\n    });\n\n    // Add PKCE code verifier if available\n    if (pendingState.codeVerifier) {\n      params.set('code_verifier', pendingState.codeVerifier);\n    }\n\n    this.logger.debug('Exchanging code for tokens', { providerId: pendingState.providerId });\n\n    // Exchange code for tokens\n    const response = await fetch(provider.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      this.logger.error('Token exchange failed', { status: response.status, error: errorText });\n      throw new Error(`Token exchange failed: ${errorText}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    // Parse tokens\n    const tokens: OAuth2Tokens = {\n      accessToken: data.access_token as string,\n      refreshToken: data.refresh_token as string | undefined,\n      tokenType: (data.token_type as string) || 'Bearer',\n      expiresIn: data.expires_in as number | undefined,\n      scope: data.scope as string | undefined,\n      raw: data,\n    };\n\n    // Remove used state\n    pendingStates.delete(state);\n\n    this.logger.info('OAuth2 tokens obtained', {\n      providerId: pendingState.providerId,\n      hasRefreshToken: !!tokens.refreshToken,\n      expiresIn: tokens.expiresIn,\n    });\n\n    return { tokens, pendingState };\n  }\n\n  /**\n   * Refresh an expired access token\n   *\n   * @param refreshToken - The refresh token\n   * @param providerId - The OAuth2 provider ID\n   * @param appConfig - OAuth app credentials\n   * @returns New OAuth2 tokens\n   */\n  async refreshAccessToken(\n    refreshToken: string,\n    providerId: string,\n    appConfig: OAuth2AppConfig,\n  ): Promise<OAuth2Tokens> {\n    const provider = getOAuth2Provider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth2 provider: ${providerId}`);\n    }\n\n    if (!provider.supportsRefresh) {\n      throw new Error(`Provider ${providerId} does not support token refresh`);\n    }\n\n    const params = new URLSearchParams({\n      grant_type: 'refresh_token',\n      refresh_token: refreshToken,\n      client_id: appConfig.clientId,\n      client_secret: appConfig.clientSecret,\n    });\n\n    this.logger.debug('Refreshing access token', { providerId });\n\n    const response = await fetch(provider.tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n        Accept: 'application/json',\n      },\n      body: params.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      this.logger.error('Token refresh failed', { status: response.status, error: errorText });\n      throw new Error(`Token refresh failed: ${errorText}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    const tokens: OAuth2Tokens = {\n      accessToken: data.access_token as string,\n      // Some providers return a new refresh token\n      refreshToken: (data.refresh_token as string | undefined) || refreshToken,\n      tokenType: (data.token_type as string) || 'Bearer',\n      expiresIn: data.expires_in as number | undefined,\n      scope: data.scope as string | undefined,\n      raw: data,\n    };\n\n    this.logger.info('Access token refreshed', {\n      providerId,\n      expiresIn: tokens.expiresIn,\n    });\n\n    return tokens;\n  }\n\n  /**\n   * Build a CredentialConfig from OAuth2 tokens\n   */\n  buildCredentialConfig(\n    tokens: OAuth2Tokens,\n    providerId: string,\n    appConfig: { clientId: string; clientSecret: string },\n  ): CredentialConfig {\n    const now = new Date();\n    const expiresAt = tokens.expiresIn\n      ? new Date(now.getTime() + tokens.expiresIn * 1000).toISOString()\n      : undefined;\n\n    return {\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n      tokenType: tokens.tokenType,\n      scope: tokens.scope,\n      expiresAt,\n      // Store provider info for refresh\n      oauth2Provider: providerId,\n      clientId: appConfig.clientId,\n      clientSecret: appConfig.clientSecret,\n    };\n  }\n\n  /**\n   * Check if a credential's access token is expired or about to expire\n   *\n   * @param config - The credential config\n   * @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)\n   */\n  isTokenExpired(config: CredentialConfig, bufferSeconds: number = 300): boolean {\n    if (!config.expiresAt) {\n      return false; // No expiry means it doesn't expire (or we don't know)\n    }\n\n    const expiresAt = new Date(config.expiresAt);\n    const bufferMs = bufferSeconds * 1000;\n    return expiresAt.getTime() - bufferMs < Date.now();\n  }\n\n  /**\n   * Check if a credential can be refreshed\n   */\n  canRefresh(config: CredentialConfig): boolean {\n    return !!(config.refreshToken && config.oauth2Provider);\n  }\n}\n\n/**\n * Create OAuth2 service instance\n */\nexport function createOAuth2Service(logger: Logger): OAuth2Service {\n  return new OAuth2Service(logger);\n}\n"],"mappings":";;;;;;;;;;;;AAwEA,MAAM,gCAAgB,IAAI,KAAiC;AAG3D,MAAM,kBAAkB,MAAU;AAElC,SAAS,uBAAuB;CAC9B,MAAM,MAAM,KAAK,KAAK;AACtB,MAAK,MAAM,CAAC,OAAO,YAAY,cAAc,SAAS,CACpD,KAAI,MAAM,QAAQ,YAAY,gBAC5B,eAAc,OAAO,MAAM;;AAMjC,YAAY,sBAAsB,MAAS,IAAK;;;;AAKhD,IAAa,gBAAb,MAA2B;CACzB,YAAY,QAAiC;AAAhB,OAAA,SAAA;;;;;CAK7B,eAA2C;AACzC,SAAOA,yBAAAA,uBAAuB;;;;;CAMhC,YAAY,YAA0D;AACpE,SAAOC,yBAAAA,kBAAkB,WAAW;;;;;;;;;;CAWtC,uBACE,YACA,WACA,UAII,EAAE,EACa;EACnB,MAAM,WAAWA,yBAAAA,kBAAkB,WAAW;AAC9C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa;EAI3D,MAAM,SAAA,GAAA,OAAA,aAAoB,GAAG,CAAC,SAAS,MAAM;EAG7C,MAAM,gBAAA,GAAA,OAAA,aAA2B,GAAG,CAAC,SAAS,YAAY;EAC1D,MAAM,iBAAA,GAAA,OAAA,YAA2B,SAAS,CAAC,OAAO,aAAa,CAAC,OAAO,YAAY;EAGnF,MAAM,SAAS,IAAI,gBAAgB;GACjC,WAAW,UAAU;GACrB,cAAc,UAAU;GACxB,eAAe;GACf;GACA,gBAAgB;GAChB,uBAAuB;GACxB,CAAC;EAGF,MAAM,SAAS,QAAQ,UAAU,SAAS;AAC1C,MAAI,OAAO,SAAS,GAAG;GACrB,MAAM,YAAY,SAAS,kBAAkB;AAC7C,UAAO,IAAI,SAAS,OAAO,KAAK,UAAU,CAAC;;AAI7C,MAAI,SAAS,qBACX,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,qBAAqB,CACtE,QAAO,IAAI,KAAK,MAAM;EAI1B,MAAM,mBAAmB,GAAG,SAAS,iBAAiB,GAAG,OAAO,UAAU;EAG1E,MAAM,eAAmC;GACvC;GACA;GACA;GACA,WAAW,QAAQ;GACnB,gBAAgB,QAAQ;GACxB,WAAW,KAAK,KAAK;GACtB;AACD,gBAAc,IAAI,OAAO,aAAa;AAEtC,OAAK,OAAO,MAAM,uBAAuB;GAAE;GAAY;GAAO,CAAC;AAE/D,SAAO;GACL;GACA;GACA;GACD;;;;;CAMH,gBAAgB,OAA+C;AAC7D,SAAO,cAAc,IAAI,MAAM;;;;;CAMjC,mBAAmB,OAAqB;AACtC,gBAAc,OAAO,MAAM;;;;;;;;;;CAW7B,MAAM,sBACJ,MACA,OACA,WACqE;EAErE,MAAM,eAAe,cAAc,IAAI,MAAM;AAC7C,MAAI,CAAC,aACH,OAAM,IAAI,MAAM,oDAAoD;EAGtE,MAAM,WAAWA,yBAAAA,kBAAkB,aAAa,WAAW;AAC3D,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa,aAAa;EAIxE,MAAM,SAAS,IAAI,gBAAgB;GACjC,YAAY;GACZ;GACA,cAAc,UAAU;GACxB,WAAW,UAAU;GACrB,eAAe,UAAU;GAC1B,CAAC;AAGF,MAAI,aAAa,aACf,QAAO,IAAI,iBAAiB,aAAa,aAAa;AAGxD,OAAK,OAAO,MAAM,8BAA8B,EAAE,YAAY,aAAa,YAAY,CAAC;EAGxF,MAAM,WAAW,MAAM,MAAM,SAAS,UAAU;GAC9C,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACT;GACD,MAAM,OAAO,UAAU;GACxB,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,QAAK,OAAO,MAAM,yBAAyB;IAAE,QAAQ,SAAS;IAAQ,OAAO;IAAW,CAAC;AACzF,SAAM,IAAI,MAAM,0BAA0B,YAAY;;EAGxD,MAAM,OAAQ,MAAM,SAAS,MAAM;EAGnC,MAAM,SAAuB;GAC3B,aAAa,KAAK;GAClB,cAAc,KAAK;GACnB,WAAY,KAAK,cAAyB;GAC1C,WAAW,KAAK;GAChB,OAAO,KAAK;GACZ,KAAK;GACN;AAGD,gBAAc,OAAO,MAAM;AAE3B,OAAK,OAAO,KAAK,0BAA0B;GACzC,YAAY,aAAa;GACzB,iBAAiB,CAAC,CAAC,OAAO;GAC1B,WAAW,OAAO;GACnB,CAAC;AAEF,SAAO;GAAE;GAAQ;GAAc;;;;;;;;;;CAWjC,MAAM,mBACJ,cACA,YACA,WACuB;EACvB,MAAM,WAAWA,yBAAAA,kBAAkB,WAAW;AAC9C,MAAI,CAAC,SACH,OAAM,IAAI,MAAM,4BAA4B,aAAa;AAG3D,MAAI,CAAC,SAAS,gBACZ,OAAM,IAAI,MAAM,YAAY,WAAW,iCAAiC;EAG1E,MAAM,SAAS,IAAI,gBAAgB;GACjC,YAAY;GACZ,eAAe;GACf,WAAW,UAAU;GACrB,eAAe,UAAU;GAC1B,CAAC;AAEF,OAAK,OAAO,MAAM,2BAA2B,EAAE,YAAY,CAAC;EAE5D,MAAM,WAAW,MAAM,MAAM,SAAS,UAAU;GAC9C,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;IACT;GACD,MAAM,OAAO,UAAU;GACxB,CAAC;AAEF,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,MAAM;AACvC,QAAK,OAAO,MAAM,wBAAwB;IAAE,QAAQ,SAAS;IAAQ,OAAO;IAAW,CAAC;AACxF,SAAM,IAAI,MAAM,yBAAyB,YAAY;;EAGvD,MAAM,OAAQ,MAAM,SAAS,MAAM;EAEnC,MAAM,SAAuB;GAC3B,aAAa,KAAK;GAElB,cAAe,KAAK,iBAAwC;GAC5D,WAAY,KAAK,cAAyB;GAC1C,WAAW,KAAK;GAChB,OAAO,KAAK;GACZ,KAAK;GACN;AAED,OAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,WAAW,OAAO;GACnB,CAAC;AAEF,SAAO;;;;;CAMT,sBACE,QACA,YACA,WACkB;EAClB,MAAM,sBAAM,IAAI,MAAM;EACtB,MAAM,YAAY,OAAO,YACrB,IAAI,KAAK,IAAI,SAAS,GAAG,OAAO,YAAY,IAAK,CAAC,aAAa,GAC/D,KAAA;AAEJ,SAAO;GACL,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,WAAW,OAAO;GAClB,OAAO,OAAO;GACd;GAEA,gBAAgB;GAChB,UAAU,UAAU;GACpB,cAAc,UAAU;GACzB;;;;;;;;CASH,eAAe,QAA0B,gBAAwB,KAAc;AAC7E,MAAI,CAAC,OAAO,UACV,QAAO;EAGT,MAAM,YAAY,IAAI,KAAK,OAAO,UAAU;EAC5C,MAAM,WAAW,gBAAgB;AACjC,SAAO,UAAU,SAAS,GAAG,WAAW,KAAK,KAAK;;;;;CAMpD,WAAW,QAAmC;AAC5C,SAAO,CAAC,EAAE,OAAO,gBAAgB,OAAO;;;;;;AAO5C,SAAgB,oBAAoB,QAA+B;AACjE,QAAO,IAAI,cAAc,OAAO"}

package/dist/services/credentials/oauth2.service.d.cts

@@ -0,0 +1,132 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.cjs";
+import { OAuth2ProviderDefinition } from "./oauth2-providers.cjs";
+import { CredentialConfig } from "../../database/schema-sqlite.cjs";
+
+//#region src/services/credentials/oauth2.service.d.ts
+/**
+ * OAuth2 configuration for the Invect application
+ */
+interface OAuth2AppConfig {
+  /** Client ID from the OAuth provider */
+  clientId: string;
+  /** Client secret from the OAuth provider */
+  clientSecret: string;
+  /** Redirect URI registered with the provider */
+  redirectUri: string;
+}
+/**
+ * Result of starting an OAuth2 flow
+ */
+interface OAuth2StartResult {
+  /** URL to redirect the user to */
+  authorizationUrl: string;
+  /** State parameter for CSRF protection (store and verify on callback) */
+  state: string;
+  /** Code verifier for PKCE (store and use during token exchange) */
+  codeVerifier?: string;
+}
+/**
+ * OAuth2 tokens received from provider
+ */
+interface OAuth2Tokens {
+  accessToken: string;
+  refreshToken?: string;
+  tokenType: string;
+  expiresIn?: number;
+  scope?: string;
+  /** Additional provider-specific data */
+  raw?: Record<string, unknown>;
+}
+/**
+ * Pending OAuth2 flow state
+ * Store this temporarily during the OAuth flow
+ */
+interface OAuth2PendingState {
+  state: string;
+  providerId: string;
+  codeVerifier?: string;
+  /** Original URL to redirect back to after OAuth completes */
+  returnUrl?: string;
+  /** Custom credential name */
+  credentialName?: string;
+  /** Timestamp when this state was created */
+  createdAt: number;
+}
+/**
+ * OAuth2 Service for handling authorization flows
+ */
+declare class OAuth2Service {
+  private readonly logger;
+  constructor(logger: Logger);
+  /**
+   * Get all available OAuth2 providers
+   */
+  getProviders(): OAuth2ProviderDefinition[];
+  /**
+   * Get a specific OAuth2 provider
+   */
+  getProvider(providerId: string): OAuth2ProviderDefinition | undefined;
+  /**
+   * Start an OAuth2 authorization flow
+   *
+   * @param providerId - The OAuth2 provider ID
+   * @param appConfig - OAuth app credentials and redirect URI
+   * @param options - Additional options
+   * @returns Authorization URL and state to redirect user to
+   */
+  startAuthorizationFlow(providerId: string, appConfig: OAuth2AppConfig, options?: {
+    scopes?: string[];
+    returnUrl?: string;
+    credentialName?: string;
+  }): OAuth2StartResult;
+  /**
+   * Get pending OAuth2 state
+   */
+  getPendingState(state: string): OAuth2PendingState | undefined;
+  /**
+   * Remove pending OAuth2 state (after successful exchange)
+   */
+  removePendingState(state: string): void;
+  /**
+   * Exchange authorization code for tokens
+   *
+   * @param code - Authorization code from callback
+   * @param state - State parameter for verification
+   * @param appConfig - OAuth app credentials
+   * @returns OAuth2 tokens
+   */
+  exchangeCodeForTokens(code: string, state: string, appConfig: OAuth2AppConfig): Promise<{
+    tokens: OAuth2Tokens;
+    pendingState: OAuth2PendingState;
+  }>;
+  /**
+   * Refresh an expired access token
+   *
+   * @param refreshToken - The refresh token
+   * @param providerId - The OAuth2 provider ID
+   * @param appConfig - OAuth app credentials
+   * @returns New OAuth2 tokens
+   */
+  refreshAccessToken(refreshToken: string, providerId: string, appConfig: OAuth2AppConfig): Promise<OAuth2Tokens>;
+  /**
+   * Build a CredentialConfig from OAuth2 tokens
+   */
+  buildCredentialConfig(tokens: OAuth2Tokens, providerId: string, appConfig: {
+    clientId: string;
+    clientSecret: string;
+  }): CredentialConfig;
+  /**
+   * Check if a credential's access token is expired or about to expire
+   *
+   * @param config - The credential config
+   * @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)
+   */
+  isTokenExpired(config: CredentialConfig, bufferSeconds?: number): boolean;
+  /**
+   * Check if a credential can be refreshed
+   */
+  canRefresh(config: CredentialConfig): boolean;
+}
+//#endregion
+export { OAuth2AppConfig, OAuth2PendingState, OAuth2Service, OAuth2StartResult, OAuth2Tokens };
+//# sourceMappingURL=oauth2.service.d.cts.map

package/dist/services/credentials/oauth2.service.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.service.d.cts","names":[],"sources":["../../../src/services/credentials/oauth2.service.ts"],"mappings":";;;;;;;;UAqBiB,eAAA;EAYiB;EAVhC,QAAA;EAUgC;EARhC,YAAA;EAYA;EAVA,WAAA;AAAA;;AAkBF;;UAZiB,iBAAA;EAmBH;EAjBZ,gBAAA;EAYA;EAVA,KAAA;EAYA;EAVA,YAAA;AAAA;;;;UAMe,YAAA;EACf,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,KAAA;EAYA;EAVA,GAAA,GAAM,MAAA;AAAA;;;;AAwCR;UAjCiB,kBAAA;EACf,KAAA;EACA,UAAA;EACA,YAAA;EA2CiC;EAzCjC,SAAA;EA6DG;EA3DH,cAAA;EA+Ia;EA7Ib,SAAA;AAAA;;;;cAwBW,aAAA;EAAA,iBACkB,MAAA;cAAA,MAAA,EAAQ,MAAA;EA2Rd;;;EAtRvB,YAAA,CAAA,GAAgB,wBAAA;EALa;;;EAY7B,WAAA,CAAY,UAAA,WAAqB,wBAAA;EAPjC;;;;;;;;EAmBA,sBAAA,CACE,UAAA,UACA,SAAA,EAAW,eAAA,EACX,OAAA;IACE,MAAA;IACA,SAAA;IACA,cAAA;EAAA,IAED,iBAAA;EAAA;;;EA8DH,eAAA,CAAgB,KAAA,WAAgB,kBAAA;EAOhC;;;EAAA,kBAAA,CAAmB,KAAA;EAcjB;;;;;;;;EAFI,qBAAA,CACJ,IAAA,UACA,KAAA,UACA,SAAA,EAAW,eAAA,GACV,OAAA;IAAU,MAAA,EAAQ,YAAA;IAAc,YAAA,EAAc,kBAAA;EAAA;EA+E/C;;;;;;;;EAHI,kBAAA,CACJ,YAAA,UACA,UAAA,UACA,SAAA,EAAW,eAAA,GACV,OAAA,CAAQ,YAAA;EA4DT;;;EAHF,qBAAA,CACE,MAAA,EAAQ,YAAA,EACR,UAAA,UACA,SAAA;IAAa,QAAA;IAAkB,YAAA;EAAA,IAC9B,gBAAA;EAsCgB;;;;;;EAbnB,cAAA,CAAe,MAAA,EAAQ,gBAAA,EAAkB,aAAA;;;;EAazC,UAAA,CAAW,MAAA,EAAQ,gBAAA;AAAA"}

package/dist/services/credentials/oauth2.service.d.ts

@@ -0,0 +1,132 @@
+import { Logger } from "../../types/schemas-fresh/invect-config.js";
+import { OAuth2ProviderDefinition } from "./oauth2-providers.js";
+import { CredentialConfig } from "../../database/schema-sqlite.js";
+
+//#region src/services/credentials/oauth2.service.d.ts
+/**
+ * OAuth2 configuration for the Invect application
+ */
+interface OAuth2AppConfig {
+  /** Client ID from the OAuth provider */
+  clientId: string;
+  /** Client secret from the OAuth provider */
+  clientSecret: string;
+  /** Redirect URI registered with the provider */
+  redirectUri: string;
+}
+/**
+ * Result of starting an OAuth2 flow
+ */
+interface OAuth2StartResult {
+  /** URL to redirect the user to */
+  authorizationUrl: string;
+  /** State parameter for CSRF protection (store and verify on callback) */
+  state: string;
+  /** Code verifier for PKCE (store and use during token exchange) */
+  codeVerifier?: string;
+}
+/**
+ * OAuth2 tokens received from provider
+ */
+interface OAuth2Tokens {
+  accessToken: string;
+  refreshToken?: string;
+  tokenType: string;
+  expiresIn?: number;
+  scope?: string;
+  /** Additional provider-specific data */
+  raw?: Record<string, unknown>;
+}
+/**
+ * Pending OAuth2 flow state
+ * Store this temporarily during the OAuth flow
+ */
+interface OAuth2PendingState {
+  state: string;
+  providerId: string;
+  codeVerifier?: string;
+  /** Original URL to redirect back to after OAuth completes */
+  returnUrl?: string;
+  /** Custom credential name */
+  credentialName?: string;
+  /** Timestamp when this state was created */
+  createdAt: number;
+}
+/**
+ * OAuth2 Service for handling authorization flows
+ */
+declare class OAuth2Service {
+  private readonly logger;
+  constructor(logger: Logger);
+  /**
+   * Get all available OAuth2 providers
+   */
+  getProviders(): OAuth2ProviderDefinition[];
+  /**
+   * Get a specific OAuth2 provider
+   */
+  getProvider(providerId: string): OAuth2ProviderDefinition | undefined;
+  /**
+   * Start an OAuth2 authorization flow
+   *
+   * @param providerId - The OAuth2 provider ID
+   * @param appConfig - OAuth app credentials and redirect URI
+   * @param options - Additional options
+   * @returns Authorization URL and state to redirect user to
+   */
+  startAuthorizationFlow(providerId: string, appConfig: OAuth2AppConfig, options?: {
+    scopes?: string[];
+    returnUrl?: string;
+    credentialName?: string;
+  }): OAuth2StartResult;
+  /**
+   * Get pending OAuth2 state
+   */
+  getPendingState(state: string): OAuth2PendingState | undefined;
+  /**
+   * Remove pending OAuth2 state (after successful exchange)
+   */
+  removePendingState(state: string): void;
+  /**
+   * Exchange authorization code for tokens
+   *
+   * @param code - Authorization code from callback
+   * @param state - State parameter for verification
+   * @param appConfig - OAuth app credentials
+   * @returns OAuth2 tokens
+   */
+  exchangeCodeForTokens(code: string, state: string, appConfig: OAuth2AppConfig): Promise<{
+    tokens: OAuth2Tokens;
+    pendingState: OAuth2PendingState;
+  }>;
+  /**
+   * Refresh an expired access token
+   *
+   * @param refreshToken - The refresh token
+   * @param providerId - The OAuth2 provider ID
+   * @param appConfig - OAuth app credentials
+   * @returns New OAuth2 tokens
+   */
+  refreshAccessToken(refreshToken: string, providerId: string, appConfig: OAuth2AppConfig): Promise<OAuth2Tokens>;
+  /**
+   * Build a CredentialConfig from OAuth2 tokens
+   */
+  buildCredentialConfig(tokens: OAuth2Tokens, providerId: string, appConfig: {
+    clientId: string;
+    clientSecret: string;
+  }): CredentialConfig;
+  /**
+   * Check if a credential's access token is expired or about to expire
+   *
+   * @param config - The credential config
+   * @param bufferSeconds - Buffer time before actual expiry (default 5 minutes)
+   */
+  isTokenExpired(config: CredentialConfig, bufferSeconds?: number): boolean;
+  /**
+   * Check if a credential can be refreshed
+   */
+  canRefresh(config: CredentialConfig): boolean;
+}
+//#endregion
+export { OAuth2AppConfig, OAuth2PendingState, OAuth2Service, OAuth2StartResult, OAuth2Tokens };
+//# sourceMappingURL=oauth2.service.d.ts.map

package/dist/services/credentials/oauth2.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.service.d.ts","names":[],"sources":["../../../src/services/credentials/oauth2.service.ts"],"mappings":";;;;;;;;UAqBiB,eAAA;EAYA;EAVf,QAAA;;EAEA,YAAA;EAUA;EARA,WAAA;AAAA;;;AAkBF;UAZiB,iBAAA;;EAEf,gBAAA;EAWA;EATA,KAAA;EAWA;EATA,YAAA;AAAA;;;;UAMe,YAAA;EACf,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,KAAA;EAWA;EATA,GAAA,GAAM,MAAA;AAAA;;;;;UAOS,kBAAA;EACf,KAAA;EACA,UAAA;EACA,YAAA;EAoCgB;EAlChB,SAAA;EAuDa;EArDb,cAAA;EAyHgC;EAvHhC,SAAA;AAAA;;;;cAwBW,aAAA;EAAA,iBACkB,MAAA;cAAA,MAAA,EAAQ,MAAA;EAkQlC;;;EA7PH,YAAA,CAAA,GAAgB,wBAAA;EAmSmB;;;EA5RnC,WAAA,CAAY,UAAA,WAAqB,wBAAA;EAZJ;;;;;;;;EAwB7B,sBAAA,CACE,UAAA,UACA,SAAA,EAAW,eAAA,EACX,OAAA;IACE,MAAA;IACA,SAAA;IACA,cAAA;EAAA,IAED,iBAAA;EALD;;;EAmEF,eAAA,CAAgB,KAAA,WAAgB,kBAAA;EAAA;;;EAOhC,kBAAA,CAAmB,KAAA;EAajB;;;;;;;;EADI,qBAAA,CACJ,IAAA,UACA,KAAA,UACA,SAAA,EAAW,eAAA,GACV,OAAA;IAAU,MAAA,EAAQ,YAAA;IAAc,YAAA,EAAc,kBAAA;EAAA;EA+EpC;;;;;;;;EAHP,kBAAA,CACJ,YAAA,UACA,UAAA,UACA,SAAA,EAAW,eAAA,GACV,OAAA,CAAQ,YAAA;EA4DsB;;;EAHjC,qBAAA,CACE,MAAA,EAAQ,YAAA,EACR,UAAA,UACA,SAAA;IAAa,QAAA;IAAkB,YAAA;EAAA,IAC9B,gBAAA;EAsCH;;;;;;EAbA,cAAA,CAAe,MAAA,EAAQ,gBAAA,EAAkB,aAAA;;;;EAazC,UAAA,CAAW,MAAA,EAAQ,gBAAA;AAAA"}