@kmlckj/licos-platform-sdk 0.8.0 → 0.8.1

package/README.md

@@ -119,58 +119,58 @@ const results = await knowledge.search('How do I reset my password?', {
 });
 ```
 
-The browser entry does not export knowledge helpers because runtime tokens must
-not be bundled into public frontend code.
-
-## OAuth2 Application Management
-
-OAuth2 management is available only from trusted Node runtime code. It uses the
-current project owner's platform identity and is not exported by the browser
-entry.
-
-```js
-import { oauth } from '@kmlckj/licos-platform-sdk';
-
-const apps = await oauth.listApps();
-const app = await oauth.ensureProjectApp({
-  appId: apps.list?.[0]?.id,
-  name: 'Project login',
-  loginAudience: 'ALL',
-  redirectUriConfigs: [
-    { environment: 'prod', redirectUri: 'https://app.example/auth/callback' },
-  ],
-});
-```
-
-`ensureProjectApp` requires an explicit login audience and at least one
-callback. Store only public PKCE settings in project configuration; never put
-the returned client secret or a platform user token in browser code.
-
-## OAuth2 Project Runtime
-
-Project server routes use `oauthRuntime` for Authorization Code + PKCE. The
-runtime module reads `config/licos-oauth.json`; it is intentionally absent from
-the browser entry.
-
-```js
-import { oauthRuntime } from '@kmlckj/licos-platform-sdk';
-
-const config = await oauthRuntime.loadConfig();
-const attempt = oauthRuntime.createAuthorizationRequest(config, {
-  redirectUri: 'https://app.example/api/auth/licos/callback',
-});
-
-// Persist a hash of attempt.state plus codeVerifier, redirectUri and expiresAt
-// in a one-time server-side record before redirecting the browser.
-
-const completed = await oauthRuntime.completeAuthorization(config, {
-  code,
-  redirectUri: stored.redirectUri,
-  codeVerifier: stored.codeVerifier,
-});
-```
-
-`completeAuthorization` returns platform tokens and userinfo to trusted server
-code. Map `completed.user.sub` to the project's account, create the project's
-own session, then revoke tokens unless the application explicitly needs
-delegated platform API access. Never return these tokens to the browser.
+The browser entry does not export knowledge helpers because runtime tokens must
+not be bundled into public frontend code.
+
+## OAuth2 Application Management
+
+OAuth2 management is available only from trusted Node runtime code. It uses the
+current project owner's platform identity and is not exported by the browser
+entry.
+
+```js
+import { oauth } from '@kmlckj/licos-platform-sdk';
+
+const apps = await oauth.listApps();
+const app = await oauth.ensureProjectApp({
+  appId: apps.list?.[0]?.id,
+  name: 'Project login',
+  loginAudience: 'ALL',
+  redirectUriConfigs: [
+    { environment: 'prod', redirectUri: 'https://app.example/auth/callback' },
+  ],
+});
+```
+
+`ensureProjectApp` requires an explicit login audience and at least one
+callback. Store only public PKCE settings in project configuration; never put
+the returned client secret or a platform user token in browser code.
+
+## OAuth2 Project Runtime
+
+Project server routes use `oauthRuntime` for Authorization Code + PKCE. The
+runtime module reads `config/licos-oauth.json`; it is intentionally absent from
+the browser entry.
+
+```js
+import { oauthRuntime } from '@kmlckj/licos-platform-sdk';
+
+const config = await oauthRuntime.loadConfig();
+const attempt = oauthRuntime.createAuthorizationRequest(config, {
+  redirectUri: 'https://app.example/api/auth/licos/callback',
+});
+
+// Persist a hash of attempt.state plus codeVerifier, redirectUri and expiresAt
+// in a one-time server-side record before redirecting the browser.
+
+const completed = await oauthRuntime.completeAuthorization(config, {
+  code,
+  redirectUri: stored.redirectUri,
+  codeVerifier: stored.codeVerifier,
+});
+```
+
+`completeAuthorization` returns platform tokens and userinfo to trusted server
+code. Map `completed.user.sub` to the project's account, create the project's
+own session, then revoke tokens unless the application explicitly needs
+delegated platform API access. Never return these tokens to the browser.

package/dist/index.d.ts

@@ -26,166 +26,170 @@ export interface RuntimeConfig {
 }
 
 export function runtimeConfig(options?: { environmentOverrideEnv?: string }): Promise<RuntimeConfig>;
-export function authHeaders(config: RuntimeConfig, contentType?: string): Record<string, string>;
-
-export type OAuthLoginAudience = 'ALL' | 'OWNER_TENANT';
-
-export interface OAuthRedirectUriConfig {
-  environment?: 'dev' | 'prod';
-  redirectUri: string;
-}
-
-export interface OAuthApp {
-  id: string;
-  tenantId?: string;
-  appCode?: string;
-  name?: string;
-  description?: string;
-  clientId?: string;
-  loginAudience?: OAuthLoginAudience;
-  redirectUris?: string[];
-  redirectUriConfigs?: OAuthRedirectUriConfig[];
-  allowedScopes?: string[];
-  secret?: string;
-  status?: string;
-  [key: string]: unknown;
-}
-
-export interface OAuthAppList {
-  list?: OAuthApp[];
-  total?: number;
-  page?: number;
-  pageSize?: number;
-  hasNext?: boolean;
-}
-
-export interface CreateOAuthAppOptions {
-  description?: string;
-  appCode?: string;
-  app_code?: string;
-  loginAudience?: OAuthLoginAudience;
-  login_audience?: OAuthLoginAudience;
-  redirectUriConfigs?: OAuthRedirectUriConfig[];
-  redirect_uri_configs?: OAuthRedirectUriConfig[];
-  redirectUris?: string[];
-  redirect_uris?: string[];
-  allowedScopes?: string[];
-  allowed_scopes?: string[];
-  appType?: string;
-  app_type?: string;
-  consentRequired?: boolean;
-  consent_required?: boolean;
-}
-
-export interface EnsureProjectOAuthAppOptions extends CreateOAuthAppOptions {
-  name: string;
-  loginAudience: OAuthLoginAudience;
-  appId?: string;
-  app_id?: string;
-  redirectUriConfigs: OAuthRedirectUriConfig[];
-}
-
-export function listOAuthApps(options?: { page?: number; pageSize?: number }): Promise<OAuthAppList>;
-export function getOAuthApp(appId: string): Promise<OAuthApp>;
-export function createOAuthApp(name: string, options?: CreateOAuthAppOptions): Promise<OAuthApp>;
-export function updateOAuthApp(appId: string, changes?: Record<string, unknown>): Promise<OAuthApp>;
-export function deleteOAuthApp(appId: string): Promise<void>;
-export function setOAuthAppEnabled(appId: string, enabled: boolean): Promise<OAuthApp>;
-export function rotateOAuthAppSecret(appId: string): Promise<OAuthApp>;
-export function listOAuthGrants(appId: string): Promise<Array<Record<string, unknown>>>;
-export function revokeOAuthGrant(grantId: string): Promise<void>;
-export function findOAuthAppByCode(appCode: string, options?: { pageSize?: number }): Promise<OAuthApp | null>;
-export function ensureProjectOAuthApp(options: EnsureProjectOAuthAppOptions): Promise<OAuthApp>;
-
-export const oauth: {
-  listApps: typeof listOAuthApps;
-  getApp: typeof getOAuthApp;
-  createApp: typeof createOAuthApp;
-  updateApp: typeof updateOAuthApp;
-  deleteApp: typeof deleteOAuthApp;
-  setEnabled: typeof setOAuthAppEnabled;
-  rotateSecret: typeof rotateOAuthAppSecret;
-  listGrants: typeof listOAuthGrants;
-  revokeGrant: typeof revokeOAuthGrant;
-  findAppByCode: typeof findOAuthAppByCode;
-  ensureProjectApp: typeof ensureProjectOAuthApp;
-};
-
-export class OAuthProtocolError extends ApiError {
-  error?: string;
-}
-
+export function authHeaders(config: RuntimeConfig, contentType?: string): Record<string, string>;
+
+export type OAuthLoginAudience = 'ALL' | 'OWNER_TENANT';
+
+export interface OAuthRedirectUriConfig {
+  environment?: 'dev' | 'prod';
+  redirectUri: string;
+}
+
+export interface OAuthApp {
+  id: string;
+  tenantId?: string;
+  appCode?: string;
+  name?: string;
+  description?: string;
+  clientId?: string;
+  loginAudience?: OAuthLoginAudience;
+  redirectUris?: string[];
+  redirectUriConfigs?: OAuthRedirectUriConfig[];
+  allowedScopes?: string[];
+  secret?: string;
+  status?: string;
+  [key: string]: unknown;
+}
+
+export interface OAuthAppList {
+  list?: OAuthApp[];
+  total?: number;
+  page?: number;
+  pageSize?: number;
+  hasNext?: boolean;
+}
+
+export interface CreateOAuthAppOptions {
+  description?: string;
+  appCode?: string;
+  app_code?: string;
+  loginAudience?: OAuthLoginAudience;
+  login_audience?: OAuthLoginAudience;
+  redirectUriConfigs?: OAuthRedirectUriConfig[];
+  redirect_uri_configs?: OAuthRedirectUriConfig[];
+  redirectUris?: string[];
+  redirect_uris?: string[];
+  allowedScopes?: string[];
+  allowed_scopes?: string[];
+  appType?: string;
+  app_type?: string;
+  consentRequired?: boolean;
+  consent_required?: boolean;
+}
+
+export interface EnsureProjectOAuthAppOptions extends CreateOAuthAppOptions {
+  name: string;
+  loginAudience: OAuthLoginAudience;
+  appId?: string;
+  app_id?: string;
+  redirectUriConfigs: OAuthRedirectUriConfig[];
+}
+
+export function listOAuthApps(options?: { page?: number; pageSize?: number }): Promise<OAuthAppList>;
+export function getOAuthApp(appId: string): Promise<OAuthApp>;
+export function createOAuthApp(name: string, options?: CreateOAuthAppOptions): Promise<OAuthApp>;
+export function updateOAuthApp(appId: string, changes?: Record<string, unknown>): Promise<OAuthApp>;
+export function deleteOAuthApp(appId: string): Promise<void>;
+export function setOAuthAppEnabled(appId: string, enabled: boolean): Promise<OAuthApp>;
+export function rotateOAuthAppSecret(appId: string): Promise<OAuthApp>;
+export function listOAuthGrants(appId: string): Promise<Array<Record<string, unknown>>>;
+export function revokeOAuthGrant(grantId: string): Promise<void>;
+export function findOAuthAppByCode(appCode: string, options?: { pageSize?: number }): Promise<OAuthApp | null>;
+export function ensureProjectOAuthApp(options: EnsureProjectOAuthAppOptions): Promise<OAuthApp>;
+
+export const oauth: {
+  listApps: typeof listOAuthApps;
+  getApp: typeof getOAuthApp;
+  createApp: typeof createOAuthApp;
+  updateApp: typeof updateOAuthApp;
+  deleteApp: typeof deleteOAuthApp;
+  setEnabled: typeof setOAuthAppEnabled;
+  rotateSecret: typeof rotateOAuthAppSecret;
+  listGrants: typeof listOAuthGrants;
+  revokeGrant: typeof revokeOAuthGrant;
+  findAppByCode: typeof findOAuthAppByCode;
+  ensureProjectApp: typeof ensureProjectOAuthApp;
+};
+
+export class OAuthProtocolError extends ApiError {
+  error?: string;
+}
+
 export interface OAuthRuntimeConfig {
   clientId: string;
   publicBaseUrl: string;
   scopes: readonly string[];
+  redirectUriConfigs: readonly OAuthRedirectUriConfig[];
   redirectUris: readonly string[];
-  endpoints: Readonly<Record<string, string>>;
-  appId?: string;
-  appCode?: string;
-  loginAudience?: OAuthLoginAudience;
-}
-
-export interface OAuthAuthorizationRequest {
-  authorizationUrl: string;
-  state: string;
-  codeVerifier: string;
-  redirectUri: string;
-  expiresAt: number;
+  endpoints: Readonly<Record<string, string>>;
+  appId?: string;
+  appCode?: string;
+  loginAudience?: OAuthLoginAudience;
 }
 
-export interface OAuthTokenResponse {
-  access_token: string;
-  token_type?: string;
-  expires_in?: number;
-  refresh_token?: string;
-  scope?: string;
-  id_token?: string;
-  [key: string]: unknown;
-}
-
-export function loadOAuthRuntimeConfig(options?: { configPath?: string }): Promise<OAuthRuntimeConfig>;
-export function createOAuthAuthorizationRequest(
-  config: OAuthRuntimeConfig,
-  options: {
-    redirectUri: string;
-    scopes?: string[];
-    state?: string;
-    codeVerifier?: string;
-    ttlSeconds?: number;
-    now?: number;
-  },
-): OAuthAuthorizationRequest;
-export function exchangeOAuthAuthorizationCode(
-  config: OAuthRuntimeConfig,
-  options: { code: string; redirectUri: string; codeVerifier: string },
-): Promise<OAuthTokenResponse>;
-export function refreshOAuthAccessToken(
-  config: OAuthRuntimeConfig,
-  options: { refreshToken: string; scopes?: string[] },
-): Promise<OAuthTokenResponse>;
-export function getOAuthUserInfo(
-  config: OAuthRuntimeConfig,
-  options: { accessToken: string },
-): Promise<Record<string, unknown>>;
-export function revokeOAuthToken(
-  config: OAuthRuntimeConfig,
-  options: { token: string; tokenTypeHint?: 'access_token' | 'refresh_token' | string },
-): Promise<void>;
-export function completeOAuthAuthorization(
-  config: OAuthRuntimeConfig,
-  options: { code: string; redirectUri: string; codeVerifier: string },
-): Promise<{ tokens: OAuthTokenResponse; user: Record<string, unknown> }>;
-
+export function oauthRedirectUriForEnvironment(config: OAuthRuntimeConfig, environment: string): string;
+
+export interface OAuthAuthorizationRequest {
+  authorizationUrl: string;
+  state: string;
+  codeVerifier: string;
+  redirectUri: string;
+  expiresAt: number;
+}
+
+export interface OAuthTokenResponse {
+  access_token: string;
+  token_type?: string;
+  expires_in?: number;
+  refresh_token?: string;
+  scope?: string;
+  id_token?: string;
+  [key: string]: unknown;
+}
+
+export function loadOAuthRuntimeConfig(options?: { configPath?: string }): Promise<OAuthRuntimeConfig>;
+export function createOAuthAuthorizationRequest(
+  config: OAuthRuntimeConfig,
+  options: {
+    redirectUri: string;
+    scopes?: string[];
+    state?: string;
+    codeVerifier?: string;
+    ttlSeconds?: number;
+    now?: number;
+  },
+): OAuthAuthorizationRequest;
+export function exchangeOAuthAuthorizationCode(
+  config: OAuthRuntimeConfig,
+  options: { code: string; redirectUri: string; codeVerifier: string },
+): Promise<OAuthTokenResponse>;
+export function refreshOAuthAccessToken(
+  config: OAuthRuntimeConfig,
+  options: { refreshToken: string; scopes?: string[] },
+): Promise<OAuthTokenResponse>;
+export function getOAuthUserInfo(
+  config: OAuthRuntimeConfig,
+  options: { accessToken: string },
+): Promise<Record<string, unknown>>;
+export function revokeOAuthToken(
+  config: OAuthRuntimeConfig,
+  options: { token: string; tokenTypeHint?: 'access_token' | 'refresh_token' | string },
+): Promise<void>;
+export function completeOAuthAuthorization(
+  config: OAuthRuntimeConfig,
+  options: { code: string; redirectUri: string; codeVerifier: string },
+): Promise<{ tokens: OAuthTokenResponse; user: Record<string, unknown> }>;
+
 export const oauthRuntime: {
   loadConfig: typeof loadOAuthRuntimeConfig;
-  createAuthorizationRequest: typeof createOAuthAuthorizationRequest;
-  exchangeAuthorizationCode: typeof exchangeOAuthAuthorizationCode;
-  refreshAccessToken: typeof refreshOAuthAccessToken;
-  getUserInfo: typeof getOAuthUserInfo;
-  revokeToken: typeof revokeOAuthToken;
-  completeAuthorization: typeof completeOAuthAuthorization;
-};
+  redirectUriForEnvironment: typeof oauthRedirectUriForEnvironment;
+  createAuthorizationRequest: typeof createOAuthAuthorizationRequest;
+  exchangeAuthorizationCode: typeof exchangeOAuthAuthorizationCode;
+  refreshAccessToken: typeof refreshOAuthAccessToken;
+  getUserInfo: typeof getOAuthUserInfo;
+  revokeToken: typeof revokeOAuthToken;
+  completeAuthorization: typeof completeOAuthAuthorization;
+};
 
 export const DataSourceType: {
   TEXT: 0;

package/dist/oauth-runtime.js

@@ -1 +1 @@
-import{createHash as e,randomBytes as t}from"node:crypto";import{readFile as r}from"node:fs/promises";import o from"node:path";import{ApiError as n}from"./shared.js";const i=["authorization","token","userinfo","revoke"],s=/^[A-Za-z0-9._~-]{43,128}$/;export class OAuthProtocolError extends n{constructor(e,t={}){super(e,t),this.error=t.error}}function c(e,t){const r=String(e||"").trim();let o;try{o=new URL(r)}catch{throw new TypeError(`${t} must be an absolute http(s) URL`)}if(!["http:","https:"].includes(o.protocol))throw new TypeError(`${t} must be an absolute http(s) URL`);if(o.hash)throw new TypeError(`${t} must not contain a fragment`);return r}function a(e){return new URL(e).origin.toLowerCase()}function u(e,t,r){const o=String(t||"").trim();if(!o)throw new TypeError(`OAuth endpoint is missing: ${r}`);const n=c(new URL(o,`${e}/`).toString(),`endpoints.${r}`);if(a(n)!==a(e))throw new TypeError(`OAuth endpoint ${r} must use the same origin as publicBaseUrl`);return n}function h(e){return!(!e||"object"!=typeof e)&&(Array.isArray(e)?e.some(h):Object.entries(e).some(([e,t])=>e.toLowerCase().replaceAll("_","").includes("secret")||h(t)))}export async function loadOAuthRuntimeConfig({configPath:e}={}){const t=o.resolve(process.env.LICOS_PROJECT_PATH||process.cwd()),n=o.resolve(e||o.join(t,"config/licos-oauth.json"));let s;try{s=JSON.parse(await r(n,"utf8"))}catch(e){if("ENOENT"===e?.code)throw new TypeError(`OAuth config not found: ${n}`);if(e instanceof SyntaxError)throw new TypeError(`OAuth config is not valid JSON: ${n}`);throw e}if(!s||"object"!=typeof s||Array.isArray(s))throw new TypeError("OAuth config must be a JSON object");if(h(s))throw new TypeError("OAuth config must not contain client secret fields");if("licos-oauth2"!==s.provider)throw new TypeError("OAuth config provider must be licos-oauth2");if(!0!==s.pkce)throw new TypeError("OAuth config must enable PKCE");const a=String(s.clientId||"").trim();if(!a)throw new TypeError("OAuth config is missing clientId");const p=c(s.publicBaseUrl,"publicBaseUrl").replace(/\/$/,"");if(!Array.isArray(s.scopes)||0===s.scopes.length||s.scopes.some(e=>!String(e).trim()))throw new TypeError("OAuth config scopes must be a non-empty string array");if(!Array.isArray(s.redirectUriConfigs)||0===s.redirectUriConfigs.length)throw new TypeError("OAuth config redirectUriConfigs must not be empty");const f=[...new Set(s.scopes.map(e=>String(e).trim()))],d=[...new Set(s.redirectUriConfigs.map(e=>c(e?.redirectUri,"redirectUri")))];if(!s.endpoints||"object"!=typeof s.endpoints||Array.isArray(s.endpoints))throw new TypeError("OAuth config endpoints must be an object");const l=Object.fromEntries(Object.entries(s.endpoints).map(([e,t])=>[e,u(p,t,e)]));for(const e of i)if(!l[e])throw new TypeError(`OAuth endpoint is missing: ${e}`);return Object.freeze({clientId:a,publicBaseUrl:p,scopes:Object.freeze(f),redirectUris:Object.freeze(d),endpoints:Object.freeze(l),appId:String(s.appId||"").trim()||void 0,appCode:String(s.appCode||"").trim()||void 0,loginAudience:String(s.loginAudience||"").trim()||void 0})}function p(e,t){const r=c(t,"redirectUri");if(!e.redirectUris.includes(r))throw new TypeError("redirectUri is not configured for this OAuth application");return r}function f(e){if(!s.test(e))throw new TypeError("codeVerifier must be 43-128 RFC 7636 unreserved characters");return e}function d(e,t){const r=[...new Set((t||e.scopes).map(e=>String(e).trim()).filter(Boolean))];if(0===r.length)throw new TypeError("at least one OAuth scope is required");const o=r.filter(t=>!e.scopes.includes(t));if(o.length)throw new TypeError(`OAuth scopes are not configured: ${o.sort().join(", ")}`);return r}export function createOAuthAuthorizationRequest(r,o){const n=p(r,o?.redirectUri),i=d(r,o?.scopes),s=String(o?.state||t(32).toString("base64url")).trim();if(!s)throw new TypeError("state is required");const c=f(o?.codeVerifier||t(64).toString("base64url")),a=o?.ttlSeconds??600;if(!Number.isInteger(a)||a<=0)throw new TypeError("ttlSeconds must be a positive integer");const u=e("sha256").update(c,"ascii").digest("base64url"),h=new URL(r.endpoints.authorization);h.search=new URLSearchParams({response_type:"code",client_id:r.clientId,redirect_uri:n,scope:i.join(" "),state:s,code_challenge:u,code_challenge_method:"S256"}).toString();const l=o?.now??Math.floor(Date.now()/1e3);return{authorizationUrl:h.toString(),state:s,codeVerifier:c,redirectUri:n,expiresAt:l+a}}function l(e,t){let r;try{r=e?JSON.parse(e):void 0}catch{r=void 0}const o=r&&"object"==typeof r&&String(r.error||"").trim()||void 0,n=r&&"object"==typeof r&&(r.error_description||r.message||o)||e||"OAuth request failed";return new OAuthProtocolError(String(n),{status:t,error:o,details:r})}async function w(e,{method:t,form:r,accessToken:o,allowEmpty:n=!1}){const i={Accept:"application/json"};let s,c;r&&(s=new URLSearchParams(Object.entries(r).filter(([,e])=>null!=e)).toString(),i["Content-Type"]="application/x-www-form-urlencoded"),o&&(i.Authorization=`Bearer ${o}`);try{c=await fetch(e,{method:t,headers:i,body:s})}catch(e){throw new OAuthProtocolError(`OAuth request failed: ${e?.message||e}`)}const a=await c.text();if(!c.ok)throw l(a,c.status);if(!a){if(n)return;throw new OAuthProtocolError("OAuth response body is empty",{status:c.status})}let u;try{u=JSON.parse(a)}catch{throw new OAuthProtocolError("OAuth response is not valid JSON",{status:c.status})}if(!u||"object"!=typeof u||Array.isArray(u))throw new OAuthProtocolError("OAuth response is not an object",{status:c.status,details:u});if(u.error)throw l(a,c.status);return u}export async function exchangeOAuthAuthorizationCode(e,t){const r=String(t?.code||"").trim();if(!r)throw new TypeError("authorization code is required");const o=p(e,t?.redirectUri),n=f(t?.codeVerifier);return w(e.endpoints.token,{method:"POST",form:{grant_type:"authorization_code",client_id:e.clientId,code:r,redirect_uri:o,code_verifier:n}})}export async function refreshOAuthAccessToken(e,t){const r=String(t?.refreshToken||"").trim();if(!r)throw new TypeError("refreshToken is required");return w(e.endpoints.token,{method:"POST",form:{grant_type:"refresh_token",client_id:e.clientId,refresh_token:r,scope:t?.scopes?d(e,t.scopes).join(" "):void 0}})}export async function getOAuthUserInfo(e,t){const r=String(t?.accessToken||"").trim();if(!r)throw new TypeError("accessToken is required");return w(e.endpoints.userinfo,{method:"GET",accessToken:r})}export async function revokeOAuthToken(e,t){const r=String(t?.token||"").trim();if(!r)throw new TypeError("token is required");await w(e.endpoints.revoke,{method:"POST",form:{client_id:e.clientId,token:r,token_type_hint:t?.tokenTypeHint},allowEmpty:!0})}export async function completeOAuthAuthorization(e,t){const r=await exchangeOAuthAuthorizationCode(e,t),o=String(r.access_token||"").trim();if(!o)throw new OAuthProtocolError("OAuth token response is missing access_token",{details:r});return{tokens:r,user:await getOAuthUserInfo(e,{accessToken:o})}}export const oauthRuntime={loadConfig:loadOAuthRuntimeConfig,createAuthorizationRequest:createOAuthAuthorizationRequest,exchangeAuthorizationCode:exchangeOAuthAuthorizationCode,refreshAccessToken:refreshOAuthAccessToken,getUserInfo:getOAuthUserInfo,revokeToken:revokeOAuthToken,completeAuthorization:completeOAuthAuthorization};
+import{createHash as e,randomBytes as r}from"node:crypto";import{readFile as t}from"node:fs/promises";import o from"node:path";import{ApiError as n}from"./shared.js";const i=["authorization","token","userinfo","revoke"],s=/^[A-Za-z0-9._~-]{43,128}$/;export class OAuthProtocolError extends n{constructor(e,r={}){super(e,r),this.error=r.error}}function c(e,r){const t=String(e||"").trim();let o;try{o=new URL(t)}catch{throw new TypeError(`${r} must be an absolute http(s) URL`)}if(!["http:","https:"].includes(o.protocol))throw new TypeError(`${r} must be an absolute http(s) URL`);if(o.hash)throw new TypeError(`${r} must not contain a fragment`);return t}function a(e){return new URL(e).origin.toLowerCase()}function u(e,r,t){const o=String(r||"").trim();if(!o)throw new TypeError(`OAuth endpoint is missing: ${t}`);const n=c(new URL(o,`${e}/`).toString(),`endpoints.${t}`);if(a(n)!==a(e))throw new TypeError(`OAuth endpoint ${t} must use the same origin as publicBaseUrl`);return n}function h(e){return!(!e||"object"!=typeof e)&&(Array.isArray(e)?e.some(h):Object.entries(e).some(([e,r])=>e.toLowerCase().replaceAll("_","").includes("secret")||h(r)))}export async function loadOAuthRuntimeConfig({configPath:e}={}){const r=o.resolve(process.env.LICOS_PROJECT_PATH||process.cwd()),n=o.resolve(e||o.join(r,"config/licos-oauth.json"));let s;try{s=JSON.parse(await t(n,"utf8"))}catch(e){if("ENOENT"===e?.code)throw new TypeError(`OAuth config not found: ${n}`);if(e instanceof SyntaxError)throw new TypeError(`OAuth config is not valid JSON: ${n}`);throw e}if(!s||"object"!=typeof s||Array.isArray(s))throw new TypeError("OAuth config must be a JSON object");if(h(s))throw new TypeError("OAuth config must not contain client secret fields");if("licos-oauth2"!==s.provider)throw new TypeError("OAuth config provider must be licos-oauth2");if(!0!==s.pkce)throw new TypeError("OAuth config must enable PKCE");const a=String(s.clientId||"").trim();if(!a)throw new TypeError("OAuth config is missing clientId");const p=c(s.publicBaseUrl,"publicBaseUrl").replace(/\/$/,"");if(!Array.isArray(s.scopes)||0===s.scopes.length||s.scopes.some(e=>!String(e).trim()))throw new TypeError("OAuth config scopes must be a non-empty string array");if(!Array.isArray(s.redirectUriConfigs)||0===s.redirectUriConfigs.length)throw new TypeError("OAuth config redirectUriConfigs must not be empty");const d=[...new Set(s.scopes.map(e=>String(e).trim()))],f=s.redirectUriConfigs.map(e=>{if(!e||"object"!=typeof e||Array.isArray(e))throw new TypeError("OAuth redirect config must be an object");const r=String(e.environment||"").trim().toLowerCase();if(!["dev","prod"].includes(r))throw new TypeError("OAuth redirect config environment must be dev or prod");return Object.freeze({environment:r,redirectUri:c(e.redirectUri,"redirectUri")})});if(new Set(f.map(e=>e.environment)).size!==f.length)throw new TypeError("OAuth redirect config environments must be unique");const w=[...new Set(f.map(e=>e.redirectUri))];if(!s.endpoints||"object"!=typeof s.endpoints||Array.isArray(s.endpoints))throw new TypeError("OAuth config endpoints must be an object");const l=Object.fromEntries(Object.entries(s.endpoints).map(([e,r])=>[e,u(p,r,e)]));for(const e of i)if(!l[e])throw new TypeError(`OAuth endpoint is missing: ${e}`);return Object.freeze({clientId:a,publicBaseUrl:p,scopes:Object.freeze(d),redirectUriConfigs:Object.freeze(f),redirectUris:Object.freeze(w),endpoints:Object.freeze(l),appId:String(s.appId||"").trim()||void 0,appCode:String(s.appCode||"").trim()||void 0,loginAudience:String(s.loginAudience||"").trim()||void 0})}export function oauthRedirectUriForEnvironment(e,r){const t=String(r||"").trim().toLowerCase(),o="production"===t?"prod":"development"===t?"dev":t;if(!["dev","prod"].includes(o))throw new TypeError("OAuth environment must be dev or prod");const n=e.redirectUriConfigs?.find(e=>e.environment===o);if(!n)throw new TypeError(`OAuth redirect URI is not configured for environment: ${o}`);return n.redirectUri}function p(e,r){const t=c(r,"redirectUri");if(!e.redirectUris.includes(t))throw new TypeError("redirectUri is not configured for this OAuth application");return t}function d(e){if(!s.test(e))throw new TypeError("codeVerifier must be 43-128 RFC 7636 unreserved characters");return e}function f(e,r){const t=[...new Set((r||e.scopes).map(e=>String(e).trim()).filter(Boolean))];if(0===t.length)throw new TypeError("at least one OAuth scope is required");const o=t.filter(r=>!e.scopes.includes(r));if(o.length)throw new TypeError(`OAuth scopes are not configured: ${o.sort().join(", ")}`);return t}export function createOAuthAuthorizationRequest(t,o){const n=p(t,o?.redirectUri),i=f(t,o?.scopes),s=String(o?.state||r(32).toString("base64url")).trim();if(!s)throw new TypeError("state is required");const c=d(o?.codeVerifier||r(64).toString("base64url")),a=o?.ttlSeconds??600;if(!Number.isInteger(a)||a<=0)throw new TypeError("ttlSeconds must be a positive integer");const u=e("sha256").update(c,"ascii").digest("base64url"),h=new URL(t.endpoints.authorization);h.search=new URLSearchParams({response_type:"code",client_id:t.clientId,redirect_uri:n,scope:i.join(" "),state:s,code_challenge:u,code_challenge_method:"S256"}).toString();const w=o?.now??Math.floor(Date.now()/1e3);return{authorizationUrl:h.toString(),state:s,codeVerifier:c,redirectUri:n,expiresAt:w+a}}function w(e,r){let t;try{t=e?JSON.parse(e):void 0}catch{t=void 0}const o=t&&"object"==typeof t&&String(t.error||"").trim()||void 0,n=t&&"object"==typeof t&&(t.error_description||t.message||o)||e||"OAuth request failed";return new OAuthProtocolError(String(n),{status:r,error:o,details:t})}async function l(e,{method:r,form:t,accessToken:o,allowEmpty:n=!1}){const i={Accept:"application/json"};let s,c;t&&(s=new URLSearchParams(Object.entries(t).filter(([,e])=>null!=e)).toString(),i["Content-Type"]="application/x-www-form-urlencoded"),o&&(i.Authorization=`Bearer ${o}`);try{c=await fetch(e,{method:r,headers:i,body:s})}catch(e){throw new OAuthProtocolError(`OAuth request failed: ${e?.message||e}`)}const a=await c.text();if(!c.ok)throw w(a,c.status);if(!a){if(n)return;throw new OAuthProtocolError("OAuth response body is empty",{status:c.status})}let u;try{u=JSON.parse(a)}catch{throw new OAuthProtocolError("OAuth response is not valid JSON",{status:c.status})}if(!u||"object"!=typeof u||Array.isArray(u))throw new OAuthProtocolError("OAuth response is not an object",{status:c.status,details:u});if(u.error)throw w(a,c.status);return u}export async function exchangeOAuthAuthorizationCode(e,r){const t=String(r?.code||"").trim();if(!t)throw new TypeError("authorization code is required");const o=p(e,r?.redirectUri),n=d(r?.codeVerifier);return l(e.endpoints.token,{method:"POST",form:{grant_type:"authorization_code",client_id:e.clientId,code:t,redirect_uri:o,code_verifier:n}})}export async function refreshOAuthAccessToken(e,r){const t=String(r?.refreshToken||"").trim();if(!t)throw new TypeError("refreshToken is required");return l(e.endpoints.token,{method:"POST",form:{grant_type:"refresh_token",client_id:e.clientId,refresh_token:t,scope:r?.scopes?f(e,r.scopes).join(" "):void 0}})}export async function getOAuthUserInfo(e,r){const t=String(r?.accessToken||"").trim();if(!t)throw new TypeError("accessToken is required");return l(e.endpoints.userinfo,{method:"GET",accessToken:t})}export async function revokeOAuthToken(e,r){const t=String(r?.token||"").trim();if(!t)throw new TypeError("token is required");await l(e.endpoints.revoke,{method:"POST",form:{client_id:e.clientId,token:t,token_type_hint:r?.tokenTypeHint},allowEmpty:!0})}export async function completeOAuthAuthorization(e,r){const t=await exchangeOAuthAuthorizationCode(e,r),o=String(t.access_token||"").trim();if(!o)throw new OAuthProtocolError("OAuth token response is missing access_token",{details:t});return{tokens:t,user:await getOAuthUserInfo(e,{accessToken:o})}}export const oauthRuntime={loadConfig:loadOAuthRuntimeConfig,redirectUriForEnvironment:oauthRedirectUriForEnvironment,createAuthorizationRequest:createOAuthAuthorizationRequest,exchangeAuthorizationCode:exchangeOAuthAuthorizationCode,refreshAccessToken:refreshOAuthAccessToken,getUserInfo:getOAuthUserInfo,revokeToken:revokeOAuthToken,completeAuthorization:completeOAuthAuthorization};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kmlckj/licos-platform-sdk",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "LICOS platform SDK package shell for browser and Node runtimes",
   "author": "kmlckj",
   "type": "module",