@kwirthmagnify/kwirth-common-back 0.5.18 → 0.5.19

package/dist/github.d.ts

@@ -0,0 +1,2 @@
+import { IIdpIdentity } from './IIdpConnector';
+export declare function githubIdentityFromToken(apiBaseUrl: string, accessToken: string): Promise<IIdpIdentity>;

package/dist/github.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.githubIdentityFromToken = githubIdentityFromToken;
+async function ghGet(base, resource, accessToken) {
+    const res = await fetch(`${base}${resource}`, {
+        headers: {
+            'Authorization': `Bearer ${accessToken}`,
+            'Accept': 'application/vnd.github+json',
+            'User-Agent': 'kwirth'
+        }
+    });
+    if (!res.ok)
+        throw new Error(`GitHub API ${resource} returned ${res.status}`);
+    return res.json();
+}
+async function githubIdentityFromToken(apiBaseUrl, accessToken) {
+    const base = apiBaseUrl.replace(/\/+$/, '');
+    const user = await ghGet(base, '/user', accessToken);
+    // /user/emails puede fallar si falta el scope user:email; en ese caso caemos al email público
+    const emails = await ghGet(base, '/user/emails', accessToken).catch(() => []);
+    // preferimos el email primary; si no, el primero verificado; si no, el primero que haya
+    const chosen = emails.find(e => e.primary) ?? emails.find(e => e.verified) ?? emails[0];
+    return {
+        email: chosen?.email ?? user.email ?? '',
+        emailVerified: chosen?.verified === true,
+        name: user.name ?? user.login,
+        sub: user.id !== undefined ? String(user.id) : undefined
+    };
+}

package/dist/index.d.ts

@@ -4,5 +4,7 @@ export * from './IProvider';
 export * from './ISender';
 export * from './IIdpConnector';
 export * from './oidc';
+export * from './oauth2';
+export * from './github';
 export * from './KubernetesTools';
 export * from '@kwirthmagnify/kwirth-common';

package/dist/index.js

@@ -20,5 +20,7 @@ __exportStar(require("./IProvider"), exports);
 __exportStar(require("./ISender"), exports);
 __exportStar(require("./IIdpConnector"), exports);
 __exportStar(require("./oidc"), exports);
+__exportStar(require("./oauth2"), exports);
+__exportStar(require("./github"), exports);
 __exportStar(require("./KubernetesTools"), exports);
 __exportStar(require("@kwirthmagnify/kwirth-common"), exports);

package/dist/oauth2.d.ts

@@ -0,0 +1,10 @@
+import { IIdpAuthContext, IIdpCallbackContext, IIdpConfigFieldDef, IIdpIdentity } from './IIdpConnector';
+export interface IOAuth2Endpoints {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    defaultScopes?: string;
+    usePkce?: boolean;
+}
+export declare function oauth2ConfigSchema(): IIdpConfigFieldDef[];
+export declare function oauth2BuildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext, ep: IOAuth2Endpoints): string;
+export declare function oauth2HandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, ep: IOAuth2Endpoints, fetchIdentity: (accessToken: string) => Promise<IIdpIdentity>): Promise<IIdpIdentity>;

package/dist/oauth2.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauth2ConfigSchema = oauth2ConfigSchema;
+exports.oauth2BuildAuthorizationUrl = oauth2BuildAuthorizationUrl;
+exports.oauth2HandleCallback = oauth2HandleCallback;
+// esquema base de un IdP OAuth2 (el conector añade sus URLs si aplica; clientSecret 'password' → se enmascara)
+function oauth2ConfigSchema() {
+    return [
+        { name: 'clientId', label: 'Client ID', type: 'text', required: true },
+        { name: 'clientSecret', label: 'Client Secret', type: 'password', required: true },
+        { name: 'scopes', label: 'Scopes', type: 'text' }
+    ];
+}
+function oauth2BuildAuthorizationUrl(config, ctx, ep) {
+    const scope = config.scopes || ep.defaultScopes || '';
+    const url = new URL(ep.authorizationEndpoint);
+    url.searchParams.set('client_id', String(config.clientId ?? ''));
+    url.searchParams.set('redirect_uri', ctx.redirectUri);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', ctx.state);
+    if (scope)
+        url.searchParams.set('scope', scope);
+    if (ep.usePkce) {
+        url.searchParams.set('code_challenge', ctx.codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+    }
+    return url.toString();
+}
+// intercambia el 'code' por access_token (back-channel) y delega el userinfo en fetchIdentity(accessToken).
+async function oauth2HandleCallback(config, ctx, ep, fetchIdentity) {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('code', ctx.code);
+    body.set('client_id', String(config.clientId ?? ''));
+    body.set('client_secret', String(config.clientSecret ?? ''));
+    body.set('redirect_uri', ctx.redirectUri);
+    if (ep.usePkce)
+        body.set('code_verifier', ctx.codeVerifier);
+    // Accept: application/json → algunos IdP (GitHub) devuelven form-urlencoded sin esta cabecera
+    const res = await fetch(ep.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json' },
+        body
+    });
+    if (!res.ok)
+        throw new Error(`OAuth2 token endpoint returned ${res.status}`);
+    const token = await res.json();
+    if (token.error || !token.access_token) {
+        throw new Error(`OAuth2 token exchange failed: ${token.error_description || token.error || 'no access_token'}`);
+    }
+    return fetchIdentity(token.access_token);
+}

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@kwirthmagnify/kwirth-common-back",
-  "version": "0.5.18",
+  "version": "0.5.19",
   "description": "Backend interfaces for building Kwirth provider and channel plugins",
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "test": "node tests/run.mjs"
   },
   "publishConfig": {
     "access": "public",
@@ -33,6 +34,7 @@
   "devDependencies": {
     "@types/express": "^4.17.21",
     "@types/js-yaml": "^4.0.9",
+    "esbuild": "^0.27.2",
     "typescript": "^5.8.3"
   }
 }