npm - @meetopenbot/linear - Versions diffs - 0.0.3 → 0.0.4 - Mend

@meetopenbot/linear 0.0.3 → 0.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (36) hide show

package/src/oauth.ts DELETED Viewed

@@ -1,572 +0,0 @@
-/**
- * Linear OAuth 2.0 (authorization code + PKCE).
- *
- * Two callback modes:
- * - Loopback: temporary localhost server (local runtimes).
- * - Webhook: redirect to `https://<host>/api/webhooks/linear` (cloud/remote).
- */
-import { createHash, randomBytes } from "node:crypto";
-import { createServer, type Server } from "node:http";
-import type { Storage } from "@meetopenbot/plugin-sdk";
-import { GO_BACK_TO_OPENBOT_URL } from "./config.js";
-import {
-  clearPendingOAuthSession,
-  loadPendingOAuthSession,
-  savePendingOAuthSession,
-  type PendingOAuthSession,
-} from "./oauth-pending.js";
-export const LINEAR_AUTHORIZE_URL = "https://linear.app/oauth/authorize";
-export const LINEAR_TOKEN_URL = "https://api.linear.app/oauth/token";
-export const LINEAR_GRAPHQL_URL = "https://api.linear.app/graphql";
-export const OAUTH_WEBHOOK_PROVIDER = "linear";
-const LOOPBACK_CALLBACK_PATH = "/oauth/callback";
-const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
-const PENDING_SESSION_MS = 10 * 60 * 1000;
-let activeServer: Server | null = null;
-const webhookOAuthCompletions = new Map<
-  string,
-  (tokens: OAuthTokens | null) => void
->();
-export interface OAuthTokens {
-  accessToken: string;
-  refreshToken?: string;
-  /** Epoch ms when the access token expires, if Linear reported expiry. */
-  expiresAt?: number;
-  scope?: string;
-}
-export interface StartOAuthFlowArgs {
-  clientId: string;
-  clientSecret?: string;
-  port: number;
-  scopes: string;
-  /** Called once the code has been exchanged successfully. */
-  onSuccess: (tokens: OAuthTokens) => Promise<void>;
-  onError?: (error: Error) => void;
-  /** How long the callback server stays alive, in ms. */
-  timeoutMs?: number;
-}
-export interface OAuthFlowHandle {
-  authorizeUrl: string;
-  redirectUri: string;
-  /** Resolves with tokens on success, null on timeout/cancel. */
-  completion: Promise<OAuthTokens | null>;
-  cancel: () => void;
-}
-export interface StartWebhookOAuthFlowArgs {
-  storage: Storage;
-  clientId: string;
-  clientSecret?: string;
-  scopes: string;
-  webhookBaseUrl: string;
-  timeoutMs?: number;
-}
-function base64url(buffer: Buffer): string {
-  return buffer
-    .toString("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/, "");
-}
-export function oauthHtmlPage(title: string, body: string, ok: boolean): string {
-  return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>${title}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com" />
-<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&display=swap" rel="stylesheet" />
-<style>
-  body { font-family: Inter, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #101012; color: #ededef; }
-  .card { text-align: center; padding: 40px 48px; border-radius: 14px; background: #1b1b1f; border: 1px solid #2a2a30; max-width: 420px; }
-  .icon { height: 28px; margin-bottom: 18px; font-size: 28px; font-weight: 500; line-height: 28px; }
-  .success { color: #4ade80; }
-  h1 { font-size: 20px; font-weight: 600; margin: 0 0 8px; }
-  p { color: #9b9ba3; margin: 0; line-height: 1.5; }
-  .back-link { margin: 20px 0 0; font-size: 14px; }
-  .back-link a { color: #ededef; text-decoration: none; }
-  .back-link a:hover { text-decoration: underline; }
-</style>
-</head>
-<body>
-  <div class="card">
-    <div class="icon${ok ? " success" : ""}">${ok ? "✓" : "⚠"}</div>
-    <h1>${title}</h1>
-    <p>${body}</p>
-    <p class="back-link">Go back to <a href="${GO_BACK_TO_OPENBOT_URL}">OpenBot</a></p>
-  </div>
-</body>
-</html>`;
-}
-export function buildOAuthRedirectUri(webhookBaseUrl: string): string {
-  const base = webhookBaseUrl.replace(/\/$/, "");
-  return `${base}/api/webhooks/${OAUTH_WEBHOOK_PROVIDER}`;
-}
-function generatePkce() {
-  const state = base64url(randomBytes(24));
-  const codeVerifier = base64url(randomBytes(48));
-  const codeChallenge = base64url(
-    createHash("sha256").update(codeVerifier).digest(),
-  );
-  return { state, codeVerifier, codeChallenge };
-}
-export function buildAuthorizeUrl(args: {
-  clientId: string;
-  redirectUri: string;
-  scopes: string;
-  state: string;
-  codeChallenge: string;
-}): string {
-  return (
-    `${LINEAR_AUTHORIZE_URL}?` +
-    new URLSearchParams({
-      client_id: args.clientId,
-      redirect_uri: args.redirectUri,
-      response_type: "code",
-      scope: args.scopes,
-      state: args.state,
-      prompt: "consent",
-      code_challenge: args.codeChallenge,
-      code_challenge_method: "S256",
-    }).toString()
-  );
-}
-export async function exchangeAuthorizationCode(args: {
-  code: string;
-  redirectUri: string;
-  clientId: string;
-  clientSecret?: string;
-  codeVerifier: string;
-}): Promise<OAuthTokens> {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: args.code,
-    redirect_uri: args.redirectUri,
-    client_id: args.clientId,
-    code_verifier: args.codeVerifier,
-  });
-  if (args.clientSecret) body.set("client_secret", args.clientSecret);
-  const response = await fetch(LINEAR_TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body,
-  });
-  const payload = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
-  if (!response.ok || typeof payload.access_token !== "string") {
-    const detail =
-      typeof payload.error_description === "string"
-        ? payload.error_description
-        : JSON.stringify(payload);
-    throw new Error(
-      `Linear token exchange failed (${response.status}): ${detail}`,
-    );
-  }
-  return normalizeTokenResponse(payload);
-}
-export async function refreshAccessToken(args: {
-  refreshToken: string;
-  clientId: string;
-  clientSecret?: string;
-}): Promise<OAuthTokens> {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: args.refreshToken,
-    client_id: args.clientId,
-  });
-  if (args.clientSecret) body.set("client_secret", args.clientSecret);
-  const response = await fetch(LINEAR_TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body,
-  });
-  const payload = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
-  if (!response.ok || typeof payload.access_token !== "string") {
-    const detail =
-      typeof payload.error_description === "string"
-        ? payload.error_description
-        : JSON.stringify(payload);
-    throw new Error(
-      `Linear token refresh failed (${response.status}): ${detail}`,
-    );
-  }
-  return normalizeTokenResponse(payload);
-}
-function normalizeTokenResponse(
-  payload: Record<string, unknown>,
-): OAuthTokens {
-  return {
-    accessToken: payload.access_token as string,
-    refreshToken:
-      typeof payload.refresh_token === "string"
-        ? payload.refresh_token
-        : undefined,
-    expiresAt:
-      typeof payload.expires_in === "number"
-        ? Date.now() + payload.expires_in * 1000
-        : undefined,
-    scope: Array.isArray(payload.scope)
-      ? payload.scope.join(",")
-      : (payload.scope as string | undefined),
-  };
-}
-function registerWebhookOAuthCompletion(
-  state: string,
-  timeoutMs: number,
-): Promise<OAuthTokens | null> {
-  return new Promise((resolve) => {
-    const existing = webhookOAuthCompletions.get(state);
-    if (existing) {
-      webhookOAuthCompletions.delete(state);
-    }
-    const timeout = setTimeout(() => {
-      webhookOAuthCompletions.delete(state);
-      resolve(null);
-    }, timeoutMs);
-    timeout.unref?.();
-    webhookOAuthCompletions.set(state, (tokens) => {
-      clearTimeout(timeout);
-      resolve(tokens);
-    });
-  });
-}
-function settleWebhookOAuthCompletion(
-  state: string,
-  tokens: OAuthTokens | null,
-): void {
-  const resolve = webhookOAuthCompletions.get(state);
-  if (!resolve) return;
-  webhookOAuthCompletions.delete(state);
-  resolve(tokens);
-}
-export async function startWebhookOAuthFlow(
-  args: StartWebhookOAuthFlowArgs,
-): Promise<OAuthFlowHandle> {
-  const { state, codeVerifier, codeChallenge } = generatePkce();
-  const redirectUri = buildOAuthRedirectUri(args.webhookBaseUrl);
-  const pending: PendingOAuthSession = {
-    state,
-    codeVerifier,
-    clientId: args.clientId,
-    clientSecret: args.clientSecret,
-    redirectUri,
-    expiresAt: Date.now() + PENDING_SESSION_MS,
-  };
-  await savePendingOAuthSession(args.storage, pending);
-  const authorizeUrl = buildAuthorizeUrl({
-    clientId: args.clientId,
-    redirectUri,
-    scopes: args.scopes,
-    state,
-    codeChallenge,
-  });
-  const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const completion = registerWebhookOAuthCompletion(state, timeoutMs);
-  return {
-    authorizeUrl,
-    redirectUri,
-    completion,
-    cancel: () => {
-      settleWebhookOAuthCompletion(state, null);
-      void clearPendingOAuthSession(args.storage);
-    },
-  };
-}
-export type WebhookOAuthCallbackResult =
-  | {
-      kind: "oauth";
-      status: number;
-      html: string;
-      tokens: OAuthTokens | null;
-      state?: string;
-    }
-  | { kind: "ignore" };
-export async function handleWebhookOAuthCallback(args: {
-  storage: Storage;
-  query: Record<string, unknown>;
-  onSuccess: (tokens: OAuthTokens) => Promise<void>;
-}): Promise<WebhookOAuthCallbackResult> {
-  const code = queryParam(args.query, "code");
-  const state = queryParam(args.query, "state");
-  const oauthError = queryParam(args.query, "error");
-  if (!code && !state && !oauthError) {
-    return { kind: "ignore" };
-  }
-  if (oauthError) {
-    if (state) settleWebhookOAuthCompletion(state, null);
-    await clearPendingOAuthSession(args.storage);
-    return {
-      kind: "oauth",
-      status: 400,
-      html: oauthHtmlPage(
-        "Connection failed",
-        `Linear returned: ${oauthError}. Return to OpenBot and try again.`,
-        false,
-      ),
-      tokens: null,
-      state,
-    };
-  }
-  const pending = await loadPendingOAuthSession(args.storage);
-  if (!pending || !code || !state || pending.state !== state) {
-    return {
-      kind: "oauth",
-      status: 400,
-      html: oauthHtmlPage(
-        "Connection failed",
-        "Invalid callback (missing code or state mismatch). Return to OpenBot and try again.",
-        false,
-      ),
-      tokens: null,
-      state,
-    };
-  }
-  try {
-    const tokens = await exchangeAuthorizationCode({
-      code,
-      redirectUri: pending.redirectUri,
-      clientId: pending.clientId,
-      clientSecret: pending.clientSecret,
-      codeVerifier: pending.codeVerifier,
-    });
-    await args.onSuccess(tokens);
-    await clearPendingOAuthSession(args.storage);
-    settleWebhookOAuthCompletion(state, tokens);
-    return {
-      kind: "oauth",
-      status: 200,
-      html: oauthHtmlPage(
-        "Connected to Linear",
-        "You can close this tab and return to OpenBot.",
-        true,
-      ),
-      tokens,
-      state,
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    await clearPendingOAuthSession(args.storage);
-    settleWebhookOAuthCompletion(state, null);
-    return {
-      kind: "oauth",
-      status: 500,
-      html: oauthHtmlPage(
-        "Connection failed",
-        `${message}. Return to OpenBot and try again.`,
-        false,
-      ),
-      tokens: null,
-      state,
-    };
-  }
-}
-function queryParam(
-  query: Record<string, unknown>,
-  key: string,
-): string | undefined {
-  const value = query[key];
-  if (typeof value === "string" && value.trim()) return value.trim();
-  if (Array.isArray(value) && typeof value[0] === "string") {
-    return value[0].trim();
-  }
-  return undefined;
-}
-export function startOAuthFlow(args: StartOAuthFlowArgs): OAuthFlowHandle {
-  if (activeServer) {
-    activeServer.close();
-    activeServer = null;
-  }
-  const { state, codeVerifier, codeChallenge } = generatePkce();
-  const redirectUri = `http://localhost:${args.port}${LOOPBACK_CALLBACK_PATH}`;
-  const authorizeUrl = buildAuthorizeUrl({
-    clientId: args.clientId,
-    redirectUri,
-    scopes: args.scopes,
-    state,
-    codeChallenge,
-  });
-  let settle: (tokens: OAuthTokens | null) => void;
-  const completion = new Promise<OAuthTokens | null>((resolve) => {
-    settle = resolve;
-  });
-  const server = createServer(async (req, res) => {
-    const url = new URL(req.url ?? "/", `http://localhost:${args.port}`);
-    if (url.pathname !== LOOPBACK_CALLBACK_PATH) {
-      res.writeHead(404).end();
-      return;
-    }
-    const finish = (status: number, title: string, body: string, ok: boolean) => {
-      res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(oauthHtmlPage(title, body, ok));
-    };
-    const error = url.searchParams.get("error");
-    if (error) {
-      finish(
-        400,
-        "Connection failed",
-        `Linear returned: ${error}. Return to OpenBot and try again.`,
-        false,
-      );
-      cleanup();
-      args.onError?.(new Error(`Linear authorization failed: ${error}`));
-      settle(null);
-      return;
-    }
-    const code = url.searchParams.get("code");
-    if (!code || url.searchParams.get("state") !== state) {
-      finish(
-        400,
-        "Connection failed",
-        "Invalid callback (missing code or state mismatch). Return to OpenBot and try again.",
-        false,
-      );
-      return;
-    }
-    try {
-      const tokens = await exchangeAuthorizationCode({
-        code,
-        redirectUri,
-        clientId: args.clientId,
-        clientSecret: args.clientSecret,
-        codeVerifier,
-      });
-      await args.onSuccess(tokens);
-      finish(
-        200,
-        "Connected to Linear",
-        "You can close this tab and return to OpenBot.",
-        true,
-      );
-      cleanup();
-      settle(tokens);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      finish(
-        500,
-        "Connection failed",
-        `${message}. Return to OpenBot and try again.`,
-        false,
-      );
-      cleanup();
-      args.onError?.(error instanceof Error ? error : new Error(message));
-      settle(null);
-    }
-  });
-  const timeout = setTimeout(() => {
-    cleanup();
-    settle(null);
-  }, args.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  timeout.unref?.();
-  function cleanup() {
-    clearTimeout(timeout);
-    if (activeServer === server) activeServer = null;
-    server.close();
-  }
-  server.on("error", (error) => {
-    cleanup();
-    args.onError?.(error);
-    settle(null);
-  });
-  server.listen(args.port);
-  activeServer = server;
-  return {
-    authorizeUrl,
-    redirectUri,
-    completion,
-    cancel: () => {
-      cleanup();
-      settle(null);
-    },
-  };
-}
-export async function fetchViewer(accessToken: string) {
-  const response = await fetch(LINEAR_GRAPHQL_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${accessToken}`,
-    },
-    body: JSON.stringify({
-      query: `query { viewer { id name displayName email } organization { id name urlKey } }`,
-    }),
-  });
-  if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new Error(
-      `Linear API request failed (${response.status}): ${body.slice(0, 500)}`,
-    );
-  }
-  const payload = (await response.json()) as {
-    data?: {
-      viewer: { id: string; name: string; displayName: string; email: string };
-      organization: { id: string; name: string; urlKey: string };
-    };
-    errors?: Array<{ message: string }>;
-  };
-  if (payload.errors?.length) {
-    throw new Error(payload.errors.map((e) => e.message).join("; "));
-  }
-  if (!payload.data) {
-    throw new Error("Linear API returned no data.");
-  }
-  return payload.data;
-}