@meistrari/auth-core 1.35.0 → 1.37.0

package/dist/index.mjs

@@ -8,7 +8,20 @@ import { defaultStatements } from 'better-auth/plugins/organization/access';
 import z, { z as z$1 } from 'zod';
 export { APIError } from 'better-auth';
 
-const version = "1.35.0";
+function isTokenExpired(token, expiresInMs) {
+  const payload = JSON.parse(atob(token.split(".")[1] ?? ""));
+  if (!payload.exp)
+    return false;
+  const nowInSeconds = Date.now() / 1e3;
+  const expirationTime = payload.exp;
+  if (expiresInMs !== void 0) {
+    const futureTimeInSeconds = nowInSeconds + expiresInMs / 1e3;
+    return futureTimeInSeconds >= expirationTime;
+  }
+  return nowInSeconds > expirationTime;
+}
+
+const version = "1.37.0";
 
 function parsedEnumValues(schema) {
   return Object.fromEntries(
@@ -187,15 +200,17 @@ const JWTPayload = z$1.object({
 });
 
 const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const CLIENT_CREDENTIALS_GRANT = "client_credentials";
 function normalizeOrganizationsResponse(response) {
   if (Array.isArray(response)) {
     return {
       data: response
     };
   }
+  const candidate = response;
   return {
-    ...response,
-    data: Array.isArray(response.data) ? response.data : []
+    ...candidate,
+    data: Array.isArray(candidate.data) ? candidate.data : []
   };
 }
 function applicationsPluginClient() {
@@ -273,6 +288,17 @@ function applicationsPluginClient() {
               }
             });
           },
+          exchangeClientCredentialsForToken: async (credentials) => {
+            return await $fetch("/applications/token", {
+              method: "POST",
+              body: {
+                grantType: CLIENT_CREDENTIALS_GRANT,
+                clientId: credentials.clientId,
+                clientSecret: credentials.clientSecret,
+                organizationId: credentials.organizationId
+              }
+            });
+          },
           completeAuthorizationFlow: async (code, codeVerifier) => {
             return await $fetch("/applications/token", {
               method: "POST",
@@ -408,12 +434,23 @@ function createAPIClient(apiUrl, fetchOptions = {}) {
   });
 }
 
-async function readErrorMessage(response) {
+class ApplicationRouteError extends Error {
+  code;
+  details;
+  status;
+  constructor(response, body) {
+    super(body?.error ?? body?.message ?? response.statusText);
+    this.name = "ApplicationRouteError";
+    this.status = response.status;
+    this.code = body?.code;
+    this.details = body?.details;
+  }
+}
+async function readErrorBody(response) {
   try {
-    const body = await response.json();
-    return body.error ?? body.message ?? response.statusText;
+    return await response.json();
   } catch {
-    return response.statusText;
+    return null;
   }
 }
 class AdminService {
@@ -459,7 +496,7 @@ class AdminService {
       ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {}
     });
     if (!response.ok)
-      throw new Error(await readErrorMessage(response));
+      throw new ApplicationRouteError(response, await readErrorBody(response));
     return await response.json();
   }
   /**
@@ -546,6 +583,53 @@ class AdminService {
       body: options
     });
   }
+  /**
+   * Lists client secrets for an application.
+   *
+   * @param applicationId - ID of the application to inspect
+   * @returns Secret metadata without plaintext values
+   */
+  async listApplicationSecrets(applicationId) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`);
+  }
+  /**
+   * Creates a client secret for an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param options - Optional secret display name
+   * @returns The created secret, including the plaintext value shown only once
+   */
+  async createApplicationSecret(applicationId, options = {}) {
+    return await this.requestApplicationRoute(`applications/${encodeURIComponent(applicationId)}/secrets`, {
+      method: "POST",
+      body: options
+    });
+  }
+  /**
+   * Deletes one client secret for an application.
+   *
+   * @param applicationId - ID of the application to update
+   * @param secretId - ID of the secret to delete
+   * @returns The deleted secret metadata
+   */
+  async deleteApplicationSecret(applicationId, secretId) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/secrets/${encodeURIComponent(secretId)}`,
+      { method: "DELETE" }
+    );
+  }
+  /**
+   * Retires an application's service-account identity.
+   *
+   * @param applicationId - ID of the application to update
+   * @returns The updated application
+   */
+  async retireApplicationServiceAccount(applicationId) {
+    return await this.requestApplicationRoute(
+      `applications/${encodeURIComponent(applicationId)}/service-account`,
+      { method: "DELETE" }
+    );
+  }
   /**
    * Lists all organizations, optionally with member and application previews
    * and totals when a preview size is requested.
@@ -1359,6 +1443,22 @@ class ApplicationService {
       throwDeviceGrantError(error);
     }
   }
+  /**
+   * Exchanges application client credentials for a service-account access token.
+   *
+   * The returned token is scoped to the requested organization and cannot be
+   * refreshed. Exchange the credentials again when a new token is needed.
+   *
+   * @param credentials - Application credentials and target organization
+   * @returns A short-lived access token with service-account and organization details
+   */
+  async exchangeClientCredentialsForToken(credentials) {
+    const response = await this.client.applications.exchangeClientCredentialsForToken(credentials);
+    if (!response.data) {
+      throw new Error("No data returned from the API", { cause: response.error });
+    }
+    return response.data;
+  }
   /**
    * Completes an authorization flow for a specific application.
    *
@@ -1472,14 +1572,10 @@ class OrganizationService {
     });
     return organization;
   }
-  /**
-   * Lists all organizations accessible to the current user.
-   *
-   * @returns An array of organizations
-   */
-  async listOrganizations() {
-    const organizations = await this.client.organization.list();
-    return organizations;
+  async listOrganizations(options = {}) {
+    return await this.client.organization.list({
+      query: options.include?.length ? { include: options.include.join(",") } : void 0
+    });
   }
   /**
    * Sets the active organization for the current user session.
@@ -2162,18 +2258,128 @@ class AuthClient {
   }
 }
 
-function isTokenExpired(token, expiresInMs) {
-  const payload = JSON.parse(atob(token.split(".")[1] ?? ""));
-  if (!payload.exp)
-    return false;
-  const nowInSeconds = Date.now() / 1e3;
-  const expirationTime = payload.exp;
-  if (expiresInMs !== void 0) {
-    const futureTimeInSeconds = nowInSeconds + expiresInMs / 1e3;
-    return futureTimeInSeconds >= expirationTime;
+const TOKEN_REFRESH_WINDOW_MS = 6e4;
+const DEFAULT_INITIAL_BACKOFF_MS = 100;
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_MAX_ORGANIZATIONS = 300;
+function validateMaxAttempts(maxAttempts) {
+  if (!Number.isInteger(maxAttempts) || maxAttempts < 1) {
+    throw new RangeError("maxAttempts must be a positive integer");
+  }
+}
+function validateInitialBackoff(initialBackoffMs) {
+  if (!Number.isFinite(initialBackoffMs) || initialBackoffMs < 0) {
+    throw new RangeError("initialBackoffMs must be a non-negative finite number");
+  }
+}
+function getErrorStatus(error) {
+  const candidates = [error];
+  const visited = /* @__PURE__ */ new Set();
+  while (candidates.length > 0) {
+    const candidate = candidates.shift();
+    if (!candidate || typeof candidate !== "object" || visited.has(candidate))
+      continue;
+    visited.add(candidate);
+    const errorCandidate = candidate;
+    if (typeof errorCandidate.status === "number")
+      return errorCandidate.status;
+    candidates.push(errorCandidate.cause, errorCandidate.error);
+  }
+  return void 0;
+}
+function isTransientError(error) {
+  const status = getErrorStatus(error);
+  return status === void 0 || status === 429 || status >= 500 && status < 600;
+}
+class ApplicationTokenStorage {
+  auth;
+  clientId;
+  clientSecret;
+  initialBackoffMs;
+  inFlight = /* @__PURE__ */ new Map();
+  maxAttempts;
+  maxOrganizations;
+  tokens = /* @__PURE__ */ new Map();
+  /** Creates an application token cache for one client-credentials identity. */
+  constructor({
+    authApiUrl,
+    clientId,
+    clientSecret,
+    initialBackoffMs = DEFAULT_INITIAL_BACKOFF_MS,
+    maxAttempts = DEFAULT_MAX_ATTEMPTS,
+    maxOrganizations = DEFAULT_MAX_ORGANIZATIONS
+  }) {
+    if (!Number.isInteger(maxOrganizations) || maxOrganizations < 1) {
+      throw new RangeError("maxOrganizations must be a positive integer");
+    }
+    validateMaxAttempts(maxAttempts);
+    validateInitialBackoff(initialBackoffMs);
+    this.auth = new AuthClient(authApiUrl);
+    this.clientId = clientId;
+    this.clientSecret = clientSecret;
+    this.initialBackoffMs = initialBackoffMs;
+    this.maxAttempts = maxAttempts;
+    this.maxOrganizations = maxOrganizations;
+  }
+  /** Returns a fresh access token scoped to the requested organization. */
+  async getToken(organizationId, {
+    initialBackoffMs = this.initialBackoffMs,
+    maxAttempts = this.maxAttempts
+  } = {}) {
+    validateMaxAttempts(maxAttempts);
+    validateInitialBackoff(initialBackoffMs);
+    const cachedToken = this.tokens.get(organizationId);
+    if (cachedToken && !isTokenExpired(cachedToken, TOKEN_REFRESH_WINDOW_MS)) {
+      this.tokens.delete(organizationId);
+      this.tokens.set(organizationId, cachedToken);
+      return cachedToken;
+    }
+    const pendingExchange = this.inFlight.get(organizationId);
+    if (pendingExchange) {
+      return await pendingExchange;
+    }
+    const exchange = this.exchangeTokenWithRetry(organizationId, maxAttempts, initialBackoffMs).then((token) => {
+      this.tokens.delete(organizationId);
+      this.tokens.set(organizationId, token);
+      if (this.tokens.size > this.maxOrganizations) {
+        const leastRecentlyUsedOrganization = this.tokens.keys().next().value;
+        if (leastRecentlyUsedOrganization !== void 0) {
+          this.tokens.delete(leastRecentlyUsedOrganization);
+        }
+      }
+      return token;
+    }).finally(() => this.inFlight.delete(organizationId));
+    this.inFlight.set(organizationId, exchange);
+    return await exchange;
+  }
+  async exchangeTokenWithRetry(organizationId, maxAttempts, initialBackoffMs) {
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      try {
+        return await this.exchangeToken(organizationId);
+      } catch (error) {
+        if (attempt === maxAttempts || !isTransientError(error))
+          throw error;
+        const exponentialDelay = initialBackoffMs * 2 ** (attempt - 1);
+        await this.wait(Math.random() * exponentialDelay);
+      }
+    }
+    throw new Error("Client credentials exchange exhausted without a result");
+  }
+  /** Performs the client-credentials exchange for one organization. */
+  async exchangeToken(organizationId) {
+    const { accessToken } = await this.auth.application.exchangeClientCredentialsForToken({
+      clientId: this.clientId,
+      clientSecret: this.clientSecret,
+      organizationId
+    });
+    return accessToken;
+  }
+  /** Waits before the next exchange attempt. */
+  async wait(delayMs) {
+    await new Promise((resolve) => setTimeout(resolve, delayMs));
   }
-  return nowInSeconds > expirationTime;
 }
+
 async function validateToken(token, apiUrl) {
   if (isTokenExpired(token)) {
     return false;
@@ -2195,4 +2401,4 @@ function extractTokenPayload(token) {
   return payload;
 }
 
-export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };
+export { AAL, AALBrand, AALs, ACR, ACRBrand, ACRs, AMR, AMRBrand, AMRs, ApiKeyMetadata, ApplicationConfig, ApplicationError, ApplicationSessionAssuranceConfig, ApplicationSessionAssuranceError, ApplicationTokenStorage, AuthClient, AuthMethod, AuthMethodBrand, AuthMethods, AuthorizationFlowError, DEFAULT_APPLICATION_CONFIG, DEFAULT_JWT_ASSURANCE, DEFAULT_SESSION_ASSURANCE_CONFIG, DeviceAccessDeniedError, DeviceAuthorizationPendingError, DeviceAuthorizationSlowDownError, DeviceCodeExpiredError, DeviceTransientServerError, EmailOTPService, EmailRequired, InvalidCallbackURL, InvalidSocialProvider, JWTPayload, JWTPayloadAssurance, JWTPayloadUser, JWTPayloadWorkspace, OAuthStepUpProvider, RefreshTokenExpiredError, Roles, SENSITIVE_ACTION_ASSURANCE_POLICY, STEP_UP_MAX_AGE_SECONDS, SessionAssurancePolicy, SessionAssuranceRequiredError, SessionAssuranceRequiredPayload, SessionAssuranceService, StepUpOption, UserNotLoggedInError, ac, assuranceFields, canStepUpWithAmr, extractTokenPayload, getAalRank, invitationAdditionalFields, isAssuranceSufficientForPolicy, isSessionAssuranceSufficient, isTokenExpired, memberAdditionalFields, mergeStepUpAssurance, organizationAdditionalFields, parseSessionAssuranceRequiredPayload, rolesAccessControl, sessionAssurancePluginClient, userAdditionalFields, validateToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meistrari/auth-core",
-  "version": "1.35.0",
+  "version": "1.37.0",
   "type": "module",
   "exports": {
     ".": {