@metaboliccode-dev/widget 0.2.87 → 0.2.88

package/README.md

@@ -37,6 +37,35 @@ npm install @metaboliccode-dev/widget
 
 ## Component usage
 
+New integrations obtain dashboard tokens on their server using OAuth credentials
+registered for their tenant and environment:
+
+```ts
+import { createMetabolicOAuthClient } from "@metaboliccode-dev/widget/server";
+
+const oauth = createMetabolicOAuthClient({
+  baseUrl: process.env.METABOLIC_CODE_BACKEND_BASE_URL!,
+  clientId: process.env.METABOLIC_CODE_OAUTH_CLIENT_ID!,
+  clientSecret: process.env.METABOLIC_CODE_OAUTH_CLIENT_SECRET!,
+});
+
+// Validate the host user session and authorize these selectors before delegation.
+const { accessToken, expiresIn } = await oauth.getDelegatedToken({
+  sub: authorizedUserId,
+  role: "patient",
+  patient_id: authorizedPatientId,
+  report_id: authorizedReportId,
+  scope: "reports:read patient:read",
+});
+```
+
+Pass only the delegated token to the dashboard. Client secrets and service tokens
+must stay on the server. The helper caches service tokens and renews them before
+expiry; delegated tokens expire after 300 seconds. Hosts request a fresh delegated
+token when opening or renewing a dashboard session. OAuth failures never fall back
+to legacy signing. Existing HS256 dashboard tokens and embed integrations remain
+supported during migration.
+
 ```tsx
 import { MetabolicDashboard } from "@metaboliccode-dev/widget";
 import "@metaboliccode-dev/widget/styles.css";

package/dist/entry-server.d.ts

@@ -0,0 +1,58 @@
+export interface MetabolicOAuthClientOptions {
+    baseUrl: string;
+    clientId: string;
+    clientSecret: string;
+    fetch?: typeof globalThis.fetch;
+}
+export interface MetabolicAccessToken {
+    accessToken: string;
+    expiresIn: number;
+    expiresAt: number;
+    scope: string;
+}
+export interface MetabolicDelegatedIdentity {
+    sub: string;
+    role: string;
+    scope: string;
+    name?: string;
+    patient_id?: string;
+    report_id?: string;
+    questionnaire_response_id?: string;
+    white_label_domain?: string;
+    firebase_project_id?: string;
+    actor?: {
+        uid: string;
+        email?: string;
+        emailVerified?: boolean;
+        role?: string;
+        impersonatedBy?: {
+            uid: string;
+            email?: string;
+            role?: string;
+        };
+    };
+}
+export interface MetabolicEmbedLaunch {
+    subject: string;
+    role: string;
+    origin: string;
+    scope: string;
+    name?: string;
+    patient_id?: string;
+    report_id?: string;
+    questionnaire_response_id?: string;
+}
+export declare class MetabolicOAuthError extends Error {
+    readonly status: number;
+    readonly operation: string;
+    constructor(status: number, operation: string);
+}
+/** Server-only client. Never put its credentials or service tokens in browser props. */
+export declare function createMetabolicOAuthClient(options: MetabolicOAuthClientOptions): {
+    getAccessToken: (scopes: readonly string[]) => Promise<MetabolicAccessToken>;
+    getDelegatedToken: (identity: MetabolicDelegatedIdentity) => Promise<MetabolicAccessToken>;
+    createEmbedLaunch: (identity: MetabolicEmbedLaunch) => Promise<{
+        embedToken: string;
+        expiresIn: number;
+    }>;
+};

package/dist/entry-server.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server.js

@@ -0,0 +1,98 @@
+class l extends Error {
+  constructor(n, s) {
+    super(`Metabolic Code ${s} failed with HTTP ${n}.`), this.status = n, this.operation = s, this.name = "MetabolicOAuthError";
+  }
+}
+function A(e) {
+  if (typeof window < "u")
+    throw new Error("The Metabolic Code OAuth client must run on a server.");
+  const n = y(e.baseUrl);
+  if (!e.clientId || !e.clientSecret)
+    throw new Error("Metabolic Code OAuth client credentials are required.");
+  const s = e.fetch ?? globalThis.fetch, d = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map();
+  async function g(o) {
+    const t = Date.now(), r = btoa(
+      `${encodeURIComponent(e.clientId)}:${encodeURIComponent(e.clientSecret)}`
+    ), i = await s(`${n}/oauth/token`, {
+      method: "POST",
+      headers: {
+        Authorization: `Basic ${r}`,
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams({ grant_type: "client_credentials", scope: o }),
+      cache: "no-store",
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!i.ok) throw new l(i.status, "token issuance");
+    return w(await i.json(), t);
+  }
+  async function u(o) {
+    const t = [...new Set(o)].sort().join(" ");
+    if (!t) throw new Error("At least one Metabolic Code OAuth scope is required.");
+    const r = d.get(t);
+    if (r && r.expiresAt > Date.now() + 3e4) return r;
+    const i = a.get(t);
+    if (i) return i;
+    const c = g(t).then((p) => (d.set(t, p), p)).finally(() => a.delete(t));
+    return a.set(t, c), c;
+  }
+  async function h(o, t, r) {
+    const i = await u([t]), c = await s(`${n}${o}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${i.accessToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(r),
+      cache: "no-store",
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!c.ok) throw new l(c.status, "delegated authorization");
+    return c.json();
+  }
+  async function k(o) {
+    const t = Date.now(), r = await h(
+      "/api/v1/auth/delegated_tokens",
+      "tokens:delegate",
+      o
+    );
+    return w(r, t);
+  }
+  async function m(o) {
+    const t = await h("/api/v1/embed/launches", "embed:launch", {
+      embed: o
+    });
+    if (!f(t) || typeof t.embed_token != "string" || !b(t.expires_in))
+      throw new Error("Metabolic Code returned an invalid embed launch.");
+    return { embedToken: t.embed_token, expiresIn: t.expires_in };
+  }
+  return { getAccessToken: u, getDelegatedToken: k, createEmbedLaunch: m };
+}
+function y(e) {
+  const n = new URL(e), s = ["localhost", "127.0.0.1", "[::1]"].includes(n.hostname);
+  if (n.protocol !== "https:" && !(n.protocol === "http:" && s) || n.username || n.password || n.search || n.hash || n.pathname !== "/")
+    throw new Error("Metabolic Code OAuth requires an HTTPS origin or loopback HTTP origin.");
+  return n.origin;
+}
+function f(e) {
+  return typeof e == "object" && e !== null;
+}
+function b(e) {
+  return typeof e == "number" && Number.isInteger(e) && e > 0 && e <= 300;
+}
+function w(e, n) {
+  if (!f(e) || typeof e.access_token != "string" || !e.access_token || e.token_type !== "Bearer" || !b(e.expires_in) || typeof e.scope != "string")
+    throw new Error("Metabolic Code returned an invalid OAuth token response.");
+  return {
+    accessToken: e.access_token,
+    expiresIn: e.expires_in,
+    expiresAt: n + e.expires_in * 1e3,
+    scope: e.scope
+  };
+}
+export {
+  l as MetabolicOAuthError,
+  A as createMetabolicOAuthClient
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaboliccode-dev/widget",
-  "version": "0.2.87",
+  "version": "0.2.88",
   "type": "module",
   "files": [
     "dist",
@@ -21,6 +21,11 @@
       "import": "./dist/api.js",
       "default": "./dist/api.js"
     },
+    "./server": {
+      "types": "./dist/entry-server.d.ts",
+      "import": "./dist/server.js",
+      "default": "./dist/server.js"
+    },
     "./ag-charts": {
       "types": "./dist/entry-ag-charts.d.ts",
       "import": "./dist/ag-charts.js",