@moxn/kb-migrate 0.4.28 → 0.4.30

package/dist/sources/onenote/onenote-auth.js

@@ -0,0 +1,136 @@
+/**
+ * MSAL wrapper for OneNote / Microsoft Graph OAuth.
+ *
+ * We use MSAL's ConfidentialClientApplication and let it handle:
+ *   - code-for-token exchange
+ *   - silent refresh via the stored token cache
+ *   - cache serialization
+ *
+ * The serialized cache JSON is what we persist (encrypted) in
+ * kb_integration_credentials. On each use we deserialize, call MSAL, and
+ * write back any updated cache.
+ */
+import { ConfidentialClientApplication, } from '@azure/msal-node';
+/**
+ * Scopes we request. Read-only for v1 (see plan §OAuth design).
+ * `User.Read` is needed only during the initial code exchange to populate
+ * the credential metadata (displayName, email) — after that MSAL doesn't
+ * need it to refresh the OneNote access token.
+ */
+export const ONENOTE_READ_SCOPES = [
+    'https://graph.microsoft.com/Notes.Read',
+    'https://graph.microsoft.com/User.Read',
+    'offline_access',
+];
+export const ONENOTE_GRAPH_SCOPE = ['https://graph.microsoft.com/Notes.Read'];
+function buildConfig(cfg, cacheBlob) {
+    return {
+        auth: {
+            clientId: cfg.clientId,
+            clientSecret: cfg.clientSecret,
+            authority: `https://login.microsoftonline.com/${cfg.tenant}`,
+        },
+        cache: cacheBlob
+            ? {
+                cachePlugin: {
+                    beforeCacheAccess: async (context) => {
+                        context.tokenCache.deserialize(cacheBlob);
+                    },
+                    afterCacheAccess: async () => {
+                        /* no-op; caller reads serialize() after the call */
+                    },
+                },
+            }
+            : undefined,
+    };
+}
+/**
+ * Exchange an authorization code (plus PKCE verifier) for tokens, and return
+ * an encrypted-cache-ready payload. Called once from the OAuth callback.
+ */
+export async function exchangeCodeForTokens(cfg, params) {
+    const cca = new ConfidentialClientApplication(buildConfig(cfg));
+    const result = await cca.acquireTokenByCode({
+        code: params.code,
+        redirectUri: cfg.redirectUri,
+        scopes: params.scopes ?? ONENOTE_READ_SCOPES,
+        codeVerifier: params.codeVerifier,
+    });
+    if (!result) {
+        throw new Error('MSAL returned no result from code exchange');
+    }
+    const cacheBlob = cca.getTokenCache().serialize();
+    const account = result.account;
+    if (!account) {
+        throw new Error('MSAL result missing account — cannot store credential');
+    }
+    return {
+        accessToken: result.accessToken,
+        cacheBlob,
+        accountId: account.homeAccountId,
+        userPrincipalName: account.username,
+        tenantId: account.tenantId,
+        displayName: account.name,
+        expiresOn: result.expiresOn?.toISOString(),
+    };
+}
+/**
+ * Silently acquire an access token using a persisted MSAL cache.
+ * Auto-refreshes if the access token is expired (needs offline_access in cache).
+ */
+export async function getAccessTokenSilent(cfg, params) {
+    const cca = new ConfidentialClientApplication(buildConfig(cfg, params.cacheBlob));
+    const cache = cca.getTokenCache();
+    const account = await cache.getAccountByHomeId(params.accountId);
+    if (!account) {
+        throw new Error(`No cached account for homeId ${params.accountId}. User must reconnect.`);
+    }
+    const result = await cca.acquireTokenSilent({
+        account,
+        scopes: params.scopes ?? ONENOTE_GRAPH_SCOPE,
+    });
+    if (!result) {
+        throw new Error('MSAL silent token acquisition returned no result');
+    }
+    const freshCache = cache.serialize();
+    const updatedCacheBlob = freshCache !== params.cacheBlob ? freshCache : null;
+    return {
+        accessToken: result.accessToken,
+        updatedCacheBlob,
+        expiresOn: result.expiresOn?.toISOString(),
+    };
+}
+/**
+ * Build the Microsoft authorize URL for the popup/redirect. Called from
+ * the "Connect OneNote" server action.
+ */
+export async function buildAuthorizeUrl(cfg, params) {
+    const cca = new ConfidentialClientApplication(buildConfig(cfg));
+    return cca.getAuthCodeUrl({
+        redirectUri: cfg.redirectUri,
+        scopes: params.scopes ?? ONENOTE_READ_SCOPES,
+        state: params.state,
+        codeChallenge: params.codeChallenge,
+        codeChallengeMethod: 'S256',
+        responseMode: 'query',
+    });
+}
+// ============================================
+// PKCE helpers (pure, no MSAL dependency)
+// ============================================
+import { createHash, randomBytes } from 'crypto';
+export function generatePkcePair() {
+    const verifier = base64UrlEncode(randomBytes(32));
+    const challenge = base64UrlEncode(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+export function generateOAuthState() {
+    return base64UrlEncode(randomBytes(32));
+}
+function base64UrlEncode(buf) {
+    return buf
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}

package/dist/sources/onenote/onenote-html.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Convert OneNote page HTML into Moxn SectionInput[].
+ *
+ * Contract:
+ *   - Input: a page's HTML body as returned by GET /me/onenote/pages/{id}/content
+ *     (with ?includeIDs=true, so each element has a stable data-id).
+ *   - Output: zero or more SectionInput. Content before the first <h2> lands
+ *     in an "Introduction" section; each <h2> starts a new section.
+ *
+ * This is the highest-risk part of the import — OneNote HTML is idiosyncratic
+ * (absolute positioning, data-tag semantics, citation footers). The function
+ * is pure: no network, no filesystem. It consumes an ImageResolver callback
+ * that the fan-out task wires to a Supabase-upload pipeline.
+ *
+ * Images: the converter does NOT fetch images. It calls `resolveMedia` for
+ * every <img>/<object> and expects back a storage key. The resolver is free
+ * to return null to indicate "skip this embed".
+ */
+import type { ConvertedOneNotePage } from './types.js';
+export type MediaKind = 'image' | 'file';
+export interface ResolvedMedia {
+    /** Supabase storage key, e.g. "kb/onenote/2026/abc.png" */
+    key: string;
+    mediaType: string;
+    /** Filename for attachments (not required for images). */
+    filename?: string;
+}
+export interface ResolveMediaContext {
+    kind: MediaKind;
+    /** `src` (for <img>) or `data` (for <object>) */
+    url: string;
+    /** Parsed MIME type from the element, if present */
+    declaredMimeType?: string;
+    /** Filename parsed from <object data-attachment="..."> */
+    declaredFilename?: string;
+    /** Alt text from <img alt="..."> */
+    alt?: string;
+}
+export type ResolveMediaFn = (ctx: ResolveMediaContext) => Promise<ResolvedMedia | null>;
+export interface ConvertOptions {
+    /**
+     * Strip OneNote's "Copied from ..." citation footer rather than rendering
+     * it. Default: render as a blockquote at section end.
+     */
+    dropCitations?: boolean;
+    /**
+     * Called for every image and object the converter encounters. Returns a
+     * storage key, or null to skip the embed entirely.
+     */
+    resolveMedia: ResolveMediaFn;
+    /** Optional page title override — overrides the page's own <title> / <h1>. */
+    titleOverride?: string;
+}
+export declare function convertOneNoteHtmlToSections(html: string, options: ConvertOptions): Promise<ConvertedOneNotePage>;