@naylence/runtime 0.3.5-test.909 → 0.3.5-test.911

package/dist/cjs/naylence/fame/security/auth/oauth2-pkce-token-provider-factory.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2PkceTokenProviderFactory = exports.FACTORY_META = void 0;
+const credential_provider_factory_js_1 = require("../credential/credential-provider-factory.js");
+const secret_source_js_1 = require("../credential/secret-source.js");
+const lazy_import_js_1 = require("../../util/lazy-import.js");
+const token_provider_factory_js_1 = require("./token-provider-factory.js");
+let oauth2PkceTokenProviderModulePromise = null;
+async function getOAuth2PkceTokenProviderModule() {
+    if (!oauth2PkceTokenProviderModulePromise) {
+        oauth2PkceTokenProviderModulePromise = (0, lazy_import_js_1.safeImport)(() => Promise.resolve().then(() => __importStar(require('./oauth2-pkce-token-provider.js'))), 'oauth2-pkce-token-provider');
+    }
+    return oauth2PkceTokenProviderModulePromise;
+}
+function ensureNonEmptyString(value, field) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`OAuth2PkceTokenProvider ${field} must be a non-empty string`);
+    }
+    return value.trim();
+}
+function normalizeScopes(value) {
+    if (Array.isArray(value)) {
+        const scopes = value
+            .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+            .filter((scope) => scope.length > 0);
+        return scopes;
+    }
+    if (typeof value === 'string' && value.trim().length > 0) {
+        return value
+            .split(/[\s,]+/u)
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0);
+    }
+    return [];
+}
+function normalizeConfig(config) {
+    if (!config) {
+        throw new Error('OAuth2PkceTokenProvider requires configuration');
+    }
+    const candidate = config;
+    const authorizeUrl = ensureNonEmptyString(candidate.authorizeUrl ?? candidate.authorize_url, 'authorizeUrl');
+    const tokenUrl = ensureNonEmptyString(candidate.tokenUrl ?? candidate.token_url, 'tokenUrl');
+    const redirectUri = ensureNonEmptyString(candidate.redirectUri ?? candidate.redirect_uri, 'redirectUri');
+    const clientId = ensureNonEmptyString(candidate.clientId ?? candidate.client_id, 'clientId');
+    const usernameSource = (candidate.username ??
+        candidate.username_source);
+    const clientSecretSource = (candidate.clientSecret ??
+        candidate.client_secret);
+    const scopes = normalizeScopes(candidate.scopes ?? candidate.scope);
+    const normalized = {
+        authorizeUrl,
+        tokenUrl,
+        redirectUri,
+        clientId,
+        scopes,
+    };
+    if (usernameSource) {
+        normalized.usernameConfig = (0, secret_source_js_1.normalizeSecretSource)(usernameSource);
+    }
+    if (clientSecretSource) {
+        normalized.clientSecretConfig = (0, secret_source_js_1.normalizeSecretSource)(clientSecretSource);
+    }
+    const audienceCandidate = candidate.audience ?? candidate.aud;
+    if (typeof audienceCandidate === 'string' && audienceCandidate.trim().length > 0) {
+        normalized.audience = audienceCandidate.trim();
+    }
+    const codeChallengeMethod = candidate.codeChallengeMethod ?? candidate.code_challenge_method;
+    if (typeof codeChallengeMethod === 'string' && codeChallengeMethod.trim().length > 0) {
+        normalized.codeChallengeMethod = codeChallengeMethod.trim();
+    }
+    const codeVerifierLength = candidate.codeVerifierLength ?? candidate.code_verifier_length;
+    if (typeof codeVerifierLength === 'number' && Number.isFinite(codeVerifierLength)) {
+        normalized.codeVerifierLength = codeVerifierLength;
+    }
+    const clockSkewSeconds = candidate.clockSkewSeconds ?? candidate.clock_skew_seconds;
+    if (typeof clockSkewSeconds === 'number' && Number.isFinite(clockSkewSeconds)) {
+        normalized.clockSkewSeconds = clockSkewSeconds;
+    }
+    const loginHintParam = candidate.loginHintParam ?? candidate.login_hint_param;
+    if (typeof loginHintParam === 'string' && loginHintParam.trim().length > 0) {
+        normalized.loginHintParam = loginHintParam.trim();
+    }
+    return normalized;
+}
+exports.FACTORY_META = {
+    base: token_provider_factory_js_1.TOKEN_PROVIDER_FACTORY_BASE_TYPE,
+    key: 'OAuth2PkceTokenProvider',
+};
+class OAuth2PkceTokenProviderFactory extends token_provider_factory_js_1.TokenProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'OAuth2PkceTokenProvider';
+    }
+    async create(config) {
+        const normalized = normalizeConfig(config);
+        const [usernameProvider, clientSecretProvider] = await Promise.all([
+            normalized.usernameConfig
+                ? credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.usernameConfig)
+                : Promise.resolve(undefined),
+            normalized.clientSecretConfig
+                ? credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.clientSecretConfig)
+                : Promise.resolve(undefined),
+        ]);
+        const options = {
+            authorizeUrl: normalized.authorizeUrl,
+            tokenUrl: normalized.tokenUrl,
+            redirectUri: normalized.redirectUri,
+            clientId: normalized.clientId,
+            scopes: normalized.scopes,
+        };
+        if (usernameProvider) {
+            options.usernameProvider = usernameProvider;
+        }
+        if (clientSecretProvider) {
+            options.clientSecretProvider = clientSecretProvider;
+        }
+        if (normalized.audience) {
+            options.audience = normalized.audience;
+        }
+        if (normalized.codeChallengeMethod) {
+            options.codeChallengeMethod = normalized.codeChallengeMethod
+                .toUpperCase();
+        }
+        if (normalized.codeVerifierLength) {
+            options.codeVerifierLength = normalized.codeVerifierLength;
+        }
+        if (normalized.clockSkewSeconds) {
+            options.clockSkewSeconds = normalized.clockSkewSeconds;
+        }
+        if (normalized.loginHintParam) {
+            options.loginHintParam = normalized.loginHintParam;
+        }
+        const { OAuth2PkceTokenProvider } = await getOAuth2PkceTokenProviderModule();
+        return new OAuth2PkceTokenProvider(options);
+    }
+}
+exports.OAuth2PkceTokenProviderFactory = OAuth2PkceTokenProviderFactory;
+exports.default = OAuth2PkceTokenProviderFactory;