@naylence/runtime 0.3.5-test.910 → 0.3.5-test.911

package/dist/cjs/naylence/fame/node/admission/admission-profile-factory.js

@@ -11,6 +11,12 @@ const ENV_VAR_JWT_AUDIENCE = 'FAME_JWT_AUDIENCE';
 const ENV_VAR_ADMISSION_TOKEN_URL = 'FAME_ADMISSION_TOKEN_URL';
 const ENV_VAR_ADMISSION_CLIENT_ID = 'FAME_ADMISSION_CLIENT_ID';
 const ENV_VAR_ADMISSION_CLIENT_SECRET = 'FAME_ADMISSION_CLIENT_SECRET';
+const ENV_VAR_ADMISSION_AUTHORIZE_URL = 'FAME_ADMISSION_AUTHORIZE_URL';
+const ENV_VAR_ADMISSION_REDIRECT_URL = 'FAME_ADMISSION_REDIRECT_URL';
+const ENV_VAR_ADMISSION_LOGIN_HINT_PARAM = 'FAME_ADMISSION_LOGIN_HINT_PARAM';
+const ENV_VAR_ADMISSION_CODE_CHALLENGE_METHOD = 'FAME_ADMISSION_CODE_CHALLENGE_METHOD';
+const ENV_VAR_ADMISSION_CODE_VERIFIER_LENGTH = 'FAME_ADMISSION_CODE_VERIFIER_LENGTH';
+const ENV_VAR_ADMISSION_CLOCK_SKEW_SECONDS = 'FAME_ADMISSION_CLOCK_SKEW_SECONDS';
 const ENV_VAR_DIRECT_ADMISSION_URL = 'FAME_DIRECT_ADMISSION_URL';
 const ENV_VAR_DIRECT_INPAGE_CHANNEL = 'FAME_DIRECT_INPAGE_CHANNEL';
 const ENV_VAR_ADMISSION_SERVICE_URL = 'FAME_ADMISSION_SERVICE_URL';
@@ -19,10 +25,12 @@ const PROFILE_NAME_WELCOME = 'welcome';
 const PROFILE_NAME_DIRECT = 'direct';
 const PROFILE_NAME_DIRECT_HTTP = 'direct-http';
 const PROFILE_NAME_DIRECT_INPAGE = 'direct-inpage';
+const PROFILE_NAME_DIRECT_PKCE = 'direct-pkce';
 const PROFILE_NAME_OPEN = 'open';
 const PROFILE_NAME_NOOP = 'noop';
 const PROFILE_NAME_NONE = 'none';
 const PROFILE_NAME_DIRECT_INPAGE_ALIAS = 'direct_inpage';
+const PROFILE_NAME_DIRECT_PKCE_ALIAS = 'direct_pkce';
 function createOAuthTokenProviderConfig() {
     const tokenUrl = factory_1.Expressions.env(ENV_VAR_ADMISSION_TOKEN_URL);
     const clientId = factory_1.Expressions.env(ENV_VAR_ADMISSION_CLIENT_ID);
@@ -40,6 +48,38 @@ function createOAuthTokenProviderConfig() {
         audience,
     };
 }
+function createOAuthPkceTokenProviderConfig() {
+    const authorizeUrl = factory_1.Expressions.env(ENV_VAR_ADMISSION_AUTHORIZE_URL);
+    const tokenUrl = factory_1.Expressions.env(ENV_VAR_ADMISSION_TOKEN_URL);
+    const redirectUri = factory_1.Expressions.env(ENV_VAR_ADMISSION_REDIRECT_URL);
+    const clientId = factory_1.Expressions.env(ENV_VAR_ADMISSION_CLIENT_ID);
+    const loginHintParam = factory_1.Expressions.env(ENV_VAR_ADMISSION_LOGIN_HINT_PARAM, 'login_hint');
+    const audience = factory_1.Expressions.env(ENV_VAR_JWT_AUDIENCE);
+    const codeChallengeMethod = factory_1.Expressions.env(ENV_VAR_ADMISSION_CODE_CHALLENGE_METHOD, 'S256');
+    const codeVerifierLength = factory_1.Expressions.env(ENV_VAR_ADMISSION_CODE_VERIFIER_LENGTH, '64');
+    const clockSkewSeconds = factory_1.Expressions.env(ENV_VAR_ADMISSION_CLOCK_SKEW_SECONDS, '30');
+    return {
+        type: 'OAuth2PkceTokenProvider',
+        authorizeUrl,
+        authorize_url: authorizeUrl,
+        tokenUrl,
+        token_url: tokenUrl,
+        redirectUri,
+        redirect_uri: redirectUri,
+        clientId,
+        client_id: clientId,
+        loginHintParam,
+        login_hint_param: loginHintParam,
+        scopes: ['node.connect'],
+        audience,
+        codeChallengeMethod,
+        code_challenge_method: codeChallengeMethod,
+        codeVerifierLength,
+        code_verifier_length: codeVerifierLength,
+        clockSkewSeconds,
+        clock_skew_seconds: clockSkewSeconds,
+    };
+}
 const welcomeIsRoot = factory_1.Expressions.env(ENV_VAR_IS_ROOT, 'false');
 const welcomeTokenProvider = createOAuthTokenProviderConfig();
 const WELCOME_SERVICE_PROFILE = {
@@ -74,6 +114,25 @@ const DIRECT_PROFILE = {
     connection_grants: directGrants,
     connectionGrants: directGrants,
 };
+const directPkceTokenProvider = createOAuthPkceTokenProviderConfig();
+const directPkceGrant = {
+    type: 'WebSocketConnectionGrant',
+    purpose: grant_js_1.GRANT_PURPOSE_NODE_ATTACH,
+    url: factory_1.Expressions.env(ENV_VAR_DIRECT_ADMISSION_URL),
+    auth: {
+        type: 'WebSocketSubprotocolAuth',
+        token_provider: directPkceTokenProvider,
+        tokenProvider: directPkceTokenProvider,
+    },
+    ttl: 0,
+    durable: false,
+};
+const directPkceGrants = [directPkceGrant];
+const DIRECT_PKCE_PROFILE = {
+    type: 'DirectAdmissionClient',
+    connection_grants: directPkceGrants,
+    connectionGrants: directPkceGrants,
+};
 const directHttpTokenProvider = createOAuthTokenProviderConfig();
 const directHttpGrant = {
     type: 'HttpConnectionGrant',
@@ -142,6 +201,8 @@ const NOOP_PROFILE = {
 const PROFILE_MAP = {
     [PROFILE_NAME_WELCOME]: WELCOME_SERVICE_PROFILE,
     [PROFILE_NAME_DIRECT]: DIRECT_PROFILE,
+    [PROFILE_NAME_DIRECT_PKCE]: DIRECT_PKCE_PROFILE,
+    [PROFILE_NAME_DIRECT_PKCE_ALIAS]: DIRECT_PKCE_PROFILE,
     [PROFILE_NAME_DIRECT_HTTP]: DIRECT_HTTP_PROFILE,
     [PROFILE_NAME_DIRECT_INPAGE]: DIRECT_INPAGE_PROFILE,
     [PROFILE_NAME_DIRECT_INPAGE_ALIAS]: DIRECT_INPAGE_PROFILE,

package/dist/cjs/naylence/fame/security/auth/oauth2-pkce-token-provider-factory.js

@@ -0,0 +1,171 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2PkceTokenProviderFactory = exports.FACTORY_META = void 0;
+const credential_provider_factory_js_1 = require("../credential/credential-provider-factory.js");
+const secret_source_js_1 = require("../credential/secret-source.js");
+const lazy_import_js_1 = require("../../util/lazy-import.js");
+const token_provider_factory_js_1 = require("./token-provider-factory.js");
+let oauth2PkceTokenProviderModulePromise = null;
+async function getOAuth2PkceTokenProviderModule() {
+    if (!oauth2PkceTokenProviderModulePromise) {
+        oauth2PkceTokenProviderModulePromise = (0, lazy_import_js_1.safeImport)(() => Promise.resolve().then(() => __importStar(require('./oauth2-pkce-token-provider.js'))), 'oauth2-pkce-token-provider');
+    }
+    return oauth2PkceTokenProviderModulePromise;
+}
+function ensureNonEmptyString(value, field) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`OAuth2PkceTokenProvider ${field} must be a non-empty string`);
+    }
+    return value.trim();
+}
+function normalizeScopes(value) {
+    if (Array.isArray(value)) {
+        const scopes = value
+            .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+            .filter((scope) => scope.length > 0);
+        return scopes;
+    }
+    if (typeof value === 'string' && value.trim().length > 0) {
+        return value
+            .split(/[\s,]+/u)
+            .map((scope) => scope.trim())
+            .filter((scope) => scope.length > 0);
+    }
+    return [];
+}
+function normalizeConfig(config) {
+    if (!config) {
+        throw new Error('OAuth2PkceTokenProvider requires configuration');
+    }
+    const candidate = config;
+    const authorizeUrl = ensureNonEmptyString(candidate.authorizeUrl ?? candidate.authorize_url, 'authorizeUrl');
+    const tokenUrl = ensureNonEmptyString(candidate.tokenUrl ?? candidate.token_url, 'tokenUrl');
+    const redirectUri = ensureNonEmptyString(candidate.redirectUri ?? candidate.redirect_uri, 'redirectUri');
+    const clientId = ensureNonEmptyString(candidate.clientId ?? candidate.client_id, 'clientId');
+    const usernameSource = (candidate.username ??
+        candidate.username_source);
+    const clientSecretSource = (candidate.clientSecret ??
+        candidate.client_secret);
+    const scopes = normalizeScopes(candidate.scopes ?? candidate.scope);
+    const normalized = {
+        authorizeUrl,
+        tokenUrl,
+        redirectUri,
+        clientId,
+        scopes,
+    };
+    if (usernameSource) {
+        normalized.usernameConfig = (0, secret_source_js_1.normalizeSecretSource)(usernameSource);
+    }
+    if (clientSecretSource) {
+        normalized.clientSecretConfig = (0, secret_source_js_1.normalizeSecretSource)(clientSecretSource);
+    }
+    const audienceCandidate = candidate.audience ?? candidate.aud;
+    if (typeof audienceCandidate === 'string' && audienceCandidate.trim().length > 0) {
+        normalized.audience = audienceCandidate.trim();
+    }
+    const codeChallengeMethod = candidate.codeChallengeMethod ?? candidate.code_challenge_method;
+    if (typeof codeChallengeMethod === 'string' && codeChallengeMethod.trim().length > 0) {
+        normalized.codeChallengeMethod = codeChallengeMethod.trim();
+    }
+    const codeVerifierLength = candidate.codeVerifierLength ?? candidate.code_verifier_length;
+    if (typeof codeVerifierLength === 'number' && Number.isFinite(codeVerifierLength)) {
+        normalized.codeVerifierLength = codeVerifierLength;
+    }
+    const clockSkewSeconds = candidate.clockSkewSeconds ?? candidate.clock_skew_seconds;
+    if (typeof clockSkewSeconds === 'number' && Number.isFinite(clockSkewSeconds)) {
+        normalized.clockSkewSeconds = clockSkewSeconds;
+    }
+    const loginHintParam = candidate.loginHintParam ?? candidate.login_hint_param;
+    if (typeof loginHintParam === 'string' && loginHintParam.trim().length > 0) {
+        normalized.loginHintParam = loginHintParam.trim();
+    }
+    return normalized;
+}
+exports.FACTORY_META = {
+    base: token_provider_factory_js_1.TOKEN_PROVIDER_FACTORY_BASE_TYPE,
+    key: 'OAuth2PkceTokenProvider',
+};
+class OAuth2PkceTokenProviderFactory extends token_provider_factory_js_1.TokenProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'OAuth2PkceTokenProvider';
+    }
+    async create(config) {
+        const normalized = normalizeConfig(config);
+        const [usernameProvider, clientSecretProvider] = await Promise.all([
+            normalized.usernameConfig
+                ? credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.usernameConfig)
+                : Promise.resolve(undefined),
+            normalized.clientSecretConfig
+                ? credential_provider_factory_js_1.CredentialProviderFactory.createCredentialProvider(normalized.clientSecretConfig)
+                : Promise.resolve(undefined),
+        ]);
+        const options = {
+            authorizeUrl: normalized.authorizeUrl,
+            tokenUrl: normalized.tokenUrl,
+            redirectUri: normalized.redirectUri,
+            clientId: normalized.clientId,
+            scopes: normalized.scopes,
+        };
+        if (usernameProvider) {
+            options.usernameProvider = usernameProvider;
+        }
+        if (clientSecretProvider) {
+            options.clientSecretProvider = clientSecretProvider;
+        }
+        if (normalized.audience) {
+            options.audience = normalized.audience;
+        }
+        if (normalized.codeChallengeMethod) {
+            options.codeChallengeMethod = normalized.codeChallengeMethod
+                .toUpperCase();
+        }
+        if (normalized.codeVerifierLength) {
+            options.codeVerifierLength = normalized.codeVerifierLength;
+        }
+        if (normalized.clockSkewSeconds) {
+            options.clockSkewSeconds = normalized.clockSkewSeconds;
+        }
+        if (normalized.loginHintParam) {
+            options.loginHintParam = normalized.loginHintParam;
+        }
+        const { OAuth2PkceTokenProvider } = await getOAuth2PkceTokenProviderModule();
+        return new OAuth2PkceTokenProvider(options);
+    }
+}
+exports.OAuth2PkceTokenProviderFactory = OAuth2PkceTokenProviderFactory;
+exports.default = OAuth2PkceTokenProviderFactory;