@nuvlore/extension-access-bamboo 0.1.1

package/vendor/extension-sso/src/oktaAppCatalog.mjs

@@ -0,0 +1,118 @@
+/**
+ * All apps visible on https://workday.okta.com/app/UserHome
+ * Read-only access only — probe paths are GET.
+ */
+export const OKTA_USER_HOME_APPS = {
+  Workday: {
+    serviceId: "sso",
+    domains: ["workday.okta.com"],
+    defaultBaseUrl: "https://workday.okta.com",
+    probePath: "/app/UserHome"
+  },
+  JIRA2: { serviceId: "jira", domains: ["jira2.workday.com"], defaultBaseUrl: "https://jira2.workday.com", probePath: "/rest/api/latest/myself" },
+  Bitbucket: { serviceId: "bitbucket", domains: ["bitbucket.workday.com"], defaultBaseUrl: "https://bitbucket.workday.com", probePath: "/" },
+  Confluence: { serviceId: "confluence", domains: ["confluence.workday.com"], defaultBaseUrl: "https://confluence.workday.com", probePath: "/rest/api/user/current" },
+  Pharos: { serviceId: "pharos", domains: ["grafana.produs.us.wdpharos.io"], defaultBaseUrl: "https://grafana.produs.us.wdpharos.io", probePath: "/login" },
+  "GitHub EMU Cloud": { serviceId: "github", domains: ["ghe.megaleo.com"], defaultBaseUrl: "https://ghe.megaleo.com", probePath: "/" },
+  PagerDuty: { serviceId: "pagerduty", domains: ["workday.pagerduty.com"], defaultBaseUrl: "https://workday.pagerduty.com", probePath: "/" },
+  "Amazon Web Services - AWS": { serviceId: "workday-infra-access", platform: "aws", domains: ["signin.aws.amazon.com"], defaultBaseUrl: "https://signin.aws.amazon.com", probePath: "/", mode: "cli-readonly" },
+  Slack: {
+    domains: ["workday.enterprise.slack.com", "workday.slack.com", "workday-dev.slack.com", "slack.com", "app.slack.com"],
+    defaultBaseUrl: "https://workday.enterprise.slack.com",
+    probePath: "/"
+  },
+  Zoom: { domains: ["workday.zoom.us", "zoom.us", "us.telemetry.zoom.us"], defaultBaseUrl: "https://workday.zoom.us", probePath: "/" },
+  Horizon: { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "On Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "People & Purpose on Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
+  "Workday Service Hub": { domains: ["workday.service-now.com"], defaultBaseUrl: "https://workday.service-now.com", probePath: "/" },
+  "Analytics Hub": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Internal Analytics": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
+  "Workday - Google Apps Drive": {
+    domains: ["drive.google.com", "accounts.google.com", "google.com"],
+    defaultBaseUrl: "https://drive.google.com",
+    probePath: "/drive/"
+  },
+  Sana: {
+    domains: ["workday.sana.ai", "sana.ai", "sanalabs.com"],
+    defaultBaseUrl: "https://workday.sana.ai",
+    agentsUrl: "https://sana.ai/tPNxyS5GyK1r",
+    agentsWorkspaceId: "tPNxyS5GyK1r",
+    probePath: "/",
+    launchViaUserHome: true
+  },
+  Peakon: { domains: ["workday.peakon.com", "peakon.com"], defaultBaseUrl: "https://workday.peakon.com", probePath: "/" },
+  "Workday Community": { domains: ["community.workday.com"], defaultBaseUrl: "https://community.workday.com", probePath: "/" },
+  Achievers: { domains: ["workday.achievers.com"], defaultBaseUrl: "https://workday.achievers.com", probePath: "/" },
+  Workboard: { domains: ["workboard.com"], defaultBaseUrl: "https://www.workboard.com", probePath: "/" },
+  "Eptura Office Space Tool & Desk Reservations": { domains: ["workday.iofficeconnect.com"], defaultBaseUrl: "https://workday.iofficeconnect.com", probePath: "/" },
+  Miro: { domains: ["miro.com", "www.miro.com"], defaultBaseUrl: "https://miro.com", probePath: "/app/dashboard/" },
+  OneTrust: { domains: ["app.onetrust.com"], defaultBaseUrl: "https://app.onetrust.com", probePath: "/" },
+  "Collibra Data Intelligence Platform": { domains: ["workday.collibra.com"], defaultBaseUrl: "https://workday.collibra.com", probePath: "/" },
+  Snyk: { domains: ["app.snyk.io"], defaultBaseUrl: "https://app.snyk.io", probePath: "/" },
+  Seismic: { domains: ["workday.seismic.com"], defaultBaseUrl: "https://workday.seismic.com", probePath: "/" },
+  Togglr: { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Togglr - Internal": { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
+  "Metrics Portal": { domains: ["metrics.workday.com"], defaultBaseUrl: "https://metrics.workday.com", probePath: "/" },
+  "Security Portal": { domains: ["security.workday.com"], defaultBaseUrl: "https://security.workday.com", probePath: "/" },
+  "Microsoft Office 365 Office Portal": { domains: ["office.com"], defaultBaseUrl: "https://www.office.com", probePath: "/" },
+  "Microsoft Outlook": { domains: ["outlook.office.com"], defaultBaseUrl: "https://outlook.office.com", probePath: "/" },
+  Mixpanel: { domains: ["mixpanel.com"], defaultBaseUrl: "https://mixpanel.com", probePath: "/" },
+  "Secure Code Warrior": { domains: ["securecodewarrior.com"], defaultBaseUrl: "https://portal.securecodewarrior.com", probePath: "/" },
+  "Proofpoint Security Education Platform": { domains: ["proofpoint.com"], defaultBaseUrl: "https://www.proofpoint.com", probePath: "/" },
+  "HackerRank For Work": { domains: ["hackerrank.com"], defaultBaseUrl: "https://www.hackerrank.com", probePath: "/" },
+  "Visitor Registration": { domains: ["envoy.com"], defaultBaseUrl: "https://envoy.com", probePath: "/" },
+  "Healthy Working": { domains: ["cardinus.com"], defaultBaseUrl: "https://www.cardinus.com", probePath: "/" },
+  Meetingselect: { domains: ["meetingselect.com"], defaultBaseUrl: "https://www.meetingselect.com", probePath: "/" },
+  EveryoneSocial: { domains: ["everyonesocial.com"], defaultBaseUrl: "https://everyonesocial.com", probePath: "/" },
+  Aperian: { domains: ["aperianglobal.com"], defaultBaseUrl: "https://www.aperianglobal.com", probePath: "/" },
+  "BT diagramming": { domains: ["lucid.co"], defaultBaseUrl: "https://lucid.co", probePath: "/" },
+  "Fragomen Nomadic": { domains: ["fragomen.com"], defaultBaseUrl: "https://www.fragomen.com", probePath: "/" },
+  "6120 Meeting Center Booking": { domains: ["briefingsource.com"], defaultBaseUrl: "https://www.briefingsource.com", probePath: "/" },
+  "WCP Dev Site": { domains: ["workday.com"], defaultBaseUrl: "https://developer.workday.com", probePath: "/" },
+  "Workday Procurement": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Travel Tool - US": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Policies": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Workday Pattern Library": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Canvas Design System": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
+  "Global Records Retention Schedule": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Digital Event Library": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "Employee Event Registration": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  DevCon: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  WOAH: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "VitalSource eBooks": { domains: ["vitalsource.com"], defaultBaseUrl: "https://www.vitalsource.com", probePath: "/" },
+  "P&T Planner": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
+  "P&T Okta Password Check": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  "INF-IDM": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
+  ISD: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "SkyLab Portal": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Prod LDAP Password Tool": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "PRM-Wallboard": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  Osprey: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  ArcPrime: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
+  "Google Gemini": { domains: ["gemini.google.com"], defaultBaseUrl: "https://gemini.google.com", probePath: "/", mode: "bookmark" },
+  NotebookLM: { domains: ["notebooklm.google.com"], defaultBaseUrl: "https://notebooklm.google.com", probePath: "/", mode: "bookmark" },
+  Lovable: { domains: ["lovable.dev"], defaultBaseUrl: "https://lovable.dev", probePath: "/", mode: "bookmark" }
+};
+
+export function listOktaApps() {
+  return Object.entries(OKTA_USER_HOME_APPS).map(([name, app]) => ({
+    name,
+    readOnly: true,
+    ...app,
+    mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http")
+  }));
+}
+
+export function getOktaApp(name) {
+  const app = OKTA_USER_HOME_APPS[name];
+  if (!app) {
+    throw new Error(`Unknown Okta app: ${name}`);
+  }
+  return { name, readOnly: true, ...app, mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http") };
+}
+
+export function getOktaAppByServiceId(serviceId) {
+  const match = listOktaApps().find((app) => app.serviceId === serviceId);
+  return match ?? null;
+}

package/vendor/extension-sso/src/oktaAppRead.mjs

@@ -0,0 +1,119 @@
+import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
+import { assertReadOnlyHttpRequest } from "./extensionAccess.mjs";
+import { resolveBestCookieHost } from "./cookieJar.mjs";
+import { isAuthStatusResponse, resolveAutoAuthOptions, shouldRetryAuthAfterFailure } from "./autoAuth.mjs";
+import { ensureOktaAppSession } from "./sessionAuth.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+import { getOktaApp } from "./oktaAppCatalog.mjs";
+import { extractHtmlSession, extractEmbeddedJson } from "./htmlSessionExtract.mjs";
+
+/** Default read targets for Okta-only apps (GET, read-only). */
+export const OKTA_APP_READ_TARGETS = {
+  Slack: {
+    defaultPath: "/messages",
+    extract: "generic",
+    extraHeaders: { accept: "text/html,application/json" }
+  },
+  Zoom: { defaultPath: "/", extract: "generic" },
+  Horizon: { defaultPath: "/", extract: "generic" },
+  "Workday Service Hub": {
+    defaultPath: "/api/now/table/sys_user?sysparm_limit=1&sysparm_fields=user_name,name",
+    accept: "application/json"
+  },
+  "Workday - Google Apps Drive": { defaultPath: "/drive/home", extract: "generic" },
+  Sana: { defaultPath: "/", extract: "generic" },
+  Peakon: { defaultPath: "/", extract: "generic" },
+  Miro: { defaultPath: "/app/dashboard/", extract: "generic" },
+  "Microsoft Outlook": { defaultPath: "/mail/", extract: "generic" }
+};
+
+export async function oktaAppHttpRead(appName, input = {}, options = {}) {
+  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || "/" });
+  const app = getOktaApp(appName);
+  const target = OKTA_APP_READ_TARGETS[appName] ?? {};
+  const authOptions = resolveAutoAuthOptions(options);
+  const config = authOptions.config ?? getSsoConfig();
+  const session = await ensureOktaAppSession(appName, { ...authOptions, config });
+  const { jar } = session;
+  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
+  if (!hasCookies || !cookie) {
+    if (session.openedBrowser) {
+      throw new Error(
+        `Okta app "${appName}" auth incomplete. Finish login in Chrome (${session.authUrl}), then retry.`
+      );
+    }
+    throw new Error(
+      `No SSO cookies for Okta app "${appName}". Set WORKDAY_SSO_AUTO_AUTH=true or run workday_okta_login.`
+    );
+  }
+
+  const baseUrl = normalizeBaseUrl(input.baseUrl || app.defaultBaseUrl || `https://${host}`);
+  const restPath = String(input.restPath || target.defaultPath || app.probePath || "/").trim();
+  const url = buildRequestUrl(baseUrl, restPath, input.query);
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  const follow = input.followRedirects ?? target.followRedirects ?? true;
+
+  const response = await fetchImpl(url.toString(), {
+    method: "GET",
+    redirect: follow ? "follow" : "manual",
+    headers: {
+      accept: target.accept ?? input.accept ?? "application/json,text/html",
+      cookie,
+      "user-agent": `Mozilla/5.0 nuvlore/0.1 okta-${appName.replace(/\s+/g, "-").toLowerCase()}-read`,
+      ...(target.extraHeaders ?? {}),
+      ...(input.headers ?? {})
+    }
+  });
+
+  const text = await response.text();
+  const contentType = response.headers.get("content-type") || "";
+  const isJson = contentType.includes("json") || (text.trim().startsWith("{") || text.trim().startsWith("["));
+
+  let data = isJson ? parseResponseBody(text) : null;
+  let extracted = null;
+  if (!isJson || input.extractHtml) {
+    const extractKind = input.extract || target.extract || "generic";
+    extracted = extractHtmlSession(extractKind, text, { url: response.url || url.toString() });
+    if (target.embeddedJsonMarker) {
+      const embedded = extractEmbeddedJson(text, target.embeddedJsonMarker);
+      if (embedded) extracted = { ...extracted, embedded };
+    }
+  }
+
+  if (
+    !response.ok &&
+    !extracted?.authenticated &&
+    isAuthStatusResponse(response.status) &&
+    shouldRetryAuthAfterFailure({ status: response.status }, authOptions)
+  ) {
+    await ensureOktaAppSession(appName, {
+      ...authOptions,
+      config,
+      forceBrowser: true,
+      openBrowserOnMissing: true
+    });
+    return oktaAppHttpRead(appName, input, { ...authOptions, _retriedAuth: true });
+  }
+
+  if (!response.ok && !extracted?.authenticated) {
+    throw new Error(
+      `Okta app "${appName}" read failed (${response.status}) at ${restPath}. Open ${session.authUrl} in Chrome to refresh login.`
+    );
+  }
+
+  return {
+    readOnly: true,
+    method: "GET",
+    oktaApp: appName,
+    service: app.serviceId,
+    baseUrl,
+    host,
+    restPath,
+    url: (response.url || url).toString(),
+    status: response.status,
+    contentType,
+    data: data ?? (extracted ? undefined : text.slice(0, 4000)),
+    extracted,
+    bodyLength: text.length
+  };
+}

package/vendor/extension-sso/src/oktaConfig.mjs

@@ -0,0 +1,12 @@
+import { getSsoConfig } from "./ssoConfig.mjs";
+
+/** @deprecated Use getSsoConfig — kept for backward compatibility. */
+export function getOktaConfig(env = process.env) {
+  return getSsoConfig(env);
+}
+
+export function assertOktaConfig(config = getSsoConfig()) {
+  if (!config.domain) {
+    throw new Error("Missing WORKDAY_OKTA_DOMAIN. Copy .env.example to .env and set your Okta org domain.");
+  }
+}

package/vendor/extension-sso/src/oktaSession.mjs

@@ -0,0 +1,32 @@
+import {
+  buildCookieHeader,
+  isValidationFresh,
+  jarSummary,
+  loadCookieJar,
+  saveCookieJar
+} from "./cookieJar.mjs";
+import { getSsoConfig } from "./ssoConfig.mjs";
+
+/** @deprecated Use loadCookieJar — session is now a browser cookie jar. */
+export async function loadSession(sessionPath) {
+  const config = getSsoConfig();
+  return loadCookieJar(sessionPath ?? config.cookieJarPath);
+}
+
+/** @deprecated Use saveCookieJar */
+export async function saveSession(sessionPath, session) {
+  return saveCookieJar(sessionPath, session);
+}
+
+/** @deprecated Use jar validation via sessionManager */
+export function isSessionValid(jar, now = Date.now()) {
+  if (!jar?.cookies?.length) return false;
+  const config = getSsoConfig();
+  if (jar.authenticated && isValidationFresh(jar, config.validateTtlMs, now)) return true;
+  return Boolean(buildCookieHeader(jar.cookies, config.domain));
+}
+
+/** @deprecated Use jarSummary */
+export function sessionSummary(jar, config) {
+  return jarSummary(jar, config ?? getSsoConfig());
+}