@nuvlore/extension-access-jira 0.1.1 → 0.1.2

package/vendor/extension-sso/src/ssoHttpRead.mjs

@@ -1,292 +0,0 @@
-import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
-import { assertNonHtmlApiResponse } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-import { assertReadOnlyHttpRequest } from "./extensionAccess.mjs";
-import {
-  mergeCookies,
-  resolveBestCookieHost,
-  saveCookieJar
-} from "./cookieJar.mjs";
-import { importCookiesFromChrome } from "./sessionManager.mjs";
-import { resolveAutoAuthOptions, shouldRetryAuthAfterFailure } from "./autoAuth.mjs";
-import { ensureServiceSession } from "./sessionAuth.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-import { getServiceDomains, getWorkdayService } from "./serviceRegistry.mjs";
-import { extractHtmlSession } from "./htmlSessionExtract.mjs";
-
-/** Per-service HTTP hints for real browser-session API access (GET only). */
-export const SSO_HTTP_PROFILES = {
-  jira: {
-    apiPrefix: "/rest/api/latest",
-    extraHeaders: { "X-Atlassian-Token": "no-check" },
-    verifyPath: "/rest/api/latest/myself",
-    refererPath: "/secure/Dashboard.jspa"
-  },
-  bitbucket: {
-    apiPrefix: "/rest/api/1.0",
-    extraHeaders: { "X-Atlassian-Token": "no-check" },
-    verifyPath: "/rest/api/latest/projects",
-    verifyFollowRedirects: true
-  },
-  confluence: {
-    apiPrefix: "/rest/api",
-    extraHeaders: { "X-Atlassian-Token": "no-check" },
-    verifyPath: "/rest/api/user/current"
-  },
-  bamboo: {
-    apiPrefix: "/rest/api/latest",
-    extraHeaders: {},
-    verifyPath: "/rest/api/latest/info"
-  },
-  github: {
-    apiPrefix: "/api/v3",
-    extraHeaders: { Accept: "application/vnd.github+json" },
-    verifyPath: "/settings/profile",
-    verifyMode: "html",
-    verifyExtract: "github-profile"
-  },
-  teamcity: {
-    apiPrefix: "/app/rest",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/login.html",
-    verifyMode: "html",
-    verifyExtract: "generic"
-  },
-  pharos: {
-    apiPrefix: "/api",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/api/health"
-  },
-  dashboard: {
-    apiPrefix: "/s/readonly",
-    extraHeaders: {},
-    verifyPath: "/s/readonly/app/discover"
-  },
-  pagerduty: {
-    apiPrefix: "/api/v2",
-    extraHeaders: { Accept: "application/vnd.pagerduty+json;version=2" },
-    verifyPath: "/",
-    verifyMode: "html",
-    verifyExtract: "generic"
-  },
-  repository: {
-    apiPrefix: "/artifactory/api",
-    extraHeaders: {},
-    verifyPath: "/artifactory/api/system/ping"
-  },
-  slack: {
-    apiPrefix: "/",
-    extraHeaders: {},
-    verifyPath: "/",
-    verifyMode: "html",
-    verifyExtract: "generic",
-    verifyFollowRedirects: true
-  },
-  sana: {
-    apiPrefix: "/",
-    extraHeaders: {},
-    verifyPath: "/",
-    verifyMode: "html",
-    verifyExtract: "generic",
-    verifyFollowRedirects: true
-  },
-  "google-drive": {
-    apiPrefix: "/drive",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/drive/v3/about",
-    verifyBaseUrl: "https://www.googleapis.com",
-    verifyQuery: { fields: "user" }
-  },
-  "service-hub": {
-    apiPrefix: "/api/now",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/api/now/ui/user/current_user"
-  },
-  snyk: {
-    apiPrefix: "/",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/api/me"
-  },
-  collibra: {
-    apiPrefix: "/rest/2.0",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/rest/2.0/communities",
-    verifyQuery: { limit: 1 }
-  },
-  mixpanel: {
-    apiPrefix: "/",
-    extraHeaders: { Accept: "application/json" },
-    verifyPath: "/api/app/workspaces"
-  }
-};
-
-async function refreshServiceCookies(config, serviceId, options = {}) {
-  const domains = getServiceDomains(serviceId);
-  const imported = await importCookiesFromChrome(config, [config.domain, ...domains]);
-  if (!imported?.cookies?.length) return null;
-  const { jar } = await ensureServiceSession(serviceId, {
-    config,
-    openBrowserOnMissing: options.openBrowserOnMissing,
-    autoAuth: options.autoAuth,
-    onStatus: options.onStatus
-  });
-  const merged = {
-    ...(jar ?? {}),
-    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-    source: "chrome-sync"
-  };
-  await saveCookieJar(config.cookieJarPath, merged);
-  return merged;
-}
-
-async function ssoReadGetOnce(serviceId, input = {}, options = {}) {
-  const service = getWorkdayService(serviceId);
-  const profile = SSO_HTTP_PROFILES[serviceId] ?? {};
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const session = await ensureServiceSession(serviceId, { ...authOptions, config });
-  let jar = session.jar;
-  jar = (await refreshServiceCookies(config, serviceId, authOptions)) ?? jar;
-
-  const domains = getServiceDomains(serviceId);
-  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, domains);
-  if (!hasCookies || !cookie) {
-    throw new Error(
-      `No SSO cookies for ${service.label}. Open ${session.authUrl} in Chrome via Okta, then retry.`
-    );
-  }
-
-  const readAccess = service.readAccess ?? {};
-  const baseUrl = normalizeBaseUrl(input.baseUrl || readAccess.defaultBaseUrl || `https://${host}`);
-  const restPath = String(input.restPath || input.path || "").trim();
-  if (!restPath) throw new Error("restPath is required.");
-  const url = buildRequestUrl(baseUrl, restPath, input.query);
-  const fetchImpl = authOptions.fetchImpl ?? globalThis.fetch;
-
-  const response = await fetchImpl(url, {
-    method: "GET",
-    headers: {
-      accept: "application/json,text/html",
-      cookie,
-      "user-agent": `Mozilla/5.0 nuvlore/0.1 ${serviceId}-sso-read`,
-      ...(profile.refererPath ? { referer: `${baseUrl}${profile.refererPath}` } : {}),
-      ...(profile.extraHeaders ?? {}),
-      ...(input.headers ?? {})
-    },
-    redirect: input.followRedirects ? "follow" : "manual"
-  });
-
-  const text = await response.text();
-  if (!authOptions.allowHtml) {
-    assertNonHtmlApiResponse(service.label, text);
-  }
-  const data = parseResponseBody(text);
-  if (!response.ok && !authOptions.allowHtml) {
-    const error = new Error(`${service.label} SSO read failed (${response.status}) at ${restPath}`);
-    error.status = response.status;
-    throw error;
-  }
-
-  return {
-    readOnly: true,
-    method: "GET",
-    service: serviceId,
-    extension: service.extension,
-    baseUrl,
-    host,
-    restPath,
-    url: url.toString(),
-    status: response.status,
-    contentType: response.headers.get("content-type"),
-    data
-  };
-}
-
-export async function ssoReadGet(serviceId, input = {}, options = {}) {
-  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || input.path });
-  const authOptions = resolveAutoAuthOptions(options);
-  try {
-    return await ssoReadGetOnce(serviceId, input, authOptions);
-  } catch (error) {
-    if (!shouldRetryAuthAfterFailure(error, authOptions)) throw error;
-    await ensureServiceSession(serviceId, {
-      ...authOptions,
-      forceBrowser: true,
-      openBrowserOnMissing: true
-    });
-    return ssoReadGetOnce(serviceId, input, { ...authOptions, _retriedAuth: true });
-  }
-}
-
-export async function ssoReadHtml(
-  serviceId,
-  htmlPath,
-  { extract = "generic", followRedirects = false } = {},
-  options = {}
-) {
-  const result = await ssoReadGet(
-    serviceId,
-    { restPath: htmlPath, followRedirects },
-    { ...options, allowHtml: true }
-  );
-  const html = typeof result.data === "string" ? result.data : String(result.data ?? "");
-  const extracted = extractHtmlSession(extract, html, { url: result.url });
-  return {
-    ...result,
-    mode: "html-session",
-    extracted,
-    htmlLength: html.length
-  };
-}
-
-export async function verifySsoAccess(serviceId, options = {}) {
-  const profile = SSO_HTTP_PROFILES[serviceId];
-  const service = getWorkdayService(serviceId);
-  const verifyPath = options.restPath || profile?.verifyPath || service.readAccess?.restPathPrefix || "/";
-  const verifyBaseUrl = profile?.verifyBaseUrl;
-  try {
-    const result =
-      profile?.verifyMode === "html"
-        ? await ssoReadHtml(
-            serviceId,
-            verifyPath,
-            {
-              extract: profile.verifyExtract ?? "generic",
-              followRedirects: profile.verifyFollowRedirects ?? false
-            },
-            options
-          )
-        : await ssoReadGet(
-            serviceId,
-            { restPath: verifyPath, query: profile?.verifyQuery, ...(verifyBaseUrl ? { baseUrl: verifyBaseUrl } : {}) },
-            options
-          );
-    const preview =
-      result.extracted ??
-      (typeof result.data === "object" ? result.data : String(result.data ?? "").slice(0, 200));
-    const accessible =
-      profile?.verifyMode === "html" ? Boolean(result.extracted?.authenticated) : true;
-    return {
-      accessible,
-      readOnly: true,
-      service: serviceId,
-      extension: service.extension,
-      verifyPath,
-      mode: result.mode ?? "api",
-      status: result.status,
-      preview
-    };
-  } catch (error) {
-    return {
-      accessible: false,
-      readOnly: true,
-      service: serviceId,
-      extension: service.extension,
-      verifyPath,
-      error: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-
-export function listSsoHttpServices() {
-  return Object.keys(SSO_HTTP_PROFILES);
-}

package/vendor/extension-sso/tools/extension-access-tools.shared.mjs

@@ -1,16 +0,0 @@
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}

package/vendor/extension-sso/tools/okta-app-tools.shared.mjs

@@ -1,5 +0,0 @@
-import { getOktaAppReadAccess, listOktaApps, oktaAppReadGet, probeAllOktaApps } from "../src/oktaAppAccess.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}

package/vendor/extension-sso/tools/okta-tools.shared.mjs

@@ -1,18 +0,0 @@
-import { getSsoConfig } from "../src/ssoConfig.mjs";
-import {
-  ensureSsoSession,
-  getOktaCookieHeader,
-  jarSummary,
-  loadCookieJar
-} from "../src/sessionManager.mjs";
-import {
-  getServiceCookieHeader,
-  openOktaAppForAuth,
-  openServiceForAuth
-} from "../src/sessionAuth.mjs";
-import { getOktaApp } from "../src/oktaAppCatalog.mjs";
-import { getWorkdayService, listWorkdayServices } from "../src/serviceRegistry.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}

package/vendor/extension-sso/tools/workday_extension_read.mjs

@@ -1,51 +0,0 @@
-export const description = "Perform a read-only HTTP GET against a Workday extension API using SSO browser cookies. GET only — no POST/PUT/PATCH/DELETE.";
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_extension_read",
-    description:
-      "Perform a read-only HTTP GET against a Workday extension API using SSO browser cookies. GET only — no POST/PUT/PATCH/DELETE.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        service: { type: "string", description: "Service id, e.g. jira, bitbucket" },
-        restPath: { type: "string", description: "Relative REST path, e.g. /rest/api/latest/myself" },
-        baseUrl: { type: "string", description: "Optional override of the Workday default base URL" },
-        query: {
-          type: "object",
-          description: "Optional query string parameters",
-          additionalProperties: true
-        }
-      },
-      required: ["service", "restPath"]
-    },
-    meta: {
-      permissions: { rule: "ask" },
-      secret_provider: "keychain"
-    },
-    async handler(args) {
-      const result = await extensionReadGet(String(args.service).toLowerCase(), {
-        restPath: args.restPath,
-        baseUrl: args.baseUrl,
-        query: args.query
-      });
-      return textResult(JSON.stringify(result, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_extension_read_access.mjs

@@ -1,65 +0,0 @@
-export const description = "Read-only SSO access profile for an Nuvlore extension service (Cookie headers + base URL). Never returns write credentials.";
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_extension_read_access",
-    description:
-      "Read-only SSO access profile for an Nuvlore extension service (Cookie headers + base URL). Never returns write credentials.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        service: {
-          type: "string",
-          description: "Extension service id, e.g. jira, bitbucket, bamboo, bds"
-        },
-        extension: {
-          type: "string",
-          description: "Alternatively, npm package name e.g. @nuvlore/extension-jira"
-        }
-      }
-    },
-    meta: {
-      permissions: { rule: "allow" },
-      secret_provider: "keychain"
-    },
-    async handler(args = {}) {
-      const serviceId = args.service
-        ? String(args.service).toLowerCase()
-        : args.extension
-          ? getServiceByExtension(String(args.extension)).id
-          : "";
-      if (!serviceId) {
-        return textResult(
-          JSON.stringify(
-            {
-              ok: false,
-              readOnly: true,
-              message: "Provide service or extension.",
-              services: listExtensionReadAccess()
-            },
-            null,
-            2
-          )
-        );
-      }
-      const access = await getExtensionReadAccess(serviceId);
-      return textResult(JSON.stringify({ ok: access.ready !== false, ...access }, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_list_extension_access.mjs

@@ -1,39 +0,0 @@
-export const description = "List read-only SSO access modes for every registered Nuvlore extension.";
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_list_extension_access",
-    description: "List read-only SSO access modes for every registered Nuvlore extension.",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    async handler() {
-      return textResult(
-        JSON.stringify(
-          {
-            readOnly: true,
-            methods: ["GET"],
-            services: listExtensionReadAccess()
-          },
-          null,
-          2
-        )
-      );
-    }
-  };

package/vendor/extension-sso/tools/workday_list_okta_apps.mjs

@@ -1,18 +0,0 @@
-export const description = "List all Okta UserHome apps from workday.okta.com with read-only access metadata.";
-import { getOktaAppReadAccess, listOktaApps, oktaAppReadGet, probeAllOktaApps } from "../src/oktaAppAccess.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_list_okta_apps",
-    description: "List all Okta UserHome apps from workday.okta.com with read-only access metadata.",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    async handler() {
-      return textResult(JSON.stringify({ readOnly: true, apps: listOktaApps() }, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_list_service_operations.mjs

@@ -1,41 +0,0 @@
-export const description = "List concrete read-only service operations for Jira, Bitbucket, Confluence, Bamboo, GitHub, TeamCity, PagerDuty, Repository, Pharos, and Dashboard.";
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_list_service_operations",
-    description:
-      "List concrete read-only service operations for Jira, Bitbucket, Confluence, Bamboo, GitHub, TeamCity, PagerDuty, Repository, Pharos, and Dashboard.",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    annotations: { readOnlyHint: true, destructiveHint: false },
-    async handler() {
-      return textResult(
-        JSON.stringify(
-          {
-            readOnly: true,
-            methods: ["GET"],
-            services: listServiceOperations()
-          },
-          null,
-          2
-        )
-      );
-    }
-  };

package/vendor/extension-sso/tools/workday_list_service_read_search_capabilities.mjs

@@ -1,34 +0,0 @@
-export const description = "List read/default-read/search routes for every registered Workday service, including generated Okta app services.";
-import {
-  extensionReadGet,
-  getExtensionReadAccess,
-  listExtensionReadAccess
-} from "../src/extensionAccess.mjs";
-import { getServiceByExtension } from "../src/serviceRegistry.mjs";
-import { listServiceOperations, readServiceOperation } from "../src/serviceOperations.mjs";
-import {
-  listServiceReadSearchCapabilities,
-  readAnyService,
-  searchAnyService
-} from "../src/serviceReadSearch.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_list_service_read_search_capabilities",
-    description:
-      "List read/default-read/search routes for every registered Workday service, including generated Okta app services.",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    annotations: { readOnlyHint: true, destructiveHint: false },
-    async handler() {
-      return textResult(JSON.stringify({
-        readOnly: true,
-        services: listServiceReadSearchCapabilities()
-      }, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_list_services.mjs

@@ -1,31 +0,0 @@
-export const description = "List Workday services that share Okta SSO authentication.";
-import { getSsoConfig } from "../src/ssoConfig.mjs";
-import {
-  ensureSsoSession,
-  getOktaCookieHeader,
-  jarSummary,
-  loadCookieJar
-} from "../src/sessionManager.mjs";
-import {
-  getServiceCookieHeader,
-  openOktaAppForAuth,
-  openServiceForAuth
-} from "../src/sessionAuth.mjs";
-import { getOktaApp } from "../src/oktaAppCatalog.mjs";
-import { getWorkdayService, listWorkdayServices } from "../src/serviceRegistry.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_list_services",
-    description: "List Workday services that share Okta SSO authentication.",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    async handler() {
-      return textResult(JSON.stringify({ services: listWorkdayServices() }, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_okta_app_probe_all.mjs

@@ -1,24 +0,0 @@
-export const description = "Probe read-only readiness for every Okta UserHome app (GET only).";
-import { getOktaAppReadAccess, listOktaApps, oktaAppReadGet, probeAllOktaApps } from "../src/oktaAppAccess.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_okta_app_probe_all",
-    description: "Probe read-only readiness for every Okta UserHome app (GET only).",
-    inputSchema: { type: "object", properties: {} },
-    meta: { permissions: { rule: "allow" } },
-    async handler() {
-      const results = await probeAllOktaApps();
-      const summary = {
-        total: results.length,
-        ready: results.filter((r) => r.ready).length,
-        notReady: results.filter((r) => !r.ready).length
-      };
-      return textResult(JSON.stringify({ readOnly: true, summary, results }, null, 2));
-    }
-  };

package/vendor/extension-sso/tools/workday_okta_app_read.mjs

@@ -1,30 +0,0 @@
-export const description = "Read-only GET for an Okta UserHome app using browser cookies. GET only.";
-import { getOktaAppReadAccess, listOktaApps, oktaAppReadGet, probeAllOktaApps } from "../src/oktaAppAccess.mjs";
-
-function textResult(text) {
-  return { content: [{ type: "text", text }] };
-}
-
-
-
-export default {
-    name: "workday_okta_app_read",
-    description: "Read-only GET for an Okta UserHome app using browser cookies. GET only.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        app: { type: "string" },
-        restPath: { type: "string" },
-        allowCookieFallback: { type: "boolean", default: true }
-      },
-      required: ["app"]
-    },
-    meta: { permissions: { rule: "ask" } },
-    async handler(args) {
-      const result = await oktaAppReadGet(String(args.app), {
-        restPath: args.restPath,
-        allowCookieFallback: args.allowCookieFallback !== false
-      });
-      return textResult(JSON.stringify(result, null, 2));
-    }
-  };