@nuvlore/extension-access-okta-slack 0.1.1 → 0.1.2

package/vendor/extension-sso/src/oktaAppAccess.mjs

@@ -1,133 +0,0 @@
-import { resolveBestCookieHost } from "./cookieJar.mjs";
-import { getExtensionReadAccess, extensionReadGet } from "./extensionAccess.mjs";
-import { ensureSsoSession, syncAllOktaCatalogCookies } from "./sessionManager.mjs";
-import { resolveAutoAuthOptions } from "./autoAuth.mjs";
-import { ensureOktaAppSession } from "./sessionAuth.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-import { getOktaApp, listOktaApps } from "./oktaAppCatalog.mjs";
-import { oktaAppHttpRead } from "./oktaAppRead.mjs";
-import { readServiceDefault } from "./serviceReads.mjs";
-import { probeReadOnlyUrl } from "./sessionValidate.mjs";
-
-export { probeReadOnlyUrl };
-
-export async function getOktaAppReadAccess(appName, options = {}) {
-  const app = getOktaApp(appName);
-  const readOnly = true;
-
-  if (app.serviceId && app.mode !== "cli-readonly") {
-    try {
-      const extensionAccess = await getExtensionReadAccess(app.serviceId, options);
-      return {
-        readOnly,
-        oktaApp: appName,
-        ...extensionAccess,
-        probePath: app.probePath,
-        defaultBaseUrl: app.defaultBaseUrl ?? extensionAccess.baseUrl
-      };
-    } catch {
-      // fall through to cookie probe
-    }
-  }
-
-  if (app.mode === "cli-readonly") {
-    return {
-      readOnly,
-      oktaApp: appName,
-      service: app.serviceId,
-      mode: "cli-readonly",
-      platform: app.platform,
-      ready: true,
-      recommendation: "Read-only CLI tools only — describe/list/get/logs."
-    };
-  }
-
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const { jar } = await ensureOktaAppSession(appName, { ...authOptions, config });
-  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
-  const probe = hasCookies
-    ? await probeReadOnlyUrl(jar, { host, path: app.probePath ?? "/", cookie, fetchImpl: options.fetchImpl })
-    : { ready: false, reason: "no_cookies" };
-
-  return {
-    readOnly,
-    methods: ["GET"],
-    oktaApp: appName,
-    service: app.serviceId,
-    mode: app.mode ?? "cookie-http",
-    baseUrl: app.defaultBaseUrl,
-    host,
-    hasCookies,
-    ready: Boolean(hasCookies && probe.ready),
-    probe,
-    cookiePresent: Boolean(cookie),
-    recommendation: probe.ready
-      ? `Read-only GET ${app.defaultBaseUrl}${app.probePath ?? "/"}`
-      : hasCookies
-        ? "Cookies present but session probe failed — open app in Chrome once."
-        : "Open app in Chrome via Okta, then retry."
-  };
-}
-
-export async function oktaAppReadGet(appName, input = {}, options = {}) {
-  const app = getOktaApp(appName);
-
-  if (app.serviceId && !input.forceCookie) {
-    try {
-      if (input.useDefault) {
-        return readServiceDefault(app.serviceId, options);
-      }
-      return await extensionReadGet(
-        app.serviceId,
-        {
-          restPath: input.restPath || app.probePath,
-          baseUrl: input.baseUrl || app.defaultBaseUrl,
-          query: input.query,
-          followRedirects: input.followRedirects
-        },
-        options
-      );
-    } catch (error) {
-      if (!input.allowCookieFallback) throw error;
-    }
-  }
-
-  return oktaAppHttpRead(appName, input, options);
-}
-
-export async function probeAllOktaApps(options = {}) {
-  const authOptions = resolveAutoAuthOptions(options);
-  if (!authOptions.probeOnly) {
-    await ensureSsoSession({
-      config: authOptions.config ?? getSsoConfig(),
-      openBrowserOnMissing: authOptions.openBrowserOnMissing,
-      forceBrowser: authOptions.forceBrowser === true,
-      onStatus: authOptions.onStatus
-    }).catch(() => {});
-  }
-  await syncAllOktaCatalogCookies(options);
-  const results = [];
-  for (const app of listOktaApps()) {
-    try {
-      const access = await getOktaAppReadAccess(app.name, { ...options, probeOnly: true });
-      results.push({
-        app: app.name,
-        service: app.serviceId,
-        mode: access.mode,
-        ready: access.ready === true,
-        host: access.host,
-        status: access.probe?.status
-      });
-    } catch (error) {
-      results.push({
-        app: app.name,
-        ready: false,
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  return results;
-}
-
-export { listOktaApps };

package/vendor/extension-sso/src/oktaAppCatalog.mjs

@@ -1,118 +0,0 @@
-/**
- * All apps visible on https://workday.okta.com/app/UserHome
- * Read-only access only — probe paths are GET.
- */
-export const OKTA_USER_HOME_APPS = {
-  Workday: {
-    serviceId: "sso",
-    domains: ["workday.okta.com"],
-    defaultBaseUrl: "https://workday.okta.com",
-    probePath: "/app/UserHome"
-  },
-  JIRA2: { serviceId: "jira", domains: ["jira2.workday.com"], defaultBaseUrl: "https://jira2.workday.com", probePath: "/rest/api/latest/myself" },
-  Bitbucket: { serviceId: "bitbucket", domains: ["bitbucket.workday.com"], defaultBaseUrl: "https://bitbucket.workday.com", probePath: "/" },
-  Confluence: { serviceId: "confluence", domains: ["confluence.workday.com"], defaultBaseUrl: "https://confluence.workday.com", probePath: "/rest/api/user/current" },
-  Pharos: { serviceId: "pharos", domains: ["grafana.produs.us.wdpharos.io"], defaultBaseUrl: "https://grafana.produs.us.wdpharos.io", probePath: "/login" },
-  "GitHub EMU Cloud": { serviceId: "github", domains: ["ghe.megaleo.com"], defaultBaseUrl: "https://ghe.megaleo.com", probePath: "/" },
-  PagerDuty: { serviceId: "pagerduty", domains: ["workday.pagerduty.com"], defaultBaseUrl: "https://workday.pagerduty.com", probePath: "/" },
-  "Amazon Web Services - AWS": { serviceId: "workday-infra-access", platform: "aws", domains: ["signin.aws.amazon.com"], defaultBaseUrl: "https://signin.aws.amazon.com", probePath: "/", mode: "cli-readonly" },
-  Slack: {
-    domains: ["workday.enterprise.slack.com", "workday.slack.com", "workday-dev.slack.com", "slack.com", "app.slack.com"],
-    defaultBaseUrl: "https://workday.enterprise.slack.com",
-    probePath: "/"
-  },
-  Zoom: { domains: ["workday.zoom.us", "zoom.us", "us.telemetry.zoom.us"], defaultBaseUrl: "https://workday.zoom.us", probePath: "/" },
-  Horizon: { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
-  "On Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
-  "People & Purpose on Horizon": { domains: ["horizon.workdayinternal.com"], defaultBaseUrl: "https://horizon.workdayinternal.com", probePath: "/" },
-  "Workday Service Hub": { domains: ["workday.service-now.com"], defaultBaseUrl: "https://workday.service-now.com", probePath: "/" },
-  "Analytics Hub": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
-  "Internal Analytics": { domains: ["console.cloud.google.com"], defaultBaseUrl: "https://console.cloud.google.com", probePath: "/", mode: "cli-readonly" },
-  "Workday - Google Apps Drive": {
-    domains: ["drive.google.com", "accounts.google.com", "google.com"],
-    defaultBaseUrl: "https://drive.google.com",
-    probePath: "/drive/"
-  },
-  Sana: {
-    domains: ["workday.sana.ai", "sana.ai", "sanalabs.com"],
-    defaultBaseUrl: "https://workday.sana.ai",
-    agentsUrl: "https://sana.ai/tPNxyS5GyK1r",
-    agentsWorkspaceId: "tPNxyS5GyK1r",
-    probePath: "/",
-    launchViaUserHome: true
-  },
-  Peakon: { domains: ["workday.peakon.com", "peakon.com"], defaultBaseUrl: "https://workday.peakon.com", probePath: "/" },
-  "Workday Community": { domains: ["community.workday.com"], defaultBaseUrl: "https://community.workday.com", probePath: "/" },
-  Achievers: { domains: ["workday.achievers.com"], defaultBaseUrl: "https://workday.achievers.com", probePath: "/" },
-  Workboard: { domains: ["workboard.com"], defaultBaseUrl: "https://www.workboard.com", probePath: "/" },
-  "Eptura Office Space Tool & Desk Reservations": { domains: ["workday.iofficeconnect.com"], defaultBaseUrl: "https://workday.iofficeconnect.com", probePath: "/" },
-  Miro: { domains: ["miro.com", "www.miro.com"], defaultBaseUrl: "https://miro.com", probePath: "/app/dashboard/" },
-  OneTrust: { domains: ["app.onetrust.com"], defaultBaseUrl: "https://app.onetrust.com", probePath: "/" },
-  "Collibra Data Intelligence Platform": { domains: ["workday.collibra.com"], defaultBaseUrl: "https://workday.collibra.com", probePath: "/" },
-  Snyk: { domains: ["app.snyk.io"], defaultBaseUrl: "https://app.snyk.io", probePath: "/" },
-  Seismic: { domains: ["workday.seismic.com"], defaultBaseUrl: "https://workday.seismic.com", probePath: "/" },
-  Togglr: { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
-  "Togglr - Internal": { domains: ["togglr.io"], defaultBaseUrl: "https://togglr.io", probePath: "/" },
-  "Metrics Portal": { domains: ["metrics.workday.com"], defaultBaseUrl: "https://metrics.workday.com", probePath: "/" },
-  "Security Portal": { domains: ["security.workday.com"], defaultBaseUrl: "https://security.workday.com", probePath: "/" },
-  "Microsoft Office 365 Office Portal": { domains: ["office.com"], defaultBaseUrl: "https://www.office.com", probePath: "/" },
-  "Microsoft Outlook": { domains: ["outlook.office.com"], defaultBaseUrl: "https://outlook.office.com", probePath: "/" },
-  Mixpanel: { domains: ["mixpanel.com"], defaultBaseUrl: "https://mixpanel.com", probePath: "/" },
-  "Secure Code Warrior": { domains: ["securecodewarrior.com"], defaultBaseUrl: "https://portal.securecodewarrior.com", probePath: "/" },
-  "Proofpoint Security Education Platform": { domains: ["proofpoint.com"], defaultBaseUrl: "https://www.proofpoint.com", probePath: "/" },
-  "HackerRank For Work": { domains: ["hackerrank.com"], defaultBaseUrl: "https://www.hackerrank.com", probePath: "/" },
-  "Visitor Registration": { domains: ["envoy.com"], defaultBaseUrl: "https://envoy.com", probePath: "/" },
-  "Healthy Working": { domains: ["cardinus.com"], defaultBaseUrl: "https://www.cardinus.com", probePath: "/" },
-  Meetingselect: { domains: ["meetingselect.com"], defaultBaseUrl: "https://www.meetingselect.com", probePath: "/" },
-  EveryoneSocial: { domains: ["everyonesocial.com"], defaultBaseUrl: "https://everyonesocial.com", probePath: "/" },
-  Aperian: { domains: ["aperianglobal.com"], defaultBaseUrl: "https://www.aperianglobal.com", probePath: "/" },
-  "BT diagramming": { domains: ["lucid.co"], defaultBaseUrl: "https://lucid.co", probePath: "/" },
-  "Fragomen Nomadic": { domains: ["fragomen.com"], defaultBaseUrl: "https://www.fragomen.com", probePath: "/" },
-  "6120 Meeting Center Booking": { domains: ["briefingsource.com"], defaultBaseUrl: "https://www.briefingsource.com", probePath: "/" },
-  "WCP Dev Site": { domains: ["workday.com"], defaultBaseUrl: "https://developer.workday.com", probePath: "/" },
-  "Workday Procurement": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "Workday Travel Tool - US": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "Workday Policies": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "Workday Pattern Library": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
-  "Canvas Design System": { domains: ["workday.com"], defaultBaseUrl: "https://canvas.workday.com", probePath: "/" },
-  "Global Records Retention Schedule": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "Digital Event Library": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "Employee Event Registration": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  DevCon: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  WOAH: { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "VitalSource eBooks": { domains: ["vitalsource.com"], defaultBaseUrl: "https://www.vitalsource.com", probePath: "/" },
-  "P&T Planner": { domains: ["workday.com"], defaultBaseUrl: "https://www.workday.com", probePath: "/" },
-  "P&T Okta Password Check": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
-  "INF-IDM": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/" },
-  ISD: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  "SkyLab Portal": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  "Prod LDAP Password Tool": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  "PRM-Wallboard": { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  Osprey: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  ArcPrime: { domains: ["workday.okta.com"], defaultBaseUrl: "https://workday.okta.com", probePath: "/", mode: "oidc-app" },
-  "Google Gemini": { domains: ["gemini.google.com"], defaultBaseUrl: "https://gemini.google.com", probePath: "/", mode: "bookmark" },
-  NotebookLM: { domains: ["notebooklm.google.com"], defaultBaseUrl: "https://notebooklm.google.com", probePath: "/", mode: "bookmark" },
-  Lovable: { domains: ["lovable.dev"], defaultBaseUrl: "https://lovable.dev", probePath: "/", mode: "bookmark" }
-};
-
-export function listOktaApps() {
-  return Object.entries(OKTA_USER_HOME_APPS).map(([name, app]) => ({
-    name,
-    readOnly: true,
-    ...app,
-    mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http")
-  }));
-}
-
-export function getOktaApp(name) {
-  const app = OKTA_USER_HOME_APPS[name];
-  if (!app) {
-    throw new Error(`Unknown Okta app: ${name}`);
-  }
-  return { name, readOnly: true, ...app, mode: app.mode ?? (app.serviceId ? "extension" : "cookie-http") };
-}
-
-export function getOktaAppByServiceId(serviceId) {
-  const match = listOktaApps().find((app) => app.serviceId === serviceId);
-  return match ?? null;
-}

package/vendor/extension-sso/src/oktaAppRead.mjs

@@ -1,119 +0,0 @@
-import { buildRequestUrl, normalizeBaseUrl, parseResponseBody } from "@nuvlore/extension-read-only-toolkit/enterprise-api-read";
-import { assertReadOnlyHttpRequest } from "./extensionAccess.mjs";
-import { resolveBestCookieHost } from "./cookieJar.mjs";
-import { isAuthStatusResponse, resolveAutoAuthOptions, shouldRetryAuthAfterFailure } from "./autoAuth.mjs";
-import { ensureOktaAppSession } from "./sessionAuth.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-import { getOktaApp } from "./oktaAppCatalog.mjs";
-import { extractHtmlSession, extractEmbeddedJson } from "./htmlSessionExtract.mjs";
-
-/** Default read targets for Okta-only apps (GET, read-only). */
-export const OKTA_APP_READ_TARGETS = {
-  Slack: {
-    defaultPath: "/messages",
-    extract: "generic",
-    extraHeaders: { accept: "text/html,application/json" }
-  },
-  Zoom: { defaultPath: "/", extract: "generic" },
-  Horizon: { defaultPath: "/", extract: "generic" },
-  "Workday Service Hub": {
-    defaultPath: "/api/now/table/sys_user?sysparm_limit=1&sysparm_fields=user_name,name",
-    accept: "application/json"
-  },
-  "Workday - Google Apps Drive": { defaultPath: "/drive/home", extract: "generic" },
-  Sana: { defaultPath: "/", extract: "generic" },
-  Peakon: { defaultPath: "/", extract: "generic" },
-  Miro: { defaultPath: "/app/dashboard/", extract: "generic" },
-  "Microsoft Outlook": { defaultPath: "/mail/", extract: "generic" }
-};
-
-export async function oktaAppHttpRead(appName, input = {}, options = {}) {
-  assertReadOnlyHttpRequest({ method: "GET", path: input.restPath || "/" });
-  const app = getOktaApp(appName);
-  const target = OKTA_APP_READ_TARGETS[appName] ?? {};
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const session = await ensureOktaAppSession(appName, { ...authOptions, config });
-  const { jar } = session;
-  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, app.domains ?? []);
-  if (!hasCookies || !cookie) {
-    if (session.openedBrowser) {
-      throw new Error(
-        `Okta app "${appName}" auth incomplete. Finish login in Chrome (${session.authUrl}), then retry.`
-      );
-    }
-    throw new Error(
-      `No SSO cookies for Okta app "${appName}". Set WORKDAY_SSO_AUTO_AUTH=true or run workday_okta_login.`
-    );
-  }
-
-  const baseUrl = normalizeBaseUrl(input.baseUrl || app.defaultBaseUrl || `https://${host}`);
-  const restPath = String(input.restPath || target.defaultPath || app.probePath || "/").trim();
-  const url = buildRequestUrl(baseUrl, restPath, input.query);
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  const follow = input.followRedirects ?? target.followRedirects ?? true;
-
-  const response = await fetchImpl(url.toString(), {
-    method: "GET",
-    redirect: follow ? "follow" : "manual",
-    headers: {
-      accept: target.accept ?? input.accept ?? "application/json,text/html",
-      cookie,
-      "user-agent": `Mozilla/5.0 nuvlore/0.1 okta-${appName.replace(/\s+/g, "-").toLowerCase()}-read`,
-      ...(target.extraHeaders ?? {}),
-      ...(input.headers ?? {})
-    }
-  });
-
-  const text = await response.text();
-  const contentType = response.headers.get("content-type") || "";
-  const isJson = contentType.includes("json") || (text.trim().startsWith("{") || text.trim().startsWith("["));
-
-  let data = isJson ? parseResponseBody(text) : null;
-  let extracted = null;
-  if (!isJson || input.extractHtml) {
-    const extractKind = input.extract || target.extract || "generic";
-    extracted = extractHtmlSession(extractKind, text, { url: response.url || url.toString() });
-    if (target.embeddedJsonMarker) {
-      const embedded = extractEmbeddedJson(text, target.embeddedJsonMarker);
-      if (embedded) extracted = { ...extracted, embedded };
-    }
-  }
-
-  if (
-    !response.ok &&
-    !extracted?.authenticated &&
-    isAuthStatusResponse(response.status) &&
-    shouldRetryAuthAfterFailure({ status: response.status }, authOptions)
-  ) {
-    await ensureOktaAppSession(appName, {
-      ...authOptions,
-      config,
-      forceBrowser: true,
-      openBrowserOnMissing: true
-    });
-    return oktaAppHttpRead(appName, input, { ...authOptions, _retriedAuth: true });
-  }
-
-  if (!response.ok && !extracted?.authenticated) {
-    throw new Error(
-      `Okta app "${appName}" read failed (${response.status}) at ${restPath}. Open ${session.authUrl} in Chrome to refresh login.`
-    );
-  }
-
-  return {
-    readOnly: true,
-    method: "GET",
-    oktaApp: appName,
-    service: app.serviceId,
-    baseUrl,
-    host,
-    restPath,
-    url: (response.url || url).toString(),
-    status: response.status,
-    contentType,
-    data: data ?? (extracted ? undefined : text.slice(0, 4000)),
-    extracted,
-    bodyLength: text.length
-  };
-}

package/vendor/extension-sso/src/oktaConfig.mjs

@@ -1,12 +0,0 @@
-import { getSsoConfig } from "./ssoConfig.mjs";
-
-/** @deprecated Use getSsoConfig — kept for backward compatibility. */
-export function getOktaConfig(env = process.env) {
-  return getSsoConfig(env);
-}
-
-export function assertOktaConfig(config = getSsoConfig()) {
-  if (!config.domain) {
-    throw new Error("Missing WORKDAY_OKTA_DOMAIN. Copy .env.example to .env and set your Okta org domain.");
-  }
-}

package/vendor/extension-sso/src/oktaSession.mjs

@@ -1,32 +0,0 @@
-import {
-  buildCookieHeader,
-  isValidationFresh,
-  jarSummary,
-  loadCookieJar,
-  saveCookieJar
-} from "./cookieJar.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-
-/** @deprecated Use loadCookieJar — session is now a browser cookie jar. */
-export async function loadSession(sessionPath) {
-  const config = getSsoConfig();
-  return loadCookieJar(sessionPath ?? config.cookieJarPath);
-}
-
-/** @deprecated Use saveCookieJar */
-export async function saveSession(sessionPath, session) {
-  return saveCookieJar(sessionPath, session);
-}
-
-/** @deprecated Use jar validation via sessionManager */
-export function isSessionValid(jar, now = Date.now()) {
-  if (!jar?.cookies?.length) return false;
-  const config = getSsoConfig();
-  if (jar.authenticated && isValidationFresh(jar, config.validateTtlMs, now)) return true;
-  return Boolean(buildCookieHeader(jar.cookies, config.domain));
-}
-
-/** @deprecated Use jarSummary */
-export function sessionSummary(jar, config) {
-  return jarSummary(jar, config ?? getSsoConfig());
-}