@nuvlore/extension-access-okta-slack 0.1.1 → 0.1.2

package/vendor/extension-sso/src/sessionAuth.mjs

@@ -1,339 +0,0 @@
-import {
-  cookiesForHost,
-  jarSummary,
-  loadCookieJar,
-  mergeCookies,
-  resolveBestCookieHost,
-  saveCookieJar
-} from "./cookieJar.mjs";
-import { openBrowser, waitFor } from "./browserLogin.mjs";
-
-export { openBrowser };
-import {
-  isAutoAuthEnabled,
-  resolveAutoAuthOptions
-} from "./autoAuth.mjs";
-
-export { isAutoAuthEnabled, resolveAutoAuthOptions };
-import {
-  ensureSsoSession,
-  importCookiesFromChrome,
-  syncOktaAppCookies
-} from "./sessionManager.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-import { getServiceDomains, getWorkdayService } from "./serviceRegistry.mjs";
-import { getOktaApp } from "./oktaAppCatalog.mjs";
-import { validateOktaAppHost, validateServiceHost } from "./sessionValidate.mjs";
-
-function hasCookiesForDomains(jar, domains) {
-  if (!domains.length) return true;
-  return domains.some((domain) => cookiesForHost(jar?.cookies ?? [], domain).length > 0);
-}
-
-async function mergeImportedCookies(config, jar, domains) {
-  const imported = await importCookiesFromChrome(config, [config.domain, ...domains]);
-  if (!imported?.cookies?.length) return jar;
-  const next = {
-    ...(jar ?? {}),
-    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-    source: imported.source ?? "chrome"
-  };
-  await saveCookieJar(config.cookieJarPath, next);
-  return next;
-}
-
-export async function waitForChromeCookies(
-  config,
-  domains,
-  { timeoutMs, pollMs = 2000, onStatus, label } = {}
-) {
-  const deadline = Date.now() + (timeoutMs ?? config.loginTimeoutMs);
-  let jar = await loadCookieJar(config.cookieJarPath);
-  while (Date.now() < deadline) {
-    onStatus?.({ phase: "waiting_for_app_cookies", label, domains });
-    jar = await mergeImportedCookies(config, jar, domains);
-    if (hasCookiesForDomains(jar, domains)) {
-      return { jar, ready: true };
-    }
-    await waitFor(pollMs);
-  }
-  return { jar, ready: hasCookiesForDomains(jar, domains) };
-}
-
-async function openAuthPageAndWait(config, { authUrl, domains, label, options }) {
-  options.onStatus?.({ phase: "opening_auth", label, url: authUrl });
-  await openBrowser(authUrl, { chromeProfile: config.chromeProfile });
-  const waited = await waitForChromeCookies(config, domains, {
-    timeoutMs: options.appAuthTimeoutMs,
-    onStatus: options.onStatus,
-    label
-  });
-  return { jar: waited.jar, ready: waited.ready, openedBrowser: true };
-}
-
-export function resolveServiceAuthUrl(serviceId) {
-  const service = getWorkdayService(serviceId);
-  const domains = getServiceDomains(serviceId);
-  return service.readAccess?.authUrl || service.readAccess?.defaultBaseUrl || (domains[0] ? `https://${domains[0]}` : getSsoConfig().loginUrl);
-}
-
-export function resolveOktaAppAuthUrl(appName) {
-  const app = getOktaApp(appName);
-  if (app.mode === "bookmark" || app.mode === "oidc-app") {
-    return getSsoConfig().loginUrl;
-  }
-  return app.agentsUrl || app.defaultBaseUrl || getSsoConfig().loginUrl;
-}
-
-/** Open Chrome at the Okta app URL so the user can sign in (read-only). */
-export async function openOktaAppForAuth(appName, options = {}) {
-  const config = options.config ?? getSsoConfig();
-  const app = getOktaApp(appName);
-  const authUrl = resolveOktaAppAuthUrl(appName);
-  const domains = app.domains ?? [];
-  let openedBrowser = false;
-
-  if (app.launchViaUserHome && options.skipUserHome !== true) {
-    options.onStatus?.({
-      phase: "opening_okta_userhome",
-      oktaApp: appName,
-      url: config.loginUrl,
-      hint:
-        appName === "Sana"
-          ? 'On workday.sana.ai click "Continue with SSO" to finish login'
-          : `Click "${appName}" on UserHome if SSO does not auto-launch`
-    });
-    await openBrowser(config.loginUrl, { chromeProfile: config.chromeProfile });
-    openedBrowser = true;
-    if (options.userHomeDelayMs !== 0) {
-      await waitFor(options.userHomeDelayMs ?? 2500);
-    }
-  }
-
-  const result = await openAuthPageAndWait(config, {
-    authUrl,
-    domains: domains.length ? domains : [config.domain],
-    label: appName,
-    options
-  });
-  return { authUrl, userHomeUrl: app.launchViaUserHome ? config.loginUrl : undefined, openedBrowser: openedBrowser || result.openedBrowser, ...result };
-}
-
-/** Open Chrome at the Workday service URL so the user can sign in via Okta (read-only). */
-export async function openServiceForAuth(serviceId, options = {}) {
-  const config = options.config ?? getSsoConfig();
-  const domains = getServiceDomains(serviceId);
-  const authUrl = resolveServiceAuthUrl(serviceId);
-  const result = await openAuthPageAndWait(config, {
-    authUrl,
-    domains: domains.length ? domains : [config.domain],
-    label: serviceId,
-    options
-  });
-  let serviceReady = false;
-  for (const domain of domains) {
-    if (await validateServiceHost(result.jar, domain).catch(() => false)) {
-      serviceReady = true;
-      break;
-    }
-  }
-  return { authUrl, openedBrowser: true, ...result, ready: serviceReady, serviceReady };
-}
-
-export async function getServiceCookieHeader(serviceId, options = {}) {
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const session = await ensureServiceSession(serviceId, { ...authOptions, config });
-  const domains = getServiceDomains(serviceId);
-  const { host, cookie, hasCookies } = resolveBestCookieHost(session.jar, domains);
-
-  if (!host || !session.jar?.cookies?.length || !hasCookies) {
-    return {
-      ok: false,
-      summary: session.summary,
-      host,
-      domains,
-      serviceReady: session.serviceReady,
-      openedBrowser: session.openedBrowser,
-      authUrl: session.authUrl,
-      message: `No cookies for ${serviceId}. Open ${session.authUrl} in Chrome via Okta, then retry.`
-    };
-  }
-
-  const ready = session.summary.authenticated && Boolean(cookie) && session.serviceReady;
-  return {
-    ok: ready,
-    summary: session.summary,
-    host,
-    cookie,
-    domains,
-    serviceReady: session.serviceReady,
-    openedBrowser: session.openedBrowser,
-    authUrl: session.authUrl
-  };
-}
-
-export async function ensureServiceSession(serviceId, options = {}) {
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const { autoAuth, openBrowserOnMissing } = authOptions;
-  const domains = getServiceDomains(serviceId);
-  const authUrl = resolveServiceAuthUrl(serviceId);
-  let openedBrowser = false;
-
-  let { jar, summary, openedBrowser: oktaOpened } = await ensureSsoSession({
-    config,
-    serviceId,
-    openBrowserOnMissing,
-    forceBrowser: authOptions.forceBrowser === true,
-    onStatus: authOptions.onStatus
-  });
-  summary = summary ?? jarSummary(jar ?? {}, config);
-  openedBrowser = openedBrowser || oktaOpened;
-
-  jar = await mergeImportedCookies(config, jar, domains);
-  let hasServiceCookies = hasCookiesForDomains(jar, domains);
-  let serviceReady = false;
-  if (summary.authenticated && hasServiceCookies) {
-    for (const domain of domains) {
-      if (await validateServiceHost(jar, domain).catch(() => false)) {
-        serviceReady = true;
-        break;
-      }
-    }
-  }
-
-  const needsAuth =
-    openBrowserOnMissing && (!hasServiceCookies || (hasServiceCookies && !serviceReady));
-
-  if (needsAuth) {
-    authOptions.onStatus?.({ phase: "opening_service_auth", service: serviceId, url: authUrl });
-    const auth = await openAuthPageAndWait(config, {
-      authUrl,
-      domains,
-      label: serviceId,
-      options: authOptions
-    });
-    jar = auth.jar;
-    openedBrowser = openedBrowser || auth.openedBrowser;
-    hasServiceCookies = hasCookiesForDomains(jar, domains);
-    if (!auth.ready && !hasServiceCookies) {
-      throw new Error(
-        `Service ${serviceId} auth timed out. Complete login in Chrome at ${authUrl}, then retry.`
-      );
-    }
-    summary = jarSummary(jar, config);
-    serviceReady = false;
-    if (summary.authenticated) {
-      for (const domain of domains) {
-        if (await validateServiceHost(jar, domain).catch(() => false)) {
-          serviceReady = true;
-          break;
-        }
-      }
-    }
-  }
-
-  return {
-    jar,
-    summary,
-    openedBrowser,
-    serviceReady,
-    hasServiceCookies,
-    authUrl
-  };
-}
-
-export async function ensureOktaAppSession(appName, options = {}) {
-  const authOptions = resolveAutoAuthOptions(options);
-  const config = authOptions.config ?? getSsoConfig();
-  const { openBrowserOnMissing } = authOptions;
-  const app = getOktaApp(appName);
-  const domains = app.domains ?? [];
-  const authUrl = resolveOktaAppAuthUrl(appName);
-  let openedBrowser = false;
-
-  if (app.mode === "cli-readonly") {
-    const { jar, summary } = await ensureSsoSession({
-      config,
-      openBrowserOnMissing,
-      onStatus: authOptions.onStatus
-    });
-    return { jar, summary, openedBrowser: false, appReady: true, authUrl };
-  }
-
-  let { jar, summary, openedBrowser: oktaOpened } = await ensureSsoSession({
-    config,
-    openBrowserOnMissing,
-    forceBrowser: authOptions.forceBrowser === true,
-    onStatus: authOptions.onStatus
-  });
-  openedBrowser = openedBrowser || oktaOpened;
-
-  await syncOktaAppCookies(appName, { config });
-  jar = await loadCookieJar(config.cookieJarPath);
-  let hasAppCookies = hasCookiesForDomains(jar, domains);
-  let appValidated =
-    !domains.length ||
-    app.mode === "bookmark" ||
-    app.mode === "oidc-app" ||
-    (hasAppCookies && (await validateOktaAppHost(jar, app, authOptions.fetchImpl).catch(() => false)));
-
-  const needsAuth = openBrowserOnMissing && domains.length > 0 && (!hasAppCookies || !appValidated);
-
-  if (needsAuth) {
-    authOptions.onStatus?.({ phase: "opening_okta_app_auth", oktaApp: appName, url: authUrl });
-    const auth = app.launchViaUserHome
-      ? await openOktaAppForAuth(appName, { ...authOptions, config })
-      : await openAuthPageAndWait(config, {
-          authUrl,
-          domains,
-          label: appName,
-          options: authOptions
-        });
-    jar = auth.jar;
-    openedBrowser = openedBrowser || auth.openedBrowser;
-    hasAppCookies = hasCookiesForDomains(jar, domains);
-    appValidated = hasAppCookies && (await validateOktaAppHost(jar, app, authOptions.fetchImpl).catch(() => false));
-    if (!auth.ready && !hasAppCookies && app.mode !== "bookmark" && app.mode !== "oidc-app") {
-      throw new Error(
-        `Okta app "${appName}" auth timed out. Complete login in Chrome at ${authUrl}, then retry.`
-      );
-    }
-    summary = jarSummary(jar, config);
-  }
-
-  const appReady =
-    appValidated ||
-    app.mode === "bookmark" ||
-    app.mode === "oidc-app" ||
-    (domains.length === 0 && summary.authenticated);
-
-  return {
-    jar,
-    summary,
-    openedBrowser,
-    appReady,
-    hasAppCookies,
-    authUrl
-  };
-}
-
-export async function openAppsForAuth(appNames = [], options = {}) {
-  const config = options.config ?? getSsoConfig();
-  const opened = [];
-  await ensureSsoSession({
-    config,
-    openBrowserOnMissing: true,
-    forceBrowser: options.forceOkta === true,
-    onStatus: options.onStatus
-  });
-  for (const appName of appNames) {
-    const url = resolveOktaAppAuthUrl(appName);
-    options.onStatus?.({ phase: "opening_app", oktaApp: appName, url });
-    await openBrowser(url);
-    opened.push({ app: appName, url });
-    if (options.delayMs) await waitFor(options.delayMs);
-  }
-  return { opened, loginUrl: config.loginUrl };
-}

package/vendor/extension-sso/src/sessionManager.mjs

@@ -1,212 +0,0 @@
-import { existsSync, readdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import {
-  buildCookieHeader,
-  cookiesForHost,
-  resolveBestCookieHost,
-  isValidationFresh,
-  jarSummary,
-  loadCookieJar,
-  mergeCookies,
-  saveCookieJar
-} from "./cookieJar.mjs";
-import { hostPatternsForDomains, readChromeCookies, resolveChromeCookiesPath } from "./chromeCookies.mjs";
-import { openBrowser, waitFor } from "./browserLogin.mjs";
-import { validateOktaSession, validateServiceHost } from "./sessionValidate.mjs";
-import { getSsoConfig } from "./ssoConfig.mjs";
-import { getServiceDomains } from "./serviceRegistry.mjs";
-
-export async function importCookiesFromChrome(config = getSsoConfig(), domains = []) {
-  const patterns = hostPatternsForDomains([config.domain, ...domains]);
-  const cookiesPath = resolveChromeCookiesPath(config);
-  let cookies = await readChromeCookies(cookiesPath, patterns);
-  if (!cookies.length) {
-    cookies = await readChromeCookiesFromProfileFallbacks(config, patterns);
-  }
-  if (!cookies.length) return null;
-  return {
-    cookies,
-    authenticated: false,
-    source: "chrome"
-  };
-}
-
-async function readChromeCookiesFromProfileFallbacks(config, patterns) {
-  if (process.env.WORKDAY_CHROME_PROFILE_FALLBACK === "false") return [];
-  for (const cookiesPath of chromeCookieFallbackPaths(config)) {
-    const cookies = await readChromeCookies(cookiesPath, patterns);
-    if (cookies.length) return cookies;
-  }
-  return [];
-}
-
-export function chromeCookieFallbackPaths(config = getSsoConfig(), { readdir = readdirSync, exists = existsSync } = {}) {
-  const primary = config.chromeCookiesPath || resolveChromeCookiesPath(config);
-  const chromeRoot = dirname(dirname(primary));
-  let entries;
-  try {
-    entries = readdir(chromeRoot);
-  } catch {
-    return [];
-  }
-  return entries
-    .filter((entry) => entry === "Default" || /^Profile \d+$/u.test(entry))
-    .map((entry) => join(chromeRoot, entry, "Cookies"))
-    .filter((cookiesPath) => cookiesPath !== primary && exists(cookiesPath));
-}
-
-async function persistValidatedJar(config, jar) {
-  const authenticated = await validateOktaSession(jar, config);
-  const next = {
-    ...jar,
-    authenticated,
-    validatedAt: authenticated ? new Date().toISOString() : jar.validatedAt
-  };
-  await saveCookieJar(config.cookieJarPath, next);
-  return next;
-}
-
-function hasCookiesForDomains(jar, domains) {
-  if (!domains.length) return true;
-  return domains.some((domain) => cookiesForHost(jar?.cookies ?? [], domain).length > 0);
-}
-
-async function importAndMergeJar(config, jar, domains, { validate = true } = {}) {
-  const imported = await importCookiesFromChrome(config, [config.domain, ...domains]);
-  if (!imported) return jar;
-  const next = {
-    ...(jar ?? {}),
-    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-    source: imported.source
-  };
-  if (!validate) {
-    await saveCookieJar(config.cookieJarPath, next);
-    return next;
-  }
-  return persistValidatedJar(config, { ...next, authenticated: false });
-}
-
-export async function ensureSsoSession({
-  config = getSsoConfig(),
-  openBrowserOnMissing = false,
-  forceBrowser = false,
-  serviceId,
-  onStatus
-} = {}) {
-  let jar = await loadCookieJar(config.cookieJarPath);
-  const serviceDomains = serviceId ? getServiceDomains(serviceId) : [];
-  const needsServiceCookies = !hasCookiesForDomains(jar, serviceDomains);
-
-  if (
-    !forceBrowser &&
-    jar &&
-    isValidationFresh(jar, config.validateTtlMs) &&
-    jar.authenticated &&
-    !needsServiceCookies
-  ) {
-    return { jar, summary: jarSummary(jar, config), openedBrowser: false };
-  }
-
-  if (!forceBrowser && jar?.authenticated && needsServiceCookies) {
-    onStatus?.({ phase: "import_service_cookies" });
-    jar = await importAndMergeJar(config, jar, serviceDomains, { validate: false });
-    return { jar, summary: jarSummary(jar, config), openedBrowser: false };
-  }
-
-  if (!forceBrowser) {
-    onStatus?.({ phase: "import_from_chrome" });
-    const imported = await importCookiesFromChrome(config, [config.domain, ...serviceDomains]);
-    if (imported) {
-      jar = {
-        cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-        source: "chrome",
-        authenticated: false
-      };
-      jar = await persistValidatedJar(config, jar);
-      if (jar.authenticated) {
-        return { jar, summary: jarSummary(jar, config), openedBrowser: false };
-      }
-    }
-  }
-
-  if (!openBrowserOnMissing && !forceBrowser) {
-    return {
-      jar,
-      summary: jarSummary(jar, config),
-      openedBrowser: false
-    };
-  }
-
-  onStatus?.({ phase: "browser_opened", url: config.loginUrl });
-  await openBrowser(config.loginUrl, { chromeProfile: config.chromeProfile });
-
-  const deadline = Date.now() + config.loginTimeoutMs;
-  while (Date.now() < deadline) {
-    await waitFor(2000);
-    onStatus?.({ phase: "waiting_for_login" });
-    const imported = await importCookiesFromChrome(config, [config.domain, ...serviceDomains]);
-    if (!imported?.cookies?.length) continue;
-    jar = {
-      cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-      source: "chrome-browser-login",
-      authenticated: false
-    };
-    jar = await persistValidatedJar(config, jar);
-    if (jar.authenticated) {
-      return { jar, summary: jarSummary(jar, config), openedBrowser: true };
-    }
-  }
-
-  throw new Error(
-    `Okta browser login timed out after ${config.loginTimeoutMs}ms. Complete MFA in Chrome, then retry.`
-  );
-}
-
-export function getOktaCookieHeader(jar, config = getSsoConfig()) {
-  if (!jar?.cookies?.length) return "";
-  return buildCookieHeader(jar.cookies, config.domain);
-}
-
-export function getCookiesForService(jar, serviceId) {
-  const domains = getServiceDomains(serviceId);
-  const cookies = domains.flatMap((domain) => cookiesForHost(jar?.cookies ?? [], domain));
-  return { domains, cookies };
-}
-
-export async function syncOktaAppCookies(appName, options = {}) {
-  const { getOktaApp } = await import("./oktaAppCatalog.mjs");
-  const app = getOktaApp(appName);
-  const config = options.config ?? getSsoConfig();
-  const domains = [...new Set([config.domain, ...(app.domains ?? [])])];
-  const imported = await importCookiesFromChrome(config, domains);
-  if (!imported?.cookies?.length) return null;
-  const jar = await loadCookieJar(config.cookieJarPath);
-  const merged = {
-    ...(jar ?? {}),
-    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-    source: "chrome-okta-app-sync"
-  };
-  await saveCookieJar(config.cookieJarPath, merged);
-  return merged;
-}
-
-export async function syncAllOktaCatalogCookies(options = {}) {
-  const { OKTA_USER_HOME_APPS } = await import("./oktaAppCatalog.mjs");
-  const config = options.config ?? getSsoConfig();
-  const domains = new Set([config.domain]);
-  for (const app of Object.values(OKTA_USER_HOME_APPS)) {
-    for (const domain of app.domains ?? []) domains.add(domain);
-  }
-  const imported = await importCookiesFromChrome(config, [...domains]);
-  if (!imported?.cookies?.length) return null;
-  const jar = await loadCookieJar(config.cookieJarPath);
-  const merged = {
-    ...(jar ?? {}),
-    cookies: mergeCookies(jar?.cookies ?? [], imported.cookies),
-    source: "chrome-okta-catalog-sync"
-  };
-  await saveCookieJar(config.cookieJarPath, merged);
-  return merged;
-}
-
-export { jarSummary, loadCookieJar };

package/vendor/extension-sso/src/sessionValidate.mjs

@@ -1,74 +0,0 @@
-import { buildCookieHeader, resolveBestCookieHost } from "./cookieJar.mjs";
-
-export async function validateOktaSession(jar, config) {
-  if (!jar?.cookies?.length) return false;
-  const cookie = buildCookieHeader(jar.cookies, config.domain);
-  if (!cookie) return false;
-
-  const response = await fetch(config.loginUrl, {
-    method: "GET",
-    redirect: "manual",
-    headers: { cookie }
-  });
-
-  if (response.status === 200) return true;
-  const location = response.headers.get("location") || "";
-  if (response.status >= 300 && response.status < 400) {
-    return !/login|signin|authorize/i.test(location);
-  }
-  return false;
-}
-
-export async function probeReadOnlyUrl(
-  jar,
-  { host, path = "/", cookie, fetchImpl = globalThis.fetch } = {}
-) {
-  if (!host || !cookie) return { ready: false, status: 0, reason: "no_cookies" };
-  const response = await fetchImpl(`https://${host}${path}`, {
-    method: "GET",
-    redirect: "manual",
-    headers: { cookie, accept: "text/html,application/json" }
-  });
-  const location = response.headers.get("location") || "";
-  const loginRedirect = /login|signin|authorize|okta/i.test(location);
-  const contentType = response.headers.get("content-type") || undefined;
-  let loginPage = false;
-  if (response.status === 200 && /text\/html/i.test(contentType ?? "")) {
-    const htmlResponse = typeof response.clone === "function" ? response.clone() : response;
-    const html = typeof htmlResponse.text === "function" ? await htmlResponse.text().catch(() => "") : "";
-    loginPage = /<title[^>]*>\s*(?:log in|login|log into|sign in|signin)\b|data-testid=["']login|name=["']os_username/i.test(html);
-  }
-  return {
-    ready:
-      (response.status === 200 && !loginPage) ||
-      (response.status >= 300 && response.status < 400 && !loginRedirect),
-    status: response.status,
-    location: location || undefined,
-    contentType,
-    loginPage
-  };
-}
-
-export async function validateOktaAppHost(jar, app, fetchImpl = globalThis.fetch) {
-  const domains = app?.domains ?? [];
-  if (!domains.length) return true;
-  if (app.mode === "bookmark" || app.mode === "oidc-app" || app.mode === "cli-readonly") return true;
-  const { host, cookie, hasCookies } = resolveBestCookieHost(jar, domains);
-  if (!hasCookies || !cookie || !host) return false;
-  const probe = await probeReadOnlyUrl(jar, {
-    host,
-    path: app.probePath ?? "/",
-    cookie,
-    fetchImpl
-  });
-  return probe.ready;
-}
-
-export async function validateServiceHost(jar, host) {
-  if (!jar?.cookies?.length || !host) return false;
-  const cookie = buildCookieHeader(jar.cookies, host);
-  if (!cookie) return false;
-
-  const probe = await probeReadOnlyUrl(jar, { host, cookie });
-  return probe.ready;
-}

package/vendor/extension-sso/src/ssoConfig.mjs

@@ -1,31 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-export function getSsoConfig(env = process.env) {
-  const domain = env.WORKDAY_OKTA_DOMAIN?.trim() || "workday.okta.com";
-  const loginUrl = env.WORKDAY_OKTA_LOGIN_URL?.trim() || `https://${domain}/app/UserHome`;
-  const chromeProfileOverride = env.WORKDAY_CHROME_PROFILE?.trim();
-  const chromeProfile = chromeProfileOverride || "Default";
-  const validateTtlMs = Number(env.WORKDAY_SSO_VALIDATE_TTL_MS ?? 900_000);
-  const loginTimeoutMs = Number(env.WORKDAY_SSO_LOGIN_TIMEOUT_MS ?? 300_000);
-  const baseDir = join(homedir(), ".Nuvlore", "workday");
-
-  return {
-    domain,
-    loginUrl,
-    chromeProfile,
-    chromeProfileExplicit: Boolean(chromeProfileOverride),
-    validateTtlMs,
-    loginTimeoutMs,
-    cookieJarPath: join(baseDir, "cookie-jar.json"),
-    chromeCookiesPath: join(
-      homedir(),
-      "Library",
-      "Application Support",
-      "Google",
-      "Chrome",
-      chromeProfile,
-      "Cookies"
-    )
-  };
-}