@openclaw/googlechat 2026.5.20-beta.2 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/jwtclient.js

@@ -0,0 +1,301 @@
+"use strict";
+// Copyright 2013 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWT = void 0;
+const googleToken_1 = require("../gtoken/googleToken");
+const getCredentials_1 = require("../gtoken/getCredentials");
+const jwtaccess_1 = require("./jwtaccess");
+const oauth2client_1 = require("./oauth2client");
+const authclient_1 = require("./authclient");
+class JWT extends oauth2client_1.OAuth2Client {
+    email;
+    keyFile;
+    key;
+    keyId;
+    defaultScopes;
+    scopes;
+    scope;
+    subject;
+    gtoken;
+    additionalClaims;
+    useJWTAccessWithScope;
+    defaultServicePath;
+    access;
+    /**
+     * JWT service account credentials.
+     *
+     * Retrieve access token using gtoken.
+     *
+     * @param options the
+     */
+    constructor(options = {}) {
+        super(options);
+        this.email = options.email;
+        this.keyFile = options.keyFile;
+        this.key = options.key;
+        this.keyId = options.keyId;
+        this.scopes = options.scopes;
+        this.subject = options.subject;
+        this.additionalClaims = options.additionalClaims;
+        // Start with an expired refresh token, which will automatically be
+        // refreshed before the first API call is made.
+        this.credentials = { refresh_token: 'jwt-placeholder', expiry_date: 1 };
+    }
+    /**
+     * Creates a copy of the credential with the specified scopes.
+     * @param scopes List of requested scopes or a single scope.
+     * @return The cloned instance.
+     */
+    createScoped(scopes) {
+        const jwt = new JWT(this);
+        jwt.scopes = scopes;
+        return jwt;
+    }
+    /**
+     * Obtains the metadata to be sent with the request.
+     *
+     * @param url the URI being authorized.
+     */
+    async getRequestMetadataAsync(url) {
+        url = this.defaultServicePath ? `https://${this.defaultServicePath}/` : url;
+        const useSelfSignedJWT = (!this.hasUserScopes() && url) ||
+            (this.useJWTAccessWithScope && this.hasAnyScopes()) ||
+            this.universeDomain !== authclient_1.DEFAULT_UNIVERSE;
+        if (this.subject && this.universeDomain !== authclient_1.DEFAULT_UNIVERSE) {
+            throw new RangeError(`Service Account user is configured for the credential. Domain-wide delegation is not supported in universes other than ${authclient_1.DEFAULT_UNIVERSE}`);
+        }
+        if (!this.apiKey && useSelfSignedJWT) {
+            if (this.additionalClaims &&
+                this.additionalClaims.target_audience) {
+                const { tokens } = await this.refreshToken();
+                return {
+                    headers: this.addSharedMetadataHeaders(new Headers({
+                        authorization: `Bearer ${tokens.id_token}`,
+                    })),
+                };
+            }
+            else {
+                // no scopes have been set, but a uri has been provided. Use JWTAccess
+                // credentials.
+                if (!this.access) {
+                    this.access = new jwtaccess_1.JWTAccess(this.email, this.key, this.keyId, this.eagerRefreshThresholdMillis);
+                }
+                let scopes;
+                if (this.hasUserScopes()) {
+                    scopes = this.scopes;
+                }
+                else if (!url) {
+                    scopes = this.defaultScopes;
+                }
+                const useScopes = this.useJWTAccessWithScope ||
+                    this.universeDomain !== authclient_1.DEFAULT_UNIVERSE;
+                const headers = await this.access.getRequestHeaders(url ?? undefined, this.additionalClaims, 
+                // Scopes take precedent over audience for signing,
+                // so we only provide them if `useJWTAccessWithScope` is on or
+                // if we are in a non-default universe
+                useScopes ? scopes : undefined);
+                return { headers: this.addSharedMetadataHeaders(headers) };
+            }
+        }
+        else if (this.hasAnyScopes() || this.apiKey) {
+            return super.getRequestMetadataAsync(url);
+        }
+        else {
+            // If no audience, apiKey, or scopes are provided, we should not attempt
+            // to populate any headers:
+            return { headers: new Headers() };
+        }
+    }
+    /**
+     * Fetches an ID token.
+     * @param targetAudience the audience for the fetched ID token.
+     */
+    async fetchIdToken(targetAudience) {
+        // Create a new gToken for fetching an ID token
+        const gtoken = new googleToken_1.GoogleToken({
+            iss: this.email,
+            sub: this.subject,
+            scope: this.scopes || this.defaultScopes,
+            keyFile: this.keyFile,
+            key: this.key,
+            additionalClaims: { target_audience: targetAudience },
+            transporter: this.transporter,
+        });
+        await gtoken.getToken({
+            forceRefresh: true,
+        });
+        if (!gtoken.idToken) {
+            throw new Error('Unknown error: Failed to fetch ID token');
+        }
+        return gtoken.idToken;
+    }
+    /**
+     * Determine if there are currently scopes available.
+     */
+    hasUserScopes() {
+        if (!this.scopes) {
+            return false;
+        }
+        return this.scopes.length > 0;
+    }
+    /**
+     * Are there any default or user scopes defined.
+     */
+    hasAnyScopes() {
+        if (this.scopes && this.scopes.length > 0)
+            return true;
+        if (this.defaultScopes && this.defaultScopes.length > 0)
+            return true;
+        return false;
+    }
+    authorize(callback) {
+        if (callback) {
+            this.authorizeAsync().then(r => callback(null, r), callback);
+        }
+        else {
+            return this.authorizeAsync();
+        }
+    }
+    async authorizeAsync() {
+        const result = await this.refreshToken();
+        if (!result) {
+            throw new Error('No result returned');
+        }
+        this.credentials = result.tokens;
+        this.credentials.refresh_token = 'jwt-placeholder';
+        this.key = this.gtoken.googleTokenOptions?.key;
+        this.email = this.gtoken.googleTokenOptions?.iss;
+        return result.tokens;
+    }
+    /**
+     * Refreshes the access token.
+     * @param refreshToken ignored
+     * @private
+     */
+    async refreshTokenNoCache() {
+        const gtoken = this.createGToken();
+        const token = await gtoken.getToken({
+            forceRefresh: this.isTokenExpiring(),
+        });
+        const tokens = {
+            access_token: token.access_token,
+            token_type: 'Bearer',
+            expiry_date: gtoken.expiresAt,
+            id_token: gtoken.idToken,
+        };
+        this.emit('tokens', tokens);
+        return { res: null, tokens };
+    }
+    /**
+     * Create a gToken if it doesn't already exist.
+     */
+    createGToken() {
+        if (!this.gtoken) {
+            this.gtoken = new googleToken_1.GoogleToken({
+                iss: this.email,
+                sub: this.subject,
+                scope: this.scopes || this.defaultScopes,
+                keyFile: this.keyFile,
+                key: this.key,
+                additionalClaims: this.additionalClaims,
+                transporter: this.transporter,
+            });
+        }
+        return this.gtoken;
+    }
+    /**
+     * Create a JWT credentials instance using the given input options.
+     * @param json The input object.
+     *
+     * @remarks
+     *
+     * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
+     */
+    fromJSON(json) {
+        if (!json) {
+            throw new Error('Must pass in a JSON object containing the service account auth settings.');
+        }
+        if (!json.client_email) {
+            throw new Error('The incoming JSON object does not contain a client_email field');
+        }
+        if (!json.private_key) {
+            throw new Error('The incoming JSON object does not contain a private_key field');
+        }
+        // Extract the relevant information from the json key file.
+        this.email = json.client_email;
+        this.key = json.private_key;
+        this.keyId = json.private_key_id;
+        this.projectId = json.project_id;
+        this.quotaProjectId = json.quota_project_id;
+        this.universeDomain = json.universe_domain || this.universeDomain;
+    }
+    fromStream(inputStream, callback) {
+        if (callback) {
+            this.fromStreamAsync(inputStream).then(() => callback(), callback);
+        }
+        else {
+            return this.fromStreamAsync(inputStream);
+        }
+    }
+    fromStreamAsync(inputStream) {
+        return new Promise((resolve, reject) => {
+            if (!inputStream) {
+                throw new Error('Must pass in a stream containing the service account auth settings.');
+            }
+            let s = '';
+            inputStream
+                .setEncoding('utf8')
+                .on('error', reject)
+                .on('data', chunk => (s += chunk))
+                .on('end', () => {
+                try {
+                    const data = JSON.parse(s);
+                    this.fromJSON(data);
+                    resolve();
+                }
+                catch (e) {
+                    reject(e);
+                }
+            });
+        });
+    }
+    /**
+     * Creates a JWT credentials instance using an API Key for authentication.
+     * @param apiKey The API Key in string form.
+     */
+    fromAPIKey(apiKey) {
+        if (typeof apiKey !== 'string') {
+            throw new Error('Must provide an API Key string.');
+        }
+        this.apiKey = apiKey;
+    }
+    /**
+     * Using the key or keyFile on the JWT client, obtain an object that contains
+     * the key and the client email.
+     */
+    async getCredentials() {
+        if (this.key) {
+            return { private_key: this.key, client_email: this.email };
+        }
+        else if (this.keyFile) {
+            const gtoken = this.createGToken();
+            const creds = await (0, getCredentials_1.getCredentials)(this.keyFile);
+            return { private_key: creds.privateKey, client_email: creds.clientEmail };
+        }
+        throw new Error('A key or a keyFile must be provided to getCredentials.');
+    }
+}
+exports.JWT = JWT;
+//# sourceMappingURL=jwtclient.js.map

package/node_modules/google-auth-library/build/src/auth/loginticket.d.ts

@@ -0,0 +1,140 @@
+export declare class LoginTicket {
+    private envelope?;
+    private payload?;
+    /**
+     * Create a simple class to extract user ID from an ID Token
+     *
+     * @param {string} env Envelope of the jwt
+     * @param {TokenPayload} pay Payload of the jwt
+     * @constructor
+     */
+    constructor(env?: string, pay?: TokenPayload);
+    getEnvelope(): string | undefined;
+    getPayload(): TokenPayload | undefined;
+    /**
+     * Create a simple class to extract user ID from an ID Token
+     *
+     * @return The user ID
+     */
+    getUserId(): string | null;
+    /**
+     * Returns attributes from the login ticket.  This can contain
+     * various information about the user session.
+     *
+     * @return The envelope and payload
+     */
+    getAttributes(): {
+        envelope: string | undefined;
+        payload: TokenPayload | undefined;
+    };
+}
+export interface TokenPayload {
+    /**
+     * The Issuer Identifier for the Issuer of the response. Always
+     * https://accounts.google.com or accounts.google.com for Google ID tokens.
+     */
+    iss: string;
+    /**
+     * Access token hash. Provides validation that the access token is tied to the
+     * identity token. If the ID token is issued with an access token in the
+     * server flow, this is always included. This can be used as an alternate
+     * mechanism to protect against cross-site request forgery attacks, but if you
+     * follow Step 1 and Step 3 it is not necessary to verify the access token.
+     */
+    at_hash?: string;
+    /**
+     * True if the user's e-mail address has been verified; otherwise false.
+     */
+    email_verified?: boolean;
+    /**
+     * An identifier for the user, unique among all Google accounts and never
+     * reused. A Google account can have multiple emails at different points in
+     * time, but the sub value is never changed. Use sub within your application
+     * as the unique-identifier key for the user.
+     */
+    sub: string;
+    /**
+     * The client_id of the authorized presenter. This claim is only needed when
+     * the party requesting the ID token is not the same as the audience of the ID
+     * token. This may be the case at Google for hybrid apps where a web
+     * application and Android app have a different client_id but share the same
+     * project.
+     */
+    azp?: string;
+    /**
+     * The user's email address. This may not be unique and is not suitable for
+     * use as a primary key. Provided only if your scope included the string
+     * "email".
+     */
+    email?: string;
+    /**
+     * The URL of the user's profile page. Might be provided when:
+     * - The request scope included the string "profile"
+     * - The ID token is returned from a token refresh
+     * - When profile claims are present, you can use them to update your app's
+     * user records. Note that this claim is never guaranteed to be present.
+     */
+    profile?: string;
+    /**
+     * The URL of the user's profile picture. Might be provided when:
+     * - The request scope included the string "profile"
+     * - The ID token is returned from a token refresh
+     * - When picture claims are present, you can use them to update your app's
+     * user records. Note that this claim is never guaranteed to be present.
+     */
+    picture?: string;
+    /**
+     * The user's full name, in a displayable form. Might be provided when:
+     * - The request scope included the string "profile"
+     * - The ID token is returned from a token refresh
+     * - When name claims are present, you can use them to update your app's user
+     * records. Note that this claim is never guaranteed to be present.
+     */
+    name?: string;
+    /**
+     * The user's given name, in a displayable form. Might be provided when:
+     * - The request scope included the string "profile"
+     * - The ID token is returned from a token refresh
+     * - When name claims are present, you can use them to update your app's user
+     * records. Note that this claim is never guaranteed to be present.
+     */
+    given_name?: string;
+    /**
+     * The user's family name, in a displayable form. Might be provided when:
+     * - The request scope included the string "profile"
+     * - The ID token is returned from a token refresh
+     * - When name claims are present, you can use them to update your app's user
+     * records. Note that this claim is never guaranteed to be present.
+     */
+    family_name?: string;
+    /**
+     * Identifies the audience that this ID token is intended for. It must be one
+     * of the OAuth 2.0 client IDs of your application.
+     */
+    aud: string;
+    /**
+     * The time the ID token was issued, represented in Unix time (integer
+     * seconds).
+     */
+    iat: number;
+    /**
+     * The time the ID token expires, represented in Unix time (integer seconds).
+     */
+    exp: number;
+    /**
+     * The value of the nonce supplied by your app in the authentication request.
+     * You should enforce protection against replay attacks by ensuring it is
+     * presented only once.
+     */
+    nonce?: string;
+    /**
+     * The hosted G Suite domain of the user. Provided only if the user belongs to
+     * a hosted domain.
+     */
+    hd?: string;
+    /**
+     * The user's locale, represented by a BCP 47 language tag.
+     * Might be provided when a name claim is present.
+     */
+    locale?: string;
+}

package/node_modules/google-auth-library/build/src/auth/loginticket.js

@@ -0,0 +1,60 @@
+"use strict";
+// Copyright 2014 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginTicket = void 0;
+class LoginTicket {
+    envelope;
+    payload;
+    /**
+     * Create a simple class to extract user ID from an ID Token
+     *
+     * @param {string} env Envelope of the jwt
+     * @param {TokenPayload} pay Payload of the jwt
+     * @constructor
+     */
+    constructor(env, pay) {
+        this.envelope = env;
+        this.payload = pay;
+    }
+    getEnvelope() {
+        return this.envelope;
+    }
+    getPayload() {
+        return this.payload;
+    }
+    /**
+     * Create a simple class to extract user ID from an ID Token
+     *
+     * @return The user ID
+     */
+    getUserId() {
+        const payload = this.getPayload();
+        if (payload && payload.sub) {
+            return payload.sub;
+        }
+        return null;
+    }
+    /**
+     * Returns attributes from the login ticket.  This can contain
+     * various information about the user session.
+     *
+     * @return The envelope and payload
+     */
+    getAttributes() {
+        return { envelope: this.getEnvelope(), payload: this.getPayload() };
+    }
+}
+exports.LoginTicket = LoginTicket;
+//# sourceMappingURL=loginticket.js.map