@optimizely-opal/opal-tool-ocp-sdk 0.0.0-beta.11 → 0.0.0-beta.13

package/src/service/Service.ts

@@ -3,8 +3,12 @@ import { AuthRequirement, Parameter } from '../types/Models';
 import * as App from '@zaiusinc/app-sdk';
 import { logger } from '@zaiusinc/app-sdk';
 import { ToolFunction } from '../function/ToolFunction';
+import { GlobalToolFunction } from '../function/GlobalToolFunction';
 
-
+/**
+ * Default OptiID authentication requirement that will be enforced for all tools
+ */
+const DEFAULT_OPTIID_AUTH = new AuthRequirement('OptiID', 'default', true);
 
 /**
  * Result type for interaction handlers
@@ -23,7 +27,11 @@ export class Interaction<TAuthData> {
   public constructor(
     public name: string,
     public endpoint: string,
-    public handler: (functionContext: ToolFunction, data: unknown, authData?: TAuthData) => Promise<InteractionResult>
+    public handler: (
+      functionContext: ToolFunction | GlobalToolFunction,
+      data: unknown,
+      authData?: TAuthData
+    ) => Promise<InteractionResult>
   ) {}
 }
 
@@ -43,15 +51,19 @@ export class Tool<TAuthData> {
    * @param parameters Function parameters
    * @param endpoint API endpoint
    * @param handler Function implementing the tool
-   * @param authRequirements Authentication requirements (optional)
+   * @param authRequirements Authentication requirements (mandatory - OptiID enforced)
    */
   public constructor(
     public name: string,
     public description: string,
     public parameters: Parameter[],
     public endpoint: string,
-    public handler: (functionContext: ToolFunction, params: unknown, authData?: TAuthData) => Promise<unknown>,
-    public authRequirements?: AuthRequirement[]
+    public handler: (
+      functionContext: ToolFunction | GlobalToolFunction,
+      params: unknown,
+      authData?: TAuthData
+    ) => Promise<unknown>,
+    public authRequirements: AuthRequirement[] = [DEFAULT_OPTIID_AUTH]
   ) {}
 
   /**
@@ -63,13 +75,10 @@ export class Tool<TAuthData> {
       description: this.description,
       parameters: this.parameters.map((p) => p.toJSON()),
       endpoint: this.endpoint,
-      http_method: this.httpMethod
+      http_method: this.httpMethod,
+      auth_requirements: this.authRequirements.map((auth) => auth.toJSON())
     };
 
-    if (this.authRequirements && this.authRequirements.length > 0) {
-      result.auth_requirements = this.authRequirements.map((auth) => auth.toJSON());
-    }
-
     return result;
   }
 }
@@ -79,18 +88,19 @@ export class ToolsService {
   private interactions: Map<string, Interaction<any>> = new Map();
 
   /**
-   * Extract Bearer token from Authorization header
-   * @param headers Request headers (Map-like object or Headers object with get method)
-   * @returns Bearer token string or undefined
+   * Enforce OptiID authentication for tools by ensuring OptiID auth requirement is present
+   * @param authRequirements Original authentication requirements
+   * @returns Enforced authentication requirements with OptiID
    */
-  public extractBearerToken(headers: App.Headers): string | undefined {
-    let bearerToken: string | undefined;
+  private enforceOptiIdAuth(authRequirements?: AuthRequirement[]): AuthRequirement[] {
+    const hasOptiIdProvider = authRequirements
+      && authRequirements.some((auth) => auth.provider.toLowerCase() === 'optiid');
 
-    const authHeader = headers ? headers.get('authorization') : undefined;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
-      bearerToken = authHeader.substring(7).trim();
+    if (hasOptiIdProvider) {
+      return authRequirements;
     }
-    return bearerToken;
+
+    return [...(authRequirements || []), DEFAULT_OPTIID_AUTH];
   }
 
   /**
@@ -105,12 +115,25 @@ export class ToolsService {
   public registerTool<TAuthData>(
     name: string,
     description: string,
-    handler: (functionContext: ToolFunction, params: unknown, authData?: TAuthData) => Promise<unknown>,
+    handler: (
+      functionContext: ToolFunction | GlobalToolFunction,
+      params: unknown,
+      authData?: TAuthData
+    ) => Promise<unknown>,
     parameters: Parameter[],
     endpoint: string,
     authRequirements?: AuthRequirement[]
   ): void {
-    const func = new Tool<TAuthData>(name, description, parameters, endpoint, handler, authRequirements);
+    // Enforce OptiID authentication for all tools
+    const enforcedAuthRequirements = this.enforceOptiIdAuth(authRequirements);
+    const func = new Tool<TAuthData>(
+      name,
+      description,
+      parameters,
+      endpoint,
+      handler,
+      enforcedAuthRequirements
+    );
     this.functions.set(endpoint, func);
   }
 
@@ -122,15 +145,21 @@ export class ToolsService {
    */
   public registerInteraction<TAuthData>(
     name: string,
-    handler: (functionContext: ToolFunction, data: unknown, authData?: TAuthData) => Promise<InteractionResult>,
+    handler: (
+      functionContext: ToolFunction | GlobalToolFunction,
+      data: unknown,
+      authData?: TAuthData
+    ) => Promise<InteractionResult>,
     endpoint: string
   ): void {
     const func = new Interaction<TAuthData>(name, endpoint, handler);
     this.interactions.set(endpoint, func);
   }
 
-  public async processRequest(req: App.Request,
-                              functionContext: ToolFunction): Promise<App.Response> {
+  public async processRequest(
+    req: App.Request,
+    functionContext: ToolFunction | GlobalToolFunction
+  ): Promise<App.Response> {
     if (req.path === '/discovery') {
       return new App.Response(200, { functions: Array.from(this.functions.values()).map((f) => f.toJSON()) });
     } else {

package/src/types/Models.ts

@@ -48,10 +48,10 @@ export class Parameter {
 export class OptiIdAuthDataCredentials {
 
   public constructor(
-    public customerId: string,
-    public instanceId: string,
-    public accessToken: string,
-    public productSku: string
+    public customer_id: string,
+    public instance_id: string,
+    public access_token: string,
+    public product_sku: string
   ) {}
 }