@palantir/pack.auth.foundry 0.0.1-beta.1

package/build/cjs/index.cjs

@@ -0,0 +1,381 @@
+'use strict';
+
+var pack_auth = require('@palantir/pack.auth');
+var foundry_admin = require('@osdk/foundry.admin');
+
+// src/auth/AuthServiceConfidential.ts
+
+// src/utils/jwtUtils.ts
+function maybeDecodeUuidClaim(value) {
+  if (!Array.isArray(value)) {
+    return void 0;
+  }
+  if (value.length === 16 && value.every((v) => typeof v === "number")) {
+    return decodeUuidBytes(value);
+  }
+  return void 0;
+}
+function decodeUuidBytes(bytes) {
+  if (bytes.length !== 16) {
+    return "";
+  }
+  const hex = bytes.map((b) => b.toString(16).padStart(2, "0")).join("");
+  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20, 32)].join("-");
+}
+function parseJwtToken(token) {
+  if (!token) {
+    return void 0;
+  }
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return void 0;
+    }
+    const payload = parts[1];
+    if (!payload) {
+      return void 0;
+    }
+    const paddedPayload = payload.padEnd(payload.length + (4 - payload.length % 4) % 4, "=");
+    const decoded = JSON.parse(atob(paddedPayload));
+    return {
+      // JWT exp is seconds since epoch, convert to ms
+      expiryInstantUtc: typeof decoded.exp === "number" ? decoded.exp * 1e3 : void 0,
+      orgId: maybeDecodeUuidClaim(decoded.org),
+      sessionId: maybeDecodeUuidClaim(decoded.sid),
+      tokenId: maybeDecodeUuidClaim(decoded.jti),
+      userId: maybeDecodeUuidClaim(decoded.sub)
+    };
+  } catch {
+    return void 0;
+  }
+}
+
+// src/auth/AuthServiceBase.ts
+var AuthServiceBase = class {
+  currentState;
+  isTokenValidated = false;
+  currentUserId;
+  cachedUserData;
+  stateCallbacks = /* @__PURE__ */ new Set();
+  tokenChangeCallbacks = /* @__PURE__ */ new Set();
+  currentToken;
+  app;
+  logger;
+  constructor(app, logger, initialState = pack_auth.AuthState.Unauthenticated) {
+    this.app = app;
+    this.logger = logger;
+    this.currentState = initialState;
+  }
+  clearUserState() {
+    this.isTokenValidated = false;
+    this.currentUserId = void 0;
+    this.cachedUserData = void 0;
+  }
+  isAuthenticated() {
+    return this.getTokenOrUndefined() != null;
+  }
+  getCurrentUserId() {
+    return this.isTokenValidated ? this.currentUserId : void 0;
+  }
+  isValidated() {
+    return this.isTokenValidated;
+  }
+  async validateToken() {
+    if (!this.isAuthenticated()) {
+      this.clearUserState();
+      return false;
+    }
+    if (this.app.config.isTestMode) {
+      this.isTokenValidated = true;
+      return true;
+    }
+    try {
+      const user = await foundry_admin.Users.getCurrent(this.app.config.osdkClient);
+      this.isTokenValidated = true;
+      this.cachedUserData = user;
+      this.currentUserId = user.id;
+      return true;
+    } catch (error) {
+      this.logger.error("Token validation failed", error);
+      this.clearUserState();
+      return false;
+    }
+  }
+  onAuthStateChange(callback) {
+    this.stateCallbacks.add(callback);
+    try {
+      callback({
+        state: this.currentState
+      });
+    } catch (err) {
+      this.logger.error("Error in auth state callback:", err);
+    }
+    return () => {
+      this.stateCallbacks.delete(callback);
+    };
+  }
+  onTokenChange(callback) {
+    this.tokenChangeCallbacks.add(callback);
+    const token = this.getTokenOrUndefined();
+    if (token != null) {
+      const info = parseJwtToken(token) ?? {};
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    }
+    return () => {
+      this.tokenChangeCallbacks.delete(callback);
+    };
+  }
+  getCurrentState() {
+    return this.currentState;
+  }
+  async getUserData(userId, force) {
+    if (!this.isTokenValidated || !this.currentUserId || this.currentUserId !== userId) {
+      throw new Error(`User data not available for userId: ${userId}`);
+    }
+    if (!force && this.cachedUserData) {
+      return this.cachedUserData;
+    }
+    if (this.app.config.isTestMode) {
+      throw new Error("Cannot refresh user data in test mode");
+    }
+    try {
+      const user = await foundry_admin.Users.get(this.app.config.osdkClient, userId);
+      this.cachedUserData = user;
+      return user;
+    } catch (error) {
+      this.logger.error("Failed to refresh user data", error);
+      throw new Error("Failed to refresh user data");
+    }
+  }
+  dispose() {
+    this.stateCallbacks.clear();
+    this.tokenChangeCallbacks.clear();
+    this.clearUserState();
+  }
+  notifyTokenChange(token) {
+    const info = (token != null ? parseJwtToken(token) : void 0) ?? {};
+    this.tokenChangeCallbacks.forEach((callback) => {
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    });
+  }
+  updateState(newState, error) {
+    const previousState = this.currentState;
+    this.currentState = newState;
+    const event = {
+      previousState,
+      state: newState,
+      error
+    };
+    this.stateCallbacks.forEach((callback) => {
+      try {
+        callback(event);
+      } catch (err) {
+        this.logger.error("Error in auth state callback:", err);
+      }
+    });
+  }
+};
+
+// src/auth/AuthServiceConfidential.ts
+var AuthServiceConfidential = class extends AuthServiceBase {
+  oauthClient;
+  constructor(app, oauthClient) {
+    const initialState = oauthClient.getTokenOrUndefined() ? pack_auth.AuthState.Authenticated : pack_auth.AuthState.Unauthenticated;
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServiceConfidential"
+    }), initialState);
+    this.oauthClient = oauthClient;
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+  }
+  async getToken() {
+    return this.oauthClient();
+  }
+  signInHandler = () => {
+    this.updateState(pack_auth.AuthState.Authenticated);
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+  };
+  signOutHandler = () => {
+    this.updateState(pack_auth.AuthState.Unauthenticated);
+    this.notifyTokenChange(void 0);
+  };
+  getTokenOrUndefined() {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+  async signIn() {
+    try {
+      this.updateState(pack_auth.AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(pack_auth.AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async signOut() {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(pack_auth.AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  dispose() {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    super.dispose();
+  }
+};
+function createConfidentialOauthService(app, oauthClient) {
+  return new AuthServiceConfidential(app, oauthClient);
+}
+var AuthServicePublic = class extends AuthServiceBase {
+  hasInitialized = false;
+  oauthClient;
+  constructor(app, oauthClient) {
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServicePublic"
+    }), pack_auth.AuthState.Initializing);
+    this.oauthClient = oauthClient;
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+    this.oauthClient.addEventListener("refresh", this.refreshHandler);
+  }
+  async getToken() {
+    return this.oauthClient();
+  }
+  signInHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(pack_auth.AuthState.Authenticated);
+  };
+  signOutHandler = () => {
+    this.notifyTokenChange(void 0);
+    this.updateState(pack_auth.AuthState.Unauthenticated);
+  };
+  refreshHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(pack_auth.AuthState.Authenticated);
+  };
+  getTokenOrUndefined() {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+  onAuthStateChange(callback) {
+    const unsubscribe = super.onAuthStateChange(callback);
+    if (!this.hasInitialized && this.currentState === pack_auth.AuthState.Initializing) {
+      this.hasInitialized = true;
+      void this.signIn().catch(() => {
+      });
+    }
+    return unsubscribe;
+  }
+  async signIn() {
+    try {
+      this.updateState(pack_auth.AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(pack_auth.AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async signOut() {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(pack_auth.AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  async refresh() {
+    try {
+      await this.oauthClient.refresh();
+    } catch (error) {
+      this.updateState(pack_auth.AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+  dispose() {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    this.oauthClient.removeEventListener("refresh", this.refreshHandler);
+    super.dispose();
+  }
+};
+function createPublicOauthService(app, oauthClient) {
+  return new AuthServicePublic(app, oauthClient);
+}
+var AuthServiceStatic = class extends AuthServiceBase {
+  tokenProvider;
+  latestToken;
+  constructor(app, tokenProvider) {
+    super(app, app.config.logger.child({}, {
+      msgPrefix: "AuthServiceStatic"
+    }), pack_auth.AuthState.Unauthenticated);
+    this.tokenProvider = tokenProvider;
+    void this.getToken().catch(() => {
+    });
+  }
+  async getToken() {
+    try {
+      const token = await this.tokenProvider();
+      if (this.latestToken !== token) {
+        this.latestToken = token;
+        this.notifyTokenChange(token);
+        if (this.currentState !== pack_auth.AuthState.Authenticated) {
+          this.updateState(pack_auth.AuthState.Authenticated);
+        }
+      }
+      return token;
+    } catch (error) {
+      if (this.latestToken !== void 0) {
+        this.latestToken = void 0;
+        this.notifyTokenChange(void 0);
+      }
+      this.updateState(pack_auth.AuthState.Error, error);
+      throw error;
+    }
+  }
+  getTokenOrUndefined() {
+    return this.latestToken;
+  }
+  isAuthenticated() {
+    return this.latestToken != null;
+  }
+  signIn() {
+    return Promise.resolve();
+  }
+  signOut() {
+    this.clearUserState();
+    this.latestToken = void 0;
+    this.updateState(pack_auth.AuthState.Unauthenticated);
+    return Promise.reject(new Error("Sign out not supported for static token providers"));
+  }
+  dispose() {
+    super.dispose();
+    this.latestToken = void 0;
+  }
+};
+function createStaticTokenService(app, tokenProvider) {
+  return new AuthServiceStatic(app, tokenProvider);
+}
+
+Object.defineProperty(exports, "createAuthModuleConfig", {
+  enumerable: true,
+  get: function () { return pack_auth.createAuthModuleConfig; }
+});
+exports.createConfidentialOauthService = createConfidentialOauthService;
+exports.createPublicOauthService = createPublicOauthService;
+exports.createStaticTokenService = createStaticTokenService;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/build/cjs/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/jwtUtils.ts","../../src/auth/AuthServiceBase.ts","../../src/auth/AuthServiceConfidential.ts","../../src/auth/AuthServicePublic.ts","../../src/auth/AuthServiceStatic.ts"],"names":["AuthState","Users"],"mappings":";;;;;;;;AAoBA,SAAS,qBAAqB,KAAA,EAAO;AACnC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,IAAM,KAAA,CAAM,MAAM,CAAA,CAAA,KAAK,OAAO,CAAA,KAAM,QAAQ,CAAA,EAAG;AAElE,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,MAAA;AACT;AAMA,SAAS,gBAAgB,KAAA,EAAO;AAC9B,EAAA,IAAI,KAAA,CAAM,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO,EAAA;AAAA,EACT;AAGA,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAGnE,EAAA,OAAO,CAAC,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA,EAAG,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAC,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC9G;AAeO,SAAS,cAAc,KAAA,EAAO;AACnC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI;AAEF,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AAGA,IAAA,MAAM,OAAA,GAAU,MAAM,CAAC,CAAA;AACvB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AAGA,IAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,MAAA,GAAA,CAAU,IAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,IAAK,CAAA,EAAG,GAAG,CAAA;AACvF,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,aAAa,CAAC,CAAA;AAC9C,IAAA,OAAO;AAAA;AAAA,MAEL,kBAAkB,OAAO,OAAA,CAAQ,QAAQ,QAAA,GAAW,OAAA,CAAQ,MAAM,GAAA,GAAO,KAAA,CAAA;AAAA,MACzE,KAAA,EAAO,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MACvC,SAAA,EAAW,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MAC3C,OAAA,EAAS,oBAAA,CAAqB,OAAA,CAAQ,GAAG,CAAA;AAAA,MACzC,MAAA,EAAQ,oBAAA,CAAqB,OAAA,CAAQ,GAAG;AAAA,KAC1C;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;;;ACxEO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAAA;AAAA,EACA,gBAAA,GAAmB,KAAA;AAAA,EACnB,aAAA;AAAA,EACA,cAAA;AAAA,EACA,cAAA,uBAAqB,GAAA,EAAI;AAAA,EACzB,oBAAA,uBAA2B,GAAA,EAAI;AAAA,EAC/B,YAAA;AAAA,EACA,GAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA,CAAY,GAAA,EAAK,MAAA,EAAQ,YAAA,GAAeA,oBAAU,eAAA,EAAiB;AACjE,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AAAA,EACtB;AAAA,EACA,cAAA,GAAiB;AACf,IAAA,IAAA,CAAK,gBAAA,GAAmB,KAAA;AACxB,IAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AACrB,IAAA,IAAA,CAAK,cAAA,GAAiB,MAAA;AAAA,EACxB;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,qBAAoB,IAAK,IAAA;AAAA,EACvC;AAAA,EACA,gBAAA,GAAmB;AACjB,IAAA,OAAO,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,aAAA,GAAgB,MAAA;AAAA,EACtD;AAAA,EACA,WAAA,GAAc;AACZ,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EACA,MAAM,aAAA,GAAgB;AACpB,IAAA,IAAI,CAAC,IAAA,CAAK,eAAA,EAAgB,EAAG;AAC3B,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,OAAO,KAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAA,EAAY;AAC9B,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAMC,mBAAA,CAAM,WAAW,IAAA,CAAK,GAAA,CAAI,OAAO,UAAU,CAAA;AAC9D,MAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AACxB,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,EAAA;AAC1B,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,yBAAA,EAA2B,KAAK,CAAA;AAClD,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AAAA,EACA,kBAAkB,QAAA,EAAU;AAC1B,IAAA,IAAA,CAAK,cAAA,CAAe,IAAI,QAAQ,CAAA;AAChC,IAAA,IAAI;AACF,MAAA,QAAA,CAAS;AAAA,QACP,OAAO,IAAA,CAAK;AAAA,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,GAAG,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,QAAQ,CAAA;AAAA,IACrC,CAAA;AAAA,EACF;AAAA,EACA,cAAc,QAAA,EAAU;AACtB,IAAA,IAAA,CAAK,oBAAA,CAAqB,IAAI,QAAQ,CAAA;AAGtC,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAI,SAAS,IAAA,EAAM;AACjB,MAAA,MAAM,IAAA,GAAO,aAAA,CAAc,KAAK,CAAA,IAAK,EAAC;AACtC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,OAAO,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF;AACA,IAAA,OAAO,MAAM;AACX,MAAA,IAAA,CAAK,oBAAA,CAAqB,OAAO,QAAQ,CAAA;AAAA,IAC3C,CAAA;AAAA,EACF;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACd;AAAA,EACA,MAAM,WAAA,CAAY,MAAA,EAAQ,KAAA,EAAO;AAC/B,IAAA,IAAI,CAAC,KAAK,gBAAA,IAAoB,CAAC,KAAK,aAAA,IAAiB,IAAA,CAAK,kBAAkB,MAAA,EAAQ;AAClF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,MAAM,CAAA,CAAE,CAAA;AAAA,IACjE;AACA,IAAA,IAAI,CAAC,KAAA,IAAS,IAAA,CAAK,cAAA,EAAgB;AACjC,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACd;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD;AACA,IAAA,IAAI;AAEF,MAAA,MAAM,IAAA,GAAO,MAAMA,mBAAA,CAAM,GAAA,CAAI,KAAK,GAAA,CAAI,MAAA,CAAO,YAAY,MAAM,CAAA;AAC/D,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,6BAAA,EAA+B,KAAK,CAAA;AACtD,MAAA,MAAM,IAAI,MAAM,6BAA6B,CAAA;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,eAAe,KAAA,EAAM;AAC1B,IAAA,IAAA,CAAK,qBAAqB,KAAA,EAAM;AAChC,IAAA,IAAA,CAAK,cAAA,EAAe;AAAA,EACtB;AAAA,EACA,kBAAkB,KAAA,EAAO;AACvB,IAAA,MAAM,QAAQ,KAAA,IAAS,IAAA,GAAO,cAAc,KAAK,CAAA,GAAI,WAAc,EAAC;AACpE,IAAA,IAAA,CAAK,oBAAA,CAAqB,QAAQ,CAAA,QAAA,KAAY;AAC5C,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,OAAO,IAAI,CAAA;AAAA,MACtB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EACA,WAAA,CAAY,UAAU,KAAA,EAAO;AAC3B,IAAA,MAAM,gBAAgB,IAAA,CAAK,YAAA;AAC3B,IAAA,IAAA,CAAK,YAAA,GAAe,QAAA;AACpB,IAAA,MAAM,KAAA,GAAQ;AAAA,MACZ,aAAA;AAAA,MACA,KAAA,EAAO,QAAA;AAAA,MACP;AAAA,KACF;AACA,IAAA,IAAA,CAAK,cAAA,CAAe,QAAQ,CAAA,QAAA,KAAY;AACtC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,CAAA;AAAA,MAChB,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,+BAAA,EAAiC,GAAG,CAAA;AAAA,MACxD;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AACF,CAAA;;;ACvIO,IAAM,uBAAA,GAAN,cAAsC,eAAA,CAAgB;AAAA,EAC3D,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,WAAA,EAAa;AAC5B,IAAA,MAAM,eAAe,WAAA,CAAY,mBAAA,EAAoB,GAAID,mBAAAA,CAAU,gBAAgBA,mBAAAA,CAAU,eAAA;AAC7F,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,GAAG,YAAY,CAAA;AAChB,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AAC9D,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAAA,EAClE;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,WAAA,EAAY;AAAA,EAC1B;AAAA,EACA,gBAAgB,MAAM;AACpB,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,aAAa,CAAA;AACxC,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAAA,EAC9B,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,eAAe,CAAA;AAC1C,IAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAAA,EAClC,CAAA;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,YAAY,mBAAA,EAAoB;AAAA,EAC9C;AAAA,EACA,MAAM,MAAA,GAAS;AACb,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,cAAc,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,YAAY,MAAA,EAAO;AAAA,IAChC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF,CAAA;AAKO,SAAS,8BAAA,CAA+B,KAAK,WAAA,EAAa;AAC/D,EAAA,OAAO,IAAI,uBAAA,CAAwB,GAAA,EAAK,WAAW,CAAA;AACrD;ACxDO,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAA,EACrD,cAAA,GAAiB,KAAA;AAAA,EACjB,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,WAAA,EAAa;AAC5B,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,CAAA,EAAGA,mBAAAA,CAAU,YAAY,CAAA;AAC1B,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AAC9D,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAChE,IAAA,IAAA,CAAK,WAAA,CAAY,gBAAA,CAAiB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AAAA,EAClE;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,OAAO,KAAK,WAAA,EAAY;AAAA,EAC1B;AAAA,EACA,gBAAgB,MAAM;AACpB,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,aAAa,CAAA;AAAA,EAC1C,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAChC,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,eAAe,CAAA;AAAA,EAC5C,CAAA;AAAA,EACA,iBAAiB,MAAM;AACrB,IAAA,MAAM,KAAA,GAAQ,KAAK,mBAAA,EAAoB;AACvC,IAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,aAAa,CAAA;AAAA,EAC1C,CAAA;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,YAAY,mBAAA,EAAoB;AAAA,EAC9C;AAAA,EACA,kBAAkB,QAAA,EAAU;AAC1B,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,iBAAA,CAAkB,QAAQ,CAAA;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,YAAA,KAAiBA,oBAAU,YAAA,EAAc;AACxE,MAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AACtB,MAAA,KAAK,IAAA,CAAK,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,MAI/B,CAAC,CAAA;AAAA,IACH;AACA,IAAA,OAAO,WAAA;AAAA,EACT;AAAA,EACA,MAAM,MAAA,GAAS;AACb,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,cAAc,CAAA;AACzC,MAAA,MAAM,IAAA,CAAK,YAAY,MAAA,EAAO;AAAA,IAChC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,cAAA,EAAe;AACpB,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,OAAA,GAAU;AACd,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,YAAY,OAAA,EAAQ;AAAA,IACjC,SAAS,KAAA,EAAO;AACd,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAC3F,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,QAAA,EAAU,IAAA,CAAK,aAAa,CAAA;AACjE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,IAAA,CAAK,WAAA,CAAY,mBAAA,CAAoB,SAAA,EAAW,IAAA,CAAK,cAAc,CAAA;AACnE,IAAA,KAAA,CAAM,OAAA,EAAQ;AAAA,EAChB;AACF,CAAA;AAKO,SAAS,wBAAA,CAAyB,KAAK,WAAA,EAAa;AACzD,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,EAAK,WAAW,CAAA;AAC/C;ACnFO,IAAM,iBAAA,GAAN,cAAgC,eAAA,CAAgB;AAAA,EACrD,aAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA,CAAY,KAAK,aAAA,EAAe;AAC9B,IAAA,KAAA,CAAM,KAAK,GAAA,CAAI,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,EAAC,EAAG;AAAA,MACrC,SAAA,EAAW;AAAA,KACZ,CAAA,EAAGA,mBAAAA,CAAU,eAAe,CAAA;AAC7B,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AACrB,IAAA,KAAK,IAAA,CAAK,QAAA,EAAS,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACrC;AAAA,EACA,MAAM,QAAA,GAAW;AACf,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,IAAA,CAAK,kBAAkB,KAAK,CAAA;AAC5B,QAAA,IAAI,IAAA,CAAK,YAAA,KAAiBA,mBAAAA,CAAU,aAAA,EAAe;AACjD,UAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,aAAa,CAAA;AAAA,QAC1C;AAAA,MACF;AACA,MAAA,OAAO,KAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,EAAW;AAClC,QAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AACnB,QAAA,IAAA,CAAK,kBAAkB,MAAS,CAAA;AAAA,MAClC;AACA,MAAA,IAAA,CAAK,WAAA,CAAYA,mBAAAA,CAAU,KAAA,EAAO,KAAK,CAAA;AACvC,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EACA,mBAAA,GAAsB;AACpB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EACA,eAAA,GAAkB;AAChB,IAAA,OAAO,KAAK,WAAA,IAAe,IAAA;AAAA,EAC7B;AAAA,EACA,MAAA,GAAS;AACP,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA,EACA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,cAAA,EAAe;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AACnB,IAAA,IAAA,CAAK,WAAA,CAAYA,oBAAU,eAAe,CAAA;AAC1C,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,mDAAmD,CAAC,CAAA;AAAA,EACtF;AAAA,EACA,OAAA,GAAU;AACR,IAAA,KAAA,CAAM,OAAA,EAAQ;AACd,IAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,EACrB;AACF,CAAA;AAKO,SAAS,wBAAA,CAAyB,KAAK,aAAA,EAAe;AAC3D,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,EAAK,aAAa,CAAA;AACjD","file":"index.cjs","sourcesContent":["/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Decode a Palantir-specific JWT claim that stores UUIDs as 16-byte arrays.\n * These are the sub, sid, jti, and org claims.\n */\nfunction maybeDecodeUuidClaim(value) {\n  if (!Array.isArray(value)) {\n    return undefined;\n  }\n  if (value.length === 16 && value.every(v => typeof v === \"number\")) {\n    // Convert 16-byte array to UUID string\n    return decodeUuidBytes(value);\n  }\n  return undefined;\n}\n\n/**\n * Convert a 16-byte array to UUID string format.\n * Based on Palantir's UUID encoding format.\n */\nfunction decodeUuidBytes(bytes) {\n  if (bytes.length !== 16) {\n    return \"\";\n  }\n\n  // Convert bytes to hex string\n  const hex = bytes.map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n\n  // Format as UUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\n  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20, 32)].join(\"-\");\n}\n\n/**\n * Represents the parsed payload from a JWT token (unverified).\n * The information provided should not be used for security-sensitive\n * applications unless verified through some other process.\n */\n\n/**\n * Parse JWT token to extract unverified claims including userId, sessionId, tokenId, organizationId, and expiry.\n * This does NOT verify the token signature - it only extracts payload data.\n *\n * @param token - JWT token string\n * @returns Unverified token info or undefined if parsing fails\n */\nexport function parseJwtToken(token) {\n  if (!token) {\n    return undefined;\n  }\n  try {\n    // JWT tokens have 3 parts separated by dots: header.payload.signature\n    const parts = token.split(\".\");\n    if (parts.length !== 3) {\n      return undefined;\n    }\n\n    // Decode the payload (second part)\n    const payload = parts[1];\n    if (!payload) {\n      return undefined;\n    }\n\n    // Add padding if needed for base64 decoding\n    const paddedPayload = payload.padEnd(payload.length + (4 - payload.length % 4) % 4, \"=\");\n    const decoded = JSON.parse(atob(paddedPayload));\n    return {\n      // JWT exp is seconds since epoch, convert to ms\n      expiryInstantUtc: typeof decoded.exp === \"number\" ? decoded.exp * 1000 : undefined,\n      orgId: maybeDecodeUuidClaim(decoded.org),\n      sessionId: maybeDecodeUuidClaim(decoded.sid),\n      tokenId: maybeDecodeUuidClaim(decoded.jti),\n      userId: maybeDecodeUuidClaim(decoded.sub)\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Check if a JWT token is expired based on its exp claim (unverified).\n *\n * @param tokenInfo - Unverified token info\n * @returns true if token is expired, false if valid or no expiry info\n */\nexport function isTokenExpired(tokenInfo) {\n  if (!tokenInfo.expiryInstantUtc) {\n    return false; // No expiry info, assume valid\n  }\n  const now = Date.now();\n  return tokenInfo.expiryInstantUtc < now;\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Users } from \"@osdk/foundry.admin\";\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { parseJwtToken } from \"../utils/jwtUtils.js\";\nexport class AuthServiceBase {\n  currentState;\n  isTokenValidated = false;\n  currentUserId;\n  cachedUserData;\n  stateCallbacks = new Set();\n  tokenChangeCallbacks = new Set();\n  currentToken;\n  app;\n  logger;\n  constructor(app, logger, initialState = AuthState.Unauthenticated) {\n    this.app = app;\n    this.logger = logger;\n    this.currentState = initialState;\n  }\n  clearUserState() {\n    this.isTokenValidated = false;\n    this.currentUserId = undefined;\n    this.cachedUserData = undefined;\n  }\n  isAuthenticated() {\n    return this.getTokenOrUndefined() != null;\n  }\n  getCurrentUserId() {\n    return this.isTokenValidated ? this.currentUserId : undefined;\n  }\n  isValidated() {\n    return this.isTokenValidated;\n  }\n  async validateToken() {\n    if (!this.isAuthenticated()) {\n      this.clearUserState();\n      return false;\n    }\n    if (this.app.config.isTestMode) {\n      this.isTokenValidated = true;\n      return true;\n    }\n    try {\n      const user = await Users.getCurrent(this.app.config.osdkClient);\n      this.isTokenValidated = true;\n      this.cachedUserData = user;\n      this.currentUserId = user.id;\n      return true;\n    } catch (error) {\n      this.logger.error(\"Token validation failed\", error);\n      this.clearUserState();\n      return false;\n    }\n  }\n  onAuthStateChange(callback) {\n    this.stateCallbacks.add(callback);\n    try {\n      callback({\n        state: this.currentState\n      });\n    } catch (err) {\n      this.logger.error(\"Error in auth state callback:\", err);\n    }\n    return () => {\n      this.stateCallbacks.delete(callback);\n    };\n  }\n  onTokenChange(callback) {\n    this.tokenChangeCallbacks.add(callback);\n\n    // Immediately notify with current token if available\n    const token = this.getTokenOrUndefined();\n    if (token != null) {\n      const info = parseJwtToken(token) ?? {};\n      try {\n        callback(token, info);\n      } catch (err) {\n        this.logger.error(\"Error in token change callback:\", err);\n      }\n    }\n    return () => {\n      this.tokenChangeCallbacks.delete(callback);\n    };\n  }\n  getCurrentState() {\n    return this.currentState;\n  }\n  async getUserData(userId, force) {\n    if (!this.isTokenValidated || !this.currentUserId || this.currentUserId !== userId) {\n      throw new Error(`User data not available for userId: ${userId}`);\n    }\n    if (!force && this.cachedUserData) {\n      return this.cachedUserData;\n    }\n    if (this.app.config.isTestMode) {\n      throw new Error(\"Cannot refresh user data in test mode\");\n    }\n    try {\n      // TODO: debounce and use Users.getBatch for efficiency when looking up multiple users\n      const user = await Users.get(this.app.config.osdkClient, userId);\n      this.cachedUserData = user;\n      return user;\n    } catch (error) {\n      this.logger.error(\"Failed to refresh user data\", error);\n      throw new Error(\"Failed to refresh user data\");\n    }\n  }\n  dispose() {\n    this.stateCallbacks.clear();\n    this.tokenChangeCallbacks.clear();\n    this.clearUserState();\n  }\n  notifyTokenChange(token) {\n    const info = (token != null ? parseJwtToken(token) : undefined) ?? {};\n    this.tokenChangeCallbacks.forEach(callback => {\n      try {\n        callback(token, info);\n      } catch (err) {\n        this.logger.error(\"Error in token change callback:\", err);\n      }\n    });\n  }\n  updateState(newState, error) {\n    const previousState = this.currentState;\n    this.currentState = newState;\n    const event = {\n      previousState,\n      state: newState,\n      error\n    };\n    this.stateCallbacks.forEach(callback => {\n      try {\n        callback(event);\n      } catch (err) {\n        this.logger.error(\"Error in auth state callback:\", err);\n      }\n    });\n  }\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServiceConfidential extends AuthServiceBase {\n  oauthClient;\n  constructor(app, oauthClient) {\n    const initialState = oauthClient.getTokenOrUndefined() ? AuthState.Authenticated : AuthState.Unauthenticated;\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServiceConfidential\"\n    }), initialState);\n    this.oauthClient = oauthClient;\n    this.oauthClient.addEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.addEventListener(\"signOut\", this.signOutHandler);\n  }\n  async getToken() {\n    return this.oauthClient();\n  }\n  signInHandler = () => {\n    this.updateState(AuthState.Authenticated);\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n  };\n  signOutHandler = () => {\n    this.updateState(AuthState.Unauthenticated);\n    this.notifyTokenChange(undefined);\n  };\n  getTokenOrUndefined() {\n    return this.oauthClient.getTokenOrUndefined();\n  }\n  async signIn() {\n    try {\n      this.updateState(AuthState.Authenticating);\n      await this.oauthClient.signIn();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async signOut() {\n    try {\n      this.clearUserState();\n      await this.oauthClient.signOut();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  dispose() {\n    this.oauthClient.removeEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.removeEventListener(\"signOut\", this.signOutHandler);\n    super.dispose();\n  }\n}\n\n/**\n * Creates a confidential OAuth auth service that wraps a ConfidentialOauthClient\n */\nexport function createConfidentialOauthService(app, oauthClient) {\n  return new AuthServiceConfidential(app, oauthClient);\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServicePublic extends AuthServiceBase {\n  hasInitialized = false;\n  oauthClient;\n  constructor(app, oauthClient) {\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServicePublic\"\n    }), AuthState.Initializing);\n    this.oauthClient = oauthClient;\n    this.oauthClient.addEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.addEventListener(\"signOut\", this.signOutHandler);\n    this.oauthClient.addEventListener(\"refresh\", this.refreshHandler);\n  }\n  async getToken() {\n    return this.oauthClient();\n  }\n  signInHandler = () => {\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n    this.updateState(AuthState.Authenticated);\n  };\n  signOutHandler = () => {\n    this.notifyTokenChange(undefined);\n    this.updateState(AuthState.Unauthenticated);\n  };\n  refreshHandler = () => {\n    const token = this.getTokenOrUndefined();\n    this.notifyTokenChange(token);\n    this.updateState(AuthState.Authenticated);\n  };\n  getTokenOrUndefined() {\n    return this.oauthClient.getTokenOrUndefined();\n  }\n  onAuthStateChange(callback) {\n    const unsubscribe = super.onAuthStateChange(callback);\n    if (!this.hasInitialized && this.currentState === AuthState.Initializing) {\n      this.hasInitialized = true;\n      void this.signIn().catch(() => {\n        // Don't allow unhandled rejection to bubble up, mostly for testing.\n        // Note the signIn method will log errors and throw for promise consumers,\n        // but we don't need to handle anything here.\n      });\n    }\n    return unsubscribe;\n  }\n  async signIn() {\n    try {\n      this.updateState(AuthState.Authenticating);\n      await this.oauthClient.signIn();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async signOut() {\n    try {\n      this.clearUserState();\n      await this.oauthClient.signOut();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  async refresh() {\n    try {\n      await this.oauthClient.refresh();\n    } catch (error) {\n      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));\n      throw error;\n    }\n  }\n  dispose() {\n    this.oauthClient.removeEventListener(\"signIn\", this.signInHandler);\n    this.oauthClient.removeEventListener(\"signOut\", this.signOutHandler);\n    this.oauthClient.removeEventListener(\"refresh\", this.refreshHandler);\n    super.dispose();\n  }\n}\n\n/**\n * Creates a public OAuth auth service that wraps a PublicOauthClient\n */\nexport function createPublicOauthService(app, oauthClient) {\n  return new AuthServicePublic(app, oauthClient);\n}","/*\n * Copyright 2025 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { AuthState } from \"@palantir/pack.auth\";\nimport { AuthServiceBase } from \"./AuthServiceBase.js\";\nexport class AuthServiceStatic extends AuthServiceBase {\n  tokenProvider;\n  latestToken;\n  constructor(app, tokenProvider) {\n    super(app, app.config.logger.child({}, {\n      msgPrefix: \"AuthServiceStatic\"\n    }), AuthState.Unauthenticated);\n    this.tokenProvider = tokenProvider;\n    void this.getToken().catch(() => {});\n  }\n  async getToken() {\n    try {\n      const token = await this.tokenProvider();\n      if (this.latestToken !== token) {\n        this.latestToken = token;\n        this.notifyTokenChange(token);\n        if (this.currentState !== AuthState.Authenticated) {\n          this.updateState(AuthState.Authenticated);\n        }\n      }\n      return token;\n    } catch (error) {\n      if (this.latestToken !== undefined) {\n        this.latestToken = undefined;\n        this.notifyTokenChange(undefined);\n      }\n      this.updateState(AuthState.Error, error);\n      throw error;\n    }\n  }\n  getTokenOrUndefined() {\n    return this.latestToken;\n  }\n  isAuthenticated() {\n    return this.latestToken != null;\n  }\n  signIn() {\n    return Promise.resolve();\n  }\n  signOut() {\n    this.clearUserState();\n    this.latestToken = undefined;\n    this.updateState(AuthState.Unauthenticated);\n    return Promise.reject(new Error(\"Sign out not supported for static token providers\"));\n  }\n  dispose() {\n    super.dispose();\n    this.latestToken = undefined;\n  }\n}\n\n/**\n * Creates a static token auth service for CLI/service scenarios where a token is provided externally.\n */\nexport function createStaticTokenService(app, tokenProvider) {\n  return new AuthServiceStatic(app, tokenProvider);\n}"]}

package/build/cjs/index.d.cts

@@ -0,0 +1,90 @@
+import { createConfidentialOauthClient, PublicOauthClient } from '@osdk/oauth';
+import { PackAppInternal, Unsubscribe, TokenProvider } from '@palantir/pack.core';
+import { Logger } from '@osdk/api';
+import { BaseAuthService, AuthState, AuthStateCallback, TokenChangeCallback } from '@palantir/pack.auth';
+export { createAuthModuleConfig } from '@palantir/pack.auth';
+
+declare abstract class AuthServiceBase implements BaseAuthService {
+    protected currentState: AuthState;
+    protected isTokenValidated: boolean;
+    protected currentUserId: string | undefined;
+    protected cachedUserData: unknown;
+    private readonly stateCallbacks;
+    private readonly tokenChangeCallbacks;
+    protected currentToken?: string;
+    protected readonly app: PackAppInternal;
+    protected readonly logger: Logger;
+    constructor(app: PackAppInternal, logger: Logger, initialState?: AuthState);
+    abstract getToken(): Promise<string>;
+    protected clearUserState(): void;
+    isAuthenticated(): boolean;
+    getCurrentUserId(): string | undefined;
+    abstract getTokenOrUndefined(): string | undefined;
+    isValidated(): boolean;
+    validateToken(): Promise<boolean>;
+    abstract signIn(): Promise<void>;
+    abstract signOut(): Promise<void>;
+    refresh?(): Promise<void>;
+    onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+    onTokenChange(callback: TokenChangeCallback): Unsubscribe;
+    getCurrentState(): AuthState;
+    getUserData(userId: string, force?: boolean): Promise<unknown>;
+    dispose(): void;
+    protected notifyTokenChange(token: string | undefined): void;
+    protected updateState(newState: AuthState, error?: Error): void;
+}
+
+type ConfidentialOauthClient = ReturnType<typeof createConfidentialOauthClient>;
+declare class AuthServiceConfidential extends AuthServiceBase {
+    private readonly oauthClient;
+    constructor(app: PackAppInternal, oauthClient: ConfidentialOauthClient);
+    getToken(): Promise<string>;
+    private readonly signInHandler;
+    private readonly signOutHandler;
+    getTokenOrUndefined(): string | undefined;
+    signIn(): Promise<void>;
+    signOut(): Promise<void>;
+    dispose(): void;
+}
+/**
+ * Creates a confidential OAuth auth service that wraps a ConfidentialOauthClient
+ */
+declare function createConfidentialOauthService(app: PackAppInternal, oauthClient: ConfidentialOauthClient): AuthServiceConfidential;
+
+declare class AuthServicePublic extends AuthServiceBase {
+    private hasInitialized;
+    private readonly oauthClient;
+    constructor(app: PackAppInternal, oauthClient: PublicOauthClient);
+    getToken(): Promise<string>;
+    private readonly signInHandler;
+    private readonly signOutHandler;
+    private readonly refreshHandler;
+    getTokenOrUndefined(): string | undefined;
+    onAuthStateChange(callback: AuthStateCallback): Unsubscribe;
+    signIn(): Promise<void>;
+    signOut(): Promise<void>;
+    refresh(): Promise<void>;
+    dispose(): void;
+}
+/**
+ * Creates a public OAuth auth service that wraps a PublicOauthClient
+ */
+declare function createPublicOauthService(app: PackAppInternal, oauthClient: PublicOauthClient): AuthServicePublic;
+
+declare class AuthServiceStatic extends AuthServiceBase {
+    private readonly tokenProvider;
+    private latestToken;
+    constructor(app: PackAppInternal, tokenProvider: TokenProvider);
+    getToken(): Promise<string>;
+    getTokenOrUndefined(): string | undefined;
+    isAuthenticated(): boolean;
+    signIn(): Promise<void>;
+    signOut(): Promise<void>;
+    dispose(): void;
+}
+/**
+ * Creates a static token auth service for CLI/service scenarios where a token is provided externally.
+ */
+declare function createStaticTokenService(app: PackAppInternal, tokenProvider: TokenProvider): AuthServiceStatic;
+
+export { createConfidentialOauthService, createPublicOauthService, createStaticTokenService };