@palantir/pack.auth.foundry 0.0.1-beta.1

package/src/__tests__/AuthServiceStatic.test.ts

@@ -0,0 +1,341 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { Logger } from "@osdk/api";
+import type { Client } from "@osdk/client";
+import { Users } from "@osdk/foundry.admin";
+import { AuthState, type BaseAuthService } from "@palantir/pack.auth";
+import type { PackAppInternal, TokenProvider } from "@palantir/pack.core";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { MockProxy } from "vitest-mock-extended";
+import { mock } from "vitest-mock-extended";
+import { createStaticTokenService } from "../auth/AuthServiceStatic.js";
+
+// Mock the Users module
+vi.mock("@osdk/foundry.admin", () => ({
+  Users: {
+    getCurrent: vi.fn(),
+  },
+}));
+
+describe("StaticTokenService", () => {
+  let mockTokenProvider: TokenProvider;
+  let mockApp: PackAppInternal;
+  let mockLogger: MockProxy<Logger>;
+  let service: BaseAuthService;
+
+  beforeEach(() => {
+    mockTokenProvider = vi.fn().mockResolvedValue("static-test-token");
+    mockLogger = mock<Logger>();
+    mockLogger.child.mockReturnValue(mockLogger);
+
+    const mockOsdkClient = mock<Client>();
+
+    mockApp = {
+      config: {
+        app: { appId: "test-app" },
+        isTestMode: false,
+        logger: mockLogger,
+        osdkClient: mockOsdkClient,
+        remote: {
+          packWsPath: "/pack/ws",
+          baseUrl: "https://test.example.com",
+          fetchFn: globalThis.fetch,
+        },
+      },
+      getModule: vi.fn(),
+    };
+
+    // Mock Users.getCurrent to return a mock user
+    vi.mocked(Users.getCurrent).mockResolvedValue({
+      id: "test-user-id",
+      username: "test-user",
+      realm: "test-realm",
+      attributes: {},
+    });
+
+    service = createStaticTokenService(mockApp, mockTokenProvider);
+  });
+
+  describe("initialization", () => {
+    it("should eagerly fetch token and transition to authenticated", async () => {
+      await vi.waitFor(() => {
+        expect(service.getCurrentState()).toBe(AuthState.Authenticated);
+      });
+      expect(service.isAuthenticated()).toBe(true);
+      expect(service.getTokenOrUndefined()).toBe("static-test-token");
+      expect(mockTokenProvider).toHaveBeenCalled();
+    });
+
+    it("should start in un-validated state", () => {
+      expect(service.isValidated()).toBe(false);
+    });
+
+    it("should return undefined for getCurrentUser before validation", () => {
+      expect(service.getCurrentUserId()).toBeUndefined();
+    });
+  });
+
+  describe("getToken method", () => {
+    it("should return token from provider", async () => {
+      const token = await service.getToken();
+      expect(token).toBe("static-test-token");
+      expect(mockTokenProvider).toHaveBeenCalled();
+    });
+
+    describe("with custom token providers", () => {
+      it("should handle async token provider", async () => {
+        const customProvider = vi.fn().mockResolvedValue("async-token");
+        const customService = createStaticTokenService(mockApp, customProvider);
+
+        const token = await customService.getToken();
+        expect(token).toBe("async-token");
+      });
+
+      it("should handle token provider that throws", async () => {
+        const error = new Error("Token provider error");
+        const failingProvider = vi.fn().mockRejectedValue(error);
+        const customService = createStaticTokenService(mockApp, failingProvider);
+
+        await vi.waitFor(() => {
+          expect(customService.getCurrentState()).toBe(AuthState.Error);
+        });
+
+        await expect(customService.getToken()).rejects.toThrow("Token provider error");
+      });
+    });
+  });
+
+  describe("authentication methods", () => {
+    it("should return true for isAuthenticated after eager fetch", async () => {
+      await vi.waitFor(() => {
+        expect(service.isAuthenticated()).toBe(true);
+      });
+    });
+
+    it("should return token for getTokenOrUndefined after eager fetch", async () => {
+      await vi.waitFor(() => {
+        expect(service.getTokenOrUndefined()).toBe("static-test-token");
+      });
+    });
+
+    it("should be no-op for signIn", async () => {
+      await expect(service.signIn()).resolves.toBeUndefined();
+    });
+
+    it("should reject signOut for static token providers", async () => {
+      await expect(service.signOut()).rejects.toThrow(
+        "Sign out not supported for static token providers",
+      );
+    });
+
+    it("should not have refresh capability", () => {
+      expect(service.refresh).toBeUndefined();
+    });
+  });
+
+  describe("state management", () => {
+    it("should fire auth state change event with current state immediately", () => {
+      const callback = vi.fn();
+      const unsubscribe = service.onAuthStateChange(callback);
+
+      // First call should be immediate callback with current state (no previousState)
+      expect(callback).toHaveBeenCalledWith({
+        state: AuthState.Authenticated,
+      });
+
+      expect(typeof unsubscribe).toBe("function");
+    });
+
+    it("should allow unsubscribing from state changes", () => {
+      const callback = vi.fn();
+      const unsubscribe = service.onAuthStateChange(callback);
+
+      unsubscribe();
+      expect(typeof unsubscribe).toBe("function");
+    });
+
+    it("should maintain authenticated state after signIn", async () => {
+      await vi.waitFor(() => {
+        expect(service.getCurrentState()).toBe(AuthState.Authenticated);
+      });
+
+      await expect(service.signIn()).resolves.toBeUndefined();
+      expect(service.getCurrentState()).toBe(AuthState.Authenticated);
+    });
+  });
+
+  describe("token validation", () => {
+    beforeEach(() => {
+      global.fetch = vi.fn();
+    });
+
+    it("should validate token successfully with baseUrl", async () => {
+      await service.getToken();
+
+      const isValid = await service.validateToken();
+
+      expect(isValid).toBe(true);
+      expect(service.isValidated()).toBe(true);
+      expect(service.getCurrentUserId()).toBeDefined();
+      expect(Users.getCurrent).toHaveBeenCalledWith(mockApp.config.osdkClient);
+    });
+
+    it("should handle validation failure", async () => {
+      vi.mocked(Users.getCurrent).mockRejectedValueOnce(new Error("Unauthorized"));
+
+      await service.getToken();
+
+      const isValid = await service.validateToken();
+
+      expect(isValid).toBe(false);
+      expect(service.isValidated()).toBe(false);
+      expect(service.getCurrentUserId()).toBeUndefined();
+    });
+
+    it("should handle network errors during validation", async () => {
+      vi.mocked(Users.getCurrent).mockRejectedValueOnce(new Error("Network error"));
+
+      await service.getToken();
+
+      const isValid = await service.validateToken();
+
+      expect(isValid).toBe(false);
+      expect(service.isValidated()).toBe(false);
+      expect(service.getCurrentUserId()).toBeUndefined();
+    });
+
+    describe("in test mode", () => {
+      it("should always return true for validation without baseUrl", async () => {
+        vi.clearAllMocks();
+
+        const testModeApp: PackAppInternal = {
+          config: {
+            app: { appId: "test-app" },
+            isTestMode: true,
+            logger: mockLogger,
+            osdkClient: mock<Client>(),
+            remote: {
+              packWsPath: "/pack/ws",
+              baseUrl: "https://localhost:5173",
+              fetchFn: globalThis.fetch,
+            },
+          },
+          getModule: vi.fn(),
+        };
+
+        service = createStaticTokenService(testModeApp, mockTokenProvider);
+        await service.getToken();
+
+        const isValid = await service.validateToken();
+
+        expect(isValid).toBe(true);
+        expect(service.isValidated()).toBe(true);
+        expect(service.getCurrentUserId()).toBeUndefined();
+        expect(Users.getCurrent).not.toHaveBeenCalled();
+      });
+    });
+
+    it("should reset validation state on signOut", async () => {
+      await service.getToken();
+
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: () => Promise.resolve({ userId: "test-user" }),
+      });
+      await service.validateToken();
+
+      expect(service.isValidated()).toBe(true);
+
+      await expect(service.signOut()).rejects.toThrow();
+
+      expect(service.isValidated()).toBe(false);
+      expect(service.getCurrentUserId()).toBeUndefined();
+    });
+  });
+
+  describe("cleanup", () => {
+    it("should clear state callbacks on dispose", () => {
+      const callback = vi.fn();
+      service.onAuthStateChange(callback);
+
+      service.dispose();
+
+      expect(() => {
+        service.dispose();
+      }).not.toThrow();
+    });
+
+    it("should reset validation state on dispose", async () => {
+      global.fetch = vi.fn().mockResolvedValue({
+        ok: true,
+        json: () => Promise.resolve({ userId: "test-user" }),
+      });
+
+      await service.getToken();
+      await service.validateToken();
+
+      expect(service.isValidated()).toBe(true);
+
+      service.dispose();
+
+      expect(service.isValidated()).toBe(false);
+      expect(service.getCurrentUserId()).toBeUndefined();
+    });
+
+    it("should not affect token provider after dispose", async () => {
+      await service.getToken();
+
+      service.dispose();
+
+      const token = await service.getToken();
+      expect(token).toBe("static-test-token");
+    });
+  });
+
+  describe("multiple instances", () => {
+    it("should create independent services", () => {
+      const provider1 = vi.fn().mockResolvedValue("token1");
+      const provider2 = vi.fn().mockResolvedValue("token2");
+
+      const service1 = createStaticTokenService(mockApp, provider1);
+      const service2 = createStaticTokenService(mockApp, provider2);
+
+      expect(service1).not.toBe(service2);
+      expect(service1.getCurrentState()).toBe(AuthState.Unauthenticated);
+      expect(service2.getCurrentState()).toBe(AuthState.Unauthenticated);
+    });
+
+    it("should handle different token provider behaviors", async () => {
+      const syncProvider = () => Promise.resolve("sync-token");
+      const asyncProvider = async () => {
+        await new Promise(resolve => setTimeout(resolve, 10));
+        return "async-token";
+      };
+
+      const syncService = createStaticTokenService(mockApp, syncProvider);
+      const asyncService = createStaticTokenService(mockApp, asyncProvider);
+
+      const [syncToken, asyncToken] = await Promise.all([
+        syncService.getToken(),
+        asyncService.getToken(),
+      ]);
+
+      expect(syncToken).toBe("sync-token");
+      expect(asyncToken).toBe("async-token");
+    });
+  });
+});

package/src/auth/AuthServiceBase.ts

@@ -0,0 +1,201 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { Logger } from "@osdk/api";
+import { Users } from "@osdk/foundry.admin";
+import {
+  AuthState,
+  type AuthStateCallback,
+  type AuthStateChangeEvent,
+  type BaseAuthService,
+  type TokenChangeCallback,
+} from "@palantir/pack.auth";
+import type { PackAppInternal, Unsubscribe } from "@palantir/pack.core";
+import { parseJwtToken } from "../utils/jwtUtils.js";
+
+export abstract class AuthServiceBase implements BaseAuthService {
+  protected currentState: AuthState;
+  protected isTokenValidated = false;
+  protected currentUserId: string | undefined;
+  protected cachedUserData: unknown;
+  private readonly stateCallbacks: Set<AuthStateCallback> = new Set<AuthStateCallback>();
+  private readonly tokenChangeCallbacks = new Set<TokenChangeCallback>();
+  protected currentToken?: string;
+  protected readonly app: PackAppInternal;
+  protected readonly logger: Logger;
+
+  constructor(
+    app: PackAppInternal,
+    logger: Logger,
+    initialState: AuthState = AuthState.Unauthenticated,
+  ) {
+    this.app = app;
+    this.logger = logger;
+    this.currentState = initialState;
+  }
+
+  abstract getToken(): Promise<string>;
+
+  protected clearUserState(): void {
+    this.isTokenValidated = false;
+    this.currentUserId = undefined;
+    this.cachedUserData = undefined;
+  }
+
+  isAuthenticated(): boolean {
+    return this.getTokenOrUndefined() != null;
+  }
+
+  getCurrentUserId(): string | undefined {
+    return this.isTokenValidated ? this.currentUserId : undefined;
+  }
+
+  abstract getTokenOrUndefined(): string | undefined;
+
+  isValidated(): boolean {
+    return this.isTokenValidated;
+  }
+
+  async validateToken(): Promise<boolean> {
+    if (!this.isAuthenticated()) {
+      this.clearUserState();
+      return false;
+    }
+
+    if (this.app.config.isTestMode) {
+      this.isTokenValidated = true;
+      return true;
+    }
+
+    try {
+      const user = await Users.getCurrent(this.app.config.osdkClient);
+      this.isTokenValidated = true;
+      this.cachedUserData = user;
+      this.currentUserId = user.id;
+      return true;
+    } catch (error) {
+      this.logger.error("Token validation failed", error);
+      this.clearUserState();
+      return false;
+    }
+  }
+
+  abstract signIn(): Promise<void>;
+
+  abstract signOut(): Promise<void>;
+
+  refresh?(): Promise<void>;
+
+  onAuthStateChange(callback: AuthStateCallback): Unsubscribe {
+    this.stateCallbacks.add(callback);
+
+    try {
+      callback({
+        state: this.currentState,
+      });
+    } catch (err) {
+      this.logger.error("Error in auth state callback:", err);
+    }
+
+    return () => {
+      this.stateCallbacks.delete(callback);
+    };
+  }
+
+  onTokenChange(callback: TokenChangeCallback): Unsubscribe {
+    this.tokenChangeCallbacks.add(callback);
+
+    // Immediately notify with current token if available
+    const token = this.getTokenOrUndefined();
+    if (token != null) {
+      const info = parseJwtToken(token) ?? {};
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    }
+
+    return () => {
+      this.tokenChangeCallbacks.delete(callback);
+    };
+  }
+
+  getCurrentState(): AuthState {
+    return this.currentState;
+  }
+
+  async getUserData(userId: string, force?: boolean): Promise<unknown> {
+    if (!this.isTokenValidated || !this.currentUserId || this.currentUserId !== userId) {
+      throw new Error(`User data not available for userId: ${userId}`);
+    }
+
+    if (!force && this.cachedUserData) {
+      return this.cachedUserData;
+    }
+
+    if (this.app.config.isTestMode) {
+      throw new Error("Cannot refresh user data in test mode");
+    }
+
+    try {
+      // TODO: debounce and use Users.getBatch for efficiency when looking up multiple users
+      const user = await Users.get(this.app.config.osdkClient, userId);
+      this.cachedUserData = user;
+      return user;
+    } catch (error) {
+      this.logger.error("Failed to refresh user data", error);
+      throw new Error("Failed to refresh user data");
+    }
+  }
+
+  dispose(): void {
+    this.stateCallbacks.clear();
+    this.tokenChangeCallbacks.clear();
+    this.clearUserState();
+  }
+
+  protected notifyTokenChange(token: string | undefined): void {
+    const info = (token != null ? parseJwtToken(token) : undefined) ?? {};
+
+    this.tokenChangeCallbacks.forEach(callback => {
+      try {
+        callback(token, info);
+      } catch (err) {
+        this.logger.error("Error in token change callback:", err);
+      }
+    });
+  }
+
+  protected updateState(newState: AuthState, error?: Error): void {
+    const previousState = this.currentState;
+    this.currentState = newState;
+
+    const event: AuthStateChangeEvent = {
+      previousState,
+      state: newState,
+      error,
+    };
+
+    this.stateCallbacks.forEach(callback => {
+      try {
+        callback(event);
+      } catch (err) {
+        this.logger.error("Error in auth state callback:", err);
+      }
+    });
+  }
+}

package/src/auth/AuthServiceConfidential.ts

@@ -0,0 +1,96 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { createConfidentialOauthClient } from "@osdk/oauth";
+import { AuthState } from "@palantir/pack.auth";
+import type { PackAppInternal } from "@palantir/pack.core";
+import { AuthServiceBase } from "./AuthServiceBase.js";
+
+type ConfidentialOauthClient = ReturnType<typeof createConfidentialOauthClient>;
+
+export class AuthServiceConfidential extends AuthServiceBase {
+  private readonly oauthClient: ConfidentialOauthClient;
+
+  constructor(app: PackAppInternal, oauthClient: ConfidentialOauthClient) {
+    const initialState = oauthClient.getTokenOrUndefined()
+      ? AuthState.Authenticated
+      : AuthState.Unauthenticated;
+    super(
+      app,
+      app.config.logger.child({}, { msgPrefix: "AuthServiceConfidential" }),
+      initialState,
+    );
+    this.oauthClient = oauthClient;
+
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+  }
+
+  override async getToken(): Promise<string> {
+    return this.oauthClient();
+  }
+
+  private readonly signInHandler = () => {
+    this.updateState(AuthState.Authenticated);
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+  };
+
+  private readonly signOutHandler = () => {
+    this.updateState(AuthState.Unauthenticated);
+    this.notifyTokenChange(undefined);
+  };
+
+  override getTokenOrUndefined(): string | undefined {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+
+  override async signIn(): Promise<void> {
+    try {
+      this.updateState(AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+
+  override async signOut(): Promise<void> {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+
+  override dispose(): void {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    super.dispose();
+  }
+}
+
+/**
+ * Creates a confidential OAuth auth service that wraps a ConfidentialOauthClient
+ */
+export function createConfidentialOauthService(
+  app: PackAppInternal,
+  oauthClient: ConfidentialOauthClient,
+): AuthServiceConfidential {
+  return new AuthServiceConfidential(app, oauthClient);
+}