@palantir/pack.auth.foundry 0.0.1-beta.1

package/src/auth/AuthServicePublic.ts

@@ -0,0 +1,124 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { PublicOauthClient } from "@osdk/oauth";
+import { AuthState, type AuthStateCallback } from "@palantir/pack.auth";
+import type { PackAppInternal, Unsubscribe } from "@palantir/pack.core";
+import { AuthServiceBase } from "./AuthServiceBase.js";
+
+export class AuthServicePublic extends AuthServiceBase {
+  private hasInitialized = false;
+  private readonly oauthClient: PublicOauthClient;
+
+  constructor(app: PackAppInternal, oauthClient: PublicOauthClient) {
+    super(
+      app,
+      app.config.logger.child({}, { msgPrefix: "AuthServicePublic" }),
+      AuthState.Initializing,
+    );
+    this.oauthClient = oauthClient;
+
+    this.oauthClient.addEventListener("signIn", this.signInHandler);
+    this.oauthClient.addEventListener("signOut", this.signOutHandler);
+    this.oauthClient.addEventListener("refresh", this.refreshHandler);
+  }
+
+  override async getToken(): Promise<string> {
+    return this.oauthClient();
+  }
+
+  private readonly signInHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(AuthState.Authenticated);
+  };
+
+  private readonly signOutHandler = () => {
+    this.notifyTokenChange(undefined);
+    this.updateState(AuthState.Unauthenticated);
+  };
+
+  private readonly refreshHandler = () => {
+    const token = this.getTokenOrUndefined();
+    this.notifyTokenChange(token);
+    this.updateState(AuthState.Authenticated);
+  };
+
+  override getTokenOrUndefined(): string | undefined {
+    return this.oauthClient.getTokenOrUndefined();
+  }
+
+  override onAuthStateChange(callback: AuthStateCallback): Unsubscribe {
+    const unsubscribe = super.onAuthStateChange(callback);
+
+    if (!this.hasInitialized && this.currentState === AuthState.Initializing) {
+      this.hasInitialized = true;
+      void this.signIn().catch(() => {
+        // Don't allow unhandled rejection to bubble up, mostly for testing.
+        // Note the signIn method will log errors and throw for promise consumers,
+        // but we don't need to handle anything here.
+      });
+    }
+
+    return unsubscribe;
+  }
+
+  override async signIn(): Promise<void> {
+    try {
+      this.updateState(AuthState.Authenticating);
+      await this.oauthClient.signIn();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+
+  override async signOut(): Promise<void> {
+    try {
+      this.clearUserState();
+      await this.oauthClient.signOut();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+
+  override async refresh(): Promise<void> {
+    try {
+      await this.oauthClient.refresh();
+    } catch (error) {
+      this.updateState(AuthState.Error, error instanceof Error ? error : new Error(String(error)));
+      throw error;
+    }
+  }
+
+  override dispose(): void {
+    this.oauthClient.removeEventListener("signIn", this.signInHandler);
+    this.oauthClient.removeEventListener("signOut", this.signOutHandler);
+    this.oauthClient.removeEventListener("refresh", this.refreshHandler);
+    super.dispose();
+  }
+}
+
+/**
+ * Creates a public OAuth auth service that wraps a PublicOauthClient
+ */
+export function createPublicOauthService(
+  app: PackAppInternal,
+  oauthClient: PublicOauthClient,
+): AuthServicePublic {
+  return new AuthServicePublic(app, oauthClient);
+}

package/src/auth/AuthServiceStatic.ts

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { AuthState } from "@palantir/pack.auth";
+import type { PackAppInternal, TokenProvider } from "@palantir/pack.core";
+import { AuthServiceBase } from "./AuthServiceBase.js";
+
+export class AuthServiceStatic extends AuthServiceBase {
+  private readonly tokenProvider: TokenProvider;
+  private latestToken: string | undefined;
+
+  constructor(app: PackAppInternal, tokenProvider: TokenProvider) {
+    super(
+      app,
+      app.config.logger.child({}, { msgPrefix: "AuthServiceStatic" }),
+      AuthState.Unauthenticated,
+    );
+    this.tokenProvider = tokenProvider;
+    void this.getToken().catch(() => {});
+  }
+
+  override async getToken(): Promise<string> {
+    try {
+      const token = await this.tokenProvider();
+
+      if (this.latestToken !== token) {
+        this.latestToken = token;
+        this.notifyTokenChange(token);
+        if (this.currentState !== AuthState.Authenticated) {
+          this.updateState(AuthState.Authenticated);
+        }
+      }
+
+      return token;
+    } catch (error) {
+      if (this.latestToken !== undefined) {
+        this.latestToken = undefined;
+        this.notifyTokenChange(undefined);
+      }
+      this.updateState(AuthState.Error, error as Error);
+      throw error;
+    }
+  }
+
+  override getTokenOrUndefined(): string | undefined {
+    return this.latestToken;
+  }
+
+  override isAuthenticated(): boolean {
+    return this.latestToken != null;
+  }
+
+  override signIn(): Promise<void> {
+    return Promise.resolve();
+  }
+
+  override signOut(): Promise<void> {
+    this.clearUserState();
+    this.latestToken = undefined;
+    this.updateState(AuthState.Unauthenticated);
+    return Promise.reject(new Error("Sign out not supported for static token providers"));
+  }
+
+  override dispose(): void {
+    super.dispose();
+    this.latestToken = undefined;
+  }
+}
+
+/**
+ * Creates a static token auth service for CLI/service scenarios where a token is provided externally.
+ */
+export function createStaticTokenService(
+  app: PackAppInternal,
+  tokenProvider: TokenProvider,
+): AuthServiceStatic {
+  return new AuthServiceStatic(app, tokenProvider);
+}

package/src/index.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+export { createConfidentialOauthService } from "./auth/AuthServiceConfidential.js";
+export { createPublicOauthService } from "./auth/AuthServicePublic.js";
+export { createStaticTokenService } from "./auth/AuthServiceStatic.js";
+export { createAuthModuleConfig } from "./AuthModuleConfig.js";

package/src/utils/jwtUtils.ts

@@ -0,0 +1,127 @@
+/*
+ * Copyright 2025 Palantir Technologies, Inc. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { UserId } from "@palantir/pack.auth";
+
+/**
+ * Decode a Palantir-specific JWT claim that stores UUIDs as 16-byte arrays.
+ * These are the sub, sid, jti, and org claims.
+ */
+function maybeDecodeUuidClaim(value: unknown): string | undefined {
+  if (!Array.isArray(value)) {
+    return undefined;
+  }
+
+  if (value.length === 16 && value.every(v => typeof v === "number")) {
+    // Convert 16-byte array to UUID string
+    return decodeUuidBytes(value);
+  }
+
+  return undefined;
+}
+
+/**
+ * Convert a 16-byte array to UUID string format.
+ * Based on Palantir's UUID encoding format.
+ */
+function decodeUuidBytes(bytes: readonly number[]): string {
+  if (bytes.length !== 16) {
+    return "";
+  }
+
+  // Convert bytes to hex string
+  const hex = bytes.map(b => b.toString(16).padStart(2, "0")).join("");
+
+  // Format as UUID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32),
+  ].join("-");
+}
+
+/**
+ * Represents the parsed payload from a JWT token (unverified).
+ * The information provided should not be used for security-sensitive
+ * applications unless verified through some other process.
+ */
+export interface UnverifiedTokenInfo {
+  readonly expiryInstantUtc?: number;
+  readonly orgId?: string;
+  readonly sessionId?: string;
+  readonly tokenId?: string;
+  readonly userId?: UserId;
+}
+
+/**
+ * Parse JWT token to extract unverified claims including userId, sessionId, tokenId, organizationId, and expiry.
+ * This does NOT verify the token signature - it only extracts payload data.
+ *
+ * @param token - JWT token string
+ * @returns Unverified token info or undefined if parsing fails
+ */
+export function parseJwtToken(token: string): UnverifiedTokenInfo | undefined {
+  if (!token) {
+    return undefined;
+  }
+
+  try {
+    // JWT tokens have 3 parts separated by dots: header.payload.signature
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return undefined;
+    }
+
+    // Decode the payload (second part)
+    const payload = parts[1];
+    if (!payload) {
+      return undefined;
+    }
+
+    // Add padding if needed for base64 decoding
+    const paddedPayload = payload.padEnd(payload.length + (4 - payload.length % 4) % 4, "=");
+
+    const decoded = JSON.parse(atob(paddedPayload)) as Record<string, unknown>;
+
+    return {
+      // JWT exp is seconds since epoch, convert to ms
+      expiryInstantUtc: typeof decoded.exp === "number" ? decoded.exp * 1000 : undefined,
+      orgId: maybeDecodeUuidClaim(decoded.org),
+      sessionId: maybeDecodeUuidClaim(decoded.sid),
+      tokenId: maybeDecodeUuidClaim(decoded.jti),
+      userId: maybeDecodeUuidClaim(decoded.sub),
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Check if a JWT token is expired based on its exp claim (unverified).
+ *
+ * @param tokenInfo - Unverified token info
+ * @returns true if token is expired, false if valid or no expiry info
+ */
+export function isTokenExpired(tokenInfo: UnverifiedTokenInfo): boolean {
+  if (!tokenInfo.expiryInstantUtc) {
+    return false; // No expiry info, assume valid
+  }
+
+  const now = Date.now();
+  return tokenInfo.expiryInstantUtc < now;
+}

package/tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "extends": "@palantir/pack.monorepo.tsconfig/base.json",
+  "compilerOptions": {
+    "outDir": "./build/esm",
+    "rootDir": "./src",
+    "declarationDir": "./build/types",
+    "tsBuildInfoFile": "./build/tsconfig.tsbuildinfo"
+  },
+  "include": [
+    "src/**/*"
+  ],
+  "exclude": [
+    "build",
+    "dist",
+    "node_modules",
+    "test-output",
+    "**/__tests__/**/__snapshots__",
+    "**/__tests__/**/fixtures"
+  ],
+  "references": []
+}

package/vitest.config.mjs

@@ -0,0 +1,26 @@
+import { coverageConfigDefaults, defaultExclude, defineProject } from "vitest/config";
+
+export default defineProject({
+  test: {
+    exclude: [...defaultExclude, "**/build/**", "**/test-output/**"],
+    coverage: {
+      provider: "v8",
+      all: true,
+      enabled: true,
+      pool: "forks",
+      include: ["src/**/*.{ts,tsx}"],
+      exclude: [
+        ...coverageConfigDefaults.exclude,
+        "**/*.test.{ts,tsx}",
+        "**/__tests__",
+        "build",
+        "coverage",
+        "dist",
+        "node_modules",
+        "src/index.ts",
+        "test-output",
+        "vitest.config.*",
+      ],
+    },
+  },
+});