@pattern-stack/codegen 0.15.1 → 0.15.3

package/dist/runtime/subsystems/auth/index.js

@@ -1,546 +1,57 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
-
-// runtime/subsystems/auth/protocols/oauth-state-store.ts
-var OAuthStateError = class extends Error {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "OAuthStateError";
-  }
-  reason;
-};
-
-// runtime/subsystems/token-key.ts
-var PKG = "@pattern-stack/codegen";
-var tokenKey = (area, name) => `${PKG}.${area}.${name}`;
-
-// runtime/subsystems/auth/auth.tokens.ts
-var ENCRYPTION_KEY = Symbol.for(tokenKey("auth", "encryption-key"));
-var OAUTH_STATE_STORE = Symbol.for(tokenKey("auth", "oauth-state-store"));
-var AUTH_CONNECTION_READER = Symbol.for(tokenKey("auth", "connection-reader"));
-var AUTH_CONNECTION_TOKEN_WRITER = Symbol.for(tokenKey("auth", "connection-token-writer"));
-var AUTH_CONNECTION_GRANT_SINK = Symbol.for(tokenKey("auth", "connection-grant-sink"));
-var AUTH_USER_CONTEXT = Symbol.for(tokenKey("auth", "user-context"));
-var STRATEGY_REGISTRY = Symbol.for(tokenKey("auth", "strategy-registry"));
-var AUTH_OPTIONS = Symbol.for(tokenKey("auth", "options"));
-
-// runtime/subsystems/auth/runtime/connection-broken.error.ts
-var ConnectionBrokenError = class extends Error {
-  constructor(connectionId, errorCode, errorDescription) {
-    super(
-      `Connection ${connectionId} broken: ${errorCode} - ${errorDescription}`
-    );
-    this.connectionId = connectionId;
-    this.errorCode = errorCode;
-    this.errorDescription = errorDescription;
-    this.name = "ConnectionBrokenError";
-  }
-  connectionId;
-  errorCode;
-  errorDescription;
-};
-
-// runtime/subsystems/auth/runtime/oauth2-refresh.strategy.ts
-var REFRESH_SAFETY_MS = 5 * 60 * 1e3;
-var OAuth2RefreshStrategy = class {
-  connectionReader;
-  tokenWriter;
-  fetchImpl;
-  now;
-  constructor(opts) {
-    this.connectionReader = opts.connectionReader;
-    this.tokenWriter = opts.tokenWriter;
-    this.fetchImpl = opts.fetch ?? fetch;
-    this.now = opts.now ?? Date.now;
-  }
-  async resolve(connectionId, opts = {}) {
-    const connection = await this.connectionReader.findByIdDecrypted(connectionId);
-    if (!connection) {
-      throw new Error(`Connection ${connectionId} not found`);
-    }
-    if (connection.provider !== this.provider) {
-      throw new Error(
-        `${this.constructor.name} called for non-${this.provider} connection ${connectionId} (provider=${connection.provider})`
-      );
-    }
-    const needsRefresh = opts.forceRefresh || this.isExpiring(connection.expiresAt) || !connection.accessToken;
-    if (!needsRefresh) {
-      return this.buildCredentials(connection.accessToken, connection);
-    }
-    if (!connection.refreshToken) {
-      throw new ConnectionBrokenError(
-        connectionId,
-        "no_refresh_token",
-        "Connection has no refresh token; user must reconnect"
-      );
-    }
-    const { parsed, raw } = await this.executeRefresh(
-      connectionId,
-      connection.refreshToken
-    );
-    const newExpiresAt = new Date(
-      this.now() + (parsed.expiresInSec ?? this.defaultExpiresInSec) * 1e3
-    );
-    await this.tokenWriter.persistRefresh({
-      connectionId,
-      accessToken: parsed.accessToken,
-      refreshToken: parsed.refreshToken ?? void 0,
-      expiresAt: newExpiresAt
-    });
-    return this.buildCredentials(parsed.accessToken, connection, raw);
-  }
-  async executeRefresh(connectionId, refreshToken) {
-    const body = new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      ...this.refreshBodyExtras()
-    });
-    const response = await this.fetchImpl(this.tokenEndpoint(), {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: body.toString()
-    });
-    if (!response.ok) {
-      const err = await safeJson(response);
-      if (response.status === 400 && (err.error === "invalid_grant" || err.error === "invalid_token")) {
-        throw new ConnectionBrokenError(
-          connectionId,
-          err.error ?? "invalid_grant",
-          err.error_description ?? err.message ?? "refresh token rejected"
-        );
-      }
-      throw new Error(
-        `${this.provider} token refresh failed: ${response.status} ${err.error ?? ""} ${err.error_description ?? err.message ?? ""}`.trim()
-      );
-    }
-    const raw = await response.json();
-    return { parsed: this.parseRefreshResponse(raw), raw };
-  }
-  isExpiring(expiresAt) {
-    if (!expiresAt) return true;
-    return expiresAt.getTime() - this.now() < REFRESH_SAFETY_MS;
-  }
-};
-async function safeJson(response) {
-  try {
-    return await response.clone().json();
-  } catch {
-    return {};
-  }
-}
-
-// runtime/subsystems/auth/runtime/session-expired.error.ts
-var SessionExpiredError = class extends Error {
-  /** Duck-type marker — works across package boundaries where `instanceof` fails. */
-  isSessionExpired = true;
-  constructor(message = "Access token rejected by provider") {
-    super(message);
-    this.name = "SessionExpiredError";
-  }
-};
-function isSessionExpiredError(err) {
-  if (err instanceof SessionExpiredError) return true;
-  if (err !== null && typeof err === "object" && "isSessionExpired" in err) {
-    return err.isSessionExpired === true;
-  }
-  return false;
-}
-
-// runtime/subsystems/auth/runtime/with-auth-retry.ts
-async function withAuthRetry(authStrategy, connectionId, op, options = {}) {
-  const classify = options.isSessionExpired ?? isSessionExpiredError;
-  let creds = await authStrategy.resolve(connectionId);
-  try {
-    return await op(creds);
-  } catch (e) {
-    if (!classify(e)) throw e;
-    creds = await authStrategy.resolve(connectionId, { forceRefresh: true });
-    return op(creds);
-  }
-}
-
-// runtime/subsystems/auth/auth-oauth-state.schema.ts
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
-var authOAuthState = pgTable("auth_oauth_state", {
-  state: text("state").primaryKey(),
-  userId: text("user_id").notNull(),
-  redirect: text("redirect"),
-  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
-});
-
-// runtime/subsystems/auth/backends/encryption-key/env.ts
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var ALGO = "aes-256-gcm";
-var NONCE_BYTES = 12;
-var TAG_BYTES = 16;
-var KEY_BYTES = 32;
-var EnvEncryptionKey = class {
-  key;
-  constructor(opts = {}) {
-    const env = opts.env ?? process.env;
-    const envVar = opts.envVar ?? "INTEGRATION_TOKEN_ENCRYPTION_KEY";
-    const raw = env[envVar];
-    if (!raw) {
-      throw new Error(
-        `EnvEncryptionKey: ${envVar} is not set. Generate with: openssl rand -base64 32`
-      );
-    }
-    const decoded = Buffer.from(raw, "base64");
-    if (decoded.length !== KEY_BYTES) {
-      throw new Error(
-        `EnvEncryptionKey: ${envVar} must decode to ${KEY_BYTES} bytes (got ${decoded.length}). Use: openssl rand -base64 32`
-      );
-    }
-    this.key = decoded;
-  }
-  async encrypt(plaintext) {
-    const nonce = randomBytes(NONCE_BYTES);
-    const cipher = createCipheriv(ALGO, this.key, nonce);
-    const ciphertext = Buffer.concat([
-      cipher.update(plaintext, "utf8"),
-      cipher.final()
-    ]);
-    const authTag = cipher.getAuthTag();
-    return Buffer.concat([nonce, ciphertext, authTag]).toString("base64");
-  }
-  async decrypt(ciphertext) {
-    const buf = Buffer.from(ciphertext, "base64");
-    if (buf.length < NONCE_BYTES + TAG_BYTES) {
-      throw new Error("EnvEncryptionKey: ciphertext too short");
-    }
-    const nonce = buf.subarray(0, NONCE_BYTES);
-    const authTag = buf.subarray(buf.length - TAG_BYTES);
-    const body = buf.subarray(NONCE_BYTES, buf.length - TAG_BYTES);
-    const decipher = createDecipheriv(ALGO, this.key, nonce);
-    decipher.setAuthTag(authTag);
-    const plain = Buffer.concat([decipher.update(body), decipher.final()]);
-    return plain.toString("utf8");
-  }
-};
-
-// runtime/subsystems/auth/backends/state-store.memory-backend.ts
-import { randomBytes as randomBytes2 } from "crypto";
-var MemoryOAuthStateStore = class {
-  store = /* @__PURE__ */ new Map();
-  ttlMs;
-  now;
-  generateToken;
-  constructor(opts = {}) {
-    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1e3;
-    this.now = opts.now ?? (() => Date.now());
-    this.generateToken = opts.generateToken ?? (() => randomBytes2(32).toString("base64url"));
-  }
-  async generate(record) {
-    const state = this.generateToken();
-    this.store.set(state, {
-      record: { ...record },
-      expiresAt: this.now() + this.ttlMs
-    });
-    return state;
-  }
-  async consume(state) {
-    const slot = this.store.get(state);
-    if (!slot) {
-      throw new OAuthStateError(
-        `OAuth state token unknown or already consumed`,
-        "missing"
-      );
-    }
-    this.store.delete(state);
-    if (slot.expiresAt <= this.now()) {
-      throw new OAuthStateError(`OAuth state token expired`, "expired");
-    }
-    return slot.record;
-  }
-};
-
-// runtime/subsystems/auth/backends/state-store.drizzle-backend.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { eq } from "drizzle-orm";
-var DrizzleOAuthStateStore = class {
-  constructor(db, opts = {}) {
-    this.db = db;
-    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1e3;
-    this.now = opts.now ?? (() => Date.now());
-    this.generateToken = opts.generateToken ?? (() => randomBytes3(32).toString("base64url"));
-  }
-  db;
-  ttlMs;
-  now;
-  generateToken;
-  async generate(record) {
-    const state = this.generateToken();
-    const expiresAt = new Date(this.now() + this.ttlMs);
-    await this.db.insert(authOAuthState).values({
-      state,
-      userId: record.userId,
-      redirect: record.redirect ?? null,
-      expiresAt
-    });
-    return state;
-  }
-  async consume(state) {
-    const rows = await this.db.delete(authOAuthState).where(eq(authOAuthState.state, state)).returning();
-    const row = rows[0];
-    if (!row) {
-      throw new OAuthStateError(
-        `OAuth state token unknown or already consumed`,
-        "missing"
-      );
-    }
-    if (row.expiresAt.getTime() <= this.now()) {
-      throw new OAuthStateError(`OAuth state token expired`, "expired");
-    }
-    return {
-      userId: row.userId,
-      redirect: row.redirect ?? void 0
-    };
-  }
-};
-
-// runtime/subsystems/auth/controllers/auth.controller.ts
+import "../../../chunk-7C3FOSDI.js";
 import {
-  Controller,
-  Get,
-  Inject,
-  Param,
-  Query,
-  Req,
-  Res,
-  HttpException,
-  HttpStatus
-} from "@nestjs/common";
-var AuthController = class {
-  constructor(registry, userContext, stateStore, grantSink, options) {
-    this.registry = registry;
-    this.userContext = userContext;
-    this.stateStore = stateStore;
-    this.grantSink = grantSink;
-    this.options = options;
-  }
-  registry;
-  userContext;
-  stateStore;
-  grantSink;
-  options;
-  async connect(slug, redirect, req, res) {
-    const strategy = this.requireStrategy(slug);
-    const userId = await this.userContext.getCurrentUserId(req);
-    const state = await this.stateStore.generate({ userId, redirect });
-    const url = strategy.buildAuthorizeUrl({
-      state,
-      redirectUri: this.redirectUriFor(slug)
-    });
-    return res.redirect(HttpStatus.FOUND, url);
-  }
-  async callback(slug, code, state, res) {
-    const strategy = this.requireStrategy(slug);
-    if (!code) {
-      throw new HttpException(
-        `Missing 'code' query param`,
-        HttpStatus.BAD_REQUEST
-      );
-    }
-    if (!state) {
-      throw new HttpException(
-        `Missing 'state' query param`,
-        HttpStatus.BAD_REQUEST
-      );
-    }
-    const { userId, redirect } = await this.stateStore.consume(state);
-    const tokens = await strategy.exchangeCodeForTokens({
-      code,
-      redirectUri: this.redirectUriFor(slug)
-    });
-    await this.grantSink.createOrUpdateFromOAuthGrant({
-      userId,
-      provider: slug,
-      accessToken: tokens.accessToken,
-      refreshToken: tokens.refreshToken,
-      expiresAt: tokens.expiresAt,
-      scope: tokens.scope,
-      externalAccountId: tokens.externalAccountId,
-      providerMetadata: tokens.providerMetadata
-    });
-    return res.redirect(
-      HttpStatus.FOUND,
-      redirect ?? `/settings/connections?connected=${encodeURIComponent(slug)}`
-    );
-  }
-  requireStrategy(slug) {
-    const strategy = this.registry.get(slug);
-    if (!strategy) {
-      throw new HttpException(
-        `Unknown provider '${slug}'`,
-        HttpStatus.NOT_FOUND
-      );
-    }
-    return strategy;
-  }
-  redirectUriFor(slug) {
-    const base = this.options.redirectUriBase;
-    if (!base) {
-      throw new Error(
-        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`
-      );
-    }
-    const trimmed = base.replace(/\/+$/, "");
-    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;
-  }
-};
-__decorateClass([
-  Get(":provider/connect"),
-  __decorateParam(0, Param("provider")),
-  __decorateParam(1, Query("redirect")),
-  __decorateParam(2, Req()),
-  __decorateParam(3, Res())
-], AuthController.prototype, "connect", 1);
-__decorateClass([
-  Get(":provider/callback"),
-  __decorateParam(0, Param("provider")),
-  __decorateParam(1, Query("code")),
-  __decorateParam(2, Query("state")),
-  __decorateParam(3, Res())
-], AuthController.prototype, "callback", 1);
-AuthController = __decorateClass([
-  Controller("auth"),
-  __decorateParam(0, Inject(STRATEGY_REGISTRY)),
-  __decorateParam(1, Inject(AUTH_USER_CONTEXT)),
-  __decorateParam(2, Inject(OAUTH_STATE_STORE)),
-  __decorateParam(3, Inject(AUTH_CONNECTION_GRANT_SINK)),
-  __decorateParam(4, Inject(AUTH_OPTIONS))
-], AuthController);
-
-// runtime/base-classes/tenant-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var als = new AsyncLocalStorage();
-function withRequester(ctx, fn) {
-  return als.run(ctx, fn);
-}
-
-// runtime/subsystems/auth/middleware/requester-context.ts
-async function resolveRequesterContext(userContext, req) {
-  if (typeof userContext.resolveRequester === "function") {
-    const ctx = await userContext.resolveRequester(req);
-    return ctx?.userId ? ctx : void 0;
-  }
-  const userId = await userContext.getCurrentUserId(req);
-  return userId ? { userId, organizationId: null } : void 0;
-}
-function makeRequesterContextMiddleware(userContext, options = {}) {
-  const onUnresolved = options.onUnresolved ?? "unscoped";
-  return (req, _res, next) => {
-    resolveRequesterContext(userContext, req).then(
-      (ctx) => {
-        if (!ctx) {
-          next();
-          return;
-        }
-        withRequester(ctx, async () => {
-          next();
-        });
-      },
-      (err) => {
-        if (onUnresolved === "reject") {
-          next(err);
-          return;
-        }
-        next();
-      }
-    );
-  };
-}
-function installRequesterContext(app, options = {}) {
-  const userContext = app.get(AUTH_USER_CONTEXT, {
-    strict: false
-  });
-  if (!userContext) {
-    console.warn(
-      "[auth] installRequesterContext: AUTH_USER_CONTEXT is not bound \u2014 request scoping NOT installed. Provide an IUserContext under AUTH_USER_CONTEXT in your AppModule to enable ambient tenant scoping."
-    );
-    return;
-  }
-  app.use(makeRequesterContextMiddleware(userContext, options));
-}
-
-// runtime/subsystems/auth/auth.module.ts
-import { Module } from "@nestjs/common";
-
-// runtime/constants/tokens.ts
-var DRIZZLE = "DRIZZLE";
-
-// runtime/subsystems/auth/auth.module.ts
-function resolveEncryptionKeyProvider(choice) {
-  if (choice === "env") {
-    return { provide: ENCRYPTION_KEY, useClass: EnvEncryptionKey };
-  }
-  return { provide: ENCRYPTION_KEY, ...choice };
-}
-function resolveOAuthStateStoreProvider(choice) {
-  if (choice === "memory") {
-    return { provide: OAUTH_STATE_STORE, useClass: MemoryOAuthStateStore };
-  }
-  if (choice === "drizzle") {
-    return {
-      provide: OAUTH_STATE_STORE,
-      useFactory: (db) => {
-        if (!db) {
-          throw new Error(
-            "AuthModule.forRoot: oauthStateStore: 'drizzle' selected but DRIZZLE provider is not available. Ensure DatabaseModule (or another provider exposing DRIZZLE) is imported before AuthModule.forRoot."
-          );
-        }
-        return new DrizzleOAuthStateStore(db);
-      },
-      inject: [{ token: DRIZZLE, optional: true }]
-    };
-  }
-  return { provide: OAUTH_STATE_STORE, ...choice };
-}
-var AuthModule = class {
-  static forRoot(options = {}) {
-    const resolved = {
-      encryptionKey: options.encryptionKey ?? "env",
-      oauthStateStore: options.oauthStateStore ?? "memory",
-      enableController: options.enableController ?? false,
-      redirectUriBase: options.redirectUriBase
-    };
-    if (resolved.enableController && !resolved.redirectUriBase) {
-      throw new Error(
-        "AuthModule.forRoot: redirectUriBase is required when enableController: true"
-      );
-    }
-    const encryptionKeyProvider = resolveEncryptionKeyProvider(
-      resolved.encryptionKey
-    );
-    const oauthStateStoreProvider = resolveOAuthStateStoreProvider(
-      resolved.oauthStateStore
-    );
-    const optionsProvider = {
-      provide: AUTH_OPTIONS,
-      useValue: resolved
-    };
-    return {
-      module: AuthModule,
-      global: true,
-      providers: [encryptionKeyProvider, oauthStateStoreProvider, optionsProvider],
-      controllers: resolved.enableController ? [AuthController] : [],
-      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE, AUTH_OPTIONS]
-    };
-  }
-};
-AuthModule = __decorateClass([
-  Module({})
-], AuthModule);
+  OAuth2RefreshStrategy
+} from "../../../chunk-M6QLSLPO.js";
+import {
+  ConnectionBrokenError
+} from "../../../chunk-2N4UG4VD.js";
+import {
+  withAuthRetry
+} from "../../../chunk-WL67FZGF.js";
+import {
+  SessionExpiredError,
+  isSessionExpiredError
+} from "../../../chunk-7RELQJIN.js";
+import {
+  installRequesterContext,
+  makeRequesterContextMiddleware,
+  resolveRequesterContext
+} from "../../../chunk-OSQRXVG2.js";
+import {
+  AuthModule
+} from "../../../chunk-T6SCOJF4.js";
+import {
+  EnvEncryptionKey
+} from "../../../chunk-IP4OO26U.js";
+import {
+  AuthController
+} from "../../../chunk-SZVPIHWE.js";
+import {
+  DrizzleOAuthStateStore
+} from "../../../chunk-N5OTOWTP.js";
+import {
+  MemoryOAuthStateStore
+} from "../../../chunk-QLTJSCE6.js";
+import {
+  OAuthStateError
+} from "../../../chunk-BPARRK6F.js";
+import {
+  authOAuthState
+} from "../../../chunk-NPFPZ2HO.js";
+import {
+  AUTH_CONNECTION_GRANT_SINK,
+  AUTH_CONNECTION_READER,
+  AUTH_CONNECTION_TOKEN_WRITER,
+  AUTH_OPTIONS,
+  AUTH_USER_CONTEXT,
+  ENCRYPTION_KEY,
+  OAUTH_STATE_STORE,
+  STRATEGY_REGISTRY
+} from "../../../chunk-6XY6ZMMD.js";
+import "../../../chunk-GYGNEQSC.js";
+import "../../../chunk-ZUKFQL6E.js";
+import "../../../chunk-U64T4YZE.js";
+import "../../../chunk-2E224ZSN.js";
 export {
   AUTH_CONNECTION_GRANT_SINK,
   AUTH_CONNECTION_READER,