@payloadcms/figma 0.0.1-alpha.0 → 0.0.1-alpha.10

package/dist/auth/project-token.spec.js

@@ -1,332 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import * as figmaApi from '../api/figma-api.js';
-import * as constants from '../constants.js';
-import { JWTValidationError, validateProjectToken } from './jwt-validator.js';
-import * as oauthFlow from './oauth-flow.js';
-import { getValidProjectToken, ProjectTokenError, refreshProjectToken } from './project-token.js';
-import { TokenStore } from './token-store.js';
-// Mock all external dependencies
-vi.mock('../api/figma-api.js');
-vi.mock('./oauth-flow.js');
-vi.mock('../constants.js');
-// Mock only the validateProjectToken function from jwt-validator
-// Keep JWTValidationError class unmocked so it works properly in tests
-vi.mock('./jwt-validator.js', async (importOriginal)=>{
-    // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        validateProjectToken: vi.fn()
-    };
-});
-describe('Project Token Management', ()=>{
-    let tokenStore;
-    const mockTenantId = 'test-tenant-123';
-    const mockAccessToken = 'figt_mock_access_token';
-    const mockProjectTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.mock.signature';
-    let originalEnv;
-    beforeEach(()=>{
-        // Create a unique test store for each test
-        tokenStore = new TokenStore({
-            configName: `payloadcms-figma-test-${Date.now()}`
-        });
-        // Disable mocking to test real validation flow
-        originalEnv = process.env.FIGMA_MOCK_PROJECT_TOKEN;
-        process.env.FIGMA_MOCK_PROJECT_TOKEN = 'false';
-        // Default mock implementations
-        vi.mocked(constants.getEnvironment).mockReturnValue('staging');
-        vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(mockAccessToken);
-        vi.mocked(figmaApi.getProjectToken).mockResolvedValue({
-            expiresAt: Date.now() + 30 * 60 * 1000,
-            tenantId: mockTenantId,
-            token: mockProjectTokenJWT
-        });
-        vi.mocked(validateProjectToken).mockResolvedValue({
-            aud: mockTenantId,
-            email: 'test@example.com',
-            exp: Math.floor(Date.now() / 1000) + 1800,
-            iat: Math.floor(Date.now() / 1000),
-            seat_type: 'full'
-        });
-    });
-    afterEach(()=>{
-        tokenStore.clearTokens();
-        tokenStore.clearAllProjectTokens();
-        vi.clearAllMocks();
-        // Restore original environment
-        if (originalEnv === undefined) {
-            delete process.env.FIGMA_MOCK_PROJECT_TOKEN;
-        } else {
-            process.env.FIGMA_MOCK_PROJECT_TOKEN = originalEnv;
-        }
-    });
-    describe('getValidProjectToken', ()=>{
-        describe('with valid cached token', ()=>{
-            it('should return cached token immediately without API calls', async ()=>{
-                // Store a valid project token
-                const validToken = {
-                    claims: {
-                        aud: mockTenantId,
-                        email: 'test@example.com',
-                        exp: Math.floor(Date.now() / 1000) + 1800,
-                        iat: Math.floor(Date.now() / 1000),
-                        seat_type: 'full'
-                    },
-                    expiresAt: Date.now() + 30 * 60 * 1000,
-                    tenantId: mockTenantId,
-                    token: mockProjectTokenJWT
-                };
-                tokenStore.setProjectToken(mockTenantId, validToken);
-                const result = await getValidProjectToken(tokenStore, mockTenantId);
-                expect(result).toBe(mockProjectTokenJWT);
-                // Should not call any external APIs
-                expect(oauthFlow.getValidAccessToken).not.toHaveBeenCalled();
-                expect(figmaApi.getProjectToken).not.toHaveBeenCalled();
-                expect(validateProjectToken).not.toHaveBeenCalled();
-            });
-            it('should use hasValidProjectToken for expiry check', async ()=>{
-                // Mock hasValidProjectToken to return true
-                const hasValidSpy = vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(true);
-                const getTokenSpy = vi.spyOn(tokenStore, 'getProjectToken').mockReturnValue({
-                    claims: {
-                        exp: Math.floor(Date.now() / 1000) + 1800
-                    },
-                    expiresAt: Date.now() + 30 * 60 * 1000,
-                    tenantId: mockTenantId,
-                    token: mockProjectTokenJWT
-                });
-                await getValidProjectToken(tokenStore, mockTenantId);
-                expect(hasValidSpy).toHaveBeenCalledWith(mockTenantId);
-                expect(getTokenSpy).toHaveBeenCalledWith(mockTenantId);
-            });
-        });
-        describe('with expired or missing token', ()=>{
-            it('should fetch new token when no cached token exists', async ()=>{
-                const result = await getValidProjectToken(tokenStore, mockTenantId);
-                expect(result).toBe(mockProjectTokenJWT);
-                expect(oauthFlow.getValidAccessToken).toHaveBeenCalledWith(tokenStore);
-                expect(figmaApi.getProjectToken).toHaveBeenCalledWith(mockAccessToken, mockTenantId);
-                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging');
-            });
-            it('should fetch new token when cached token is expired', async ()=>{
-                // Mock hasValidProjectToken to return false (expired)
-                vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(false);
-                const result = await getValidProjectToken(tokenStore, mockTenantId);
-                expect(result).toBe(mockProjectTokenJWT);
-                expect(figmaApi.getProjectToken).toHaveBeenCalled();
-            });
-            it('should apply 5-minute expiry buffer through hasValidProjectToken', async ()=>{
-                // Store a token expiring in 4 minutes (within 5-minute buffer)
-                const expiringToken = {
-                    claims: {
-                        exp: Math.floor(Date.now() / 1000) + 240
-                    },
-                    expiresAt: Date.now() + 4 * 60 * 1000,
-                    tenantId: mockTenantId,
-                    token: 'expiring-token'
-                };
-                tokenStore.setProjectToken(mockTenantId, expiringToken);
-                // hasValidProjectToken should return false due to buffer
-                expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(false);
-                // Should refresh the token
-                await getValidProjectToken(tokenStore, mockTenantId);
-                expect(figmaApi.getProjectToken).toHaveBeenCalled();
-            });
-        });
-        describe('JWT validation integration', ()=>{
-            it('should validate JWT signature after fetching', async ()=>{
-                await getValidProjectToken(tokenStore, mockTenantId);
-                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging');
-            });
-            it('should use correct environment for validation', async ()=>{
-                vi.mocked(constants.getEnvironment).mockReturnValue('production');
-                await getValidProjectToken(tokenStore, mockTenantId);
-                expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'production');
-            });
-            it('should throw ProjectTokenError on validation failure', async ()=>{
-                const validationError = new JWTValidationError('Invalid signature', 'SIGNATURE_INVALID');
-                vi.mocked(validateProjectToken).mockRejectedValue(validationError);
-                try {
-                    await getValidProjectToken(tokenStore, mockTenantId);
-                    expect.fail('Should have thrown ProjectTokenError');
-                } catch (error) {
-                    expect(error).toBeInstanceOf(ProjectTokenError);
-                    if (error instanceof ProjectTokenError) {
-                        expect(error.message).toContain('Project token validation failed');
-                        expect(error.message).toContain('Invalid signature');
-                        expect(error.cause).toBe(validationError);
-                    }
-                }
-            });
-            it('should rethrow non-JWTValidationError errors', async ()=>{
-                const genericError = new Error('Network error');
-                vi.mocked(validateProjectToken).mockRejectedValue(genericError);
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(genericError);
-            });
-            it('should throw error if JWT missing exp claim', async ()=>{
-                // Mock validation returning claims without exp
-                vi.mocked(validateProjectToken).mockResolvedValue({
-                    aud: mockTenantId
-                });
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(ProjectTokenError);
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow('missing expiration (exp) claim');
-            });
-        });
-        describe('claims storage', ()=>{
-            it('should store validated claims with token', async ()=>{
-                const mockClaims = {
-                    aud: mockTenantId,
-                    email: 'user@example.com',
-                    exp: Math.floor(Date.now() / 1000) + 1800,
-                    iat: Math.floor(Date.now() / 1000),
-                    seat_type: 'full'
-                };
-                vi.mocked(validateProjectToken).mockResolvedValue(mockClaims);
-                await getValidProjectToken(tokenStore, mockTenantId);
-                const storedToken = tokenStore.getProjectToken(mockTenantId);
-                expect(storedToken?.claims).toEqual(mockClaims);
-            });
-            it('should convert exp from seconds to milliseconds for expiresAt', async ()=>{
-                const expInSeconds = Math.floor(Date.now() / 1000) + 1800 // 30 min from now
-                ;
-                vi.mocked(validateProjectToken).mockResolvedValue({
-                    aud: mockTenantId,
-                    exp: expInSeconds
-                });
-                await getValidProjectToken(tokenStore, mockTenantId);
-                const storedToken = tokenStore.getProjectToken(mockTenantId);
-                expect(storedToken?.expiresAt).toBe(expInSeconds * 1000);
-            });
-            it('should store token with correct tenantId', async ()=>{
-                await getValidProjectToken(tokenStore, mockTenantId);
-                const storedToken = tokenStore.getProjectToken(mockTenantId);
-                expect(storedToken?.tenantId).toBe(mockTenantId);
-                expect(storedToken?.token).toBe(mockProjectTokenJWT);
-            });
-        });
-        describe('error handling', ()=>{
-            it('should throw ProjectTokenError when no user access token available', async ()=>{
-                vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(new Error('User not authenticated'));
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(ProjectTokenError);
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow('Failed to get valid access token');
-            });
-            it('should return null when getValidAccessToken returns null', async ()=>{
-                vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null);
-                const result = await getValidProjectToken(tokenStore, mockTenantId);
-                expect(result).toBeNull();
-                // Should not call API if no access token
-                expect(figmaApi.getProjectToken).not.toHaveBeenCalled();
-            });
-            it('should handle API 401 errors', async ()=>{
-                const apiError = new figmaApi.FigmaApiError('Unauthorized', 401);
-                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
-                try {
-                    await getValidProjectToken(tokenStore, mockTenantId);
-                    expect.fail('Should have thrown error');
-                } catch (error) {
-                    expect(error).toBe(apiError);
-                    expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
-                }
-            });
-            it('should handle API 404 errors (tenant not found)', async ()=>{
-                const apiError = new figmaApi.FigmaApiError('Tenant not found', 404);
-                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
-                try {
-                    await getValidProjectToken(tokenStore, mockTenantId);
-                    expect.fail('Should have thrown error');
-                } catch (error) {
-                    expect(error).toBe(apiError);
-                    expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
-                }
-            });
-            it('should handle network errors', async ()=>{
-                const networkError = new Error('Network timeout');
-                vi.mocked(figmaApi.getProjectToken).mockRejectedValue(networkError);
-                await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(networkError);
-            });
-            it('should wrap getValidAccessToken errors in ProjectTokenError', async ()=>{
-                const authError = new Error('OAuth refresh failed');
-                vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(authError);
-                try {
-                    await getValidProjectToken(tokenStore, mockTenantId);
-                    expect.fail('Should have thrown ProjectTokenError');
-                } catch (error) {
-                    expect(error).toBeInstanceOf(ProjectTokenError);
-                    if (error instanceof ProjectTokenError) {
-                        expect(error.cause).toBe(authError);
-                        expect(error.message).toContain('Failed to get valid access token');
-                    }
-                }
-            });
-        });
-    });
-    describe('refreshProjectToken', ()=>{
-        it('should clear existing token before fetching new one', async ()=>{
-            // Store an existing token
-            const existingToken = {
-                claims: {
-                    exp: Math.floor(Date.now() / 1000) + 1800
-                },
-                expiresAt: Date.now() + 30 * 60 * 1000,
-                tenantId: mockTenantId,
-                token: 'old-token'
-            };
-            tokenStore.setProjectToken(mockTenantId, existingToken);
-            const clearSpy = vi.spyOn(tokenStore, 'clearProjectToken');
-            await refreshProjectToken(tokenStore, mockTenantId);
-            expect(clearSpy).toHaveBeenCalledWith(mockTenantId);
-        });
-        it('should call getValidProjectToken after clearing', async ()=>{
-            const result = await refreshProjectToken(tokenStore, mockTenantId);
-            expect(result).toBe(mockProjectTokenJWT);
-            // Verify API was called (meaning cache was bypassed)
-            expect(figmaApi.getProjectToken).toHaveBeenCalled();
-        });
-        it('should force refresh even if token is still valid', async ()=>{
-            // Store a valid token
-            const validToken = {
-                claims: {
-                    exp: Math.floor(Date.now() / 1000) + 3600
-                },
-                expiresAt: Date.now() + 60 * 60 * 1000,
-                tenantId: mockTenantId,
-                token: 'valid-token'
-            };
-            tokenStore.setProjectToken(mockTenantId, validToken);
-            // Verify it's considered valid
-            expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(true);
-            await refreshProjectToken(tokenStore, mockTenantId);
-            // Should have fetched new token despite valid cache
-            expect(figmaApi.getProjectToken).toHaveBeenCalled();
-        });
-        it('should return new token after refresh', async ()=>{
-            const newTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.new.signature';
-            vi.mocked(figmaApi.getProjectToken).mockResolvedValue({
-                expiresAt: Date.now() + 30 * 60 * 1000,
-                tenantId: mockTenantId,
-                token: newTokenJWT
-            });
-            const result = await refreshProjectToken(tokenStore, mockTenantId);
-            expect(result).toBe(newTokenJWT);
-            expect(tokenStore.getProjectToken(mockTenantId)?.token).toBe(newTokenJWT);
-        });
-        it('should propagate errors from getValidProjectToken', async ()=>{
-            const apiError = new figmaApi.FigmaApiError('API Error', 500);
-            vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError);
-            try {
-                await refreshProjectToken(tokenStore, mockTenantId);
-                expect.fail('Should have thrown error');
-            } catch (error) {
-                expect(error).toBe(apiError);
-                expect(error).toBeInstanceOf(figmaApi.FigmaApiError);
-            }
-        });
-        it('should return null when refresh fails due to no access token', async ()=>{
-            vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null);
-            const result = await refreshProjectToken(tokenStore, mockTenantId);
-            expect(result).toBeNull();
-        });
-    });
-});
-
-//# sourceMappingURL=project-token.spec.js.map

package/dist/auth/project-token.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/project-token.spec.ts"],"sourcesContent":["import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { ProjectToken } from './types.js'\n\nimport * as figmaApi from '../api/figma-api.js'\nimport * as constants from '../constants.js'\nimport { JWTValidationError, validateProjectToken } from './jwt-validator.js'\nimport * as oauthFlow from './oauth-flow.js'\nimport { getValidProjectToken, ProjectTokenError, refreshProjectToken } from './project-token.js'\nimport { TokenStore } from './token-store.js'\n\n// Mock all external dependencies\nvi.mock('../api/figma-api.js')\nvi.mock('./oauth-flow.js')\nvi.mock('../constants.js')\n\n// Mock only the validateProjectToken function from jwt-validator\n// Keep JWTValidationError class unmocked so it works properly in tests\nvi.mock('./jwt-validator.js', async (importOriginal) => {\n  // eslint-disable-next-line @typescript-eslint/consistent-type-imports\n  const actual = await importOriginal<typeof import('./jwt-validator.js')>()\n  return {\n    ...actual,\n    validateProjectToken: vi.fn(),\n  }\n})\n\ndescribe('Project Token Management', () => {\n  let tokenStore: TokenStore\n  const mockTenantId = 'test-tenant-123'\n  const mockAccessToken = 'figt_mock_access_token'\n  const mockProjectTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.mock.signature'\n  let originalEnv: string | undefined\n\n  beforeEach(() => {\n    // Create a unique test store for each test\n    tokenStore = new TokenStore({ configName: `payloadcms-figma-test-${Date.now()}` })\n\n    // Disable mocking to test real validation flow\n    originalEnv = process.env.FIGMA_MOCK_PROJECT_TOKEN\n    process.env.FIGMA_MOCK_PROJECT_TOKEN = 'false'\n\n    // Default mock implementations\n    vi.mocked(constants.getEnvironment).mockReturnValue('staging')\n    vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(mockAccessToken)\n    vi.mocked(figmaApi.getProjectToken).mockResolvedValue({\n      expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes (milliseconds)\n      tenantId: mockTenantId,\n      token: mockProjectTokenJWT,\n    })\n    vi.mocked(validateProjectToken).mockResolvedValue({\n      aud: mockTenantId, // Audience claim contains the CMS ID\n      email: 'test@example.com',\n      exp: Math.floor(Date.now() / 1000) + 1800, // 30 minutes in seconds\n      iat: Math.floor(Date.now() / 1000),\n      seat_type: 'full',\n    })\n  })\n\n  afterEach(() => {\n    tokenStore.clearTokens()\n    tokenStore.clearAllProjectTokens()\n    vi.clearAllMocks()\n\n    // Restore original environment\n    if (originalEnv === undefined) {\n      delete process.env.FIGMA_MOCK_PROJECT_TOKEN\n    } else {\n      process.env.FIGMA_MOCK_PROJECT_TOKEN = originalEnv\n    }\n  })\n\n  describe('getValidProjectToken', () => {\n    describe('with valid cached token', () => {\n      it('should return cached token immediately without API calls', async () => {\n        // Store a valid project token\n        const validToken: ProjectToken = {\n          claims: {\n            aud: mockTenantId, // Audience claim contains the CMS ID\n            email: 'test@example.com',\n            exp: Math.floor(Date.now() / 1000) + 1800, // 30 minutes from now\n            iat: Math.floor(Date.now() / 1000),\n            seat_type: 'full',\n          },\n          expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes\n          tenantId: mockTenantId,\n          token: mockProjectTokenJWT,\n        }\n        tokenStore.setProjectToken(mockTenantId, validToken)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        // Should not call any external APIs\n        expect(oauthFlow.getValidAccessToken).not.toHaveBeenCalled()\n        expect(figmaApi.getProjectToken).not.toHaveBeenCalled()\n        expect(validateProjectToken).not.toHaveBeenCalled()\n      })\n\n      it('should use hasValidProjectToken for expiry check', async () => {\n        // Mock hasValidProjectToken to return true\n        const hasValidSpy = vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(true)\n        const getTokenSpy = vi.spyOn(tokenStore, 'getProjectToken').mockReturnValue({\n          claims: { exp: Math.floor(Date.now() / 1000) + 1800 },\n          expiresAt: Date.now() + 30 * 60 * 1000,\n          tenantId: mockTenantId,\n          token: mockProjectTokenJWT,\n        })\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(hasValidSpy).toHaveBeenCalledWith(mockTenantId)\n        expect(getTokenSpy).toHaveBeenCalledWith(mockTenantId)\n      })\n    })\n\n    describe('with expired or missing token', () => {\n      it('should fetch new token when no cached token exists', async () => {\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        expect(oauthFlow.getValidAccessToken).toHaveBeenCalledWith(tokenStore)\n        expect(figmaApi.getProjectToken).toHaveBeenCalledWith(mockAccessToken, mockTenantId)\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging')\n      })\n\n      it('should fetch new token when cached token is expired', async () => {\n        // Mock hasValidProjectToken to return false (expired)\n        vi.spyOn(tokenStore, 'hasValidProjectToken').mockReturnValue(false)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBe(mockProjectTokenJWT)\n        expect(figmaApi.getProjectToken).toHaveBeenCalled()\n      })\n\n      it('should apply 5-minute expiry buffer through hasValidProjectToken', async () => {\n        // Store a token expiring in 4 minutes (within 5-minute buffer)\n        const expiringToken: ProjectToken = {\n          claims: { exp: Math.floor(Date.now() / 1000) + 240 }, // 4 minutes\n          expiresAt: Date.now() + 4 * 60 * 1000,\n          tenantId: mockTenantId,\n          token: 'expiring-token',\n        }\n        tokenStore.setProjectToken(mockTenantId, expiringToken)\n\n        // hasValidProjectToken should return false due to buffer\n        expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(false)\n\n        // Should refresh the token\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(figmaApi.getProjectToken).toHaveBeenCalled()\n      })\n    })\n\n    describe('JWT validation integration', () => {\n      it('should validate JWT signature after fetching', async () => {\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'staging')\n      })\n\n      it('should use correct environment for validation', async () => {\n        vi.mocked(constants.getEnvironment).mockReturnValue('production')\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(validateProjectToken).toHaveBeenCalledWith(mockProjectTokenJWT, 'production')\n      })\n\n      it('should throw ProjectTokenError on validation failure', async () => {\n        const validationError = new JWTValidationError('Invalid signature', 'SIGNATURE_INVALID')\n        vi.mocked(validateProjectToken).mockRejectedValue(validationError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown ProjectTokenError')\n        } catch (error) {\n          expect(error).toBeInstanceOf(ProjectTokenError)\n          if (error instanceof ProjectTokenError) {\n            expect(error.message).toContain('Project token validation failed')\n            expect(error.message).toContain('Invalid signature')\n            expect(error.cause).toBe(validationError)\n          }\n        }\n      })\n\n      it('should rethrow non-JWTValidationError errors', async () => {\n        const genericError = new Error('Network error')\n        vi.mocked(validateProjectToken).mockRejectedValue(genericError)\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(genericError)\n      })\n\n      it('should throw error if JWT missing exp claim', async () => {\n        // Mock validation returning claims without exp\n        vi.mocked(validateProjectToken).mockResolvedValue({\n          aud: mockTenantId,\n          // No exp claim - intentionally omitted to test validation\n        })\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          ProjectTokenError,\n        )\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          'missing expiration (exp) claim',\n        )\n      })\n    })\n\n    describe('claims storage', () => {\n      it('should store validated claims with token', async () => {\n        const mockClaims = {\n          aud: mockTenantId,\n          email: 'user@example.com',\n          exp: Math.floor(Date.now() / 1000) + 1800,\n          iat: Math.floor(Date.now() / 1000),\n          seat_type: 'full',\n        }\n        vi.mocked(validateProjectToken).mockResolvedValue(mockClaims)\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.claims).toEqual(mockClaims)\n      })\n\n      it('should convert exp from seconds to milliseconds for expiresAt', async () => {\n        const expInSeconds = Math.floor(Date.now() / 1000) + 1800 // 30 min from now\n        vi.mocked(validateProjectToken).mockResolvedValue({\n          aud: mockTenantId,\n          exp: expInSeconds,\n        })\n\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.expiresAt).toBe(expInSeconds * 1000)\n      })\n\n      it('should store token with correct tenantId', async () => {\n        await getValidProjectToken(tokenStore, mockTenantId)\n\n        const storedToken = tokenStore.getProjectToken(mockTenantId)\n        expect(storedToken?.tenantId).toBe(mockTenantId)\n        expect(storedToken?.token).toBe(mockProjectTokenJWT)\n      })\n    })\n\n    describe('error handling', () => {\n      it('should throw ProjectTokenError when no user access token available', async () => {\n        vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(\n          new Error('User not authenticated'),\n        )\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          ProjectTokenError,\n        )\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(\n          'Failed to get valid access token',\n        )\n      })\n\n      it('should return null when getValidAccessToken returns null', async () => {\n        vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null)\n\n        const result = await getValidProjectToken(tokenStore, mockTenantId)\n\n        expect(result).toBeNull()\n        // Should not call API if no access token\n        expect(figmaApi.getProjectToken).not.toHaveBeenCalled()\n      })\n\n      it('should handle API 401 errors', async () => {\n        const apiError = new figmaApi.FigmaApiError('Unauthorized', 401)\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown error')\n        } catch (error) {\n          expect(error).toBe(apiError)\n          expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n        }\n      })\n\n      it('should handle API 404 errors (tenant not found)', async () => {\n        const apiError = new figmaApi.FigmaApiError('Tenant not found', 404)\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown error')\n        } catch (error) {\n          expect(error).toBe(apiError)\n          expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n        }\n      })\n\n      it('should handle network errors', async () => {\n        const networkError = new Error('Network timeout')\n        vi.mocked(figmaApi.getProjectToken).mockRejectedValue(networkError)\n\n        await expect(getValidProjectToken(tokenStore, mockTenantId)).rejects.toThrow(networkError)\n      })\n\n      it('should wrap getValidAccessToken errors in ProjectTokenError', async () => {\n        const authError = new Error('OAuth refresh failed')\n        vi.mocked(oauthFlow.getValidAccessToken).mockRejectedValue(authError)\n\n        try {\n          await getValidProjectToken(tokenStore, mockTenantId)\n          expect.fail('Should have thrown ProjectTokenError')\n        } catch (error) {\n          expect(error).toBeInstanceOf(ProjectTokenError)\n          if (error instanceof ProjectTokenError) {\n            expect(error.cause).toBe(authError)\n            expect(error.message).toContain('Failed to get valid access token')\n          }\n        }\n      })\n    })\n  })\n\n  describe('refreshProjectToken', () => {\n    it('should clear existing token before fetching new one', async () => {\n      // Store an existing token\n      const existingToken: ProjectToken = {\n        claims: { exp: Math.floor(Date.now() / 1000) + 1800 },\n        expiresAt: Date.now() + 30 * 60 * 1000,\n        tenantId: mockTenantId,\n        token: 'old-token',\n      }\n      tokenStore.setProjectToken(mockTenantId, existingToken)\n\n      const clearSpy = vi.spyOn(tokenStore, 'clearProjectToken')\n\n      await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(clearSpy).toHaveBeenCalledWith(mockTenantId)\n    })\n\n    it('should call getValidProjectToken after clearing', async () => {\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBe(mockProjectTokenJWT)\n      // Verify API was called (meaning cache was bypassed)\n      expect(figmaApi.getProjectToken).toHaveBeenCalled()\n    })\n\n    it('should force refresh even if token is still valid', async () => {\n      // Store a valid token\n      const validToken: ProjectToken = {\n        claims: { exp: Math.floor(Date.now() / 1000) + 3600 }, // 1 hour\n        expiresAt: Date.now() + 60 * 60 * 1000,\n        tenantId: mockTenantId,\n        token: 'valid-token',\n      }\n      tokenStore.setProjectToken(mockTenantId, validToken)\n\n      // Verify it's considered valid\n      expect(tokenStore.hasValidProjectToken(mockTenantId)).toBe(true)\n\n      await refreshProjectToken(tokenStore, mockTenantId)\n\n      // Should have fetched new token despite valid cache\n      expect(figmaApi.getProjectToken).toHaveBeenCalled()\n    })\n\n    it('should return new token after refresh', async () => {\n      const newTokenJWT = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.new.signature'\n      vi.mocked(figmaApi.getProjectToken).mockResolvedValue({\n        expiresAt: Date.now() + 30 * 60 * 1000, // 30 minutes (milliseconds)\n        tenantId: mockTenantId,\n        token: newTokenJWT,\n      })\n\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBe(newTokenJWT)\n      expect(tokenStore.getProjectToken(mockTenantId)?.token).toBe(newTokenJWT)\n    })\n\n    it('should propagate errors from getValidProjectToken', async () => {\n      const apiError = new figmaApi.FigmaApiError('API Error', 500)\n      vi.mocked(figmaApi.getProjectToken).mockRejectedValue(apiError)\n\n      try {\n        await refreshProjectToken(tokenStore, mockTenantId)\n        expect.fail('Should have thrown error')\n      } catch (error) {\n        expect(error).toBe(apiError)\n        expect(error).toBeInstanceOf(figmaApi.FigmaApiError)\n      }\n    })\n\n    it('should return null when refresh fails due to no access token', async () => {\n      vi.mocked(oauthFlow.getValidAccessToken).mockResolvedValue(null)\n\n      const result = await refreshProjectToken(tokenStore, mockTenantId)\n\n      expect(result).toBeNull()\n    })\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","vi","figmaApi","constants","JWTValidationError","validateProjectToken","oauthFlow","getValidProjectToken","ProjectTokenError","refreshProjectToken","TokenStore","mock","importOriginal","actual","fn","tokenStore","mockTenantId","mockAccessToken","mockProjectTokenJWT","originalEnv","configName","Date","now","process","env","FIGMA_MOCK_PROJECT_TOKEN","mocked","getEnvironment","mockReturnValue","getValidAccessToken","mockResolvedValue","getProjectToken","expiresAt","tenantId","token","aud","email","exp","Math","floor","iat","seat_type","clearTokens","clearAllProjectTokens","clearAllMocks","undefined","validToken","claims","setProjectToken","result","toBe","not","toHaveBeenCalled","hasValidSpy","spyOn","getTokenSpy","toHaveBeenCalledWith","expiringToken","hasValidProjectToken","validationError","mockRejectedValue","fail","error","toBeInstanceOf","message","toContain","cause","genericError","Error","rejects","toThrow","mockClaims","storedToken","toEqual","expInSeconds","toBeNull","apiError","FigmaApiError","networkError","authError","existingToken","clearSpy","newTokenJWT"],"mappings":"AAAA,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAIxE,YAAYC,cAAc,sBAAqB;AAC/C,YAAYC,eAAe,kBAAiB;AAC5C,SAASC,kBAAkB,EAAEC,oBAAoB,QAAQ,qBAAoB;AAC7E,YAAYC,eAAe,kBAAiB;AAC5C,SAASC,oBAAoB,EAAEC,iBAAiB,EAAEC,mBAAmB,QAAQ,qBAAoB;AACjG,SAASC,UAAU,QAAQ,mBAAkB;AAE7C,iCAAiC;AACjCT,GAAGU,IAAI,CAAC;AACRV,GAAGU,IAAI,CAAC;AACRV,GAAGU,IAAI,CAAC;AAER,iEAAiE;AACjE,uEAAuE;AACvEV,GAAGU,IAAI,CAAC,sBAAsB,OAAOC;IACnC,sEAAsE;IACtE,MAAMC,SAAS,MAAMD;IACrB,OAAO;QACL,GAAGC,MAAM;QACTR,sBAAsBJ,GAAGa,EAAE;IAC7B;AACF;AAEAhB,SAAS,4BAA4B;IACnC,IAAIiB;IACJ,MAAMC,eAAe;IACrB,MAAMC,kBAAkB;IACxB,MAAMC,sBAAsB;IAC5B,IAAIC;IAEJtB,WAAW;QACT,2CAA2C;QAC3CkB,aAAa,IAAIL,WAAW;YAAEU,YAAY,CAAC,sBAAsB,EAAEC,KAAKC,GAAG,IAAI;QAAC;QAEhF,+CAA+C;QAC/CH,cAAcI,QAAQC,GAAG,CAACC,wBAAwB;QAClDF,QAAQC,GAAG,CAACC,wBAAwB,GAAG;QAEvC,+BAA+B;QAC/BxB,GAAGyB,MAAM,CAACvB,UAAUwB,cAAc,EAAEC,eAAe,CAAC;QACpD3B,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAACb;QAC3DhB,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAED,iBAAiB,CAAC;YACpDE,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;YAClCW,UAAUjB;YACVkB,OAAOhB;QACT;QACAjB,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;YAChDK,KAAKnB;YACLoB,OAAO;YACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;YACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;YAC7BmB,WAAW;QACb;IACF;IAEA7C,UAAU;QACRmB,WAAW2B,WAAW;QACtB3B,WAAW4B,qBAAqB;QAChC1C,GAAG2C,aAAa;QAEhB,+BAA+B;QAC/B,IAAIzB,gBAAgB0B,WAAW;YAC7B,OAAOtB,QAAQC,GAAG,CAACC,wBAAwB;QAC7C,OAAO;YACLF,QAAQC,GAAG,CAACC,wBAAwB,GAAGN;QACzC;IACF;IAEArB,SAAS,wBAAwB;QAC/BA,SAAS,2BAA2B;YAClCE,GAAG,4DAA4D;gBAC7D,8BAA8B;gBAC9B,MAAM8C,aAA2B;oBAC/BC,QAAQ;wBACNZ,KAAKnB;wBACLoB,OAAO;wBACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;wBACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;wBAC7BmB,WAAW;oBACb;oBACAT,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;oBAClCW,UAAUjB;oBACVkB,OAAOhB;gBACT;gBACAH,WAAWiC,eAAe,CAAChC,cAAc8B;gBAEzC,MAAMG,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpB,oCAAoC;gBACpCnB,OAAOO,UAAUuB,mBAAmB,EAAEsB,GAAG,CAACC,gBAAgB;gBAC1DrD,OAAOG,SAAS6B,eAAe,EAAEoB,GAAG,CAACC,gBAAgB;gBACrDrD,OAAOM,sBAAsB8C,GAAG,CAACC,gBAAgB;YACnD;YAEApD,GAAG,oDAAoD;gBACrD,2CAA2C;gBAC3C,MAAMqD,cAAcpD,GAAGqD,KAAK,CAACvC,YAAY,wBAAwBa,eAAe,CAAC;gBACjF,MAAM2B,cAActD,GAAGqD,KAAK,CAACvC,YAAY,mBAAmBa,eAAe,CAAC;oBAC1EmB,QAAQ;wBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBAAK;oBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;oBAClCW,UAAUjB;oBACVkB,OAAOhB;gBACT;gBAEA,MAAMX,qBAAqBQ,YAAYC;gBAEvCjB,OAAOsD,aAAaG,oBAAoB,CAACxC;gBACzCjB,OAAOwD,aAAaC,oBAAoB,CAACxC;YAC3C;QACF;QAEAlB,SAAS,iCAAiC;YACxCE,GAAG,sDAAsD;gBACvD,MAAMiD,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpBnB,OAAOO,UAAUuB,mBAAmB,EAAE2B,oBAAoB,CAACzC;gBAC3DhB,OAAOG,SAAS6B,eAAe,EAAEyB,oBAAoB,CAACvC,iBAAiBD;gBACvEjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,uDAAuD;gBACxD,sDAAsD;gBACtDC,GAAGqD,KAAK,CAACvC,YAAY,wBAAwBa,eAAe,CAAC;gBAE7D,MAAMqB,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQC,IAAI,CAAChC;gBACpBnB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;YACnD;YAEApD,GAAG,oEAAoE;gBACrE,+DAA+D;gBAC/D,MAAMyD,gBAA8B;oBAClCV,QAAQ;wBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBAAI;oBACnDU,WAAWX,KAAKC,GAAG,KAAK,IAAI,KAAK;oBACjCW,UAAUjB;oBACVkB,OAAO;gBACT;gBACAnB,WAAWiC,eAAe,CAAChC,cAAcyC;gBAEzC,yDAAyD;gBACzD1D,OAAOgB,WAAW2C,oBAAoB,CAAC1C,eAAekC,IAAI,CAAC;gBAE3D,2BAA2B;gBAC3B,MAAM3C,qBAAqBQ,YAAYC;gBAEvCjB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;YACnD;QACF;QAEAtD,SAAS,8BAA8B;YACrCE,GAAG,gDAAgD;gBACjD,MAAMO,qBAAqBQ,YAAYC;gBAEvCjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,iDAAiD;gBAClDC,GAAGyB,MAAM,CAACvB,UAAUwB,cAAc,EAAEC,eAAe,CAAC;gBAEpD,MAAMrB,qBAAqBQ,YAAYC;gBAEvCjB,OAAOM,sBAAsBmD,oBAAoB,CAACtC,qBAAqB;YACzE;YAEAlB,GAAG,wDAAwD;gBACzD,MAAM2D,kBAAkB,IAAIvD,mBAAmB,qBAAqB;gBACpEH,GAAGyB,MAAM,CAACrB,sBAAsBuD,iBAAiB,CAACD;gBAElD,IAAI;oBACF,MAAMpD,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOC,cAAc,CAACvD;oBAC7B,IAAIsD,iBAAiBtD,mBAAmB;wBACtCT,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;wBAChClE,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;wBAChClE,OAAO+D,MAAMI,KAAK,EAAEhB,IAAI,CAACS;oBAC3B;gBACF;YACF;YAEA3D,GAAG,gDAAgD;gBACjD,MAAMmE,eAAe,IAAIC,MAAM;gBAC/BnE,GAAGyB,MAAM,CAACrB,sBAAsBuD,iBAAiB,CAACO;gBAElD,MAAMpE,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAACH;YAC/E;YAEAnE,GAAG,+CAA+C;gBAChD,+CAA+C;gBAC/CC,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;oBAChDK,KAAKnB;gBAEP;gBAEA,MAAMjB,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E9D;gBAEF,MAAMT,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E;YAEJ;QACF;QAEAxE,SAAS,kBAAkB;YACzBE,GAAG,4CAA4C;gBAC7C,MAAMuE,aAAa;oBACjBpC,KAAKnB;oBACLoB,OAAO;oBACPC,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;oBACrCkB,KAAKF,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK;oBAC7BmB,WAAW;gBACb;gBACAxC,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAACyC;gBAElD,MAAMhE,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAazB,QAAQ0B,OAAO,CAACF;YACtC;YAEAvE,GAAG,iEAAiE;gBAClE,MAAM0E,eAAepC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ,KAAK,kBAAkB;;gBAC5ErB,GAAGyB,MAAM,CAACrB,sBAAsByB,iBAAiB,CAAC;oBAChDK,KAAKnB;oBACLqB,KAAKqC;gBACP;gBAEA,MAAMnE,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAaxC,WAAWkB,IAAI,CAACwB,eAAe;YACrD;YAEA1E,GAAG,4CAA4C;gBAC7C,MAAMO,qBAAqBQ,YAAYC;gBAEvC,MAAMwD,cAAczD,WAAWgB,eAAe,CAACf;gBAC/CjB,OAAOyE,aAAavC,UAAUiB,IAAI,CAAClC;gBACnCjB,OAAOyE,aAAatC,OAAOgB,IAAI,CAAChC;YAClC;QACF;QAEApB,SAAS,kBAAkB;YACzBE,GAAG,sEAAsE;gBACvEC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAE+B,iBAAiB,CACxD,IAAIQ,MAAM;gBAGZ,MAAMrE,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E9D;gBAEF,MAAMT,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAC1E;YAEJ;YAEAtE,GAAG,4DAA4D;gBAC7DC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAAC;gBAE3D,MAAMmB,SAAS,MAAM1C,qBAAqBQ,YAAYC;gBAEtDjB,OAAOkD,QAAQ0B,QAAQ;gBACvB,yCAAyC;gBACzC5E,OAAOG,SAAS6B,eAAe,EAAEoB,GAAG,CAACC,gBAAgB;YACvD;YAEApD,GAAG,gCAAgC;gBACjC,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,gBAAgB;gBAC5D5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;gBAEtD,IAAI;oBACF,MAAMrE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;oBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;gBACrD;YACF;YAEA7E,GAAG,mDAAmD;gBACpD,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,oBAAoB;gBAChE5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;gBAEtD,IAAI;oBACF,MAAMrE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;oBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;gBACrD;YACF;YAEA7E,GAAG,gCAAgC;gBACjC,MAAM8E,eAAe,IAAIV,MAAM;gBAC/BnE,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACkB;gBAEtD,MAAM/E,OAAOQ,qBAAqBQ,YAAYC,eAAeqD,OAAO,CAACC,OAAO,CAACQ;YAC/E;YAEA9E,GAAG,+DAA+D;gBAChE,MAAM+E,YAAY,IAAIX,MAAM;gBAC5BnE,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAE+B,iBAAiB,CAACmB;gBAE3D,IAAI;oBACF,MAAMxE,qBAAqBQ,YAAYC;oBACvCjB,OAAO8D,IAAI,CAAC;gBACd,EAAE,OAAOC,OAAO;oBACd/D,OAAO+D,OAAOC,cAAc,CAACvD;oBAC7B,IAAIsD,iBAAiBtD,mBAAmB;wBACtCT,OAAO+D,MAAMI,KAAK,EAAEhB,IAAI,CAAC6B;wBACzBhF,OAAO+D,MAAME,OAAO,EAAEC,SAAS,CAAC;oBAClC;gBACF;YACF;QACF;IACF;IAEAnE,SAAS,uBAAuB;QAC9BE,GAAG,uDAAuD;YACxD,0BAA0B;YAC1B,MAAMgF,gBAA8B;gBAClCjC,QAAQ;oBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;gBAAK;gBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAO;YACT;YACAnB,WAAWiC,eAAe,CAAChC,cAAcgE;YAEzC,MAAMC,WAAWhF,GAAGqD,KAAK,CAACvC,YAAY;YAEtC,MAAMN,oBAAoBM,YAAYC;YAEtCjB,OAAOkF,UAAUzB,oBAAoB,CAACxC;QACxC;QAEAhB,GAAG,mDAAmD;YACpD,MAAMiD,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQC,IAAI,CAAChC;YACpB,qDAAqD;YACrDnB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;QACnD;QAEApD,GAAG,qDAAqD;YACtD,sBAAsB;YACtB,MAAM8C,aAA2B;gBAC/BC,QAAQ;oBAAEV,KAAKC,KAAKC,KAAK,CAAClB,KAAKC,GAAG,KAAK,QAAQ;gBAAK;gBACpDU,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAO;YACT;YACAnB,WAAWiC,eAAe,CAAChC,cAAc8B;YAEzC,+BAA+B;YAC/B/C,OAAOgB,WAAW2C,oBAAoB,CAAC1C,eAAekC,IAAI,CAAC;YAE3D,MAAMzC,oBAAoBM,YAAYC;YAEtC,oDAAoD;YACpDjB,OAAOG,SAAS6B,eAAe,EAAEqB,gBAAgB;QACnD;QAEApD,GAAG,yCAAyC;YAC1C,MAAMkF,cAAc;YACpBjF,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAED,iBAAiB,CAAC;gBACpDE,WAAWX,KAAKC,GAAG,KAAK,KAAK,KAAK;gBAClCW,UAAUjB;gBACVkB,OAAOgD;YACT;YAEA,MAAMjC,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQC,IAAI,CAACgC;YACpBnF,OAAOgB,WAAWgB,eAAe,CAACf,eAAekB,OAAOgB,IAAI,CAACgC;QAC/D;QAEAlF,GAAG,qDAAqD;YACtD,MAAM4E,WAAW,IAAI1E,SAAS2E,aAAa,CAAC,aAAa;YACzD5E,GAAGyB,MAAM,CAACxB,SAAS6B,eAAe,EAAE6B,iBAAiB,CAACgB;YAEtD,IAAI;gBACF,MAAMnE,oBAAoBM,YAAYC;gBACtCjB,OAAO8D,IAAI,CAAC;YACd,EAAE,OAAOC,OAAO;gBACd/D,OAAO+D,OAAOZ,IAAI,CAAC0B;gBACnB7E,OAAO+D,OAAOC,cAAc,CAAC7D,SAAS2E,aAAa;YACrD;QACF;QAEA7E,GAAG,gEAAgE;YACjEC,GAAGyB,MAAM,CAACpB,UAAUuB,mBAAmB,EAAEC,iBAAiB,CAAC;YAE3D,MAAMmB,SAAS,MAAMxC,oBAAoBM,YAAYC;YAErDjB,OAAOkD,QAAQ0B,QAAQ;QACzB;IACF;AACF"}

package/dist/auth/refresh.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=refresh.spec.d.ts.map

package/dist/auth/refresh.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.spec.d.ts","sourceRoot":"","sources":["../../src/auth/refresh.spec.ts"],"names":[],"mappings":""}

package/dist/auth/refresh.spec.js

@@ -1,105 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { mockFigmaTokenResponse } from './__tests__/fixtures.js';
-import { mockFetchFailure, mockFetchSuccess, restoreFetch } from './__tests__/mocks.js';
-import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js';
-describe('refreshAccessToken', ()=>{
-    const testRefreshToken = 'figt_test_refresh_token_987654321';
-    const testClientId = 'test-client-id';
-    const originalDebug = process.env.DEBUG;
-    beforeEach(()=>{
-        vi.clearAllMocks();
-        delete process.env.DEBUG;
-    });
-    afterEach(()=>{
-        restoreFetch();
-        if (originalDebug !== undefined) {
-            process.env.DEBUG = originalDebug;
-        }
-    });
-    it('should successfully refresh access token with correct HTTP request', async ()=>{
-        const mockResponse = mockFigmaTokenResponse();
-        const mockFetch = mockFetchSuccess(mockResponse);
-        const result = await refreshAccessToken(testRefreshToken, testClientId);
-        // Verify response transformation
-        expect(result).toMatchObject({
-            accessToken: mockResponse.access_token,
-            refreshToken: mockResponse.refresh_token,
-            userId: mockResponse.user_id_string
-        });
-        expect(result.expiresAt).toBeGreaterThan(Date.now());
-        // Verify HTTP request details
-        expect(mockFetch).toHaveBeenCalledWith('https://api.staging.figma.com/v1/oauth/refresh', expect.objectContaining({
-            method: 'POST'
-        }));
-        // Verify headers (public client - no Authorization header)
-        const callArgs = mockFetch.mock.calls[0];
-        const headers = callArgs[1].headers;
-        expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded');
-        expect(headers['Authorization']).toBeUndefined(); // Public client - no Basic Auth
-        // Verify request body includes client_id
-        const body = callArgs[1].body;
-        expect(body).toContain('grant_type=refresh_token');
-        expect(body).toContain(`refresh_token=${testRefreshToken}`);
-        expect(body).toContain(`client_id=${testClientId}`);
-    });
-    it('should throw TokenRefreshError on HTTP error', async ()=>{
-        mockFetchFailure(401, 'Invalid refresh token');
-        await expect(refreshAccessToken(testRefreshToken, testClientId)).rejects.toThrow(TokenRefreshError);
-    });
-});
-describe('exchangeCodeForTokens', ()=>{
-    const testAuthCode = 'auth_code_123';
-    const testCodeVerifier = 'code_verifier_123456789012345678901234567890';
-    const testRedirectUri = 'http://localhost:3000/callback';
-    const testClientId = 'test-client-id';
-    const originalDebug = process.env.DEBUG;
-    beforeEach(()=>{
-        vi.clearAllMocks();
-        delete process.env.DEBUG;
-    });
-    afterEach(()=>{
-        restoreFetch();
-        if (originalDebug !== undefined) {
-            process.env.DEBUG = originalDebug;
-        }
-    });
-    it('should successfully exchange authorization code for tokens with PKCE', async ()=>{
-        const mockResponse = mockFigmaTokenResponse();
-        const mockFetch = mockFetchSuccess(mockResponse);
-        const result = await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId);
-        // Verify response transformation
-        expect(result).toMatchObject({
-            accessToken: mockResponse.access_token,
-            refreshToken: mockResponse.refresh_token,
-            userId: mockResponse.user_id_string
-        });
-        expect(result.expiresAt).toBeGreaterThan(Date.now());
-        // Verify HTTP request
-        expect(mockFetch).toHaveBeenCalledWith('https://api.staging.figma.com/v1/oauth/token', expect.objectContaining({
-            method: 'POST'
-        }));
-        // Verify headers (public client - no Authorization header)
-        const callArgs = mockFetch.mock.calls[0];
-        const headers = callArgs[1].headers;
-        expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded');
-        expect(headers['Authorization']).toBeUndefined(); // Public client - no Basic Auth
-    });
-    it('should send correct request body with PKCE', async ()=>{
-        const mockResponse = mockFigmaTokenResponse();
-        const mockFetch = mockFetchSuccess(mockResponse);
-        await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId);
-        const callArgs = mockFetch.mock.calls[0];
-        const body = callArgs[1].body;
-        expect(body).toContain('grant_type=authorization_code');
-        expect(body).toContain(`code=${testAuthCode}`);
-        expect(body).toContain(`redirect_uri=${encodeURIComponent(testRedirectUri)}`);
-        expect(body).toContain(`client_id=${testClientId}`);
-        expect(body).toContain(`code_verifier=${testCodeVerifier}`);
-    });
-    it('should throw TokenRefreshError on invalid authorization code', async ()=>{
-        mockFetchFailure(400, 'Invalid authorization code');
-        await expect(exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId)).rejects.toThrow(TokenRefreshError);
-    });
-});
-
-//# sourceMappingURL=refresh.spec.js.map

package/dist/auth/refresh.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/refresh.spec.ts"],"sourcesContent":["import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport { mockFigmaTokenResponse } from './__tests__/fixtures.js'\nimport { mockFetchFailure, mockFetchSuccess, restoreFetch } from './__tests__/mocks.js'\nimport { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js'\n\ndescribe('refreshAccessToken', () => {\n  const testRefreshToken = 'figt_test_refresh_token_987654321'\n  const testClientId = 'test-client-id'\n  const originalDebug = process.env.DEBUG\n\n  beforeEach(() => {\n    vi.clearAllMocks()\n    delete process.env.DEBUG\n  })\n\n  afterEach(() => {\n    restoreFetch()\n    if (originalDebug !== undefined) {\n      process.env.DEBUG = originalDebug\n    }\n  })\n\n  it('should successfully refresh access token with correct HTTP request', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    const result = await refreshAccessToken(testRefreshToken, testClientId)\n\n    // Verify response transformation\n    expect(result).toMatchObject({\n      accessToken: mockResponse.access_token,\n      refreshToken: mockResponse.refresh_token,\n      userId: mockResponse.user_id_string,\n    })\n    expect(result.expiresAt).toBeGreaterThan(Date.now())\n\n    // Verify HTTP request details\n    expect(mockFetch).toHaveBeenCalledWith(\n      'https://api.staging.figma.com/v1/oauth/refresh',\n      expect.objectContaining({\n        method: 'POST',\n      }),\n    )\n\n    // Verify headers (public client - no Authorization header)\n    const callArgs = mockFetch.mock.calls[0]\n    const headers = callArgs[1].headers\n    expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')\n    expect(headers['Authorization']).toBeUndefined() // Public client - no Basic Auth\n\n    // Verify request body includes client_id\n    const body = callArgs[1].body\n    expect(body).toContain('grant_type=refresh_token')\n    expect(body).toContain(`refresh_token=${testRefreshToken}`)\n    expect(body).toContain(`client_id=${testClientId}`)\n  })\n\n  it('should throw TokenRefreshError on HTTP error', async () => {\n    mockFetchFailure(401, 'Invalid refresh token')\n\n    await expect(refreshAccessToken(testRefreshToken, testClientId)).rejects.toThrow(\n      TokenRefreshError,\n    )\n  })\n})\n\ndescribe('exchangeCodeForTokens', () => {\n  const testAuthCode = 'auth_code_123'\n  const testCodeVerifier = 'code_verifier_123456789012345678901234567890'\n  const testRedirectUri = 'http://localhost:3000/callback'\n  const testClientId = 'test-client-id'\n  const originalDebug = process.env.DEBUG\n\n  beforeEach(() => {\n    vi.clearAllMocks()\n    delete process.env.DEBUG\n  })\n\n  afterEach(() => {\n    restoreFetch()\n    if (originalDebug !== undefined) {\n      process.env.DEBUG = originalDebug\n    }\n  })\n\n  it('should successfully exchange authorization code for tokens with PKCE', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    const result = await exchangeCodeForTokens(\n      testAuthCode,\n      testCodeVerifier,\n      testRedirectUri,\n      testClientId,\n    )\n\n    // Verify response transformation\n    expect(result).toMatchObject({\n      accessToken: mockResponse.access_token,\n      refreshToken: mockResponse.refresh_token,\n      userId: mockResponse.user_id_string,\n    })\n    expect(result.expiresAt).toBeGreaterThan(Date.now())\n\n    // Verify HTTP request\n    expect(mockFetch).toHaveBeenCalledWith(\n      'https://api.staging.figma.com/v1/oauth/token',\n      expect.objectContaining({\n        method: 'POST',\n      }),\n    )\n\n    // Verify headers (public client - no Authorization header)\n    const callArgs = mockFetch.mock.calls[0]\n    const headers = callArgs[1].headers\n    expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')\n    expect(headers['Authorization']).toBeUndefined() // Public client - no Basic Auth\n  })\n\n  it('should send correct request body with PKCE', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId)\n\n    const callArgs = mockFetch.mock.calls[0]\n    const body = callArgs[1].body\n\n    expect(body).toContain('grant_type=authorization_code')\n    expect(body).toContain(`code=${testAuthCode}`)\n    expect(body).toContain(`redirect_uri=${encodeURIComponent(testRedirectUri)}`)\n    expect(body).toContain(`client_id=${testClientId}`)\n    expect(body).toContain(`code_verifier=${testCodeVerifier}`)\n  })\n\n  it('should throw TokenRefreshError on invalid authorization code', async () => {\n    mockFetchFailure(400, 'Invalid authorization code')\n\n    await expect(\n      exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId),\n    ).rejects.toThrow(TokenRefreshError)\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","vi","mockFigmaTokenResponse","mockFetchFailure","mockFetchSuccess","restoreFetch","exchangeCodeForTokens","refreshAccessToken","TokenRefreshError","testRefreshToken","testClientId","originalDebug","process","env","DEBUG","clearAllMocks","undefined","mockResponse","mockFetch","result","toMatchObject","accessToken","access_token","refreshToken","refresh_token","userId","user_id_string","expiresAt","toBeGreaterThan","Date","now","toHaveBeenCalledWith","objectContaining","method","callArgs","mock","calls","headers","toBe","toBeUndefined","body","toContain","rejects","toThrow","testAuthCode","testCodeVerifier","testRedirectUri","encodeURIComponent"],"mappings":"AAAA,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAExE,SAASC,sBAAsB,QAAQ,0BAAyB;AAChE,SAASC,gBAAgB,EAAEC,gBAAgB,EAAEC,YAAY,QAAQ,uBAAsB;AACvF,SAASC,qBAAqB,EAAEC,kBAAkB,EAAEC,iBAAiB,QAAQ,eAAc;AAE3FV,SAAS,sBAAsB;IAC7B,MAAMW,mBAAmB;IACzB,MAAMC,eAAe;IACrB,MAAMC,gBAAgBC,QAAQC,GAAG,CAACC,KAAK;IAEvCjB,WAAW;QACTI,GAAGc,aAAa;QAChB,OAAOH,QAAQC,GAAG,CAACC,KAAK;IAC1B;IAEAlB,UAAU;QACRS;QACA,IAAIM,kBAAkBK,WAAW;YAC/BJ,QAAQC,GAAG,CAACC,KAAK,GAAGH;QACtB;IACF;IAEAX,GAAG,sEAAsE;QACvE,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAME,SAAS,MAAMZ,mBAAmBE,kBAAkBC;QAE1D,iCAAiC;QACjCX,OAAOoB,QAAQC,aAAa,CAAC;YAC3BC,aAAaJ,aAAaK,YAAY;YACtCC,cAAcN,aAAaO,aAAa;YACxCC,QAAQR,aAAaS,cAAc;QACrC;QACA3B,OAAOoB,OAAOQ,SAAS,EAAEC,eAAe,CAACC,KAAKC,GAAG;QAEjD,8BAA8B;QAC9B/B,OAAOmB,WAAWa,oBAAoB,CACpC,kDACAhC,OAAOiC,gBAAgB,CAAC;YACtBC,QAAQ;QACV;QAGF,2DAA2D;QAC3D,MAAMC,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMC,UAAUH,QAAQ,CAAC,EAAE,CAACG,OAAO;QACnCtC,OAAOsC,OAAO,CAAC,eAAe,EAAEC,IAAI,CAAC;QACrCvC,OAAOsC,OAAO,CAAC,gBAAgB,EAAEE,aAAa,IAAG,gCAAgC;QAEjF,yCAAyC;QACzC,MAAMC,OAAON,QAAQ,CAAC,EAAE,CAACM,IAAI;QAC7BzC,OAAOyC,MAAMC,SAAS,CAAC;QACvB1C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,cAAc,EAAEhC,kBAAkB;QAC1DV,OAAOyC,MAAMC,SAAS,CAAC,CAAC,UAAU,EAAE/B,cAAc;IACpD;IAEAV,GAAG,gDAAgD;QACjDG,iBAAiB,KAAK;QAEtB,MAAMJ,OAAOQ,mBAAmBE,kBAAkBC,eAAegC,OAAO,CAACC,OAAO,CAC9EnC;IAEJ;AACF;AAEAV,SAAS,yBAAyB;IAChC,MAAM8C,eAAe;IACrB,MAAMC,mBAAmB;IACzB,MAAMC,kBAAkB;IACxB,MAAMpC,eAAe;IACrB,MAAMC,gBAAgBC,QAAQC,GAAG,CAACC,KAAK;IAEvCjB,WAAW;QACTI,GAAGc,aAAa;QAChB,OAAOH,QAAQC,GAAG,CAACC,KAAK;IAC1B;IAEAlB,UAAU;QACRS;QACA,IAAIM,kBAAkBK,WAAW;YAC/BJ,QAAQC,GAAG,CAACC,KAAK,GAAGH;QACtB;IACF;IAEAX,GAAG,wEAAwE;QACzE,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAME,SAAS,MAAMb,sBACnBsC,cACAC,kBACAC,iBACApC;QAGF,iCAAiC;QACjCX,OAAOoB,QAAQC,aAAa,CAAC;YAC3BC,aAAaJ,aAAaK,YAAY;YACtCC,cAAcN,aAAaO,aAAa;YACxCC,QAAQR,aAAaS,cAAc;QACrC;QACA3B,OAAOoB,OAAOQ,SAAS,EAAEC,eAAe,CAACC,KAAKC,GAAG;QAEjD,sBAAsB;QACtB/B,OAAOmB,WAAWa,oBAAoB,CACpC,gDACAhC,OAAOiC,gBAAgB,CAAC;YACtBC,QAAQ;QACV;QAGF,2DAA2D;QAC3D,MAAMC,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMC,UAAUH,QAAQ,CAAC,EAAE,CAACG,OAAO;QACnCtC,OAAOsC,OAAO,CAAC,eAAe,EAAEC,IAAI,CAAC;QACrCvC,OAAOsC,OAAO,CAAC,gBAAgB,EAAEE,aAAa,IAAG,gCAAgC;IACnF;IAEAvC,GAAG,8CAA8C;QAC/C,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAMX,sBAAsBsC,cAAcC,kBAAkBC,iBAAiBpC;QAE7E,MAAMwB,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMI,OAAON,QAAQ,CAAC,EAAE,CAACM,IAAI;QAE7BzC,OAAOyC,MAAMC,SAAS,CAAC;QACvB1C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,KAAK,EAAEG,cAAc;QAC7C7C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,aAAa,EAAEM,mBAAmBD,kBAAkB;QAC5E/C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,UAAU,EAAE/B,cAAc;QAClDX,OAAOyC,MAAMC,SAAS,CAAC,CAAC,cAAc,EAAEI,kBAAkB;IAC5D;IAEA7C,GAAG,gEAAgE;QACjEG,iBAAiB,KAAK;QAEtB,MAAMJ,OACJO,sBAAsBsC,cAAcC,kBAAkBC,iBAAiBpC,eACvEgC,OAAO,CAACC,OAAO,CAACnC;IACpB;AACF"}

package/dist/auth/token-store.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=token-store.spec.d.ts.map

package/dist/auth/token-store.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-store.spec.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.spec.ts"],"names":[],"mappings":""}