@payloadcms/figma 0.0.1-alpha.0

package/dist/auth/refresh.js

@@ -0,0 +1,149 @@
+/* eslint-disable perfectionist/sort-objects */ import { OAUTH_CONFIG } from '../config/oauth.js';
+import { isDebug } from '../utils/is-debug.js';
+import * as log from '../utils/log.js';
+/**
+ * Error thrown when token refresh fails
+ */ export class TokenRefreshError extends Error {
+    statusCode;
+    constructor(message, statusCode){
+        super(message), this.statusCode = statusCode;
+        this.name = 'TokenRefreshError';
+    }
+}
+/**
+ * Refresh an expired OAuth2 access token using a refresh token
+ *
+ * Makes a POST request to Figma's token endpoint with the refresh token
+ * to obtain a new access token. Uses public client pattern (no client secret).
+ *
+ * @param refreshToken - The refresh token to use
+ * @param clientId - OAuth2 client ID (defaults to config)
+ * @returns Promise resolving to new tokens
+ * @throws TokenRefreshError if refresh fails
+ */ export async function refreshAccessToken(refreshToken, clientId = OAUTH_CONFIG.clientId) {
+    // Prepare form data for token refresh request (public client)
+    const params = new URLSearchParams({
+        client_id: clientId,
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken
+    });
+    try {
+        const response = await fetch(OAUTH_CONFIG.refreshUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: params.toString()
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status);
+        }
+        const data = await response.json();
+        // Validate response contains required fields
+        if (!data.access_token || !data.refresh_token || !data.expires_in) {
+            throw new TokenRefreshError('Invalid token response: missing required fields');
+        }
+        // Convert response to our internal token format
+        const expiresAt = Date.now() + data.expires_in * 1000;
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt,
+            userId: data.user_id_string
+        };
+    } catch (error) {
+        if (error instanceof TokenRefreshError) {
+            throw error;
+        }
+        // Handle network errors and other exceptions
+        throw new TokenRefreshError(`Failed to refresh token: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+/**
+ * Exchange an authorization code for OAuth2 tokens
+ *
+ * This is used during the initial OAuth flow after the user authorizes the app.
+ * Uses public client pattern with PKCE (code verifier is required).
+ *
+ * @param code - Authorization code from OAuth callback
+ * @param codeVerifier - PKCE code verifier (required for public clients)
+ * @param redirectUri - Redirect URI used in the authorization request
+ * @param clientId - OAuth2 client ID (defaults to config)
+ * @returns Promise resolving to tokens
+ * @throws TokenRefreshError if exchange fails
+ */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri = OAUTH_CONFIG.redirectUri, clientId = OAUTH_CONFIG.clientId) {
+    // Prepare form data for token exchange (public client with PKCE)
+    const params = new URLSearchParams({
+        client_id: clientId,
+        code,
+        code_verifier: codeVerifier,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri
+    });
+    try {
+        // Public client - no client secret or Basic Auth header needed
+        // Security is provided by PKCE (code_verifier in the request body)
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        };
+        // Debug logging
+        if (isDebug()) {
+            log.debug(`Token exchange request: ${JSON.stringify({
+                url: OAUTH_CONFIG.tokenUrl,
+                headers,
+                body: params.toString()
+            })}`);
+        }
+        const response = await fetch(OAUTH_CONFIG.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: params.toString()
+        });
+        if (isDebug()) {
+            log.debug(`Token exchange response: ${JSON.stringify({
+                status: response.status,
+                statusText: response.statusText,
+                headers: Object.fromEntries(response.headers.entries())
+            })}`);
+        }
+        if (!response.ok) {
+            const errorText = await response.text();
+            if (isDebug()) {
+                log.debug(`Error response body: ${errorText}`);
+            }
+            throw new TokenRefreshError(`Token exchange failed: ${response.statusText}. ${errorText}`, response.status);
+        }
+        const data = await response.json();
+        if (isDebug()) {
+            log.debug(`Token response: ${JSON.stringify({
+                access_token: data.access_token,
+                token_type: data.token_type,
+                expires_in: data.expires_in,
+                scope: data.scope,
+                user_id_string: data.user_id_string,
+                refresh_token: data.refresh_token?.substring(0, 10) + '...'
+            })}`);
+        }
+        // Validate response contains required fields
+        if (!data.access_token || !data.refresh_token || !data.expires_in) {
+            throw new TokenRefreshError('Invalid token response: missing required fields');
+        }
+        // Convert response to our internal token format
+        const expiresAt = Date.now() + data.expires_in * 1000;
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt,
+            userId: data.user_id_string
+        };
+    } catch (error) {
+        if (error instanceof TokenRefreshError) {
+            throw error;
+        }
+        // Handle network errors and other exceptions
+        throw new TokenRefreshError(`Failed to exchange code for tokens: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+
+//# sourceMappingURL=refresh.js.map

package/dist/auth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/refresh.ts"],"sourcesContent":["/* eslint-disable perfectionist/sort-objects */\nimport type { FigmaTokenResponse, FigmaTokens } from './types.js'\n\nimport { OAUTH_CONFIG } from '../config/oauth.js'\nimport { isDebug } from '../utils/is-debug.js'\nimport * as log from '../utils/log.js'\n\n/**\n * Error thrown when token refresh fails\n */\nexport class TokenRefreshError extends Error {\n  constructor(\n    message: string,\n    public statusCode?: number,\n  ) {\n    super(message)\n    this.name = 'TokenRefreshError'\n  }\n}\n\n/**\n * Refresh an expired OAuth2 access token using a refresh token\n *\n * Makes a POST request to Figma's token endpoint with the refresh token\n * to obtain a new access token. Uses public client pattern (no client secret).\n *\n * @param refreshToken - The refresh token to use\n * @param clientId - OAuth2 client ID (defaults to config)\n * @returns Promise resolving to new tokens\n * @throws TokenRefreshError if refresh fails\n */\nexport async function refreshAccessToken(\n  refreshToken: string,\n  clientId: string = OAUTH_CONFIG.clientId,\n): Promise<FigmaTokens> {\n  // Prepare form data for token refresh request (public client)\n  const params = new URLSearchParams({\n    client_id: clientId,\n    grant_type: 'refresh_token',\n    refresh_token: refreshToken,\n  })\n\n  try {\n    const response = await fetch(OAUTH_CONFIG.refreshUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: params.toString(),\n    })\n\n    if (!response.ok) {\n      const errorText = await response.text()\n      throw new TokenRefreshError(\n        `Token refresh failed: ${response.statusText}. ${errorText}`,\n        response.status,\n      )\n    }\n\n    const data = (await response.json()) as FigmaTokenResponse\n\n    // Validate response contains required fields\n    if (!data.access_token || !data.refresh_token || !data.expires_in) {\n      throw new TokenRefreshError('Invalid token response: missing required fields')\n    }\n\n    // Convert response to our internal token format\n    const expiresAt = Date.now() + data.expires_in * 1000\n\n    return {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt,\n      userId: data.user_id_string,\n    }\n  } catch (error) {\n    if (error instanceof TokenRefreshError) {\n      throw error\n    }\n\n    // Handle network errors and other exceptions\n    throw new TokenRefreshError(\n      `Failed to refresh token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n    )\n  }\n}\n\n/**\n * Exchange an authorization code for OAuth2 tokens\n *\n * This is used during the initial OAuth flow after the user authorizes the app.\n * Uses public client pattern with PKCE (code verifier is required).\n *\n * @param code - Authorization code from OAuth callback\n * @param codeVerifier - PKCE code verifier (required for public clients)\n * @param redirectUri - Redirect URI used in the authorization request\n * @param clientId - OAuth2 client ID (defaults to config)\n * @returns Promise resolving to tokens\n * @throws TokenRefreshError if exchange fails\n */\nexport async function exchangeCodeForTokens(\n  code: string,\n  codeVerifier: string,\n  redirectUri: string = OAUTH_CONFIG.redirectUri,\n  clientId: string = OAUTH_CONFIG.clientId,\n): Promise<FigmaTokens> {\n  // Prepare form data for token exchange (public client with PKCE)\n  const params = new URLSearchParams({\n    client_id: clientId,\n    code,\n    code_verifier: codeVerifier,\n    grant_type: 'authorization_code',\n    redirect_uri: redirectUri,\n  })\n\n  try {\n    // Public client - no client secret or Basic Auth header needed\n    // Security is provided by PKCE (code_verifier in the request body)\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Debug logging\n    if (isDebug()) {\n      log.debug(\n        `Token exchange request: ${JSON.stringify({\n          url: OAUTH_CONFIG.tokenUrl,\n          headers,\n          body: params.toString(),\n        })}`,\n      )\n    }\n\n    const response = await fetch(OAUTH_CONFIG.tokenUrl, {\n      method: 'POST',\n      headers,\n      body: params.toString(),\n    })\n\n    if (isDebug()) {\n      log.debug(\n        `Token exchange response: ${JSON.stringify({\n          status: response.status,\n          statusText: response.statusText,\n          headers: Object.fromEntries(response.headers.entries()),\n        })}`,\n      )\n    }\n\n    if (!response.ok) {\n      const errorText = await response.text()\n      if (isDebug()) {\n        log.debug(`Error response body: ${errorText}`)\n      }\n      throw new TokenRefreshError(\n        `Token exchange failed: ${response.statusText}. ${errorText}`,\n        response.status,\n      )\n    }\n\n    const data = (await response.json()) as FigmaTokenResponse\n\n    if (isDebug()) {\n      log.debug(\n        `Token response: ${JSON.stringify({\n          access_token: data.access_token,\n          token_type: data.token_type,\n          expires_in: data.expires_in,\n          scope: data.scope,\n          user_id_string: data.user_id_string,\n          refresh_token: data.refresh_token?.substring(0, 10) + '...',\n        })}`,\n      )\n    }\n\n    // Validate response contains required fields\n    if (!data.access_token || !data.refresh_token || !data.expires_in) {\n      throw new TokenRefreshError('Invalid token response: missing required fields')\n    }\n\n    // Convert response to our internal token format\n    const expiresAt = Date.now() + data.expires_in * 1000\n\n    return {\n      accessToken: data.access_token,\n      refreshToken: data.refresh_token,\n      expiresAt,\n      userId: data.user_id_string,\n    }\n  } catch (error) {\n    if (error instanceof TokenRefreshError) {\n      throw error\n    }\n\n    // Handle network errors and other exceptions\n    throw new TokenRefreshError(\n      `Failed to exchange code for tokens: ${error instanceof Error ? error.message : 'Unknown error'}`,\n    )\n  }\n}\n"],"names":["OAUTH_CONFIG","isDebug","log","TokenRefreshError","Error","message","statusCode","name","refreshAccessToken","refreshToken","clientId","params","URLSearchParams","client_id","grant_type","refresh_token","response","fetch","refreshUrl","method","headers","body","toString","ok","errorText","text","statusText","status","data","json","access_token","expires_in","expiresAt","Date","now","accessToken","userId","user_id_string","error","exchangeCodeForTokens","code","codeVerifier","redirectUri","code_verifier","redirect_uri","debug","JSON","stringify","url","tokenUrl","Object","fromEntries","entries","token_type","scope","substring"],"mappings":"AAAA,6CAA6C,GAG7C,SAASA,YAAY,QAAQ,qBAAoB;AACjD,SAASC,OAAO,QAAQ,uBAAsB;AAC9C,YAAYC,SAAS,kBAAiB;AAEtC;;CAEC,GACD,OAAO,MAAMC,0BAA0BC;;IACrC,YACEC,OAAe,EACf,AAAOC,UAAmB,CAC1B;QACA,KAAK,CAACD,eAFCC,aAAAA;QAGP,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,mBACpBC,YAAoB,EACpBC,WAAmBV,aAAaU,QAAQ;IAExC,8DAA8D;IAC9D,MAAMC,SAAS,IAAIC,gBAAgB;QACjCC,WAAWH;QACXI,YAAY;QACZC,eAAeN;IACjB;IAEA,IAAI;QACF,MAAMO,WAAW,MAAMC,MAAMjB,aAAakB,UAAU,EAAE;YACpDC,QAAQ;YACRC,SAAS;gBACP,gBAAgB;YAClB;YACAC,MAAMV,OAAOW,QAAQ;QACvB;QAEA,IAAI,CAACN,SAASO,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMR,SAASS,IAAI;YACrC,MAAM,IAAItB,kBACR,CAAC,sBAAsB,EAAEa,SAASU,UAAU,CAAC,EAAE,EAAEF,WAAW,EAC5DR,SAASW,MAAM;QAEnB;QAEA,MAAMC,OAAQ,MAAMZ,SAASa,IAAI;QAEjC,6CAA6C;QAC7C,IAAI,CAACD,KAAKE,YAAY,IAAI,CAACF,KAAKb,aAAa,IAAI,CAACa,KAAKG,UAAU,EAAE;YACjE,MAAM,IAAI5B,kBAAkB;QAC9B;QAEA,gDAAgD;QAChD,MAAM6B,YAAYC,KAAKC,GAAG,KAAKN,KAAKG,UAAU,GAAG;QAEjD,OAAO;YACLI,aAAaP,KAAKE,YAAY;YAC9BrB,cAAcmB,KAAKb,aAAa;YAChCiB;YACAI,QAAQR,KAAKS,cAAc;QAC7B;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBnC,mBAAmB;YACtC,MAAMmC;QACR;QAEA,6CAA6C;QAC7C,MAAM,IAAInC,kBACR,CAAC,yBAAyB,EAAEmC,iBAAiBlC,QAAQkC,MAAMjC,OAAO,GAAG,iBAAiB;IAE1F;AACF;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAekC,sBACpBC,IAAY,EACZC,YAAoB,EACpBC,cAAsB1C,aAAa0C,WAAW,EAC9ChC,WAAmBV,aAAaU,QAAQ;IAExC,iEAAiE;IACjE,MAAMC,SAAS,IAAIC,gBAAgB;QACjCC,WAAWH;QACX8B;QACAG,eAAeF;QACf3B,YAAY;QACZ8B,cAAcF;IAChB;IAEA,IAAI;QACF,+DAA+D;QAC/D,mEAAmE;QACnE,MAAMtB,UAAkC;YACtC,gBAAgB;QAClB;QAEA,gBAAgB;QAChB,IAAInB,WAAW;YACbC,IAAI2C,KAAK,CACP,CAAC,wBAAwB,EAAEC,KAAKC,SAAS,CAAC;gBACxCC,KAAKhD,aAAaiD,QAAQ;gBAC1B7B;gBACAC,MAAMV,OAAOW,QAAQ;YACvB,IAAI;QAER;QAEA,MAAMN,WAAW,MAAMC,MAAMjB,aAAaiD,QAAQ,EAAE;YAClD9B,QAAQ;YACRC;YACAC,MAAMV,OAAOW,QAAQ;QACvB;QAEA,IAAIrB,WAAW;YACbC,IAAI2C,KAAK,CACP,CAAC,yBAAyB,EAAEC,KAAKC,SAAS,CAAC;gBACzCpB,QAAQX,SAASW,MAAM;gBACvBD,YAAYV,SAASU,UAAU;gBAC/BN,SAAS8B,OAAOC,WAAW,CAACnC,SAASI,OAAO,CAACgC,OAAO;YACtD,IAAI;QAER;QAEA,IAAI,CAACpC,SAASO,EAAE,EAAE;YAChB,MAAMC,YAAY,MAAMR,SAASS,IAAI;YACrC,IAAIxB,WAAW;gBACbC,IAAI2C,KAAK,CAAC,CAAC,qBAAqB,EAAErB,WAAW;YAC/C;YACA,MAAM,IAAIrB,kBACR,CAAC,uBAAuB,EAAEa,SAASU,UAAU,CAAC,EAAE,EAAEF,WAAW,EAC7DR,SAASW,MAAM;QAEnB;QAEA,MAAMC,OAAQ,MAAMZ,SAASa,IAAI;QAEjC,IAAI5B,WAAW;YACbC,IAAI2C,KAAK,CACP,CAAC,gBAAgB,EAAEC,KAAKC,SAAS,CAAC;gBAChCjB,cAAcF,KAAKE,YAAY;gBAC/BuB,YAAYzB,KAAKyB,UAAU;gBAC3BtB,YAAYH,KAAKG,UAAU;gBAC3BuB,OAAO1B,KAAK0B,KAAK;gBACjBjB,gBAAgBT,KAAKS,cAAc;gBACnCtB,eAAea,KAAKb,aAAa,EAAEwC,UAAU,GAAG,MAAM;YACxD,IAAI;QAER;QAEA,6CAA6C;QAC7C,IAAI,CAAC3B,KAAKE,YAAY,IAAI,CAACF,KAAKb,aAAa,IAAI,CAACa,KAAKG,UAAU,EAAE;YACjE,MAAM,IAAI5B,kBAAkB;QAC9B;QAEA,gDAAgD;QAChD,MAAM6B,YAAYC,KAAKC,GAAG,KAAKN,KAAKG,UAAU,GAAG;QAEjD,OAAO;YACLI,aAAaP,KAAKE,YAAY;YAC9BrB,cAAcmB,KAAKb,aAAa;YAChCiB;YACAI,QAAQR,KAAKS,cAAc;QAC7B;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBnC,mBAAmB;YACtC,MAAMmC;QACR;QAEA,6CAA6C;QAC7C,MAAM,IAAInC,kBACR,CAAC,oCAAoC,EAAEmC,iBAAiBlC,QAAQkC,MAAMjC,OAAO,GAAG,iBAAiB;IAErG;AACF"}

package/dist/auth/refresh.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=refresh.spec.d.ts.map

package/dist/auth/refresh.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.spec.d.ts","sourceRoot":"","sources":["../../src/auth/refresh.spec.ts"],"names":[],"mappings":""}

package/dist/auth/refresh.spec.js

@@ -0,0 +1,105 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { mockFigmaTokenResponse } from './__tests__/fixtures.js';
+import { mockFetchFailure, mockFetchSuccess, restoreFetch } from './__tests__/mocks.js';
+import { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js';
+describe('refreshAccessToken', ()=>{
+    const testRefreshToken = 'figt_test_refresh_token_987654321';
+    const testClientId = 'test-client-id';
+    const originalDebug = process.env.DEBUG;
+    beforeEach(()=>{
+        vi.clearAllMocks();
+        delete process.env.DEBUG;
+    });
+    afterEach(()=>{
+        restoreFetch();
+        if (originalDebug !== undefined) {
+            process.env.DEBUG = originalDebug;
+        }
+    });
+    it('should successfully refresh access token with correct HTTP request', async ()=>{
+        const mockResponse = mockFigmaTokenResponse();
+        const mockFetch = mockFetchSuccess(mockResponse);
+        const result = await refreshAccessToken(testRefreshToken, testClientId);
+        // Verify response transformation
+        expect(result).toMatchObject({
+            accessToken: mockResponse.access_token,
+            refreshToken: mockResponse.refresh_token,
+            userId: mockResponse.user_id_string
+        });
+        expect(result.expiresAt).toBeGreaterThan(Date.now());
+        // Verify HTTP request details
+        expect(mockFetch).toHaveBeenCalledWith('https://api.staging.figma.com/v1/oauth/refresh', expect.objectContaining({
+            method: 'POST'
+        }));
+        // Verify headers (public client - no Authorization header)
+        const callArgs = mockFetch.mock.calls[0];
+        const headers = callArgs[1].headers;
+        expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded');
+        expect(headers['Authorization']).toBeUndefined(); // Public client - no Basic Auth
+        // Verify request body includes client_id
+        const body = callArgs[1].body;
+        expect(body).toContain('grant_type=refresh_token');
+        expect(body).toContain(`refresh_token=${testRefreshToken}`);
+        expect(body).toContain(`client_id=${testClientId}`);
+    });
+    it('should throw TokenRefreshError on HTTP error', async ()=>{
+        mockFetchFailure(401, 'Invalid refresh token');
+        await expect(refreshAccessToken(testRefreshToken, testClientId)).rejects.toThrow(TokenRefreshError);
+    });
+});
+describe('exchangeCodeForTokens', ()=>{
+    const testAuthCode = 'auth_code_123';
+    const testCodeVerifier = 'code_verifier_123456789012345678901234567890';
+    const testRedirectUri = 'http://localhost:3000/callback';
+    const testClientId = 'test-client-id';
+    const originalDebug = process.env.DEBUG;
+    beforeEach(()=>{
+        vi.clearAllMocks();
+        delete process.env.DEBUG;
+    });
+    afterEach(()=>{
+        restoreFetch();
+        if (originalDebug !== undefined) {
+            process.env.DEBUG = originalDebug;
+        }
+    });
+    it('should successfully exchange authorization code for tokens with PKCE', async ()=>{
+        const mockResponse = mockFigmaTokenResponse();
+        const mockFetch = mockFetchSuccess(mockResponse);
+        const result = await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId);
+        // Verify response transformation
+        expect(result).toMatchObject({
+            accessToken: mockResponse.access_token,
+            refreshToken: mockResponse.refresh_token,
+            userId: mockResponse.user_id_string
+        });
+        expect(result.expiresAt).toBeGreaterThan(Date.now());
+        // Verify HTTP request
+        expect(mockFetch).toHaveBeenCalledWith('https://api.staging.figma.com/v1/oauth/token', expect.objectContaining({
+            method: 'POST'
+        }));
+        // Verify headers (public client - no Authorization header)
+        const callArgs = mockFetch.mock.calls[0];
+        const headers = callArgs[1].headers;
+        expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded');
+        expect(headers['Authorization']).toBeUndefined(); // Public client - no Basic Auth
+    });
+    it('should send correct request body with PKCE', async ()=>{
+        const mockResponse = mockFigmaTokenResponse();
+        const mockFetch = mockFetchSuccess(mockResponse);
+        await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId);
+        const callArgs = mockFetch.mock.calls[0];
+        const body = callArgs[1].body;
+        expect(body).toContain('grant_type=authorization_code');
+        expect(body).toContain(`code=${testAuthCode}`);
+        expect(body).toContain(`redirect_uri=${encodeURIComponent(testRedirectUri)}`);
+        expect(body).toContain(`client_id=${testClientId}`);
+        expect(body).toContain(`code_verifier=${testCodeVerifier}`);
+    });
+    it('should throw TokenRefreshError on invalid authorization code', async ()=>{
+        mockFetchFailure(400, 'Invalid authorization code');
+        await expect(exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId)).rejects.toThrow(TokenRefreshError);
+    });
+});
+
+//# sourceMappingURL=refresh.spec.js.map

package/dist/auth/refresh.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/refresh.spec.ts"],"sourcesContent":["import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport { mockFigmaTokenResponse } from './__tests__/fixtures.js'\nimport { mockFetchFailure, mockFetchSuccess, restoreFetch } from './__tests__/mocks.js'\nimport { exchangeCodeForTokens, refreshAccessToken, TokenRefreshError } from './refresh.js'\n\ndescribe('refreshAccessToken', () => {\n  const testRefreshToken = 'figt_test_refresh_token_987654321'\n  const testClientId = 'test-client-id'\n  const originalDebug = process.env.DEBUG\n\n  beforeEach(() => {\n    vi.clearAllMocks()\n    delete process.env.DEBUG\n  })\n\n  afterEach(() => {\n    restoreFetch()\n    if (originalDebug !== undefined) {\n      process.env.DEBUG = originalDebug\n    }\n  })\n\n  it('should successfully refresh access token with correct HTTP request', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    const result = await refreshAccessToken(testRefreshToken, testClientId)\n\n    // Verify response transformation\n    expect(result).toMatchObject({\n      accessToken: mockResponse.access_token,\n      refreshToken: mockResponse.refresh_token,\n      userId: mockResponse.user_id_string,\n    })\n    expect(result.expiresAt).toBeGreaterThan(Date.now())\n\n    // Verify HTTP request details\n    expect(mockFetch).toHaveBeenCalledWith(\n      'https://api.staging.figma.com/v1/oauth/refresh',\n      expect.objectContaining({\n        method: 'POST',\n      }),\n    )\n\n    // Verify headers (public client - no Authorization header)\n    const callArgs = mockFetch.mock.calls[0]\n    const headers = callArgs[1].headers\n    expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')\n    expect(headers['Authorization']).toBeUndefined() // Public client - no Basic Auth\n\n    // Verify request body includes client_id\n    const body = callArgs[1].body\n    expect(body).toContain('grant_type=refresh_token')\n    expect(body).toContain(`refresh_token=${testRefreshToken}`)\n    expect(body).toContain(`client_id=${testClientId}`)\n  })\n\n  it('should throw TokenRefreshError on HTTP error', async () => {\n    mockFetchFailure(401, 'Invalid refresh token')\n\n    await expect(refreshAccessToken(testRefreshToken, testClientId)).rejects.toThrow(\n      TokenRefreshError,\n    )\n  })\n})\n\ndescribe('exchangeCodeForTokens', () => {\n  const testAuthCode = 'auth_code_123'\n  const testCodeVerifier = 'code_verifier_123456789012345678901234567890'\n  const testRedirectUri = 'http://localhost:3000/callback'\n  const testClientId = 'test-client-id'\n  const originalDebug = process.env.DEBUG\n\n  beforeEach(() => {\n    vi.clearAllMocks()\n    delete process.env.DEBUG\n  })\n\n  afterEach(() => {\n    restoreFetch()\n    if (originalDebug !== undefined) {\n      process.env.DEBUG = originalDebug\n    }\n  })\n\n  it('should successfully exchange authorization code for tokens with PKCE', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    const result = await exchangeCodeForTokens(\n      testAuthCode,\n      testCodeVerifier,\n      testRedirectUri,\n      testClientId,\n    )\n\n    // Verify response transformation\n    expect(result).toMatchObject({\n      accessToken: mockResponse.access_token,\n      refreshToken: mockResponse.refresh_token,\n      userId: mockResponse.user_id_string,\n    })\n    expect(result.expiresAt).toBeGreaterThan(Date.now())\n\n    // Verify HTTP request\n    expect(mockFetch).toHaveBeenCalledWith(\n      'https://api.staging.figma.com/v1/oauth/token',\n      expect.objectContaining({\n        method: 'POST',\n      }),\n    )\n\n    // Verify headers (public client - no Authorization header)\n    const callArgs = mockFetch.mock.calls[0]\n    const headers = callArgs[1].headers\n    expect(headers['Content-Type']).toBe('application/x-www-form-urlencoded')\n    expect(headers['Authorization']).toBeUndefined() // Public client - no Basic Auth\n  })\n\n  it('should send correct request body with PKCE', async () => {\n    const mockResponse = mockFigmaTokenResponse()\n    const mockFetch = mockFetchSuccess(mockResponse)\n\n    await exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId)\n\n    const callArgs = mockFetch.mock.calls[0]\n    const body = callArgs[1].body\n\n    expect(body).toContain('grant_type=authorization_code')\n    expect(body).toContain(`code=${testAuthCode}`)\n    expect(body).toContain(`redirect_uri=${encodeURIComponent(testRedirectUri)}`)\n    expect(body).toContain(`client_id=${testClientId}`)\n    expect(body).toContain(`code_verifier=${testCodeVerifier}`)\n  })\n\n  it('should throw TokenRefreshError on invalid authorization code', async () => {\n    mockFetchFailure(400, 'Invalid authorization code')\n\n    await expect(\n      exchangeCodeForTokens(testAuthCode, testCodeVerifier, testRedirectUri, testClientId),\n    ).rejects.toThrow(TokenRefreshError)\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","vi","mockFigmaTokenResponse","mockFetchFailure","mockFetchSuccess","restoreFetch","exchangeCodeForTokens","refreshAccessToken","TokenRefreshError","testRefreshToken","testClientId","originalDebug","process","env","DEBUG","clearAllMocks","undefined","mockResponse","mockFetch","result","toMatchObject","accessToken","access_token","refreshToken","refresh_token","userId","user_id_string","expiresAt","toBeGreaterThan","Date","now","toHaveBeenCalledWith","objectContaining","method","callArgs","mock","calls","headers","toBe","toBeUndefined","body","toContain","rejects","toThrow","testAuthCode","testCodeVerifier","testRedirectUri","encodeURIComponent"],"mappings":"AAAA,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAExE,SAASC,sBAAsB,QAAQ,0BAAyB;AAChE,SAASC,gBAAgB,EAAEC,gBAAgB,EAAEC,YAAY,QAAQ,uBAAsB;AACvF,SAASC,qBAAqB,EAAEC,kBAAkB,EAAEC,iBAAiB,QAAQ,eAAc;AAE3FV,SAAS,sBAAsB;IAC7B,MAAMW,mBAAmB;IACzB,MAAMC,eAAe;IACrB,MAAMC,gBAAgBC,QAAQC,GAAG,CAACC,KAAK;IAEvCjB,WAAW;QACTI,GAAGc,aAAa;QAChB,OAAOH,QAAQC,GAAG,CAACC,KAAK;IAC1B;IAEAlB,UAAU;QACRS;QACA,IAAIM,kBAAkBK,WAAW;YAC/BJ,QAAQC,GAAG,CAACC,KAAK,GAAGH;QACtB;IACF;IAEAX,GAAG,sEAAsE;QACvE,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAME,SAAS,MAAMZ,mBAAmBE,kBAAkBC;QAE1D,iCAAiC;QACjCX,OAAOoB,QAAQC,aAAa,CAAC;YAC3BC,aAAaJ,aAAaK,YAAY;YACtCC,cAAcN,aAAaO,aAAa;YACxCC,QAAQR,aAAaS,cAAc;QACrC;QACA3B,OAAOoB,OAAOQ,SAAS,EAAEC,eAAe,CAACC,KAAKC,GAAG;QAEjD,8BAA8B;QAC9B/B,OAAOmB,WAAWa,oBAAoB,CACpC,kDACAhC,OAAOiC,gBAAgB,CAAC;YACtBC,QAAQ;QACV;QAGF,2DAA2D;QAC3D,MAAMC,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMC,UAAUH,QAAQ,CAAC,EAAE,CAACG,OAAO;QACnCtC,OAAOsC,OAAO,CAAC,eAAe,EAAEC,IAAI,CAAC;QACrCvC,OAAOsC,OAAO,CAAC,gBAAgB,EAAEE,aAAa,IAAG,gCAAgC;QAEjF,yCAAyC;QACzC,MAAMC,OAAON,QAAQ,CAAC,EAAE,CAACM,IAAI;QAC7BzC,OAAOyC,MAAMC,SAAS,CAAC;QACvB1C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,cAAc,EAAEhC,kBAAkB;QAC1DV,OAAOyC,MAAMC,SAAS,CAAC,CAAC,UAAU,EAAE/B,cAAc;IACpD;IAEAV,GAAG,gDAAgD;QACjDG,iBAAiB,KAAK;QAEtB,MAAMJ,OAAOQ,mBAAmBE,kBAAkBC,eAAegC,OAAO,CAACC,OAAO,CAC9EnC;IAEJ;AACF;AAEAV,SAAS,yBAAyB;IAChC,MAAM8C,eAAe;IACrB,MAAMC,mBAAmB;IACzB,MAAMC,kBAAkB;IACxB,MAAMpC,eAAe;IACrB,MAAMC,gBAAgBC,QAAQC,GAAG,CAACC,KAAK;IAEvCjB,WAAW;QACTI,GAAGc,aAAa;QAChB,OAAOH,QAAQC,GAAG,CAACC,KAAK;IAC1B;IAEAlB,UAAU;QACRS;QACA,IAAIM,kBAAkBK,WAAW;YAC/BJ,QAAQC,GAAG,CAACC,KAAK,GAAGH;QACtB;IACF;IAEAX,GAAG,wEAAwE;QACzE,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAME,SAAS,MAAMb,sBACnBsC,cACAC,kBACAC,iBACApC;QAGF,iCAAiC;QACjCX,OAAOoB,QAAQC,aAAa,CAAC;YAC3BC,aAAaJ,aAAaK,YAAY;YACtCC,cAAcN,aAAaO,aAAa;YACxCC,QAAQR,aAAaS,cAAc;QACrC;QACA3B,OAAOoB,OAAOQ,SAAS,EAAEC,eAAe,CAACC,KAAKC,GAAG;QAEjD,sBAAsB;QACtB/B,OAAOmB,WAAWa,oBAAoB,CACpC,gDACAhC,OAAOiC,gBAAgB,CAAC;YACtBC,QAAQ;QACV;QAGF,2DAA2D;QAC3D,MAAMC,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMC,UAAUH,QAAQ,CAAC,EAAE,CAACG,OAAO;QACnCtC,OAAOsC,OAAO,CAAC,eAAe,EAAEC,IAAI,CAAC;QACrCvC,OAAOsC,OAAO,CAAC,gBAAgB,EAAEE,aAAa,IAAG,gCAAgC;IACnF;IAEAvC,GAAG,8CAA8C;QAC/C,MAAMiB,eAAef;QACrB,MAAMgB,YAAYd,iBAAiBa;QAEnC,MAAMX,sBAAsBsC,cAAcC,kBAAkBC,iBAAiBpC;QAE7E,MAAMwB,WAAWhB,UAAUiB,IAAI,CAACC,KAAK,CAAC,EAAE;QACxC,MAAMI,OAAON,QAAQ,CAAC,EAAE,CAACM,IAAI;QAE7BzC,OAAOyC,MAAMC,SAAS,CAAC;QACvB1C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,KAAK,EAAEG,cAAc;QAC7C7C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,aAAa,EAAEM,mBAAmBD,kBAAkB;QAC5E/C,OAAOyC,MAAMC,SAAS,CAAC,CAAC,UAAU,EAAE/B,cAAc;QAClDX,OAAOyC,MAAMC,SAAS,CAAC,CAAC,cAAc,EAAEI,kBAAkB;IAC5D;IAEA7C,GAAG,gEAAgE;QACjEG,iBAAiB,KAAK;QAEtB,MAAMJ,OACJO,sBAAsBsC,cAAcC,kBAAkBC,iBAAiBpC,eACvEgC,OAAO,CAACC,OAAO,CAACnC;IACpB;AACF"}

package/dist/auth/token-store.d.ts

@@ -0,0 +1,110 @@
+import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+/**
+ * Secure storage manager for Figma OAuth2 tokens
+ *
+ * Uses the `conf` library to store tokens in an OS-specific secure location:
+ * - macOS: ~/Library/Preferences/payloadcms-figma
+ * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma
+ * - Windows: %APPDATA%/payloadcms-figma/Config
+ *
+ * Tokens are encrypted at rest with a machine-specific key and file permissions
+ * are set to 0600 (owner read/write only)
+ */
+export declare class TokenStore {
+    private config;
+    constructor(options?: TokenStoreConfig);
+    /**
+     * Retrieve stored tokens
+     * @returns FigmaTokens if stored, null otherwise
+     */
+    getTokens(): FigmaTokens | null;
+    /**
+     * Store OAuth2 tokens securely
+     * @param tokens - Figma OAuth2 tokens to store
+     */
+    setTokens(tokens: FigmaTokens): void;
+    /**
+     * Clear all stored tokens (used for logout)
+     */
+    clearTokens(): void;
+    /**
+     * Check if valid (non-expired) tokens exist
+     * @returns true if tokens exist and are not expired
+     */
+    hasValidTokens(): boolean;
+    /**
+     * Check if the current access token is expired
+     * Includes a buffer time to avoid using tokens that are about to expire
+     * @returns true if token is expired or will expire within buffer time
+     */
+    isExpired(): boolean;
+    /**
+     * Get the access token if it exists and is valid
+     * @returns Access token string or null if expired/missing
+     */
+    getAccessToken(): null | string;
+    /**
+     * Get the refresh token if it exists
+     * @returns Refresh token string or null if missing
+     */
+    getRefreshToken(): null | string;
+    /**
+     * Update just the access token after a refresh
+     * Preserves the existing refresh token and other metadata
+     * @param accessToken - New access token
+     * @param expiresIn - Expiration time in seconds
+     */
+    updateAccessToken(accessToken: string, expiresIn: number): void;
+    /**
+     * Get the path to the config file (useful for debugging)
+     * @returns Absolute path to the token storage file
+     */
+    getStoragePath(): string;
+    /**
+     * Retrieve a project token for a specific tenant
+     * Automatically removes expired tokens from storage
+     * @param tenantId - The tenant/CMS ID
+     * @returns ProjectToken if stored and valid, null otherwise
+     */
+    getProjectToken(tenantId: string): null | ProjectToken;
+    /**
+     * Store a project token for a specific tenant
+     * @param tenantId - The tenant/CMS ID
+     * @param projectToken - The project token to store
+     */
+    setProjectToken(tenantId: string, projectToken: ProjectToken): void;
+    /**
+     * Clear a project token for a specific tenant
+     * @param tenantId - The tenant/CMS ID
+     */
+    clearProjectToken(tenantId: string): void;
+    /**
+     * Clear all project tokens
+     */
+    clearAllProjectTokens(): void;
+    /**
+     * Check if a project token is expired
+     * Includes a buffer time to avoid using tokens that are about to expire
+     * @param projectToken - The project token to check
+     * @returns true if token is expired or will expire within buffer time
+     */
+    isProjectTokenExpired(projectToken: ProjectToken): boolean;
+    /**
+     * Check if a valid (non-expired) project token exists for a tenant
+     * @param tenantId - The tenant/CMS ID
+     * @returns true if token exists and is not expired
+     */
+    hasValidProjectToken(tenantId: string): boolean;
+    /**
+     * Get validated JWT claims from a project token
+     * @param tenantId - The tenant/CMS ID
+     * @returns JWT payload claims or null if token not found or has no claims
+     */
+    getProjectTokenClaims(tenantId: string): JWTPayload | null;
+    /**
+     * Get all tenant IDs that have stored project tokens
+     * @returns Array of tenant IDs
+     */
+    getAllProjectTokenTenantIds(): string[];
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/auth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAKzF;;;;;;;;;;GAUG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAA4E;gBAE9E,OAAO,CAAC,EAAE,gBAAgB;IAWtC;;;OAGG;IACH,SAAS,IAAI,WAAW,GAAG,IAAI;IAK/B;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIpC;;OAEG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,cAAc,IAAI,OAAO;IAQzB;;;;OAIG;IACH,SAAS,IAAI,OAAO;IAcpB;;;OAGG;IACH,cAAc,IAAI,IAAI,GAAG,MAAM;IAQ/B;;;OAGG;IACH,eAAe,IAAI,IAAI,GAAG,MAAM;IAKhC;;;;;OAKG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAe/D;;;OAGG;IACH,cAAc,IAAI,MAAM;IAIxB;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY;IAiBtD;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI;IAMnE;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAMzC;;OAEG;IACH,qBAAqB,IAAI,IAAI;IAI7B;;;;;OAKG;IACH,qBAAqB,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO;IAQ1D;;;;OAIG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQ/C;;;;OAIG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAK1D;;;OAGG;IACH,2BAA2B,IAAI,MAAM,EAAE;CAIxC"}

package/dist/auth/token-store.js

@@ -0,0 +1,188 @@
+/* eslint-disable perfectionist/sort-classes */ import Conf from 'conf';
+import { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js';
+import { deriveEncryptionKey } from './crypto-utils.js';
+/**
+ * Secure storage manager for Figma OAuth2 tokens
+ *
+ * Uses the `conf` library to store tokens in an OS-specific secure location:
+ * - macOS: ~/Library/Preferences/payloadcms-figma
+ * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma
+ * - Windows: %APPDATA%/payloadcms-figma/Config
+ *
+ * Tokens are encrypted at rest with a machine-specific key and file permissions
+ * are set to 0600 (owner read/write only)
+ */ export class TokenStore {
+    config;
+    constructor(options){
+        this.config = new Conf({
+            configName: options?.configName || 'payloadcms-figma',
+            projectName: 'payloadcms-figma',
+            // Enable encryption with machine-specific key for better security
+            encryptionKey: options?.encryptionKey || deriveEncryptionKey(),
+            // Clear schema to avoid validation issues
+            clearInvalidConfig: true
+        });
+    }
+    /**
+   * Retrieve stored tokens
+   * @returns FigmaTokens if stored, null otherwise
+   */ getTokens() {
+        const tokens = this.config.get('tokens');
+        return tokens || null;
+    }
+    /**
+   * Store OAuth2 tokens securely
+   * @param tokens - Figma OAuth2 tokens to store
+   */ setTokens(tokens) {
+        this.config.set('tokens', tokens);
+    }
+    /**
+   * Clear all stored tokens (used for logout)
+   */ clearTokens() {
+        this.config.delete('tokens');
+    }
+    /**
+   * Check if valid (non-expired) tokens exist
+   * @returns true if tokens exist and are not expired
+   */ hasValidTokens() {
+        const tokens = this.getTokens();
+        if (!tokens) {
+            return false;
+        }
+        return !this.isExpired();
+    }
+    /**
+   * Check if the current access token is expired
+   * Includes a buffer time to avoid using tokens that are about to expire
+   * @returns true if token is expired or will expire within buffer time
+   */ isExpired() {
+        // Access config directly to avoid circular dependency with getTokens()
+        const tokens = this.config.get('tokens');
+        if (!tokens) {
+            return true;
+        }
+        const now = Date.now();
+        const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000;
+        const expiryWithBuffer = tokens.expiresAt - bufferMs;
+        return now >= expiryWithBuffer;
+    }
+    /**
+   * Get the access token if it exists and is valid
+   * @returns Access token string or null if expired/missing
+   */ getAccessToken() {
+        if (!this.hasValidTokens()) {
+            return null;
+        }
+        const tokens = this.getTokens();
+        return tokens?.accessToken || null;
+    }
+    /**
+   * Get the refresh token if it exists
+   * @returns Refresh token string or null if missing
+   */ getRefreshToken() {
+        const tokens = this.getTokens();
+        return tokens?.refreshToken || null;
+    }
+    /**
+   * Update just the access token after a refresh
+   * Preserves the existing refresh token and other metadata
+   * @param accessToken - New access token
+   * @param expiresIn - Expiration time in seconds
+   */ updateAccessToken(accessToken, expiresIn) {
+        const existingTokens = this.getTokens();
+        if (!existingTokens) {
+            throw new Error('Cannot update access token: no existing tokens found');
+        }
+        const expiresAt = Date.now() + expiresIn * 1000;
+        this.setTokens({
+            ...existingTokens,
+            accessToken,
+            expiresAt
+        });
+    }
+    /**
+   * Get the path to the config file (useful for debugging)
+   * @returns Absolute path to the token storage file
+   */ getStoragePath() {
+        return this.config.path;
+    }
+    /**
+   * Retrieve a project token for a specific tenant
+   * Automatically removes expired tokens from storage
+   * @param tenantId - The tenant/CMS ID
+   * @returns ProjectToken if stored and valid, null otherwise
+   */ getProjectToken(tenantId) {
+        const projectTokens = this.config.get('projectTokens') || {};
+        const projectToken = projectTokens[tenantId];
+        if (!projectToken) {
+            return null;
+        }
+        // Auto-cleanup expired project token
+        if (this.isProjectTokenExpired(projectToken)) {
+            this.clearProjectToken(tenantId);
+            return null;
+        }
+        return projectToken;
+    }
+    /**
+   * Store a project token for a specific tenant
+   * @param tenantId - The tenant/CMS ID
+   * @param projectToken - The project token to store
+   */ setProjectToken(tenantId, projectToken) {
+        const projectTokens = this.config.get('projectTokens') || {};
+        projectTokens[tenantId] = projectToken;
+        this.config.set('projectTokens', projectTokens);
+    }
+    /**
+   * Clear a project token for a specific tenant
+   * @param tenantId - The tenant/CMS ID
+   */ clearProjectToken(tenantId) {
+        const projectTokens = this.config.get('projectTokens') || {};
+        delete projectTokens[tenantId];
+        this.config.set('projectTokens', projectTokens);
+    }
+    /**
+   * Clear all project tokens
+   */ clearAllProjectTokens() {
+        this.config.delete('projectTokens');
+    }
+    /**
+   * Check if a project token is expired
+   * Includes a buffer time to avoid using tokens that are about to expire
+   * @param projectToken - The project token to check
+   * @returns true if token is expired or will expire within buffer time
+   */ isProjectTokenExpired(projectToken) {
+        const now = Date.now();
+        const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000;
+        const expiryWithBuffer = projectToken.expiresAt - bufferMs;
+        return now >= expiryWithBuffer;
+    }
+    /**
+   * Check if a valid (non-expired) project token exists for a tenant
+   * @param tenantId - The tenant/CMS ID
+   * @returns true if token exists and is not expired
+   */ hasValidProjectToken(tenantId) {
+        const projectToken = this.getProjectToken(tenantId);
+        if (!projectToken) {
+            return false;
+        }
+        return !this.isProjectTokenExpired(projectToken);
+    }
+    /**
+   * Get validated JWT claims from a project token
+   * @param tenantId - The tenant/CMS ID
+   * @returns JWT payload claims or null if token not found or has no claims
+   */ getProjectTokenClaims(tenantId) {
+        const projectToken = this.getProjectToken(tenantId);
+        return projectToken?.claims || null;
+    }
+    /**
+   * Get all tenant IDs that have stored project tokens
+   * @returns Array of tenant IDs
+   */ getAllProjectTokenTenantIds() {
+        const projectTokens = this.config.get('projectTokens') || {};
+        return Object.keys(projectTokens);
+    }
+}
+
+//# sourceMappingURL=token-store.js.map

package/dist/auth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/token-store.ts"],"sourcesContent":["/* eslint-disable perfectionist/sort-classes */\nimport Conf from 'conf'\n\nimport type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js'\n\nimport { TOKEN_EXPIRY_BUFFER_SECONDS } from '../config/oauth.js'\nimport { deriveEncryptionKey } from './crypto-utils.js'\n\n/**\n * Secure storage manager for Figma OAuth2 tokens\n *\n * Uses the `conf` library to store tokens in an OS-specific secure location:\n * - macOS: ~/Library/Preferences/payloadcms-figma\n * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma\n * - Windows: %APPDATA%/payloadcms-figma/Config\n *\n * Tokens are encrypted at rest with a machine-specific key and file permissions\n * are set to 0600 (owner read/write only)\n */\nexport class TokenStore {\n  private config: Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>\n\n  constructor(options?: TokenStoreConfig) {\n    this.config = new Conf<{ projectTokens: Record<string, ProjectToken>; tokens: FigmaTokens }>({\n      configName: options?.configName || 'payloadcms-figma',\n      projectName: 'payloadcms-figma',\n      // Enable encryption with machine-specific key for better security\n      encryptionKey: options?.encryptionKey || deriveEncryptionKey(),\n      // Clear schema to avoid validation issues\n      clearInvalidConfig: true,\n    })\n  }\n\n  /**\n   * Retrieve stored tokens\n   * @returns FigmaTokens if stored, null otherwise\n   */\n  getTokens(): FigmaTokens | null {\n    const tokens = this.config.get('tokens')\n    return tokens || null\n  }\n\n  /**\n   * Store OAuth2 tokens securely\n   * @param tokens - Figma OAuth2 tokens to store\n   */\n  setTokens(tokens: FigmaTokens): void {\n    this.config.set('tokens', tokens)\n  }\n\n  /**\n   * Clear all stored tokens (used for logout)\n   */\n  clearTokens(): void {\n    this.config.delete('tokens')\n  }\n\n  /**\n   * Check if valid (non-expired) tokens exist\n   * @returns true if tokens exist and are not expired\n   */\n  hasValidTokens(): boolean {\n    const tokens = this.getTokens()\n    if (!tokens) {\n      return false\n    }\n    return !this.isExpired()\n  }\n\n  /**\n   * Check if the current access token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isExpired(): boolean {\n    // Access config directly to avoid circular dependency with getTokens()\n    const tokens = this.config.get('tokens')\n    if (!tokens) {\n      return true\n    }\n\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = tokens.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Get the access token if it exists and is valid\n   * @returns Access token string or null if expired/missing\n   */\n  getAccessToken(): null | string {\n    if (!this.hasValidTokens()) {\n      return null\n    }\n    const tokens = this.getTokens()\n    return tokens?.accessToken || null\n  }\n\n  /**\n   * Get the refresh token if it exists\n   * @returns Refresh token string or null if missing\n   */\n  getRefreshToken(): null | string {\n    const tokens = this.getTokens()\n    return tokens?.refreshToken || null\n  }\n\n  /**\n   * Update just the access token after a refresh\n   * Preserves the existing refresh token and other metadata\n   * @param accessToken - New access token\n   * @param expiresIn - Expiration time in seconds\n   */\n  updateAccessToken(accessToken: string, expiresIn: number): void {\n    const existingTokens = this.getTokens()\n    if (!existingTokens) {\n      throw new Error('Cannot update access token: no existing tokens found')\n    }\n\n    const expiresAt = Date.now() + expiresIn * 1000\n\n    this.setTokens({\n      ...existingTokens,\n      accessToken,\n      expiresAt,\n    })\n  }\n\n  /**\n   * Get the path to the config file (useful for debugging)\n   * @returns Absolute path to the token storage file\n   */\n  getStoragePath(): string {\n    return this.config.path\n  }\n\n  /**\n   * Retrieve a project token for a specific tenant\n   * Automatically removes expired tokens from storage\n   * @param tenantId - The tenant/CMS ID\n   * @returns ProjectToken if stored and valid, null otherwise\n   */\n  getProjectToken(tenantId: string): null | ProjectToken {\n    const projectTokens = this.config.get('projectTokens') || {}\n    const projectToken = projectTokens[tenantId]\n\n    if (!projectToken) {\n      return null\n    }\n\n    // Auto-cleanup expired project token\n    if (this.isProjectTokenExpired(projectToken)) {\n      this.clearProjectToken(tenantId)\n      return null\n    }\n\n    return projectToken\n  }\n\n  /**\n   * Store a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   * @param projectToken - The project token to store\n   */\n  setProjectToken(tenantId: string, projectToken: ProjectToken): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    projectTokens[tenantId] = projectToken\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear a project token for a specific tenant\n   * @param tenantId - The tenant/CMS ID\n   */\n  clearProjectToken(tenantId: string): void {\n    const projectTokens = this.config.get('projectTokens') || {}\n    delete projectTokens[tenantId]\n    this.config.set('projectTokens', projectTokens)\n  }\n\n  /**\n   * Clear all project tokens\n   */\n  clearAllProjectTokens(): void {\n    this.config.delete('projectTokens')\n  }\n\n  /**\n   * Check if a project token is expired\n   * Includes a buffer time to avoid using tokens that are about to expire\n   * @param projectToken - The project token to check\n   * @returns true if token is expired or will expire within buffer time\n   */\n  isProjectTokenExpired(projectToken: ProjectToken): boolean {\n    const now = Date.now()\n    const bufferMs = TOKEN_EXPIRY_BUFFER_SECONDS * 1000\n    const expiryWithBuffer = projectToken.expiresAt - bufferMs\n\n    return now >= expiryWithBuffer\n  }\n\n  /**\n   * Check if a valid (non-expired) project token exists for a tenant\n   * @param tenantId - The tenant/CMS ID\n   * @returns true if token exists and is not expired\n   */\n  hasValidProjectToken(tenantId: string): boolean {\n    const projectToken = this.getProjectToken(tenantId)\n    if (!projectToken) {\n      return false\n    }\n    return !this.isProjectTokenExpired(projectToken)\n  }\n\n  /**\n   * Get validated JWT claims from a project token\n   * @param tenantId - The tenant/CMS ID\n   * @returns JWT payload claims or null if token not found or has no claims\n   */\n  getProjectTokenClaims(tenantId: string): JWTPayload | null {\n    const projectToken = this.getProjectToken(tenantId)\n    return projectToken?.claims || null\n  }\n\n  /**\n   * Get all tenant IDs that have stored project tokens\n   * @returns Array of tenant IDs\n   */\n  getAllProjectTokenTenantIds(): string[] {\n    const projectTokens = this.config.get('projectTokens') || {}\n    return Object.keys(projectTokens)\n  }\n}\n"],"names":["Conf","TOKEN_EXPIRY_BUFFER_SECONDS","deriveEncryptionKey","TokenStore","config","options","configName","projectName","encryptionKey","clearInvalidConfig","getTokens","tokens","get","setTokens","set","clearTokens","delete","hasValidTokens","isExpired","now","Date","bufferMs","expiryWithBuffer","expiresAt","getAccessToken","accessToken","getRefreshToken","refreshToken","updateAccessToken","expiresIn","existingTokens","Error","getStoragePath","path","getProjectToken","tenantId","projectTokens","projectToken","isProjectTokenExpired","clearProjectToken","setProjectToken","clearAllProjectTokens","hasValidProjectToken","getProjectTokenClaims","claims","getAllProjectTokenTenantIds","Object","keys"],"mappings":"AAAA,6CAA6C,GAC7C,OAAOA,UAAU,OAAM;AAIvB,SAASC,2BAA2B,QAAQ,qBAAoB;AAChE,SAASC,mBAAmB,QAAQ,oBAAmB;AAEvD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC;IACHC,OAAkF;IAE1F,YAAYC,OAA0B,CAAE;QACtC,IAAI,CAACD,MAAM,GAAG,IAAIJ,KAA2E;YAC3FM,YAAYD,SAASC,cAAc;YACnCC,aAAa;YACb,kEAAkE;YAClEC,eAAeH,SAASG,iBAAiBN;YACzC,0CAA0C;YAC1CO,oBAAoB;QACtB;IACF;IAEA;;;GAGC,GACDC,YAAgC;QAC9B,MAAMC,SAAS,IAAI,CAACP,MAAM,CAACQ,GAAG,CAAC;QAC/B,OAAOD,UAAU;IACnB;IAEA;;;GAGC,GACDE,UAAUF,MAAmB,EAAQ;QACnC,IAAI,CAACP,MAAM,CAACU,GAAG,CAAC,UAAUH;IAC5B;IAEA;;GAEC,GACDI,cAAoB;QAClB,IAAI,CAACX,MAAM,CAACY,MAAM,CAAC;IACrB;IAEA;;;GAGC,GACDC,iBAA0B;QACxB,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,IAAI,CAACC,QAAQ;YACX,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACO,SAAS;IACxB;IAEA;;;;GAIC,GACDA,YAAqB;QACnB,uEAAuE;QACvE,MAAMP,SAAS,IAAI,CAACP,MAAM,CAACQ,GAAG,CAAC;QAC/B,IAAI,CAACD,QAAQ;YACX,OAAO;QACT;QAEA,MAAMQ,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAWpB,8BAA8B;QAC/C,MAAMqB,mBAAmBX,OAAOY,SAAS,GAAGF;QAE5C,OAAOF,OAAOG;IAChB;IAEA;;;GAGC,GACDE,iBAAgC;QAC9B,IAAI,CAAC,IAAI,CAACP,cAAc,IAAI;YAC1B,OAAO;QACT;QACA,MAAMN,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQc,eAAe;IAChC;IAEA;;;GAGC,GACDC,kBAAiC;QAC/B,MAAMf,SAAS,IAAI,CAACD,SAAS;QAC7B,OAAOC,QAAQgB,gBAAgB;IACjC;IAEA;;;;;GAKC,GACDC,kBAAkBH,WAAmB,EAAEI,SAAiB,EAAQ;QAC9D,MAAMC,iBAAiB,IAAI,CAACpB,SAAS;QACrC,IAAI,CAACoB,gBAAgB;YACnB,MAAM,IAAIC,MAAM;QAClB;QAEA,MAAMR,YAAYH,KAAKD,GAAG,KAAKU,YAAY;QAE3C,IAAI,CAAChB,SAAS,CAAC;YACb,GAAGiB,cAAc;YACjBL;YACAF;QACF;IACF;IAEA;;;GAGC,GACDS,iBAAyB;QACvB,OAAO,IAAI,CAAC5B,MAAM,CAAC6B,IAAI;IACzB;IAEA;;;;;GAKC,GACDC,gBAAgBC,QAAgB,EAAuB;QACrD,MAAMC,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,MAAMyB,eAAeD,aAAa,CAACD,SAAS;QAE5C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QAEA,qCAAqC;QACrC,IAAI,IAAI,CAACC,qBAAqB,CAACD,eAAe;YAC5C,IAAI,CAACE,iBAAiB,CAACJ;YACvB,OAAO;QACT;QAEA,OAAOE;IACT;IAEA;;;;GAIC,GACDG,gBAAgBL,QAAgB,EAAEE,YAA0B,EAAQ;QAClE,MAAMD,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3DwB,aAAa,CAACD,SAAS,GAAGE;QAC1B,IAAI,CAACjC,MAAM,CAACU,GAAG,CAAC,iBAAiBsB;IACnC;IAEA;;;GAGC,GACDG,kBAAkBJ,QAAgB,EAAQ;QACxC,MAAMC,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOwB,aAAa,CAACD,SAAS;QAC9B,IAAI,CAAC/B,MAAM,CAACU,GAAG,CAAC,iBAAiBsB;IACnC;IAEA;;GAEC,GACDK,wBAA8B;QAC5B,IAAI,CAACrC,MAAM,CAACY,MAAM,CAAC;IACrB;IAEA;;;;;GAKC,GACDsB,sBAAsBD,YAA0B,EAAW;QACzD,MAAMlB,MAAMC,KAAKD,GAAG;QACpB,MAAME,WAAWpB,8BAA8B;QAC/C,MAAMqB,mBAAmBe,aAAad,SAAS,GAAGF;QAElD,OAAOF,OAAOG;IAChB;IAEA;;;;GAIC,GACDoB,qBAAqBP,QAAgB,EAAW;QAC9C,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,IAAI,CAACE,cAAc;YACjB,OAAO;QACT;QACA,OAAO,CAAC,IAAI,CAACC,qBAAqB,CAACD;IACrC;IAEA;;;;GAIC,GACDM,sBAAsBR,QAAgB,EAAqB;QACzD,MAAME,eAAe,IAAI,CAACH,eAAe,CAACC;QAC1C,OAAOE,cAAcO,UAAU;IACjC;IAEA;;;GAGC,GACDC,8BAAwC;QACtC,MAAMT,gBAAgB,IAAI,CAAChC,MAAM,CAACQ,GAAG,CAAC,oBAAoB,CAAC;QAC3D,OAAOkC,OAAOC,IAAI,CAACX;IACrB;AACF"}

package/dist/auth/token-store.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-store.spec.d.ts.map

package/dist/auth/token-store.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.spec.d.ts","sourceRoot":"","sources":["../../src/auth/token-store.spec.ts"],"names":[],"mappings":""}