@payloadcms/figma 0.0.1-alpha.0

package/dist/auth/token-store.spec.js

@@ -0,0 +1,276 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { mockExpiredTokens, mockFigmaTokens, mockFreshTokens, mockTokensExpiringSoon } from './__tests__/fixtures.js';
+import { TokenStore } from './token-store.js';
+describe('TokenStore', ()=>{
+    let store;
+    beforeEach(()=>{
+        // Create a new store with a unique config name for each test
+        store = new TokenStore({
+            configName: `payloadcms-figma-test-${Date.now()}`
+        });
+    });
+    afterEach(()=>{
+        // Clean up after each test
+        store.clearTokens();
+    });
+    describe('setTokens and getTokens', ()=>{
+        it('should store and retrieve tokens', ()=>{
+            const tokens = mockFigmaTokens();
+            store.setTokens(tokens);
+            const retrieved = store.getTokens();
+            expect(retrieved).toEqual(tokens);
+        });
+    });
+    describe('clearTokens', ()=>{
+        it('should remove stored tokens', ()=>{
+            const tokens = mockFigmaTokens();
+            store.setTokens(tokens);
+            store.clearTokens();
+            const retrieved = store.getTokens();
+            expect(retrieved).toBeNull();
+        });
+    });
+    describe('hasValidTokens', ()=>{
+        it('should return true when valid tokens exist', ()=>{
+            const tokens = mockFreshTokens();
+            store.setTokens(tokens);
+            expect(store.hasValidTokens()).toBe(true);
+        });
+        it('should return false when tokens are expired', ()=>{
+            const tokens = mockExpiredTokens();
+            store.setTokens(tokens);
+            expect(store.hasValidTokens()).toBe(false);
+        });
+        it('should return false when tokens are expiring soon (within buffer)', ()=>{
+            const tokens = mockTokensExpiringSoon();
+            store.setTokens(tokens);
+            expect(store.hasValidTokens()).toBe(false);
+        });
+    });
+    describe('getAccessToken', ()=>{
+        it('should return null when tokens are expired', ()=>{
+            const tokens = mockExpiredTokens();
+            store.setTokens(tokens);
+            const accessToken = store.getAccessToken();
+            expect(accessToken).toBeNull();
+        });
+    });
+    describe('getRefreshToken', ()=>{
+        it('should return refresh token even if access token is expired', ()=>{
+            const tokens = mockExpiredTokens();
+            store.setTokens(tokens);
+            const refreshToken = store.getRefreshToken();
+            expect(refreshToken).toBe(tokens.refreshToken);
+        });
+    });
+    describe('updateAccessToken', ()=>{
+        it('should update access token and expiration time', ()=>{
+            const originalTokens = mockFigmaTokens();
+            store.setTokens(originalTokens);
+            const newAccessToken = 'figt_new_access_token';
+            const expiresIn = 7200 // 2 hours
+            ;
+            store.updateAccessToken(newAccessToken, expiresIn);
+            const updatedTokens = store.getTokens();
+            expect(updatedTokens?.accessToken).toBe(newAccessToken);
+            expect(updatedTokens?.refreshToken).toBe(originalTokens.refreshToken);
+            expect(updatedTokens?.expiresAt).toBeGreaterThan(Date.now());
+        });
+    });
+    describe('Project Token Methods', ()=>{
+        const tenantId1 = 'tenant-123';
+        const tenantId2 = 'tenant-456';
+        const createProjectToken = (tenantId, expiresInMinutes)=>({
+                claims: {
+                    aud: tenantId,
+                    email: 'test@example.com',
+                    exp: Math.floor(Date.now() / 1000) + expiresInMinutes * 60,
+                    iat: Math.floor(Date.now() / 1000),
+                    seat_type: 'full'
+                },
+                expiresAt: Date.now() + expiresInMinutes * 60 * 1000,
+                tenantId,
+                token: `jwt_token_${tenantId}`
+            });
+        describe('getProjectToken and setProjectToken', ()=>{
+            it('should store and retrieve a project token', ()=>{
+                const projectToken = createProjectToken(tenantId1, 30);
+                store.setProjectToken(tenantId1, projectToken);
+                const retrieved = store.getProjectToken(tenantId1);
+                expect(retrieved).toEqual(projectToken);
+            });
+            it('should return null for non-existent tenant', ()=>{
+                const retrieved = store.getProjectToken('non-existent');
+                expect(retrieved).toBeNull();
+            });
+            it('should store multiple project tokens independently', ()=>{
+                const token1 = createProjectToken(tenantId1, 30);
+                const token2 = createProjectToken(tenantId2, 45);
+                store.setProjectToken(tenantId1, token1);
+                store.setProjectToken(tenantId2, token2);
+                expect(store.getProjectToken(tenantId1)).toEqual(token1);
+                expect(store.getProjectToken(tenantId2)).toEqual(token2);
+            });
+            it('should overwrite existing token for same tenant', ()=>{
+                const oldToken = createProjectToken(tenantId1, 30);
+                const newToken = createProjectToken(tenantId1, 60);
+                store.setProjectToken(tenantId1, oldToken);
+                store.setProjectToken(tenantId1, newToken);
+                const retrieved = store.getProjectToken(tenantId1);
+                expect(retrieved).toEqual(newToken);
+                expect(retrieved?.token).toBe(newToken.token);
+            });
+        });
+        describe('isProjectTokenExpired', ()=>{
+            it('should return false for valid token (30 minutes remaining)', ()=>{
+                const validToken = createProjectToken(tenantId1, 30);
+                expect(store.isProjectTokenExpired(validToken)).toBe(false);
+            });
+            it('should return true for expired token (past expiresAt)', ()=>{
+                const expiredToken = createProjectToken(tenantId1, -10) // 10 minutes ago
+                ;
+                expect(store.isProjectTokenExpired(expiredToken)).toBe(true);
+            });
+            it('should return true for token within buffer window (4 minutes remaining)', ()=>{
+                // TOKEN_EXPIRY_BUFFER_SECONDS is 5 minutes (300 seconds)
+                // Token expires in 4 minutes = within buffer
+                const expiringToken = createProjectToken(tenantId1, 4);
+                expect(store.isProjectTokenExpired(expiringToken)).toBe(true);
+            });
+            it('should return false for token just outside buffer window (6 minutes remaining)', ()=>{
+                // 6 minutes > 5 minute buffer
+                const validToken = createProjectToken(tenantId1, 6);
+                expect(store.isProjectTokenExpired(validToken)).toBe(false);
+            });
+            it('should handle token expiring exactly at buffer boundary', ()=>{
+                // Exactly 5 minutes = at buffer boundary
+                const boundaryToken = createProjectToken(tenantId1, 5);
+                // Should be considered expired (>= check in implementation)
+                expect(store.isProjectTokenExpired(boundaryToken)).toBe(true);
+            });
+        });
+        describe('hasValidProjectToken', ()=>{
+            it('should return true for valid token', ()=>{
+                const validToken = createProjectToken(tenantId1, 30);
+                store.setProjectToken(tenantId1, validToken);
+                expect(store.hasValidProjectToken(tenantId1)).toBe(true);
+            });
+            it('should return false for expired token', ()=>{
+                const expiredToken = createProjectToken(tenantId1, -10);
+                store.setProjectToken(tenantId1, expiredToken);
+                expect(store.hasValidProjectToken(tenantId1)).toBe(false);
+            });
+            it('should return false for missing token', ()=>{
+                expect(store.hasValidProjectToken('non-existent')).toBe(false);
+            });
+            it('should return false for token within buffer window', ()=>{
+                const expiringToken = createProjectToken(tenantId1, 4) // Within 5-min buffer
+                ;
+                store.setProjectToken(tenantId1, expiringToken);
+                expect(store.hasValidProjectToken(tenantId1)).toBe(false);
+            });
+        });
+        describe('clearProjectToken', ()=>{
+            it('should remove specific tenant token', ()=>{
+                const token1 = createProjectToken(tenantId1, 30);
+                const token2 = createProjectToken(tenantId2, 30);
+                store.setProjectToken(tenantId1, token1);
+                store.setProjectToken(tenantId2, token2);
+                store.clearProjectToken(tenantId1);
+                expect(store.getProjectToken(tenantId1)).toBeNull();
+                expect(store.getProjectToken(tenantId2)).toEqual(token2);
+            });
+            it('should handle clearing non-existent token gracefully', ()=>{
+                expect(()=>store.clearProjectToken('non-existent')).not.toThrow();
+                expect(store.getProjectToken('non-existent')).toBeNull();
+            });
+            it('should not affect OAuth tokens', ()=>{
+                const oauthTokens = mockFigmaTokens();
+                const projectToken = createProjectToken(tenantId1, 30);
+                store.setTokens(oauthTokens);
+                store.setProjectToken(tenantId1, projectToken);
+                store.clearProjectToken(tenantId1);
+                expect(store.getTokens()).toEqual(oauthTokens);
+                expect(store.getProjectToken(tenantId1)).toBeNull();
+            });
+        });
+        describe('clearAllProjectTokens', ()=>{
+            it('should remove all project tokens', ()=>{
+                const token1 = createProjectToken(tenantId1, 30);
+                const token2 = createProjectToken(tenantId2, 30);
+                store.setProjectToken(tenantId1, token1);
+                store.setProjectToken(tenantId2, token2);
+                store.clearAllProjectTokens();
+                expect(store.getProjectToken(tenantId1)).toBeNull();
+                expect(store.getProjectToken(tenantId2)).toBeNull();
+                expect(store.getAllProjectTokenTenantIds()).toEqual([]);
+            });
+            it('should not affect OAuth tokens', ()=>{
+                const oauthTokens = mockFigmaTokens();
+                const projectToken = createProjectToken(tenantId1, 30);
+                store.setTokens(oauthTokens);
+                store.setProjectToken(tenantId1, projectToken);
+                store.clearAllProjectTokens();
+                expect(store.getTokens()).toEqual(oauthTokens);
+                expect(store.getProjectToken(tenantId1)).toBeNull();
+            });
+            it('should handle clearing when no project tokens exist', ()=>{
+                expect(()=>store.clearAllProjectTokens()).not.toThrow();
+                expect(store.getAllProjectTokenTenantIds()).toEqual([]);
+            });
+        });
+        describe('getAllProjectTokenTenantIds', ()=>{
+            it('should return all tenant IDs with stored tokens', ()=>{
+                const token1 = createProjectToken(tenantId1, 30);
+                const token2 = createProjectToken(tenantId2, 30);
+                store.setProjectToken(tenantId1, token1);
+                store.setProjectToken(tenantId2, token2);
+                const tenantIds = store.getAllProjectTokenTenantIds();
+                expect(tenantIds).toHaveLength(2);
+                expect(tenantIds).toContain(tenantId1);
+                expect(tenantIds).toContain(tenantId2);
+            });
+            it('should return empty array when no tokens stored', ()=>{
+                const tenantIds = store.getAllProjectTokenTenantIds();
+                expect(tenantIds).toEqual([]);
+            });
+            it('should return correct IDs after removing a token', ()=>{
+                const token1 = createProjectToken(tenantId1, 30);
+                const token2 = createProjectToken(tenantId2, 30);
+                store.setProjectToken(tenantId1, token1);
+                store.setProjectToken(tenantId2, token2);
+                store.clearProjectToken(tenantId1);
+                const tenantIds = store.getAllProjectTokenTenantIds();
+                expect(tenantIds).toEqual([
+                    tenantId2
+                ]);
+            });
+        });
+        describe('getProjectTokenClaims', ()=>{
+            it('should return claims for valid token', ()=>{
+                const projectToken = createProjectToken(tenantId1, 30);
+                store.setProjectToken(tenantId1, projectToken);
+                const claims = store.getProjectTokenClaims(tenantId1);
+                expect(claims).toEqual(projectToken.claims);
+                expect(claims?.aud).toBe(tenantId1);
+                expect(claims?.email).toBe('test@example.com');
+            });
+            it('should return null for non-existent token', ()=>{
+                const claims = store.getProjectTokenClaims('non-existent');
+                expect(claims).toBeNull();
+            });
+            it('should return null for token without claims', ()=>{
+                const tokenWithoutClaims = {
+                    expiresAt: Date.now() + 30 * 60 * 1000,
+                    tenantId: tenantId1,
+                    token: 'jwt_token'
+                };
+                store.setProjectToken(tenantId1, tokenWithoutClaims);
+                const claims = store.getProjectTokenClaims(tenantId1);
+                expect(claims).toBeNull();
+            });
+        });
+    });
+});
+
+//# sourceMappingURL=token-store.spec.js.map

package/dist/auth/token-store.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/token-store.spec.ts"],"sourcesContent":["import { afterEach, beforeEach, describe, expect, it } from 'vitest'\n\nimport {\n  mockExpiredTokens,\n  mockFigmaTokens,\n  mockFreshTokens,\n  mockTokensExpiringSoon,\n} from './__tests__/fixtures.js'\nimport { TokenStore } from './token-store.js'\n\ndescribe('TokenStore', () => {\n  let store: TokenStore\n\n  beforeEach(() => {\n    // Create a new store with a unique config name for each test\n    store = new TokenStore({ configName: `payloadcms-figma-test-${Date.now()}` })\n  })\n\n  afterEach(() => {\n    // Clean up after each test\n    store.clearTokens()\n  })\n\n  describe('setTokens and getTokens', () => {\n    it('should store and retrieve tokens', () => {\n      const tokens = mockFigmaTokens()\n      store.setTokens(tokens)\n\n      const retrieved = store.getTokens()\n      expect(retrieved).toEqual(tokens)\n    })\n  })\n\n  describe('clearTokens', () => {\n    it('should remove stored tokens', () => {\n      const tokens = mockFigmaTokens()\n      store.setTokens(tokens)\n\n      store.clearTokens()\n\n      const retrieved = store.getTokens()\n      expect(retrieved).toBeNull()\n    })\n  })\n\n  describe('hasValidTokens', () => {\n    it('should return true when valid tokens exist', () => {\n      const tokens = mockFreshTokens()\n      store.setTokens(tokens)\n\n      expect(store.hasValidTokens()).toBe(true)\n    })\n\n    it('should return false when tokens are expired', () => {\n      const tokens = mockExpiredTokens()\n      store.setTokens(tokens)\n\n      expect(store.hasValidTokens()).toBe(false)\n    })\n\n    it('should return false when tokens are expiring soon (within buffer)', () => {\n      const tokens = mockTokensExpiringSoon()\n      store.setTokens(tokens)\n\n      expect(store.hasValidTokens()).toBe(false)\n    })\n  })\n\n  describe('getAccessToken', () => {\n    it('should return null when tokens are expired', () => {\n      const tokens = mockExpiredTokens()\n      store.setTokens(tokens)\n\n      const accessToken = store.getAccessToken()\n      expect(accessToken).toBeNull()\n    })\n  })\n\n  describe('getRefreshToken', () => {\n    it('should return refresh token even if access token is expired', () => {\n      const tokens = mockExpiredTokens()\n      store.setTokens(tokens)\n\n      const refreshToken = store.getRefreshToken()\n      expect(refreshToken).toBe(tokens.refreshToken)\n    })\n  })\n\n  describe('updateAccessToken', () => {\n    it('should update access token and expiration time', () => {\n      const originalTokens = mockFigmaTokens()\n      store.setTokens(originalTokens)\n\n      const newAccessToken = 'figt_new_access_token'\n      const expiresIn = 7200 // 2 hours\n\n      store.updateAccessToken(newAccessToken, expiresIn)\n\n      const updatedTokens = store.getTokens()\n      expect(updatedTokens?.accessToken).toBe(newAccessToken)\n      expect(updatedTokens?.refreshToken).toBe(originalTokens.refreshToken)\n      expect(updatedTokens?.expiresAt).toBeGreaterThan(Date.now())\n    })\n  })\n\n  describe('Project Token Methods', () => {\n    const tenantId1 = 'tenant-123'\n    const tenantId2 = 'tenant-456'\n\n    const createProjectToken = (tenantId: string, expiresInMinutes: number) => ({\n      claims: {\n        aud: tenantId, // Audience claim contains the CMS ID\n        email: 'test@example.com',\n        exp: Math.floor(Date.now() / 1000) + expiresInMinutes * 60,\n        iat: Math.floor(Date.now() / 1000),\n        seat_type: 'full',\n      },\n      expiresAt: Date.now() + expiresInMinutes * 60 * 1000,\n      tenantId,\n      token: `jwt_token_${tenantId}`,\n    })\n\n    describe('getProjectToken and setProjectToken', () => {\n      it('should store and retrieve a project token', () => {\n        const projectToken = createProjectToken(tenantId1, 30)\n        store.setProjectToken(tenantId1, projectToken)\n\n        const retrieved = store.getProjectToken(tenantId1)\n        expect(retrieved).toEqual(projectToken)\n      })\n\n      it('should return null for non-existent tenant', () => {\n        const retrieved = store.getProjectToken('non-existent')\n        expect(retrieved).toBeNull()\n      })\n\n      it('should store multiple project tokens independently', () => {\n        const token1 = createProjectToken(tenantId1, 30)\n        const token2 = createProjectToken(tenantId2, 45)\n\n        store.setProjectToken(tenantId1, token1)\n        store.setProjectToken(tenantId2, token2)\n\n        expect(store.getProjectToken(tenantId1)).toEqual(token1)\n        expect(store.getProjectToken(tenantId2)).toEqual(token2)\n      })\n\n      it('should overwrite existing token for same tenant', () => {\n        const oldToken = createProjectToken(tenantId1, 30)\n        const newToken = createProjectToken(tenantId1, 60)\n\n        store.setProjectToken(tenantId1, oldToken)\n        store.setProjectToken(tenantId1, newToken)\n\n        const retrieved = store.getProjectToken(tenantId1)\n        expect(retrieved).toEqual(newToken)\n        expect(retrieved?.token).toBe(newToken.token)\n      })\n    })\n\n    describe('isProjectTokenExpired', () => {\n      it('should return false for valid token (30 minutes remaining)', () => {\n        const validToken = createProjectToken(tenantId1, 30)\n        expect(store.isProjectTokenExpired(validToken)).toBe(false)\n      })\n\n      it('should return true for expired token (past expiresAt)', () => {\n        const expiredToken = createProjectToken(tenantId1, -10) // 10 minutes ago\n        expect(store.isProjectTokenExpired(expiredToken)).toBe(true)\n      })\n\n      it('should return true for token within buffer window (4 minutes remaining)', () => {\n        // TOKEN_EXPIRY_BUFFER_SECONDS is 5 minutes (300 seconds)\n        // Token expires in 4 minutes = within buffer\n        const expiringToken = createProjectToken(tenantId1, 4)\n        expect(store.isProjectTokenExpired(expiringToken)).toBe(true)\n      })\n\n      it('should return false for token just outside buffer window (6 minutes remaining)', () => {\n        // 6 minutes > 5 minute buffer\n        const validToken = createProjectToken(tenantId1, 6)\n        expect(store.isProjectTokenExpired(validToken)).toBe(false)\n      })\n\n      it('should handle token expiring exactly at buffer boundary', () => {\n        // Exactly 5 minutes = at buffer boundary\n        const boundaryToken = createProjectToken(tenantId1, 5)\n        // Should be considered expired (>= check in implementation)\n        expect(store.isProjectTokenExpired(boundaryToken)).toBe(true)\n      })\n    })\n\n    describe('hasValidProjectToken', () => {\n      it('should return true for valid token', () => {\n        const validToken = createProjectToken(tenantId1, 30)\n        store.setProjectToken(tenantId1, validToken)\n\n        expect(store.hasValidProjectToken(tenantId1)).toBe(true)\n      })\n\n      it('should return false for expired token', () => {\n        const expiredToken = createProjectToken(tenantId1, -10)\n        store.setProjectToken(tenantId1, expiredToken)\n\n        expect(store.hasValidProjectToken(tenantId1)).toBe(false)\n      })\n\n      it('should return false for missing token', () => {\n        expect(store.hasValidProjectToken('non-existent')).toBe(false)\n      })\n\n      it('should return false for token within buffer window', () => {\n        const expiringToken = createProjectToken(tenantId1, 4) // Within 5-min buffer\n        store.setProjectToken(tenantId1, expiringToken)\n\n        expect(store.hasValidProjectToken(tenantId1)).toBe(false)\n      })\n    })\n\n    describe('clearProjectToken', () => {\n      it('should remove specific tenant token', () => {\n        const token1 = createProjectToken(tenantId1, 30)\n        const token2 = createProjectToken(tenantId2, 30)\n\n        store.setProjectToken(tenantId1, token1)\n        store.setProjectToken(tenantId2, token2)\n\n        store.clearProjectToken(tenantId1)\n\n        expect(store.getProjectToken(tenantId1)).toBeNull()\n        expect(store.getProjectToken(tenantId2)).toEqual(token2)\n      })\n\n      it('should handle clearing non-existent token gracefully', () => {\n        expect(() => store.clearProjectToken('non-existent')).not.toThrow()\n        expect(store.getProjectToken('non-existent')).toBeNull()\n      })\n\n      it('should not affect OAuth tokens', () => {\n        const oauthTokens = mockFigmaTokens()\n        const projectToken = createProjectToken(tenantId1, 30)\n\n        store.setTokens(oauthTokens)\n        store.setProjectToken(tenantId1, projectToken)\n\n        store.clearProjectToken(tenantId1)\n\n        expect(store.getTokens()).toEqual(oauthTokens)\n        expect(store.getProjectToken(tenantId1)).toBeNull()\n      })\n    })\n\n    describe('clearAllProjectTokens', () => {\n      it('should remove all project tokens', () => {\n        const token1 = createProjectToken(tenantId1, 30)\n        const token2 = createProjectToken(tenantId2, 30)\n\n        store.setProjectToken(tenantId1, token1)\n        store.setProjectToken(tenantId2, token2)\n\n        store.clearAllProjectTokens()\n\n        expect(store.getProjectToken(tenantId1)).toBeNull()\n        expect(store.getProjectToken(tenantId2)).toBeNull()\n        expect(store.getAllProjectTokenTenantIds()).toEqual([])\n      })\n\n      it('should not affect OAuth tokens', () => {\n        const oauthTokens = mockFigmaTokens()\n        const projectToken = createProjectToken(tenantId1, 30)\n\n        store.setTokens(oauthTokens)\n        store.setProjectToken(tenantId1, projectToken)\n\n        store.clearAllProjectTokens()\n\n        expect(store.getTokens()).toEqual(oauthTokens)\n        expect(store.getProjectToken(tenantId1)).toBeNull()\n      })\n\n      it('should handle clearing when no project tokens exist', () => {\n        expect(() => store.clearAllProjectTokens()).not.toThrow()\n        expect(store.getAllProjectTokenTenantIds()).toEqual([])\n      })\n    })\n\n    describe('getAllProjectTokenTenantIds', () => {\n      it('should return all tenant IDs with stored tokens', () => {\n        const token1 = createProjectToken(tenantId1, 30)\n        const token2 = createProjectToken(tenantId2, 30)\n\n        store.setProjectToken(tenantId1, token1)\n        store.setProjectToken(tenantId2, token2)\n\n        const tenantIds = store.getAllProjectTokenTenantIds()\n        expect(tenantIds).toHaveLength(2)\n        expect(tenantIds).toContain(tenantId1)\n        expect(tenantIds).toContain(tenantId2)\n      })\n\n      it('should return empty array when no tokens stored', () => {\n        const tenantIds = store.getAllProjectTokenTenantIds()\n        expect(tenantIds).toEqual([])\n      })\n\n      it('should return correct IDs after removing a token', () => {\n        const token1 = createProjectToken(tenantId1, 30)\n        const token2 = createProjectToken(tenantId2, 30)\n\n        store.setProjectToken(tenantId1, token1)\n        store.setProjectToken(tenantId2, token2)\n        store.clearProjectToken(tenantId1)\n\n        const tenantIds = store.getAllProjectTokenTenantIds()\n        expect(tenantIds).toEqual([tenantId2])\n      })\n    })\n\n    describe('getProjectTokenClaims', () => {\n      it('should return claims for valid token', () => {\n        const projectToken = createProjectToken(tenantId1, 30)\n        store.setProjectToken(tenantId1, projectToken)\n\n        const claims = store.getProjectTokenClaims(tenantId1)\n        expect(claims).toEqual(projectToken.claims)\n        expect(claims?.aud).toBe(tenantId1)\n        expect(claims?.email).toBe('test@example.com')\n      })\n\n      it('should return null for non-existent token', () => {\n        const claims = store.getProjectTokenClaims('non-existent')\n        expect(claims).toBeNull()\n      })\n\n      it('should return null for token without claims', () => {\n        const tokenWithoutClaims = {\n          expiresAt: Date.now() + 30 * 60 * 1000,\n          tenantId: tenantId1,\n          token: 'jwt_token',\n        }\n        store.setProjectToken(tenantId1, tokenWithoutClaims)\n\n        const claims = store.getProjectTokenClaims(tenantId1)\n        expect(claims).toBeNull()\n      })\n    })\n  })\n})\n"],"names":["afterEach","beforeEach","describe","expect","it","mockExpiredTokens","mockFigmaTokens","mockFreshTokens","mockTokensExpiringSoon","TokenStore","store","configName","Date","now","clearTokens","tokens","setTokens","retrieved","getTokens","toEqual","toBeNull","hasValidTokens","toBe","accessToken","getAccessToken","refreshToken","getRefreshToken","originalTokens","newAccessToken","expiresIn","updateAccessToken","updatedTokens","expiresAt","toBeGreaterThan","tenantId1","tenantId2","createProjectToken","tenantId","expiresInMinutes","claims","aud","email","exp","Math","floor","iat","seat_type","token","projectToken","setProjectToken","getProjectToken","token1","token2","oldToken","newToken","validToken","isProjectTokenExpired","expiredToken","expiringToken","boundaryToken","hasValidProjectToken","clearProjectToken","not","toThrow","oauthTokens","clearAllProjectTokens","getAllProjectTokenTenantIds","tenantIds","toHaveLength","toContain","getProjectTokenClaims","tokenWithoutClaims"],"mappings":"AAAA,SAASA,SAAS,EAAEC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAEpE,SACEC,iBAAiB,EACjBC,eAAe,EACfC,eAAe,EACfC,sBAAsB,QACjB,0BAAyB;AAChC,SAASC,UAAU,QAAQ,mBAAkB;AAE7CP,SAAS,cAAc;IACrB,IAAIQ;IAEJT,WAAW;QACT,6DAA6D;QAC7DS,QAAQ,IAAID,WAAW;YAAEE,YAAY,CAAC,sBAAsB,EAAEC,KAAKC,GAAG,IAAI;QAAC;IAC7E;IAEAb,UAAU;QACR,2BAA2B;QAC3BU,MAAMI,WAAW;IACnB;IAEAZ,SAAS,2BAA2B;QAClCE,GAAG,oCAAoC;YACrC,MAAMW,SAAST;YACfI,MAAMM,SAAS,CAACD;YAEhB,MAAME,YAAYP,MAAMQ,SAAS;YACjCf,OAAOc,WAAWE,OAAO,CAACJ;QAC5B;IACF;IAEAb,SAAS,eAAe;QACtBE,GAAG,+BAA+B;YAChC,MAAMW,SAAST;YACfI,MAAMM,SAAS,CAACD;YAEhBL,MAAMI,WAAW;YAEjB,MAAMG,YAAYP,MAAMQ,SAAS;YACjCf,OAAOc,WAAWG,QAAQ;QAC5B;IACF;IAEAlB,SAAS,kBAAkB;QACzBE,GAAG,8CAA8C;YAC/C,MAAMW,SAASR;YACfG,MAAMM,SAAS,CAACD;YAEhBZ,OAAOO,MAAMW,cAAc,IAAIC,IAAI,CAAC;QACtC;QAEAlB,GAAG,+CAA+C;YAChD,MAAMW,SAASV;YACfK,MAAMM,SAAS,CAACD;YAEhBZ,OAAOO,MAAMW,cAAc,IAAIC,IAAI,CAAC;QACtC;QAEAlB,GAAG,qEAAqE;YACtE,MAAMW,SAASP;YACfE,MAAMM,SAAS,CAACD;YAEhBZ,OAAOO,MAAMW,cAAc,IAAIC,IAAI,CAAC;QACtC;IACF;IAEApB,SAAS,kBAAkB;QACzBE,GAAG,8CAA8C;YAC/C,MAAMW,SAASV;YACfK,MAAMM,SAAS,CAACD;YAEhB,MAAMQ,cAAcb,MAAMc,cAAc;YACxCrB,OAAOoB,aAAaH,QAAQ;QAC9B;IACF;IAEAlB,SAAS,mBAAmB;QAC1BE,GAAG,+DAA+D;YAChE,MAAMW,SAASV;YACfK,MAAMM,SAAS,CAACD;YAEhB,MAAMU,eAAef,MAAMgB,eAAe;YAC1CvB,OAAOsB,cAAcH,IAAI,CAACP,OAAOU,YAAY;QAC/C;IACF;IAEAvB,SAAS,qBAAqB;QAC5BE,GAAG,kDAAkD;YACnD,MAAMuB,iBAAiBrB;YACvBI,MAAMM,SAAS,CAACW;YAEhB,MAAMC,iBAAiB;YACvB,MAAMC,YAAY,KAAK,UAAU;;YAEjCnB,MAAMoB,iBAAiB,CAACF,gBAAgBC;YAExC,MAAME,gBAAgBrB,MAAMQ,SAAS;YACrCf,OAAO4B,eAAeR,aAAaD,IAAI,CAACM;YACxCzB,OAAO4B,eAAeN,cAAcH,IAAI,CAACK,eAAeF,YAAY;YACpEtB,OAAO4B,eAAeC,WAAWC,eAAe,CAACrB,KAAKC,GAAG;QAC3D;IACF;IAEAX,SAAS,yBAAyB;QAChC,MAAMgC,YAAY;QAClB,MAAMC,YAAY;QAElB,MAAMC,qBAAqB,CAACC,UAAkBC,mBAA8B,CAAA;gBAC1EC,QAAQ;oBACNC,KAAKH;oBACLI,OAAO;oBACPC,KAAKC,KAAKC,KAAK,CAAChC,KAAKC,GAAG,KAAK,QAAQyB,mBAAmB;oBACxDO,KAAKF,KAAKC,KAAK,CAAChC,KAAKC,GAAG,KAAK;oBAC7BiC,WAAW;gBACb;gBACAd,WAAWpB,KAAKC,GAAG,KAAKyB,mBAAmB,KAAK;gBAChDD;gBACAU,OAAO,CAAC,UAAU,EAAEV,UAAU;YAChC,CAAA;QAEAnC,SAAS,uCAAuC;YAC9CE,GAAG,6CAA6C;gBAC9C,MAAM4C,eAAeZ,mBAAmBF,WAAW;gBACnDxB,MAAMuC,eAAe,CAACf,WAAWc;gBAEjC,MAAM/B,YAAYP,MAAMwC,eAAe,CAAChB;gBACxC/B,OAAOc,WAAWE,OAAO,CAAC6B;YAC5B;YAEA5C,GAAG,8CAA8C;gBAC/C,MAAMa,YAAYP,MAAMwC,eAAe,CAAC;gBACxC/C,OAAOc,WAAWG,QAAQ;YAC5B;YAEAhB,GAAG,sDAAsD;gBACvD,MAAM+C,SAASf,mBAAmBF,WAAW;gBAC7C,MAAMkB,SAAShB,mBAAmBD,WAAW;gBAE7CzB,MAAMuC,eAAe,CAACf,WAAWiB;gBACjCzC,MAAMuC,eAAe,CAACd,WAAWiB;gBAEjCjD,OAAOO,MAAMwC,eAAe,CAAChB,YAAYf,OAAO,CAACgC;gBACjDhD,OAAOO,MAAMwC,eAAe,CAACf,YAAYhB,OAAO,CAACiC;YACnD;YAEAhD,GAAG,mDAAmD;gBACpD,MAAMiD,WAAWjB,mBAAmBF,WAAW;gBAC/C,MAAMoB,WAAWlB,mBAAmBF,WAAW;gBAE/CxB,MAAMuC,eAAe,CAACf,WAAWmB;gBACjC3C,MAAMuC,eAAe,CAACf,WAAWoB;gBAEjC,MAAMrC,YAAYP,MAAMwC,eAAe,CAAChB;gBACxC/B,OAAOc,WAAWE,OAAO,CAACmC;gBAC1BnD,OAAOc,WAAW8B,OAAOzB,IAAI,CAACgC,SAASP,KAAK;YAC9C;QACF;QAEA7C,SAAS,yBAAyB;YAChCE,GAAG,8DAA8D;gBAC/D,MAAMmD,aAAanB,mBAAmBF,WAAW;gBACjD/B,OAAOO,MAAM8C,qBAAqB,CAACD,aAAajC,IAAI,CAAC;YACvD;YAEAlB,GAAG,yDAAyD;gBAC1D,MAAMqD,eAAerB,mBAAmBF,WAAW,CAAC,IAAI,iBAAiB;;gBACzE/B,OAAOO,MAAM8C,qBAAqB,CAACC,eAAenC,IAAI,CAAC;YACzD;YAEAlB,GAAG,2EAA2E;gBAC5E,yDAAyD;gBACzD,6CAA6C;gBAC7C,MAAMsD,gBAAgBtB,mBAAmBF,WAAW;gBACpD/B,OAAOO,MAAM8C,qBAAqB,CAACE,gBAAgBpC,IAAI,CAAC;YAC1D;YAEAlB,GAAG,kFAAkF;gBACnF,8BAA8B;gBAC9B,MAAMmD,aAAanB,mBAAmBF,WAAW;gBACjD/B,OAAOO,MAAM8C,qBAAqB,CAACD,aAAajC,IAAI,CAAC;YACvD;YAEAlB,GAAG,2DAA2D;gBAC5D,yCAAyC;gBACzC,MAAMuD,gBAAgBvB,mBAAmBF,WAAW;gBACpD,4DAA4D;gBAC5D/B,OAAOO,MAAM8C,qBAAqB,CAACG,gBAAgBrC,IAAI,CAAC;YAC1D;QACF;QAEApB,SAAS,wBAAwB;YAC/BE,GAAG,sCAAsC;gBACvC,MAAMmD,aAAanB,mBAAmBF,WAAW;gBACjDxB,MAAMuC,eAAe,CAACf,WAAWqB;gBAEjCpD,OAAOO,MAAMkD,oBAAoB,CAAC1B,YAAYZ,IAAI,CAAC;YACrD;YAEAlB,GAAG,yCAAyC;gBAC1C,MAAMqD,eAAerB,mBAAmBF,WAAW,CAAC;gBACpDxB,MAAMuC,eAAe,CAACf,WAAWuB;gBAEjCtD,OAAOO,MAAMkD,oBAAoB,CAAC1B,YAAYZ,IAAI,CAAC;YACrD;YAEAlB,GAAG,yCAAyC;gBAC1CD,OAAOO,MAAMkD,oBAAoB,CAAC,iBAAiBtC,IAAI,CAAC;YAC1D;YAEAlB,GAAG,sDAAsD;gBACvD,MAAMsD,gBAAgBtB,mBAAmBF,WAAW,GAAG,sBAAsB;;gBAC7ExB,MAAMuC,eAAe,CAACf,WAAWwB;gBAEjCvD,OAAOO,MAAMkD,oBAAoB,CAAC1B,YAAYZ,IAAI,CAAC;YACrD;QACF;QAEApB,SAAS,qBAAqB;YAC5BE,GAAG,uCAAuC;gBACxC,MAAM+C,SAASf,mBAAmBF,WAAW;gBAC7C,MAAMkB,SAAShB,mBAAmBD,WAAW;gBAE7CzB,MAAMuC,eAAe,CAACf,WAAWiB;gBACjCzC,MAAMuC,eAAe,CAACd,WAAWiB;gBAEjC1C,MAAMmD,iBAAiB,CAAC3B;gBAExB/B,OAAOO,MAAMwC,eAAe,CAAChB,YAAYd,QAAQ;gBACjDjB,OAAOO,MAAMwC,eAAe,CAACf,YAAYhB,OAAO,CAACiC;YACnD;YAEAhD,GAAG,wDAAwD;gBACzDD,OAAO,IAAMO,MAAMmD,iBAAiB,CAAC,iBAAiBC,GAAG,CAACC,OAAO;gBACjE5D,OAAOO,MAAMwC,eAAe,CAAC,iBAAiB9B,QAAQ;YACxD;YAEAhB,GAAG,kCAAkC;gBACnC,MAAM4D,cAAc1D;gBACpB,MAAM0C,eAAeZ,mBAAmBF,WAAW;gBAEnDxB,MAAMM,SAAS,CAACgD;gBAChBtD,MAAMuC,eAAe,CAACf,WAAWc;gBAEjCtC,MAAMmD,iBAAiB,CAAC3B;gBAExB/B,OAAOO,MAAMQ,SAAS,IAAIC,OAAO,CAAC6C;gBAClC7D,OAAOO,MAAMwC,eAAe,CAAChB,YAAYd,QAAQ;YACnD;QACF;QAEAlB,SAAS,yBAAyB;YAChCE,GAAG,oCAAoC;gBACrC,MAAM+C,SAASf,mBAAmBF,WAAW;gBAC7C,MAAMkB,SAAShB,mBAAmBD,WAAW;gBAE7CzB,MAAMuC,eAAe,CAACf,WAAWiB;gBACjCzC,MAAMuC,eAAe,CAACd,WAAWiB;gBAEjC1C,MAAMuD,qBAAqB;gBAE3B9D,OAAOO,MAAMwC,eAAe,CAAChB,YAAYd,QAAQ;gBACjDjB,OAAOO,MAAMwC,eAAe,CAACf,YAAYf,QAAQ;gBACjDjB,OAAOO,MAAMwD,2BAA2B,IAAI/C,OAAO,CAAC,EAAE;YACxD;YAEAf,GAAG,kCAAkC;gBACnC,MAAM4D,cAAc1D;gBACpB,MAAM0C,eAAeZ,mBAAmBF,WAAW;gBAEnDxB,MAAMM,SAAS,CAACgD;gBAChBtD,MAAMuC,eAAe,CAACf,WAAWc;gBAEjCtC,MAAMuD,qBAAqB;gBAE3B9D,OAAOO,MAAMQ,SAAS,IAAIC,OAAO,CAAC6C;gBAClC7D,OAAOO,MAAMwC,eAAe,CAAChB,YAAYd,QAAQ;YACnD;YAEAhB,GAAG,uDAAuD;gBACxDD,OAAO,IAAMO,MAAMuD,qBAAqB,IAAIH,GAAG,CAACC,OAAO;gBACvD5D,OAAOO,MAAMwD,2BAA2B,IAAI/C,OAAO,CAAC,EAAE;YACxD;QACF;QAEAjB,SAAS,+BAA+B;YACtCE,GAAG,mDAAmD;gBACpD,MAAM+C,SAASf,mBAAmBF,WAAW;gBAC7C,MAAMkB,SAAShB,mBAAmBD,WAAW;gBAE7CzB,MAAMuC,eAAe,CAACf,WAAWiB;gBACjCzC,MAAMuC,eAAe,CAACd,WAAWiB;gBAEjC,MAAMe,YAAYzD,MAAMwD,2BAA2B;gBACnD/D,OAAOgE,WAAWC,YAAY,CAAC;gBAC/BjE,OAAOgE,WAAWE,SAAS,CAACnC;gBAC5B/B,OAAOgE,WAAWE,SAAS,CAAClC;YAC9B;YAEA/B,GAAG,mDAAmD;gBACpD,MAAM+D,YAAYzD,MAAMwD,2BAA2B;gBACnD/D,OAAOgE,WAAWhD,OAAO,CAAC,EAAE;YAC9B;YAEAf,GAAG,oDAAoD;gBACrD,MAAM+C,SAASf,mBAAmBF,WAAW;gBAC7C,MAAMkB,SAAShB,mBAAmBD,WAAW;gBAE7CzB,MAAMuC,eAAe,CAACf,WAAWiB;gBACjCzC,MAAMuC,eAAe,CAACd,WAAWiB;gBACjC1C,MAAMmD,iBAAiB,CAAC3B;gBAExB,MAAMiC,YAAYzD,MAAMwD,2BAA2B;gBACnD/D,OAAOgE,WAAWhD,OAAO,CAAC;oBAACgB;iBAAU;YACvC;QACF;QAEAjC,SAAS,yBAAyB;YAChCE,GAAG,wCAAwC;gBACzC,MAAM4C,eAAeZ,mBAAmBF,WAAW;gBACnDxB,MAAMuC,eAAe,CAACf,WAAWc;gBAEjC,MAAMT,SAAS7B,MAAM4D,qBAAqB,CAACpC;gBAC3C/B,OAAOoC,QAAQpB,OAAO,CAAC6B,aAAaT,MAAM;gBAC1CpC,OAAOoC,QAAQC,KAAKlB,IAAI,CAACY;gBACzB/B,OAAOoC,QAAQE,OAAOnB,IAAI,CAAC;YAC7B;YAEAlB,GAAG,6CAA6C;gBAC9C,MAAMmC,SAAS7B,MAAM4D,qBAAqB,CAAC;gBAC3CnE,OAAOoC,QAAQnB,QAAQ;YACzB;YAEAhB,GAAG,+CAA+C;gBAChD,MAAMmE,qBAAqB;oBACzBvC,WAAWpB,KAAKC,GAAG,KAAK,KAAK,KAAK;oBAClCwB,UAAUH;oBACVa,OAAO;gBACT;gBACArC,MAAMuC,eAAe,CAACf,WAAWqC;gBAEjC,MAAMhC,SAAS7B,MAAM4D,qBAAqB,CAACpC;gBAC3C/B,OAAOoC,QAAQnB,QAAQ;YACzB;QACF;IACF;AACF"}

package/dist/auth/types.d.ts

@@ -0,0 +1,197 @@
+import type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User } from '@figma/rest-api-spec';
+import type { JWTPayload as JoseJWTPayload } from 'jose';
+/**
+ * Standard OAuth2 scopes for user-level permissions
+ * @see https://www.figma.com/developers/api#oauth2
+ */
+export type FigmaOAuthScope = 'current_user:read' | 'file_comments:read' | 'file_comments:write' | 'file_content:read' | 'file_dev_resources:read' | 'file_dev_resources:write' | 'file_metadata:read' | 'file_variables:read' | 'file_variables:write' | 'file_versions:read' | 'files:read' | 'library_analytics:read' | 'library_assets:read' | 'library_content:read' | 'projects:read' | 'team_library_content:read' | 'webhooks:read' | 'webhooks:write';
+/**
+ * Organization-level OAuth2 scopes
+ * Requires organization admin permissions
+ */
+export type FigmaOrgOAuthScope = 'org:activity_log_read';
+/**
+ * All valid Figma OAuth scopes
+ */
+export type FigmaScope = FigmaOAuthScope | FigmaOrgOAuthScope;
+/**
+ * OAuth tokens returned from Figma API (internal format)
+ */
+export interface FigmaTokens {
+    /** OAuth2 access token for making authenticated API requests */
+    accessToken: string;
+    /** Unix timestamp (milliseconds) when the access token expires */
+    expiresAt: number;
+    /** OAuth2 refresh token for obtaining new access tokens */
+    refreshToken: string;
+    /** OAuth scopes granted to this token */
+    scopes?: FigmaOAuthScope[];
+    /** Token type (typically "Bearer") */
+    tokenType?: string;
+    /** Figma user ID string */
+    userId?: string;
+}
+/**
+ * Raw token response from Figma OAuth2 token endpoint
+ * Response from POST https://api.figma.com/v1/oauth/token
+ */
+export interface FigmaTokenResponse {
+    /** OAuth2 access token */
+    access_token: string;
+    /** Token expiration time in seconds */
+    expires_in: number;
+    /** OAuth2 refresh token */
+    refresh_token: string;
+    /** Space-separated list of granted scopes */
+    scope?: string;
+    /** Token type (typically "Bearer") */
+    token_type?: string;
+    /** Figma user ID string */
+    user_id_string?: string;
+}
+/**
+ * OAuth2 error response
+ * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+ */
+export interface OAuthErrorResponse {
+    /** Error code */
+    error: 'invalid_client' | 'invalid_grant' | 'invalid_request' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type';
+    /** Human-readable error description */
+    error_description?: string;
+    /** URI with error information */
+    error_uri?: string;
+}
+/**
+ * Parameters for OAuth2 authorization URL
+ */
+export interface OAuthAuthorizationParams {
+    /** OAuth2 client ID */
+    client_id: string;
+    /** PKCE code challenge (optional but recommended) */
+    code_challenge?: string;
+    /** PKCE code challenge method (must be S256 if using PKCE) */
+    code_challenge_method?: 'S256';
+    /** Redirect URI for callback */
+    redirect_uri: string;
+    /** Response type (always "code" for authorization code flow) */
+    response_type: 'code';
+    /** Requested scopes (space-separated) */
+    scope: string;
+    /** State parameter for CSRF protection */
+    state: string;
+}
+/**
+ * Parameters for OAuth2 token exchange
+ */
+export interface OAuthTokenExchangeParams {
+    /** Authorization code from callback */
+    code: string;
+    /** PKCE code verifier (if PKCE was used) */
+    code_verifier?: string;
+    /** Grant type (always "authorization_code") */
+    grant_type: 'authorization_code';
+    /** Redirect URI (must match authorization request) */
+    redirect_uri: string;
+}
+/**
+ * Parameters for OAuth2 token refresh
+ */
+export interface OAuthTokenRefreshParams {
+    /** Grant type (always "refresh_token") */
+    grant_type: 'refresh_token';
+    /** Refresh token */
+    refresh_token: string;
+}
+/**
+ * Configuration for token storage
+ */
+export interface TokenStoreConfig {
+    /** Custom config name (defaults to 'payloadcms-figma') */
+    configName?: string;
+    /** Enable encryption (defaults to true) */
+    encryptionKey?: string;
+}
+/**
+ * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients
+ * @see https://datatracker.ietf.org/doc/html/rfc7636
+ */
+export interface PKCEPair {
+    /** Code challenge derived from code verifier */
+    codeChallenge: string;
+    /** Code challenge method (always S256) */
+    codeChallengeMethod: 'S256';
+    /** Code verifier - random string used to generate challenge */
+    codeVerifier: string;
+}
+/**
+ * OAuth configuration for Figma API (public client with PKCE)
+ *
+ * This configuration is for a PUBLIC OAuth client that uses PKCE
+ * (Proof Key for Code Exchange) instead of a client secret.
+ * Public clients (like CLIs) cannot securely store client secrets.
+ */
+export interface OAuthConfig {
+    /** Figma OAuth authorization URL */
+    authorizationUrl: string;
+    /** OAuth2 client ID (public client) */
+    clientId: string;
+    /** OAuth2 redirect URI for callback */
+    redirectUri: string;
+    /** Figma OAuth token refresh URL */
+    refreshUrl: string;
+    /** OAuth2 scopes to request */
+    scopes: FigmaOAuthScope[];
+    /** Figma OAuth token exchange URL */
+    tokenUrl: string;
+}
+/**
+ * Re-export Figma's official types for convenience
+ */
+export type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User };
+/**
+ * Type alias for Figma API error responses
+ * Combines both error response formats from Figma's REST API
+ */
+export type FigmaErrorResponse = ErrorResponsePayloadWithErrMessage | ErrorResponsePayloadWithErrorBoolean;
+/**
+ * Figma user information
+ * Re-exported from @figma/rest-api-spec
+ */
+export type FigmaUser = User;
+/**
+ * JWT payload structure from Figma project tokens
+ * Extends jose's standard JWTPayload with Figma-specific claims
+ */
+export interface JWTPayload extends JoseJWTPayload {
+    [key: string]: unknown;
+    /** User email address */
+    email?: string;
+    /** Tenant/CMS ID this token is scoped to */
+    tenant_id?: string;
+}
+/**
+ * Project token (JWT) for authenticating to Content API
+ * Used by local Payload instances to make authenticated requests
+ */
+export interface ProjectToken {
+    /** Validated JWT claims (populated after validation) */
+    claims?: JWTPayload;
+    /** Unix timestamp (milliseconds) when the token expires (from validated exp claim) */
+    expiresAt: number;
+    /** Tenant/CMS ID this token is scoped to */
+    tenantId: string;
+    /** JWT token string signed by Figma API */
+    token: string;
+}
+/**
+ * Raw project token response from Figma API
+ * Response from GET https://api.figma.com/v1/cms/:id/token/
+ */
+export interface ProjectTokenResponse {
+    /** Response metadata containing the JWT token */
+    meta: {
+        /** JWT token string */
+        token: string;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,oCAAoC,EACpC,IAAI,EACL,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,MAAM,CAAA;AAExD;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,yBAAyB,GACzB,0BAA0B,GAC1B,oBAAoB,GACpB,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,YAAY,GACZ,wBAAwB,GACxB,qBAAqB,GACrB,sBAAsB,GACtB,eAAe,GACf,2BAA2B,GAC3B,eAAe,GACf,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;AAExD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,kBAAkB,CAAA;AAE7D;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;IAC1B,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,KAAK,EACD,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,CAAA;IAC5B,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAA;IACrB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,4CAA4C;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,UAAU,EAAE,oBAAoB,CAAA;IAChC,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,UAAU,EAAE,eAAe,CAAA;IAC3B,oBAAoB;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,0CAA0C;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,gBAAgB,EAAE,MAAM,CAAA;IACxB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,+BAA+B;IAC/B,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,YAAY,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAA;AAE9F;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,kCAAkC,GAClC,oCAAoC,CAAA;AAExC;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,iDAAiD;IACjD,IAAI,EAAE;QACJ,uBAAuB;QACvB,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF"}

package/dist/auth/types.js

@@ -0,0 +1,6 @@
+/**
+ * Raw project token response from Figma API
+ * Response from GET https://api.figma.com/v1/cms/:id/token/
+ */ export { };
+
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type {\n  ErrorResponsePayloadWithErrMessage,\n  ErrorResponsePayloadWithErrorBoolean,\n  User,\n} from '@figma/rest-api-spec'\nimport type { JWTPayload as JoseJWTPayload } from 'jose'\n\n/**\n * Standard OAuth2 scopes for user-level permissions\n * @see https://www.figma.com/developers/api#oauth2\n */\nexport type FigmaOAuthScope =\n  | 'current_user:read' // Read user name, email, profile image\n  | 'file_comments:read' // Read file comments\n  | 'file_comments:write' // Post/delete comments and reactions\n  | 'file_content:read' // Read file contents (nodes, editor type)\n  | 'file_dev_resources:read' // Read dev resources\n  | 'file_dev_resources:write' // Write dev resources\n  | 'file_metadata:read' // Read file metadata\n  | 'file_variables:read' // Read variables (Enterprise only)\n  | 'file_variables:write' // Write variables (Enterprise only)\n  | 'file_versions:read' // Read version history\n  | 'files:read' // @deprecated Read files, projects, users\n  | 'library_analytics:read' // Read library analytics\n  | 'library_assets:read' // Read published components/styles data\n  | 'library_content:read' // Read published components/styles\n  | 'projects:read' // List projects and files\n  | 'team_library_content:read' // Read team published content\n  | 'webhooks:read' // Read webhook metadata\n  | 'webhooks:write' // Create/manage webhooks\n\n/**\n * Organization-level OAuth2 scopes\n * Requires organization admin permissions\n */\nexport type FigmaOrgOAuthScope = 'org:activity_log_read' // Read organization activity logs\n\n/**\n * All valid Figma OAuth scopes\n */\nexport type FigmaScope = FigmaOAuthScope | FigmaOrgOAuthScope\n\n/**\n * OAuth tokens returned from Figma API (internal format)\n */\nexport interface FigmaTokens {\n  /** OAuth2 access token for making authenticated API requests */\n  accessToken: string\n  /** Unix timestamp (milliseconds) when the access token expires */\n  expiresAt: number\n  /** OAuth2 refresh token for obtaining new access tokens */\n  refreshToken: string\n  /** OAuth scopes granted to this token */\n  scopes?: FigmaOAuthScope[]\n  /** Token type (typically \"Bearer\") */\n  tokenType?: string\n  /** Figma user ID string */\n  userId?: string\n}\n\n/**\n * Raw token response from Figma OAuth2 token endpoint\n * Response from POST https://api.figma.com/v1/oauth/token\n */\nexport interface FigmaTokenResponse {\n  /** OAuth2 access token */\n  access_token: string\n  /** Token expiration time in seconds */\n  expires_in: number\n  /** OAuth2 refresh token */\n  refresh_token: string\n  /** Space-separated list of granted scopes */\n  scope?: string\n  /** Token type (typically \"Bearer\") */\n  token_type?: string\n  /** Figma user ID string */\n  user_id_string?: string\n}\n\n/**\n * OAuth2 error response\n * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2\n */\nexport interface OAuthErrorResponse {\n  /** Error code */\n  error:\n    | 'invalid_client'\n    | 'invalid_grant'\n    | 'invalid_request'\n    | 'invalid_scope'\n    | 'unauthorized_client'\n    | 'unsupported_grant_type'\n  /** Human-readable error description */\n  error_description?: string\n  /** URI with error information */\n  error_uri?: string\n}\n\n/**\n * Parameters for OAuth2 authorization URL\n */\nexport interface OAuthAuthorizationParams {\n  /** OAuth2 client ID */\n  client_id: string\n  /** PKCE code challenge (optional but recommended) */\n  code_challenge?: string\n  /** PKCE code challenge method (must be S256 if using PKCE) */\n  code_challenge_method?: 'S256'\n  /** Redirect URI for callback */\n  redirect_uri: string\n  /** Response type (always \"code\" for authorization code flow) */\n  response_type: 'code'\n  /** Requested scopes (space-separated) */\n  scope: string\n  /** State parameter for CSRF protection */\n  state: string\n}\n\n/**\n * Parameters for OAuth2 token exchange\n */\nexport interface OAuthTokenExchangeParams {\n  /** Authorization code from callback */\n  code: string\n  /** PKCE code verifier (if PKCE was used) */\n  code_verifier?: string\n  /** Grant type (always \"authorization_code\") */\n  grant_type: 'authorization_code'\n  /** Redirect URI (must match authorization request) */\n  redirect_uri: string\n}\n\n/**\n * Parameters for OAuth2 token refresh\n */\nexport interface OAuthTokenRefreshParams {\n  /** Grant type (always \"refresh_token\") */\n  grant_type: 'refresh_token'\n  /** Refresh token */\n  refresh_token: string\n}\n\n/**\n * Configuration for token storage\n */\nexport interface TokenStoreConfig {\n  /** Custom config name (defaults to 'payloadcms-figma') */\n  configName?: string\n  /** Enable encryption (defaults to true) */\n  encryptionKey?: string\n}\n\n/**\n * PKCE (Proof Key for Code Exchange) pair for OAuth2 public clients\n * @see https://datatracker.ietf.org/doc/html/rfc7636\n */\nexport interface PKCEPair {\n  /** Code challenge derived from code verifier */\n  codeChallenge: string\n  /** Code challenge method (always S256) */\n  codeChallengeMethod: 'S256'\n  /** Code verifier - random string used to generate challenge */\n  codeVerifier: string\n}\n\n/**\n * OAuth configuration for Figma API (public client with PKCE)\n *\n * This configuration is for a PUBLIC OAuth client that uses PKCE\n * (Proof Key for Code Exchange) instead of a client secret.\n * Public clients (like CLIs) cannot securely store client secrets.\n */\nexport interface OAuthConfig {\n  /** Figma OAuth authorization URL */\n  authorizationUrl: string\n  /** OAuth2 client ID (public client) */\n  clientId: string\n  /** OAuth2 redirect URI for callback */\n  redirectUri: string\n  /** Figma OAuth token refresh URL */\n  refreshUrl: string\n  /** OAuth2 scopes to request */\n  scopes: FigmaOAuthScope[]\n  /** Figma OAuth token exchange URL */\n  tokenUrl: string\n}\n\n/**\n * Re-export Figma's official types for convenience\n */\nexport type { ErrorResponsePayloadWithErrMessage, ErrorResponsePayloadWithErrorBoolean, User }\n\n/**\n * Type alias for Figma API error responses\n * Combines both error response formats from Figma's REST API\n */\nexport type FigmaErrorResponse =\n  | ErrorResponsePayloadWithErrMessage\n  | ErrorResponsePayloadWithErrorBoolean\n\n/**\n * Figma user information\n * Re-exported from @figma/rest-api-spec\n */\nexport type FigmaUser = User\n\n/**\n * JWT payload structure from Figma project tokens\n * Extends jose's standard JWTPayload with Figma-specific claims\n */\nexport interface JWTPayload extends JoseJWTPayload {\n  [key: string]: unknown\n  /** User email address */\n  email?: string\n  /** Tenant/CMS ID this token is scoped to */\n  tenant_id?: string\n}\n\n/**\n * Project token (JWT) for authenticating to Content API\n * Used by local Payload instances to make authenticated requests\n */\nexport interface ProjectToken {\n  /** Validated JWT claims (populated after validation) */\n  claims?: JWTPayload\n  /** Unix timestamp (milliseconds) when the token expires (from validated exp claim) */\n  expiresAt: number\n  /** Tenant/CMS ID this token is scoped to */\n  tenantId: string\n  /** JWT token string signed by Figma API */\n  token: string\n}\n\n/**\n * Raw project token response from Figma API\n * Response from GET https://api.figma.com/v1/cms/:id/token/\n */\nexport interface ProjectTokenResponse {\n  /** Response metadata containing the JWT token */\n  meta: {\n    /** JWT token string */\n    token: string\n  }\n}\n"],"names":[],"mappings":"AAyOA;;;CAGC,GACD,WAMC"}

package/dist/cli.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Entrypoint for bin/cli.js
+ */
+export declare function main(): Promise<void>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA;;GAEG;AACH,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAS1C"}