@payloadcms/figma 0.0.1-alpha.62 → 0.0.1-alpha.64

package/dist/auth/token-store-migration.js

@@ -0,0 +1,156 @@
+import Conf from 'conf';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import * as log from '../utils/log.js';
+const OAUTH_STORE_SCHEMA_VERSION = 1;
+const PROJECT_STORE_SCHEMA_VERSION = 1;
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */ export function needsMigration(params) {
+    const checkExists = params.checkFileExists ?? fsSync.existsSync;
+    const newExists = checkExists(params.newOAuthFilePath);
+    if (newExists) {
+        return false;
+    }
+    return checkExists(params.legacyFilePath);
+}
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */ export function migrateOAuth(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const legacyTokens = safeGet(legacyConfig, 'tokens');
+    if (!legacyTokens) {
+        return;
+    }
+    // Ensure target directory exists
+    if (!fsSync.existsSync(params.newOAuthCwd)) {
+        fsSync.mkdirSync(params.newOAuthCwd, {
+            recursive: true
+        });
+    }
+    const newOAuthConfig = new Conf({
+        configName: params.newOAuthConfigName,
+        cwd: params.newOAuthCwd,
+        encryptionKey: params.encryptionKey,
+        projectName: params.projectName
+    });
+    // Write root-level keys
+    newOAuthConfig.set('_schemaVersion', OAUTH_STORE_SCHEMA_VERSION);
+    newOAuthConfig.set('accessToken', legacyTokens.accessToken);
+    newOAuthConfig.set('expiresAt', legacyTokens.expiresAt);
+    newOAuthConfig.set('refreshToken', legacyTokens.refreshToken);
+    if (legacyTokens.scopes) {
+        newOAuthConfig.set('scopes', legacyTokens.scopes);
+    }
+    if (legacyTokens.tokenType) {
+        newOAuthConfig.set('tokenType', legacyTokens.tokenType);
+    }
+    if (legacyTokens.userId) {
+        newOAuthConfig.set('userId', legacyTokens.userId);
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */ export function migrateProjectData(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const bootstrapData = safeGet(legacyConfig, 'bootstrapData') || {};
+    const projectTokens = safeGet(legacyConfig, 'projectTokens') || {};
+    if (Object.keys(bootstrapData).length === 0 && Object.keys(projectTokens).length === 0) {
+        return;
+    }
+    for (const [key, bootstrap] of Object.entries(bootstrapData)){
+        const separatorIdx = key.indexOf(':');
+        if (separatorIdx === -1) {
+            continue;
+        }
+        const projectId = key.slice(0, separatorIdx);
+        const environmentName = key.slice(separatorIdx + 1);
+        if (!projectId || !environmentName) {
+            continue;
+        }
+        const { configName, cwd } = params.resolveProjectStorePath({
+            environmentName,
+            projectId
+        });
+        const targetPath = path.join(cwd, `${configName}.json`);
+        if (fsSync.existsSync(targetPath)) {
+            continue;
+        }
+        if (!fsSync.existsSync(cwd)) {
+            fsSync.mkdirSync(cwd, {
+                recursive: true
+            });
+        }
+        const projectConfig = new Conf({
+            configName,
+            cwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+        projectConfig.set('_schemaVersion', PROJECT_STORE_SCHEMA_VERSION);
+        projectConfig.set('bootstrapData', bootstrap);
+        const legacyProjectToken = bootstrap.contentSystemId ? projectTokens[bootstrap.contentSystemId] : undefined;
+        if (legacyProjectToken) {
+            projectConfig.set('projectToken', legacyProjectToken);
+        }
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+function safeGet(config, key) {
+    try {
+        return config.get(key);
+    } catch (error) {
+        log.debug(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return undefined;
+    }
+}
+/**
+ * Open the legacy Conf store without `clearInvalidConfig`, so a decrypt
+ * error does not destroy the file. Returns null when the file cannot be
+ * opened — callers treat that as "nothing to migrate, leave file alone".
+ */ function openLegacyConfig(params) {
+    try {
+        return new Conf({
+            configName: params.legacyConfigName,
+            cwd: params.legacyCwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+    } catch (error) {
+        log.debug(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return null;
+    }
+}
+
+//# sourceMappingURL=token-store-migration.js.map

package/dist/auth/token-store.d.ts

@@ -1,151 +1,74 @@
 import type { Environment } from '../constants.js';
-import type { BootstrapData, FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+import type { BootstrapData, FigmaTokens, ProjectStoreScope, ProjectToken, TokenStoreConfig } from './types.js';
 /**
- * Get the singleton TokenStore instance for an environment
- * Use this for all production code to ensure a single shared instance per environment
- *
- * @param environment - The environment to get the token store for
- * @returns The singleton TokenStore instance for that environment
+ * Get the singleton TokenStore instance for an environment.
  */
 export declare function getTokenStore(environment?: Environment): TokenStore;
 /**
- * Secure storage manager for Figma OAuth2 tokens
- *
- * Uses the `conf` library to store tokens in an OS-specific secure location:
- * - macOS: ~/Library/Preferences/payloadcms-figma
- * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma
- * - Windows: %APPDATA%/payloadcms-figma/Config
- *
- * Tokens are encrypted at rest with a machine-specific key and file permissions
- * are set to 0600 (owner read/write only)
+ * Secure storage manager for OAuth tokens and project-scoped bootstrap/token data.
  *
  * For production code, use getTokenStore() to get the singleton instance.
  * The constructor is still exported for test isolation.
  */
 export declare class TokenStore {
-    private config;
+    private baseConfigName;
+    private encryptionKey;
     private environment;
+    private legacyRootDir;
+    private oauthConfig;
+    private projectName;
+    private projectStoreConfigs;
     constructor(options?: TokenStoreConfig);
-    private safeGet;
-    /**
-     * Retrieve stored tokens
-     * @returns FigmaTokens if stored, null otherwise
-     */
-    getTokens(): FigmaTokens | null;
-    /**
-     * Store OAuth2 tokens securely
-     * @param tokens - Figma OAuth2 tokens to store
-     */
+    getOauthInfo(): FigmaTokens | null;
     setTokens(tokens: FigmaTokens): void;
-    /**
-     * Clear all stored tokens (used for logout)
-     */
     clearTokens(): void;
-    /**
-     * Check if valid (non-expired) tokens exist
-     * @returns true if tokens exist and are not expired
-     */
-    hasValidTokens(): boolean;
-    /**
-     * Check if the current access token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isExpired(): boolean;
-    /**
-     * Get the access token if it exists and is valid
-     * @returns Access token string or null if expired/missing
-     */
-    getAccessToken(): null | string;
-    /**
-     * Get the refresh token if it exists
-     * @returns Refresh token string or null if missing
-     */
-    getRefreshToken(): null | string;
-    /**
-     * Update just the access token after a refresh
-     * Preserves the existing refresh token and other metadata
-     * @param accessToken - New access token
-     * @param expiresIn - Expiration time in seconds
-     */
+    hasValidOauthToken(): boolean;
+    isOauthExpired(): boolean;
+    getCurrentOauthToken(): null | string;
+    getCurrentRefreshToken(): null | string;
     updateAccessToken(accessToken: string, expiresIn: number): void;
     /**
-     * Get the path to the config file (useful for debugging)
-     * @returns Absolute path to the token storage file
+     * Returns the OAuth storage file path.
      */
     getStoragePath(): string;
-    /**
-     * Retrieve a project token for a specific tenant
-     * Automatically removes expired tokens from storage
-     * @param tenantId - The tenant/CMS ID
-     * @returns ProjectToken if stored and valid, null otherwise
-     */
-    getProjectToken(tenantId: string): null | ProjectToken;
-    /**
-     * Store a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     * @param projectToken - The project token to store
-     */
-    setProjectToken(tenantId: string, projectToken: ProjectToken): void;
-    /**
-     * Clear a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     */
-    clearProjectToken(tenantId: string): void;
-    /**
-     * Clear all project tokens
-     */
-    clearAllProjectTokens(): void;
-    /**
-     * Check if a project token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @param projectToken - The project token to check
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isProjectTokenExpired(projectToken: ProjectToken): boolean;
-    /**
-     * Check if a valid (non-expired) project token exists for a tenant
-     * @param tenantId - The tenant/CMS ID
-     * @returns true if token exists and is not expired
-     */
-    hasValidProjectToken(tenantId: string): boolean;
-    /**
-     * Get validated JWT claims from a project token
-     * @param tenantId - The tenant/CMS ID
-     * @returns JWT payload claims or null if token not found or has no claims
-     */
-    getProjectTokenClaims(tenantId: string): JWTPayload | null;
-    /**
-     * Get all tenant IDs that have stored project tokens
-     * @returns Array of tenant IDs
-     */
-    getAllProjectTokenTenantIds(): string[];
-    /**
-     * Build the composite key for bootstrap data storage
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name (e.g. 'production', 'staging')
-     * @returns Composite key string
-     */
-    private bootstrapKey;
-    /**
-     * Retrieve bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     * @returns BootstrapData if stored, null otherwise
-     */
+    getProjectToken({ projectInfo, }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | ProjectToken;
+    setProjectToken({ projectInfo, token, }: {
+        projectInfo?: ProjectStoreScope;
+        token: ProjectToken;
+    }): void;
+    clearProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): void;
+    isProjectTokenExpired(token: ProjectToken): boolean;
+    hasValidProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): boolean;
+    /**
+     * Get the tenantId (contentSystemId) for the project scope.
+     * Returns null if bootstrap data is not available.
+     */
+    getTenantId({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | string;
+    /**
+     * Derive project info from environment variables.
+     * Returns null if either FIGMA_PROJECT_ID or FIGMA_ENVIRONMENT_NAME is not set.
+     */
+    private getProjectInfoFromEnv;
     getBootstrapData(projectId: string, environmentName: string): BootstrapData | null;
-    /**
-     * Store bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     * @param data - The bootstrap data to store
-     */
     setBootstrapData(projectId: string, environmentName: string, data: BootstrapData): void;
-    /**
-     * Clear bootstrap data for a project + environment
-     * @param projectId - The CMS resource/project ID
-     * @param environmentName - The environment name
-     */
     clearBootstrapData(projectId: string, environmentName: string): void;
+    private buildOAuthConfigName;
+    private buildOAuthStoreCwd;
+    private buildProjectStoreConfigName;
+    private buildProjectStoreCwd;
+    private sanitizeConfigSegment;
+    private projectInfoKey;
+    private getLegacyRootDir;
+    private getProjectStore;
+    private createConfig;
+    private safeGet;
 }
 //# sourceMappingURL=token-store.d.ts.map