@payloadcms/figma 0.0.1-alpha.7 → 0.0.1-alpha.70

package/dist/auth/refresh.js

@@ -1,11 +1,12 @@
-/* eslint-disable perfectionist/sort-objects */ import { OAUTH_CONFIG } from '../config/oauth.js';
+/* eslint-disable perfectionist/sort-objects */ import { getOAuthConfig } from '../config/oauth.js';
 import * as log from '../utils/log.js';
 /**
  * Error thrown when token refresh fails
  */ export class TokenRefreshError extends Error {
     statusCode;
-    constructor(message, statusCode){
-        super(message), this.statusCode = statusCode;
+    errorCode;
+    constructor(message, statusCode, errorCode){
+        super(message), this.statusCode = statusCode, this.errorCode = errorCode;
         this.name = 'TokenRefreshError';
     }
 }
@@ -19,15 +20,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to new tokens
  * @throws TokenRefreshError if refresh fails
- */ export async function refreshAccessToken(refreshToken, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function refreshAccessToken(refreshToken, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token refresh request (public client)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         grant_type: 'refresh_token',
         refresh_token: refreshToken
     });
     try {
-        const response = await fetch(OAUTH_CONFIG.refreshUrl, {
+        const response = await fetch(oauthConfig.refreshUrl, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded'
@@ -36,7 +39,14 @@ import * as log from '../utils/log.js';
         });
         if (!response.ok) {
             const errorText = await response.text();
-            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status);
+            let errorCode;
+            try {
+                const parsed = JSON.parse(errorText);
+                errorCode = parsed.error;
+            } catch  {
+            // Not JSON, leave errorCode undefined
+            }
+            throw new TokenRefreshError(`Token refresh failed: ${response.statusText}. ${errorText}`, response.status, errorCode);
         }
         const data = await response.json();
         // Validate response contains required fields
@@ -71,14 +81,17 @@ import * as log from '../utils/log.js';
  * @param clientId - OAuth2 client ID (defaults to config)
  * @returns Promise resolving to tokens
  * @throws TokenRefreshError if exchange fails
- */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri = OAUTH_CONFIG.redirectUri, clientId = OAUTH_CONFIG.clientId) {
+ */ export async function exchangeCodeForTokens(code, codeVerifier, redirectUri, clientId) {
+    const oauthConfig = getOAuthConfig();
+    const resolvedRedirectUri = redirectUri ?? oauthConfig.redirectUri;
+    const resolvedClientId = clientId ?? oauthConfig.clientId;
     // Prepare form data for token exchange (public client with PKCE)
     const params = new URLSearchParams({
-        client_id: clientId,
+        client_id: resolvedClientId,
         code,
         code_verifier: codeVerifier,
         grant_type: 'authorization_code',
-        redirect_uri: redirectUri
+        redirect_uri: resolvedRedirectUri
     });
     try {
         // Public client - no client secret or Basic Auth header needed
@@ -88,11 +101,11 @@ import * as log from '../utils/log.js';
         };
         // Debug logging
         log.debug(`Token exchange request: ${JSON.stringify({
-            url: OAUTH_CONFIG.tokenUrl,
+            url: oauthConfig.tokenUrl,
             headers,
             body: params.toString()
         })}`);
-        const response = await fetch(OAUTH_CONFIG.tokenUrl, {
+        const response = await fetch(oauthConfig.tokenUrl, {
             method: 'POST',
             headers,
             body: params.toString()

package/dist/auth/token-store-migration.d.ts

@@ -0,0 +1,58 @@
+import type { BootstrapData, FigmaTokens, ProjectToken } from './types.js';
+export type LegacyStoreSchema = {
+    bootstrapData?: Record<string, BootstrapData>;
+    projectTokens?: Record<string, ProjectToken>;
+    tokens?: FigmaTokens;
+};
+export type MigrationCheckParams = {
+    checkFileExists?: (filePath: string) => boolean;
+    legacyFilePath: string;
+    newOAuthFilePath: string;
+};
+export type MigrateOAuthParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    newOAuthConfigName: string;
+    newOAuthCwd: string;
+    projectName: string;
+};
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */
+export declare function needsMigration(params: MigrationCheckParams): boolean;
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */
+export declare function migrateOAuth(params: MigrateOAuthParams): void;
+export type ResolveProjectStorePath = (scope: {
+    environmentName: string;
+    projectId: string;
+}) => {
+    configName: string;
+    cwd: string;
+};
+export type MigrateProjectDataParams = {
+    encryptionKey: string;
+    legacyConfigName: string;
+    legacyCwd?: string;
+    projectName: string;
+    resolveProjectStorePath: ResolveProjectStorePath;
+};
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */
+export declare function migrateProjectData(params: MigrateProjectDataParams): void;
+//# sourceMappingURL=token-store-migration.d.ts.map

package/dist/auth/token-store-migration.js

@@ -0,0 +1,156 @@
+import Conf from 'conf';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import * as log from '../utils/log.js';
+const OAUTH_STORE_SCHEMA_VERSION = 1;
+const PROJECT_STORE_SCHEMA_VERSION = 1;
+/**
+ * Check if migration is needed.
+ * Returns true only when legacy file exists AND new oauth file does not.
+ */ export function needsMigration(params) {
+    const checkExists = params.checkFileExists ?? fsSync.existsSync;
+    const newExists = checkExists(params.newOAuthFilePath);
+    if (newExists) {
+        return false;
+    }
+    return checkExists(params.legacyFilePath);
+}
+/**
+ * Migrate OAuth tokens from legacy store to new oauth store.
+ * Reads from legacy location, writes to new location with root-level keys.
+ *
+ * `clearInvalidConfig` is deliberately OFF so a transient decrypt error does
+ * not wipe the legacy file — older CLI versions elsewhere on disk still read
+ * it. If we cannot open the file, we log and skip migration.
+ */ export function migrateOAuth(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const legacyTokens = safeGet(legacyConfig, 'tokens');
+    if (!legacyTokens) {
+        return;
+    }
+    // Ensure target directory exists
+    if (!fsSync.existsSync(params.newOAuthCwd)) {
+        fsSync.mkdirSync(params.newOAuthCwd, {
+            recursive: true
+        });
+    }
+    const newOAuthConfig = new Conf({
+        configName: params.newOAuthConfigName,
+        cwd: params.newOAuthCwd,
+        encryptionKey: params.encryptionKey,
+        projectName: params.projectName
+    });
+    // Write root-level keys
+    newOAuthConfig.set('_schemaVersion', OAUTH_STORE_SCHEMA_VERSION);
+    newOAuthConfig.set('accessToken', legacyTokens.accessToken);
+    newOAuthConfig.set('expiresAt', legacyTokens.expiresAt);
+    newOAuthConfig.set('refreshToken', legacyTokens.refreshToken);
+    if (legacyTokens.scopes) {
+        newOAuthConfig.set('scopes', legacyTokens.scopes);
+    }
+    if (legacyTokens.tokenType) {
+        newOAuthConfig.set('tokenType', legacyTokens.tokenType);
+    }
+    if (legacyTokens.userId) {
+        newOAuthConfig.set('userId', legacyTokens.userId);
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+/**
+ * Migrate per-project bootstrap data and project tokens from the legacy
+ * combined store into individual per-project stores.
+ *
+ * Walks legacy `bootstrapData` (keyed by `projectId:environmentName`), writes
+ * each entry into its own project store file, and stashes the matching
+ * `projectToken` (looked up by `bootstrapData.contentSystemId`) alongside it.
+ * Target files that already exist are left alone.
+ */ export function migrateProjectData(params) {
+    const legacyConfig = openLegacyConfig({
+        encryptionKey: params.encryptionKey,
+        legacyConfigName: params.legacyConfigName,
+        legacyCwd: params.legacyCwd,
+        projectName: params.projectName
+    });
+    if (!legacyConfig) {
+        return;
+    }
+    const bootstrapData = safeGet(legacyConfig, 'bootstrapData') || {};
+    const projectTokens = safeGet(legacyConfig, 'projectTokens') || {};
+    if (Object.keys(bootstrapData).length === 0 && Object.keys(projectTokens).length === 0) {
+        return;
+    }
+    for (const [key, bootstrap] of Object.entries(bootstrapData)){
+        const separatorIdx = key.indexOf(':');
+        if (separatorIdx === -1) {
+            continue;
+        }
+        const projectId = key.slice(0, separatorIdx);
+        const environmentName = key.slice(separatorIdx + 1);
+        if (!projectId || !environmentName) {
+            continue;
+        }
+        const { configName, cwd } = params.resolveProjectStorePath({
+            environmentName,
+            projectId
+        });
+        const targetPath = path.join(cwd, `${configName}.json`);
+        if (fsSync.existsSync(targetPath)) {
+            continue;
+        }
+        if (!fsSync.existsSync(cwd)) {
+            fsSync.mkdirSync(cwd, {
+                recursive: true
+            });
+        }
+        const projectConfig = new Conf({
+            configName,
+            cwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+        projectConfig.set('_schemaVersion', PROJECT_STORE_SCHEMA_VERSION);
+        projectConfig.set('bootstrapData', bootstrap);
+        const legacyProjectToken = bootstrap.contentSystemId ? projectTokens[bootstrap.contentSystemId] : undefined;
+        if (legacyProjectToken) {
+            projectConfig.set('projectToken', legacyProjectToken);
+        }
+    }
+// Leave the legacy file untouched so older CLI versions installed in other
+// projects on the same machine can keep reading their last known state.
+}
+function safeGet(config, key) {
+    try {
+        return config.get(key);
+    } catch (error) {
+        log.debug(`Migration read failed (key: ${String(key)}). ` + `File: ${config.path}. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return undefined;
+    }
+}
+/**
+ * Open the legacy Conf store without `clearInvalidConfig`, so a decrypt
+ * error does not destroy the file. Returns null when the file cannot be
+ * opened — callers treat that as "nothing to migrate, leave file alone".
+ */ function openLegacyConfig(params) {
+    try {
+        return new Conf({
+            configName: params.legacyConfigName,
+            cwd: params.legacyCwd,
+            encryptionKey: params.encryptionKey,
+            projectName: params.projectName
+        });
+    } catch (error) {
+        log.debug(`Legacy token store could not be opened; skipping migration and leaving file intact. ` + `Error: ${error instanceof Error ? error.message : 'Unknown'}`);
+        return null;
+    }
+}
+
+//# sourceMappingURL=token-store-migration.js.map

package/dist/auth/token-store.d.ts

@@ -1,110 +1,76 @@
-import type { FigmaTokens, JWTPayload, ProjectToken, TokenStoreConfig } from './types.js';
+import type { Environment } from '../constants.js';
+import type { BootstrapData, FigmaTokens, ProjectStoreScope, ProjectToken, TokenStoreConfig } from './types.js';
 /**
- * Secure storage manager for Figma OAuth2 tokens
- *
- * Uses the `conf` library to store tokens in an OS-specific secure location:
- * - macOS: ~/Library/Preferences/payloadcms-figma
- * - Linux: ~/.config/payloadcms-figma or $XDG_CONFIG_HOME/payloadcms-figma
- * - Windows: %APPDATA%/payloadcms-figma/Config
+ * Get the singleton TokenStore instance for an environment.
+ */
+export declare function getTokenStore(environment?: Environment): TokenStore;
+/**
+ * Secure storage manager for OAuth tokens and project-scoped bootstrap/token data.
  *
- * Tokens are encrypted at rest with a machine-specific key and file permissions
- * are set to 0600 (owner read/write only)
+ * For production code, use getTokenStore() to get the singleton instance.
+ * The constructor is still exported for test isolation.
  */
 export declare class TokenStore {
-    private config;
+    private baseConfigName;
+    private deriveLegacyKey;
+    private encryptionKey;
+    private environment;
+    private legacyRootDir;
+    private oauthConfig;
+    private projectName;
+    private projectStoreConfigs;
     constructor(options?: TokenStoreConfig);
-    /**
-     * Retrieve stored tokens
-     * @returns FigmaTokens if stored, null otherwise
-     */
-    getTokens(): FigmaTokens | null;
-    /**
-     * Store OAuth2 tokens securely
-     * @param tokens - Figma OAuth2 tokens to store
-     */
+    getOauthInfo(): FigmaTokens | null;
     setTokens(tokens: FigmaTokens): void;
-    /**
-     * Clear all stored tokens (used for logout)
-     */
     clearTokens(): void;
-    /**
-     * Check if valid (non-expired) tokens exist
-     * @returns true if tokens exist and are not expired
-     */
-    hasValidTokens(): boolean;
-    /**
-     * Check if the current access token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isExpired(): boolean;
-    /**
-     * Get the access token if it exists and is valid
-     * @returns Access token string or null if expired/missing
-     */
-    getAccessToken(): null | string;
-    /**
-     * Get the refresh token if it exists
-     * @returns Refresh token string or null if missing
-     */
-    getRefreshToken(): null | string;
-    /**
-     * Update just the access token after a refresh
-     * Preserves the existing refresh token and other metadata
-     * @param accessToken - New access token
-     * @param expiresIn - Expiration time in seconds
-     */
+    hasValidOauthToken(): boolean;
+    isOauthExpired(): boolean;
+    getCurrentOauthToken(): null | string;
+    getCurrentRefreshToken(): null | string;
     updateAccessToken(accessToken: string, expiresIn: number): void;
     /**
-     * Get the path to the config file (useful for debugging)
-     * @returns Absolute path to the token storage file
+     * Returns the OAuth storage file path.
      */
     getStoragePath(): string;
-    /**
-     * Retrieve a project token for a specific tenant
-     * Automatically removes expired tokens from storage
-     * @param tenantId - The tenant/CMS ID
-     * @returns ProjectToken if stored and valid, null otherwise
-     */
-    getProjectToken(tenantId: string): null | ProjectToken;
-    /**
-     * Store a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     * @param projectToken - The project token to store
-     */
-    setProjectToken(tenantId: string, projectToken: ProjectToken): void;
-    /**
-     * Clear a project token for a specific tenant
-     * @param tenantId - The tenant/CMS ID
-     */
-    clearProjectToken(tenantId: string): void;
-    /**
-     * Clear all project tokens
-     */
-    clearAllProjectTokens(): void;
-    /**
-     * Check if a project token is expired
-     * Includes a buffer time to avoid using tokens that are about to expire
-     * @param projectToken - The project token to check
-     * @returns true if token is expired or will expire within buffer time
-     */
-    isProjectTokenExpired(projectToken: ProjectToken): boolean;
-    /**
-     * Check if a valid (non-expired) project token exists for a tenant
-     * @param tenantId - The tenant/CMS ID
-     * @returns true if token exists and is not expired
-     */
-    hasValidProjectToken(tenantId: string): boolean;
-    /**
-     * Get validated JWT claims from a project token
-     * @param tenantId - The tenant/CMS ID
-     * @returns JWT payload claims or null if token not found or has no claims
-     */
-    getProjectTokenClaims(tenantId: string): JWTPayload | null;
-    /**
-     * Get all tenant IDs that have stored project tokens
-     * @returns Array of tenant IDs
-     */
-    getAllProjectTokenTenantIds(): string[];
+    getProjectToken({ projectInfo, }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | ProjectToken;
+    setProjectToken({ projectInfo, token, }: {
+        projectInfo?: ProjectStoreScope;
+        token: ProjectToken;
+    }): void;
+    clearProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): void;
+    isProjectTokenExpired(token: ProjectToken): boolean;
+    hasValidProjectToken({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): boolean;
+    /**
+     * Get the tenantId (contentSystemId) for the project scope.
+     * Returns null if bootstrap data is not available.
+     */
+    getTenantId({ projectInfo }?: {
+        projectInfo?: ProjectStoreScope;
+    }): null | string;
+    /**
+     * Derive project info from environment variables.
+     * Returns null if either FIGMA_PROJECT_ID or FIGMA_ENVIRONMENT_NAME is not set.
+     */
+    private getProjectInfoFromEnv;
+    getBootstrapData(projectId: string, environmentName: string): BootstrapData | null;
+    setBootstrapData(projectId: string, environmentName: string, data: BootstrapData): void;
+    clearBootstrapData(projectId: string, environmentName: string): void;
+    private buildOAuthConfigName;
+    private buildOAuthStoreCwd;
+    private buildProjectStoreConfigName;
+    private buildProjectStoreCwd;
+    private sanitizeConfigSegment;
+    private projectInfoKey;
+    private getLegacyRootDir;
+    private getProjectStore;
+    private createConfig;
+    private tryMigrateLegacyKey;
+    private safeGet;
 }
 //# sourceMappingURL=token-store.d.ts.map