@pidgeon-ai/issuer 0.4.0 → 0.4.1

package/README.md

@@ -93,8 +93,9 @@ An agent is an active OAuth service app whose profile names it:
 `"profile": { "pidgeon": { "key": "…", "address": "…", "kind": "agent",
 "groups": ["refunds"] } }`. Deactivate the app to switch it off. The issuer
 reads them with a service app of its own granted `okta.apps.read` and a
-read-only admin role, signing in with Private Key JWT; its RSA or P-256
-private key is `OKTA_PRIVATE_KEY`.
+read-only admin role (`READ_ONLY_ADMIN` is enough), signing in with Private
+Key JWT; its RSA or P-256 private key is `OKTA_PRIVATE_KEY`, and its `kid`
+is `key_id`.
 
 ```json
 "directory": { "okta": { "org": "https://acme.okta.com", "client_id": "<the issuer's app>" } }

package/dist/bin.js

@@ -2,7 +2,7 @@
 import {
   UsageError,
   runIssuer
-} from "./chunk-5GZMAASA.js";
+} from "./chunk-IKGE6SNR.js";
 
 // src/bin.ts
 async function main() {

package/dist/{chunk-5GZMAASA.js → chunk-IKGE6SNR.js}

@@ -30,6 +30,20 @@ function cachedDirectory(inner, seconds = 60, now = () => Date.now()) {
   };
 }
 
+// src/rate-limit.ts
+async function withBackoff(attempt, now = () => Date.now(), sleep = (ms) => new Promise((done) => setTimeout(done, ms))) {
+  for (let tries = 0; ; tries++) {
+    const response = await attempt();
+    if (response.status !== 429 || tries >= 2) return response;
+    const reset = Number(
+      response.headers.get("x-ratelimit-reset") ?? response.headers.get("x-rate-limit-reset")
+    );
+    const retryAfter = Number(response.headers.get("retry-after"));
+    const wait = Number.isFinite(reset) && reset > 0 ? reset * 1e3 - now() : Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : 1e3;
+    await sleep(Math.min(2e3, Math.max(250, wait)));
+  }
+}
+
 // src/auth0.ts
 var PER_PAGE = 100;
 function auth0Directory(options) {
@@ -60,9 +74,13 @@ function auth0Directory(options) {
     return token.value;
   }
   async function management(path) {
-    const response = await fetcher(`${base}/api/v2${path}`, {
-      headers: { authorization: `Bearer ${await accessToken()}`, accept: "application/json" }
-    });
+    const bearer = await accessToken();
+    const response = await withBackoff(
+      () => fetcher(`${base}/api/v2${path}`, {
+        headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }
+      }),
+      now
+    );
     if (response.status === 404) return null;
     if (!response.ok) throw new Error(`Auth0 answered ${response.status} for ${path}.`);
     return await response.json();
@@ -271,9 +289,13 @@ function oktaDirectory(options) {
     return token.value;
   }
   async function api(url) {
-    const response = await fetcher(url, {
-      headers: { authorization: `Bearer ${await accessToken()}`, accept: "application/json" }
-    });
+    const bearer = await accessToken();
+    const response = await withBackoff(
+      () => fetcher(url, {
+        headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }
+      }),
+      now
+    );
     if (!response.ok && response.status !== 404) {
       throw new Error(`Okta answered ${response.status} for ${new URL(url).pathname}.`);
     }
@@ -2199,4 +2221,4 @@ export {
   UsageError2 as UsageError,
   runIssuer
 };
-//# sourceMappingURL=chunk-5GZMAASA.js.map
+//# sourceMappingURL=chunk-IKGE6SNR.js.map