@pikku/core 0.12.62 → 0.12.64

package/src/wirings/oauth2/oauth2-client.ts

@@ -1,331 +0,0 @@
-import type { OAuth2Token, OAuth2AppCredential } from './oauth2.types.js'
-import type { OAuth2CredentialConfig } from '../secret/secret.types.js'
-import type { SecretService } from '../../services/secret-service.js'
-
-/**
- * OAuth2 client that acts as a service.
- * Created once in createSingletonServices, handles token caching and refresh internally.
- * Functions use it directly via oauth.request().
- *
- * @example
- * ```typescript
- * // In services.ts
- * export const createSingletonServices = async (config, { secrets }) => {
- *   return {
- *     slackOAuth: new OAuth2Client(
- *       { tokenSecretId: 'SLACK_TOKENS', authorizationUrl: '...', tokenUrl: '...', scopes: [] },
- *       'SLACK_APP_CREDS',
- *       secrets
- *     ),
- *   }
- * }
- *
- * // In function
- * export const postMessage = pikkuFunc(async ({ slackOAuth }, { channel, text }) => {
- *   const response = await slackOAuth.request('https://slack.com/api/chat.postMessage', {
- *     method: 'POST',
- *     body: JSON.stringify({ channel, text }),
- *   })
- *   return response.json()
- * })
- * ```
- */
-const DEFAULT_TIMEOUT_MS = 30_000
-const TOKEN_EXPIRY_BUFFER_MS = 60_000
-
-/**
- * Helper to fetch with a timeout using AbortController.
- */
-async function fetchWithTimeout(
-  url: string,
-  options: RequestInit,
-  timeoutMs: number = DEFAULT_TIMEOUT_MS
-): Promise<Response> {
-  const controller = new AbortController()
-  const timeoutId = setTimeout(() => controller.abort(), timeoutMs)
-
-  try {
-    return await fetch(url, {
-      ...options,
-      signal: controller.signal,
-    })
-  } finally {
-    clearTimeout(timeoutId)
-  }
-}
-
-export class OAuth2Client {
-  private cachedToken: OAuth2Token | null = null
-  private cachedAppCredential: OAuth2AppCredential | null = null
-  private refreshPromise: Promise<OAuth2Token> | null = null
-
-  constructor(
-    private oauth2Config: OAuth2CredentialConfig,
-    private appCredentialSecretId: string,
-    private secrets: SecretService
-  ) {}
-
-  /**
-   * Make an authenticated request. Handles token caching and 401 refresh.
-   */
-  async request(
-    url: string,
-    options?: RequestInit,
-    timeoutMs: number = DEFAULT_TIMEOUT_MS
-  ): Promise<Response> {
-    const token = await this.getAccessToken()
-
-    const response = await fetchWithTimeout(
-      url,
-      {
-        ...options,
-        headers: {
-          ...options?.headers,
-          Authorization: `Bearer ${token}`,
-        },
-      },
-      timeoutMs
-    )
-
-    // Auto-retry on 401 after refresh
-    if (response.status === 401) {
-      const newToken = await this.refreshAndGetToken()
-      return fetchWithTimeout(
-        url,
-        {
-          ...options,
-          headers: {
-            ...options?.headers,
-            Authorization: `Bearer ${newToken}`,
-          },
-        },
-        timeoutMs
-      )
-    }
-
-    return response
-  }
-
-  /**
-   * Get cached token or load from secrets.
-   */
-  async getAccessToken(): Promise<string> {
-    // Return cached token if valid
-    if (this.cachedToken) {
-      if (this.isTokenValid(this.cachedToken)) {
-        return this.cachedToken.accessToken
-      }
-      // Token expired, try to refresh
-      if (this.cachedToken.refreshToken) {
-        return this.refreshAndGetToken()
-      }
-      // Token expired and no refresh token available
-      throw new Error('OAuth2 token expired and no refresh token available')
-    }
-
-    // Load from secrets
-    const token = await this.secrets.getSecret<OAuth2Token>(
-      this.oauth2Config.tokenSecretId
-    )
-    this.cachedToken = token
-
-    // Check if loaded token is expired and needs refresh
-    if (!this.isTokenValid(token)) {
-      if (token.refreshToken) {
-        return this.refreshAndGetToken()
-      }
-      // Token expired and no refresh token available
-      throw new Error('OAuth2 token expired and no refresh token available')
-    }
-
-    return token.accessToken
-  }
-
-  /**
-   * Refresh token and update cache.
-   * Uses a promise lock to prevent concurrent refresh attempts.
-   */
-  private async refreshAndGetToken(): Promise<string> {
-    if (this.refreshPromise) {
-      const token = await this.refreshPromise
-      return token.accessToken
-    }
-
-    this.refreshPromise = this.doRefreshToken()
-
-    try {
-      const token = await this.refreshPromise
-      return token.accessToken
-    } finally {
-      this.refreshPromise = null
-    }
-  }
-
-  /**
-   * Perform the actual token refresh.
-   */
-  private async doRefreshToken(): Promise<OAuth2Token> {
-    if (!this.cachedToken?.refreshToken) {
-      throw new Error('No refresh token available')
-    }
-
-    const appCredential = await this.getAppCredential()
-
-    const params = new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: this.cachedToken.refreshToken,
-      client_id: appCredential.clientId,
-    })
-
-    if (appCredential.clientSecret) {
-      params.set('client_secret', appCredential.clientSecret)
-    }
-
-    const response = await fetchWithTimeout(this.oauth2Config.tokenUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/x-www-form-urlencoded',
-      },
-      body: params.toString(),
-    })
-
-    if (!response.ok) {
-      throw new Error(`Token refresh failed: ${response.status}`)
-    }
-
-    const data = await response.json()
-
-    if (!data.access_token || typeof data.access_token !== 'string') {
-      throw new Error('Invalid token response: missing access_token')
-    }
-
-    const token: OAuth2Token = {
-      accessToken: data.access_token,
-      refreshToken: data.refresh_token || this.cachedToken.refreshToken,
-      expiresAt: data.expires_in
-        ? Date.now() + data.expires_in * 1000
-        : undefined,
-      tokenType: data.token_type || 'Bearer',
-      scope: data.scope,
-    }
-
-    await this.secrets.setSecret(this.oauth2Config.tokenSecretId, token)
-    this.cachedToken = token
-
-    return token
-  }
-
-  /**
-   * Check if token is valid (not expired).
-   */
-  private isTokenValid(token: OAuth2Token): boolean {
-    if (!token.expiresAt) {
-      return true // No expiry info, assume valid
-    }
-    return token.expiresAt > Date.now() + TOKEN_EXPIRY_BUFFER_MS
-  }
-
-  /**
-   * Get app credentials (cached).
-   */
-  private async getAppCredential(): Promise<OAuth2AppCredential> {
-    if (this.cachedAppCredential) {
-      return this.cachedAppCredential
-    }
-    this.cachedAppCredential =
-      await this.secrets.getSecret<OAuth2AppCredential>(
-        this.appCredentialSecretId
-      )
-    return this.cachedAppCredential
-  }
-
-  // ========================================
-  // CLI-only methods (for pikku oauth connect)
-  // ========================================
-
-  /**
-   * Generate OAuth2 authorization URL.
-   * Used by CLI during `pikku oauth connect`.
-   */
-  async getAuthorizationUrl(
-    state: string,
-    redirectUri: string
-  ): Promise<string> {
-    const appCredential = await this.getAppCredential()
-
-    const params = new URLSearchParams({
-      response_type: 'code',
-      client_id: appCredential.clientId,
-      redirect_uri: redirectUri,
-      scope: this.oauth2Config.scopes.join(' '),
-      state,
-    })
-
-    // Add PKCE if enabled
-    // Note: code_verifier should be stored and passed to exchangeCode
-    // For now, PKCE implementation is simplified
-
-    // Add any additional params
-    if (this.oauth2Config.additionalParams) {
-      for (const [key, value] of Object.entries(
-        this.oauth2Config.additionalParams
-      )) {
-        params.set(key, value)
-      }
-    }
-
-    return `${this.oauth2Config.authorizationUrl}?${params.toString()}`
-  }
-
-  /**
-   * Exchange authorization code for tokens.
-   * Used by CLI during `pikku oauth connect`.
-   */
-  async exchangeCode(code: string, redirectUri: string): Promise<OAuth2Token> {
-    const appCredential = await this.getAppCredential()
-
-    const params = new URLSearchParams({
-      grant_type: 'authorization_code',
-      code,
-      redirect_uri: redirectUri,
-      client_id: appCredential.clientId,
-    })
-
-    if (appCredential.clientSecret) {
-      params.set('client_secret', appCredential.clientSecret)
-    }
-
-    const response = await fetchWithTimeout(this.oauth2Config.tokenUrl, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/x-www-form-urlencoded',
-      },
-      body: params.toString(),
-    })
-
-    if (!response.ok) {
-      throw new Error(`Token exchange failed: ${response.status}`)
-    }
-
-    const data = await response.json()
-
-    if (!data.access_token || typeof data.access_token !== 'string') {
-      throw new Error('Invalid token response: missing access_token')
-    }
-
-    const token: OAuth2Token = {
-      accessToken: data.access_token,
-      refreshToken: data.refresh_token,
-      expiresAt: data.expires_in
-        ? Date.now() + data.expires_in * 1000
-        : undefined,
-      tokenType: data.token_type || 'Bearer',
-      scope: data.scope,
-    }
-
-    // Cache the token
-    this.cachedToken = token
-
-    return token
-  }
-}

package/src/wirings/oauth2/oauth2-routes.ts

@@ -1,234 +0,0 @@
-import type { CredentialService } from '../../services/credential-service.js'
-import type { SecretService } from '../../services/secret-service.js'
-import type { JWTService } from '../../services/jwt-service.js'
-import type { CredentialDefinitionsMeta } from '../credential/credential.types.js'
-import type { OAuth2Token } from './oauth2.types.js'
-import { OAuth2Client } from './oauth2-client.js'
-
-const TOKEN_EXPIRY_BUFFER_MS = 60_000
-
-export type CreateOAuth2HandlerOptions = {
-  credentialsMeta: CredentialDefinitionsMeta
-  basePath?: string
-}
-
-type OAuth2RouteContext = {
-  credentialsMeta: CredentialDefinitionsMeta
-  basePath: string
-}
-
-function getCredentialMeta(ctx: OAuth2RouteContext, name: string) {
-  const meta = ctx.credentialsMeta[name]
-  if (!meta) {
-    throw new Error(`Credential '${name}' not found`)
-  }
-  if (!meta.oauth2) {
-    throw new Error(`Credential '${name}' is not an OAuth2 credential`)
-  }
-  return meta
-}
-
-/**
- * Creates OAuth2 route handlers for user credential management.
- *
- * Returns individual handler functions for connect/callback/disconnect/status
- * that handle the OAuth2 authorization code flow and store tokens in CredentialService.
- *
- * @example
- * ```typescript
- * const oauth2 = createOAuth2Handler({ credentialsMeta })
- *
- * const oauth2Routes = defineHTTPRoutes({
- *   auth: true,
- *   basePath: '/credentials',
- *   routes: {
- *     connect: { method: 'get', route: '/:name/connect', func: oauth2.connect },
- *     callback: { method: 'get', route: '/:name/callback', func: oauth2.callback, auth: false },
- *     disconnect: { method: 'delete', route: '/:name', func: oauth2.disconnect },
- *     status: { method: 'get', route: '/:name/status', func: oauth2.status },
- *   },
- * })
- *
- * wireHTTPRoutes({ routes: { credentials: oauth2Routes } })
- * ```
- */
-export const createOAuth2Handler = (options: CreateOAuth2HandlerOptions) => {
-  const basePath = options.basePath ?? '/credentials'
-  const ctx: OAuth2RouteContext = {
-    credentialsMeta: options.credentialsMeta,
-    basePath,
-  }
-
-  const connectHandler = async (
-    services: {
-      secrets: SecretService
-      jwt: JWTService
-      credentialService: CredentialService
-    },
-    _data: any,
-    wire: any
-  ) => {
-    const { name } = wire.http.request.params()
-    const meta = getCredentialMeta(ctx, name)
-    const queryParams = wire.http.request.query()
-    const redirectUrl = queryParams.redirect_url || queryParams.redirect
-
-    const oauth2Client = new OAuth2Client(
-      meta.oauth2!,
-      meta.oauth2!.appCredentialSecretId,
-      services.secrets
-    )
-
-    const userId = wire.session?.userId
-    if (!userId) {
-      throw new Error('Authentication required for OAuth2 connect')
-    }
-
-    const state = await services.jwt.encode(
-      { value: 10, unit: 'minute' },
-      {
-        userId,
-        credentialName: name,
-        redirectUrl,
-      }
-    )
-
-    let origin = wire.http.request.header('origin')
-    if (!origin) {
-      const host = wire.http.request.header('host')
-      if (!host) {
-        throw new Error(
-          'Unable to determine request origin for OAuth2 callback'
-        )
-      }
-      const protocol = wire.http.request.header('x-forwarded-proto') || 'http'
-      origin = `${protocol}://${host}`
-    }
-    const callbackUrl = `${origin}${basePath}/${name}/callback`
-    const authUrl = await oauth2Client.getAuthorizationUrl(state, callbackUrl)
-
-    return Response.redirect(authUrl, 302)
-  }
-
-  const callbackHandler = async (
-    services: {
-      secrets: SecretService
-      jwt: JWTService
-      credentialService: CredentialService
-      logger: any
-    },
-    _data: any,
-    wire: any
-  ) => {
-    const { name } = wire.http.request.params()
-    const meta = getCredentialMeta(ctx, name)
-    const queryParams = wire.http.request.query()
-    const code = queryParams.code as string | undefined
-    const state = queryParams.state as string | undefined
-
-    if (!code || !state) {
-      throw new Error('Missing code or state parameter')
-    }
-
-    let statePayload: {
-      userId: string
-      credentialName: string
-      redirectUrl?: string
-    }
-    try {
-      statePayload = await services.jwt.decode(state)
-    } catch {
-      throw new Error('Invalid or expired OAuth2 state')
-    }
-
-    if (statePayload.credentialName !== name) {
-      throw new Error('Credential name mismatch in state')
-    }
-
-    const oauth2Client = new OAuth2Client(
-      meta.oauth2!,
-      meta.oauth2!.appCredentialSecretId,
-      services.secrets
-    )
-
-    let origin = wire.http.request.header('origin')
-    if (!origin) {
-      const host = wire.http.request.header('host')
-      if (!host) {
-        throw new Error(
-          'Unable to determine request origin for OAuth2 callback'
-        )
-      }
-      const protocol = wire.http.request.header('x-forwarded-proto') || 'http'
-      origin = `${protocol}://${host}`
-    }
-    const callbackUrl = `${origin}${basePath}/${name}/callback`
-    const tokens = await oauth2Client.exchangeCode(code, callbackUrl)
-
-    await services.credentialService.set(name, tokens, statePayload.userId)
-
-    services.logger.info(
-      `OAuth2 tokens stored for user '${statePayload.userId}', credential '${name}'`
-    )
-
-    if (statePayload.redirectUrl) {
-      return Response.redirect(statePayload.redirectUrl, 302)
-    } else {
-      return { success: true, credentialName: name }
-    }
-  }
-
-  const disconnectHandler = async (
-    services: { credentialService: CredentialService; logger: any },
-    _data: any,
-    wire: any
-  ) => {
-    const { name } = wire.http.request.params()
-    const userId = wire.session?.userId
-    if (!userId) {
-      throw new Error('Authentication required')
-    }
-    await services.credentialService.delete(name, userId)
-    services.logger.info(
-      `OAuth2 credential '${name}' disconnected for user '${userId}'`
-    )
-    return { success: true }
-  }
-
-  const statusHandler = async (
-    services: { credentialService: CredentialService },
-    _data: any,
-    wire: any
-  ) => {
-    const { name } = wire.http.request.params()
-    const userId = wire.session?.userId
-    if (!userId) {
-      throw new Error('Authentication required')
-    }
-
-    const credential = await services.credentialService.get<OAuth2Token>(
-      name,
-      userId
-    )
-
-    if (!credential) {
-      return { connected: false }
-    }
-
-    return {
-      connected: true,
-      hasRefreshToken: !!credential.refreshToken,
-      expiresAt: credential.expiresAt,
-      isExpired: credential.expiresAt
-        ? credential.expiresAt < Date.now() + TOKEN_EXPIRY_BUFFER_MS
-        : false,
-    }
-  }
-
-  return {
-    connect: { func: connectHandler } as any,
-    callback: { func: callbackHandler } as any,
-    disconnect: { func: disconnectHandler } as any,
-    status: { func: statusHandler } as any,
-  }
-}