@platform-x/shp-auth-client 0.0.1

package/dist/resilience.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CircuitBreaker = void 0;
+exports.withRetry = withRetry;
+exports.withTimeout = withTimeout;
+const errors_1 = require("./errors");
+/**
+ * Retries an async operation with exponential back-off.
+ *
+ * @param fn        - Async function to execute
+ * @param retries   - Maximum retry attempts (default 3)
+ * @param baseMs    - Initial delay in ms (default 200); doubles each attempt
+ * @param shouldRetry - Optional predicate; returning false stops retrying early
+ */
+async function withRetry(fn, retries = 3, baseMs = 200, shouldRetry) {
+    let lastError;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt === retries)
+                break;
+            if (shouldRetry && !shouldRetry(err))
+                break;
+            await sleep(baseMs * 2 ** attempt);
+        }
+    }
+    throw lastError;
+}
+/** Wraps an async function with a timeout. Throws if it takes longer than ms. */
+async function withTimeout(fn, ms = 5000) {
+    return Promise.race([
+        fn(),
+        new Promise((_, reject) => setTimeout(() => reject(new errors_1.TimeoutError(`Operation timed out after ${ms}ms`)), ms)),
+    ]);
+}
+/**
+ * Simple circuit breaker. Opens after `failureThreshold` consecutive failures
+ * and resets after `resetAfterMs`.
+ */
+class CircuitBreaker {
+    constructor(failureThreshold = 5, resetAfterMs = 30000) {
+        this.failureThreshold = failureThreshold;
+        this.resetAfterMs = resetAfterMs;
+        this.failures = 0;
+        this.openSince = null;
+    }
+    isOpen() {
+        if (this.openSince === null)
+            return false;
+        if (Date.now() - this.openSince >= this.resetAfterMs) {
+            this.failures = 0;
+            this.openSince = null;
+            return false; // half-open: allow one attempt
+        }
+        return true;
+    }
+    async call(fn) {
+        if (this.isOpen())
+            throw new errors_1.CircuitOpenError('Circuit breaker is open');
+        try {
+            const result = await fn();
+            this.failures = 0;
+            return result;
+        }
+        catch (err) {
+            this.failures++;
+            if (this.failures >= this.failureThreshold)
+                this.openSince = Date.now();
+            throw err;
+        }
+    }
+    reset() {
+        this.failures = 0;
+        this.openSince = null;
+    }
+}
+exports.CircuitBreaker = CircuitBreaker;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=resilience.js.map

package/dist/resilience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.js","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":";;;AAUA,8BAkBC;AAGD,kCAOC;AAtCD,qCAA0D;AAE1D;;;;;;;GAOG;AACI,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,OAAO,GAAG,CAAC,EACX,MAAM,GAAG,GAAG,EACZ,WAAuC;IAEvC,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,OAAO,KAAK,OAAO;gBAAE,MAAM;YAC/B,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,MAAM;YAC5C,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,iFAAiF;AAC1E,KAAK,UAAU,WAAW,CAAI,EAAoB,EAAE,EAAE,GAAG,IAAI;IAClE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,EAAE,EAAE;QACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC/B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,qBAAY,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CACpF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAa,cAAc;IAIzB,YACmB,mBAAmB,CAAC,EACpB,eAAe,KAAM;QADrB,qBAAgB,GAAhB,gBAAgB,CAAI;QACpB,iBAAY,GAAZ,YAAY,CAAS;QALhC,aAAQ,GAAG,CAAC,CAAC;QACb,cAAS,GAAkB,IAAI,CAAC;IAKrC,CAAC;IAEJ,MAAM;QACJ,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,KAAK,CAAC,CAAC,+BAA+B;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,EAAoB;QAChC,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,yBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AApCD,wCAoCC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/tenant-config.d.ts

@@ -0,0 +1,23 @@
+import type { ConfigProvider, TenantConfig, TenantAuthInfo } from './types';
+/** Override the config provider (useful for testing with mocks). */
+export declare function setConfigProvider(p: ConfigProvider): void;
+/**
+ * Main entry point. Fetches and caches tenant config for 5 minutes.
+ * @param siteName - Normalized site name e.g. 'KIWI'
+ */
+export declare function getTenantConfig(siteName: string): Promise<TenantConfig>;
+/** Clear cached config for a tenant or all tenants. */
+export declare function clearTenantCache(siteName?: string): void;
+/**
+ * Looks up a site's entry in the AUTH_TENANTS_INFO secret (a base64-encoded
+ * JSON array). Returns `null` when the site isn't listed there, meaning it
+ * uses the shared realm rather than a dedicated one.
+ *
+ * Case-insensitive: `buildSecretId` already normalizes site names to
+ * uppercase for secret ids, so a caller passing e.g. 'kiwi' while
+ * AUTH_TENANTS_INFO stores 'KIWI' (or vice versa) must still match here —
+ * otherwise this silently returns null and the caller sees a confusing
+ * "missing tenant/client data" error instead of the real entry.
+ */
+export declare function getClientTenantDetails(siteName: string): Promise<TenantAuthInfo | null>;
+//# sourceMappingURL=tenant-config.d.ts.map

package/dist/tenant-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-config.d.ts","sourceRoot":"","sources":["../src/tenant-config.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAiC,cAAc,EAAE,MAAM,SAAS,CAAC;AAY3G,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAIzD;AAqED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAU7E;AAED,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAOxD;AAaD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAI7F"}

package/dist/tenant-config.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setConfigProvider = setConfigProvider;
+exports.getTenantConfig = getTenantConfig;
+exports.clearTenantCache = clearTenantCache;
+exports.getClientTenantDetails = getClientTenantDetails;
+const cache_1 = require("./cache");
+const config_provider_1 = require("./config-provider");
+const errors_1 = require("./errors");
+const extract_site_name_1 = require("./extract-site-name");
+const cache = new cache_1.TTLCache();
+let provider = (0, config_provider_1.createConfigProvider)('auto');
+// Single global secret (not per-site, so it bypasses buildSecretId) listing
+// every dedicated-realm tenant. Cached under one fixed key since it's fetched
+// and parsed as a whole rather than per site. Mirrors hep-delivery-service's
+// SECRET_KEYS.AUTH_TENANTS_INFO / getClientTenantDetails (user_auth.services.ts).
+const AUTH_TENANTS_INFO_SECRET_ID = 'AUTH_TENANTS_INFO';
+const authTenantsCache = new cache_1.TTLCache();
+/** Override the config provider (useful for testing with mocks). */
+function setConfigProvider(p) {
+    provider = p;
+    cache.clear();
+    authTenantsCache.clear();
+}
+async function fetchShopifyConfig(siteName) {
+    const s = (key) => provider.get((0, extract_site_name_1.buildSecretId)(siteName, 'SHOPIFY', key));
+    const [adminApiAccessToken, isEnabledRaw, planName, clientId, clientSecret, storeDomain, storefrontApiVersion, storefrontPrivateToken, webhookHmacSecret,] = await Promise.all([
+        s('ADMIN_API_ACCESS_TOKEN'), s('IS_ENABLED'), s('PLAN_NAME'),
+        s('CLIENT_ID'), s('CLIENT_SECRET'), s('STORE_DOMAIN'),
+        s('STOREFRONT_API_VERSION'), s('STOREFRONT_PRIVATE_TOKEN'), s('WEBHOOK_HMAC_SECRET'),
+    ]);
+    return {
+        adminApiAccessToken,
+        isEnabled: isEnabledRaw.toLowerCase() === 'true',
+        planName, clientId, clientSecret, storeDomain,
+        storefrontApiVersion, storefrontPrivateToken, webhookHmacSecret,
+    };
+}
+/**
+ * realm/clientId/clientSecret and baseUrl are no longer read as their own
+ * `${SITENAME}_KEYCLOAK_*` secrets. Instead this mirrors how
+ * `@platform-x/hep-authentication-provider`'s `AuthenticationManager.iamAuthenticator`
+ * (see hep-delivery-service) resolves a tenant: realm/clientId/clientSecret
+ * come from the same AUTH_TENANTS_INFO entry it reads (via
+ * `getClientTenantDetails`), and baseUrl from the same `KEYCLOCK_HOST` env var
+ * the package itself reads. discoveryUrl/jwksUri/issuer follow Keycloak's
+ * fixed endpoint layout, derived from those two rather than stored — the same
+ * templates `generateKeycloakSecrets` uses to precompute them.
+ *
+ * callbackUrl/postLogoutRedirectUri stay as their own secrets, read under the
+ * `SHOPIFY` provider segment (`${SITENAME}_SHOPIFY_CALLBACK_URL` /
+ * `${SITENAME}_SHOPIFY_POST_LOGOUT_REDIRECT_URI`) rather than `KEYCLOAK` —
+ * they're Shopify-side external-IdP redirect URLs, not Keycloak realm data,
+ * so nothing about the tenant's realm can derive them.
+ */
+async function fetchKeycloakConfig(siteName) {
+    const tenant = await getClientTenantDetails(siteName);
+    const clientInfo = tenant?.clients?.[0];
+    const realm = tenant?.tenant;
+    if (!realm || !clientInfo?.client_id || !clientInfo?.client_secret) {
+        throw new errors_1.SecretNotFoundError(`AUTH_TENANTS_INFO entry for ${siteName} is missing tenant/client data`);
+    }
+    const baseUrl = (process.env.KEYCLOCK_HOST ?? '').replace(/\/+$/, '');
+    if (!baseUrl) {
+        throw new errors_1.SecretNotFoundError('KEYCLOCK_HOST');
+    }
+    const [callbackUrl, postLogoutRedirectUri] = await Promise.all([
+        provider.get((0, extract_site_name_1.buildSecretId)(siteName, 'SHOPIFY', 'CALLBACK_URL')),
+        provider.get((0, extract_site_name_1.buildSecretId)(siteName, 'SHOPIFY', 'POST_LOGOUT_REDIRECT_URI')),
+    ]);
+    return {
+        baseUrl,
+        realm,
+        clientId: clientInfo.client_id,
+        clientSecret: clientInfo.client_secret,
+        discoveryUrl: `${baseUrl}/realms/${realm}/.well-known/openid-configuration`,
+        jwksUri: `${baseUrl}/realms/${realm}/protocol/openid-connect/certs`,
+        issuer: `${baseUrl}/realms/${realm}`,
+        callbackUrl,
+        postLogoutRedirectUri,
+    };
+}
+/**
+ * Main entry point. Fetches and caches tenant config for 5 minutes.
+ * @param siteName - Normalized site name e.g. 'KIWI'
+ */
+async function getTenantConfig(siteName) {
+    const cached = cache.get(siteName);
+    if (cached)
+        return cached;
+    const [shopify, keycloak] = await Promise.all([
+        fetchShopifyConfig(siteName),
+        fetchKeycloakConfig(siteName),
+    ]);
+    const config = { siteName, shopify, keycloak };
+    cache.set(siteName, config);
+    return config;
+}
+/** Clear cached config for a tenant or all tenants. */
+function clearTenantCache(siteName) {
+    if (siteName) {
+        cache.delete(siteName);
+    }
+    else {
+        cache.clear();
+        authTenantsCache.clear();
+    }
+}
+async function fetchAuthTenantsInfo() {
+    const cached = authTenantsCache.get(AUTH_TENANTS_INFO_SECRET_ID);
+    if (cached)
+        return cached;
+    const raw = await provider.get(AUTH_TENANTS_INFO_SECRET_ID);
+    // 'ascii' to match hep-delivery-service's base64ToString/stringToBase64,
+    // which is how this secret is encoded on write.
+    const tenants = JSON.parse(Buffer.from(raw, 'base64').toString('ascii'));
+    authTenantsCache.set(AUTH_TENANTS_INFO_SECRET_ID, tenants);
+    return tenants;
+}
+/**
+ * Looks up a site's entry in the AUTH_TENANTS_INFO secret (a base64-encoded
+ * JSON array). Returns `null` when the site isn't listed there, meaning it
+ * uses the shared realm rather than a dedicated one.
+ *
+ * Case-insensitive: `buildSecretId` already normalizes site names to
+ * uppercase for secret ids, so a caller passing e.g. 'kiwi' while
+ * AUTH_TENANTS_INFO stores 'KIWI' (or vice versa) must still match here —
+ * otherwise this silently returns null and the caller sees a confusing
+ * "missing tenant/client data" error instead of the real entry.
+ */
+async function getClientTenantDetails(siteName) {
+    const tenants = await fetchAuthTenantsInfo();
+    const target = siteName.toUpperCase();
+    return tenants.find((tenant) => tenant.site_name.toUpperCase() === target) ?? null;
+}
+//# sourceMappingURL=tenant-config.js.map

package/dist/tenant-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-config.js","sourceRoot":"","sources":["../src/tenant-config.ts"],"names":[],"mappings":";;AAiBA,8CAIC;AAyED,0CAUC;AAGD,4CAOC;AAwBD,wDAIC;AA9ID,mCAAmC;AACnC,uDAAyD;AACzD,qCAA+C;AAC/C,2DAAoD;AAGpD,MAAM,KAAK,GAAG,IAAI,gBAAQ,EAAgB,CAAC;AAC3C,IAAI,QAAQ,GAAmB,IAAA,sCAAoB,EAAC,MAAM,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,kFAAkF;AAClF,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AACxD,MAAM,gBAAgB,GAAG,IAAI,gBAAQ,EAAoB,CAAC;AAE1D,oEAAoE;AACpE,SAAgB,iBAAiB,CAAC,CAAiB;IACjD,QAAQ,GAAG,CAAC,CAAC;IACb,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACjF,MAAM,CACJ,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAC3C,QAAQ,EAAE,YAAY,EAAE,WAAW,EACnC,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAChE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC;QAC5D,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC;KACrF,CAAC,CAAC;IACH,OAAO;QACL,mBAAmB;QACnB,SAAS,EAAE,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM;QAChD,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW;QAC7C,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAI,MAAM,EAAE,OAA6E,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,MAAM,EAAE,MAA4B,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,QAAQ,gCAAgC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,QAAQ,CAAC,GAAG,CAAC,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;KAC7E,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,KAAK;QACL,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;QACtC,YAAY,EAAE,GAAG,OAAO,WAAW,KAAK,mCAAmC;QAC3E,OAAO,EAAE,GAAG,OAAO,WAAW,KAAK,gCAAgC;QACnE,MAAM,EAAE,GAAG,OAAO,WAAW,KAAK,EAAE;QACpC,WAAW;QACX,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5C,kBAAkB,CAAC,QAAQ,CAAC;QAC5B,mBAAmB,CAAC,QAAQ,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC7D,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,SAAgB,gBAAgB,CAAC,QAAiB;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACjE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC5D,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB,CAAC;IAC7F,gBAAgB,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC;AACrF,CAAC"}

package/dist/tls-trust.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tls-trust.d.ts.map

package/dist/tls-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-trust.d.ts","sourceRoot":"","sources":["../src/tls-trust.ts"],"names":[],"mappings":""}

package/dist/tls-trust.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_tls_1 = __importDefault(require("node:tls"));
+/**
+ * Extends Node's default TLS trust store with the OS/system certificate store.
+ *
+ * `getGraphQLClient` calls Shopify through Node's built-in `fetch`, which only
+ * trusts a small bundled CA list by default — it does NOT include a corporate
+ * proxy's TLS-interception root CA. That CA IS already in the OS trust store
+ * (that's what lets browsers on the same machine reach HTTPS sites), so pulling
+ * it in here — once, for every consumer of this package — fixes
+ * "unable to get local issuer certificate" against Shopify/Keycloak without
+ * every service needing its own `--use-system-ca` flag or `cacert.pem` file.
+ *
+ * Runs once at module load (Node caches modules), process-wide. Falls back to
+ * the bundled default list on a Node/platform without OS store integration.
+ */
+try {
+    node_tls_1.default.setDefaultCACertificates([...node_tls_1.default.getCACertificates('default'), ...node_tls_1.default.getCACertificates('system')]);
+}
+catch {
+    // No system store integration available — keep Node's bundled defaults.
+}
+//# sourceMappingURL=tls-trust.js.map

package/dist/tls-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-trust.js","sourceRoot":"","sources":["../src/tls-trust.ts"],"names":[],"mappings":";;;;;AAAA,wDAA2B;AAE3B;;;;;;;;;;;;;GAaG;AACH,IAAI,CAAC;IACH,kBAAG,CAAC,wBAAwB,CAAC,CAAC,GAAG,kBAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,GAAG,kBAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAAC,MAAM,CAAC;IACP,wEAAwE;AAC1E,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,40 @@
+export interface ShopifyConfig {
+    adminApiAccessToken: string;
+    isEnabled: boolean;
+    planName: string;
+    clientId: string;
+    clientSecret: string;
+    storeDomain: string;
+    storefrontApiVersion: string;
+    storefrontPrivateToken: string;
+    webhookHmacSecret: string;
+}
+export interface KeycloakConfig {
+    baseUrl: string;
+    realm: string;
+    clientId: string;
+    clientSecret: string;
+    discoveryUrl: string;
+    jwksUri: string;
+    issuer: string;
+    callbackUrl: string;
+    postLogoutRedirectUri: string;
+}
+export interface TenantConfig {
+    siteName: string;
+    shopify: ShopifyConfig;
+    keycloak: KeycloakConfig;
+}
+export interface ConfigProvider {
+    get(secretId: string): Promise<string>;
+}
+/**
+ * One entry from the AUTH_TENANTS_INFO secret — a base64-encoded JSON array
+ * listing every site that has a dedicated Keycloak realm. A site absent from
+ * this list uses the shared realm instead.
+ */
+export interface TenantAuthInfo {
+    site_name: string;
+    [key: string]: unknown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@platform-x/shp-auth-client",
+  "version": "0.0.1",
+  "description": "Shared Shopify/Keycloak tenant config resolver, resilient GraphQL client, and Keycloak token verification for Platform-X microservices",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "license": "UNLICENSED",
+  "author": "HCL-X",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hcl-x/shp-auth-client.git"
+  },
+  "homepage": "https://github.com/hcl-x/shp-auth-client#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node ./node_modules/typescript/bin/tsc -p tsconfig.build.json",
+    "dev": "node ./node_modules/typescript/bin/tsc -p tsconfig.build.json --watch",
+    "clean": "rm -rf dist",
+    "lint": "eslint .",
+    "format": "prettier --write .",
+    "test": "cross-env NODE_ENV=test jest --runInBand",
+    "test:watch": "jest --watch",
+    "typecheck": "node ./node_modules/typescript/bin/tsc --noEmit"
+  },
+  "overrides": {
+    "axios": "^1.20.0",
+    "qs": "^6.16.0",
+    "uuid": "11.1.1",
+    "@platform-x/hep-authentication-provider": {
+      "uuid": "11.1.1"
+    }
+  },
+  "dependencies": {
+    "@platform-x/hep-authentication-provider": "2.3.24",
+    "graphql": "^16.8.0",
+    "graphql-request": "^6.1.0",
+    "hep-secret-access": "^1.3.4",
+    "jsonwebtoken": "^9.0.3",
+    "jwks-rsa": "^3.2.2"
+  },
+  "peerDependencies": {
+    "express": "^4.18.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.18.0",
+    "@types/express": "^4.17.21",
+    "@types/jest": "^29.5.14",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^22.10.0",
+    "@typescript-eslint/eslint-plugin": "^8.18.0",
+    "@typescript-eslint/parser": "^8.18.0",
+    "cross-env": "^7.0.3",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-import-resolver-typescript": "^3.10.1",
+    "eslint-plugin-import": "^2.31.0",
+    "globals": "^14.0.0",
+    "jest": "^29.7.0",
+    "prettier": "^3.4.2",
+    "ts-jest": "^29.2.5",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.3.0"
+  }
+}