@proton-app/main 0.1.7 → 0.1.8

package/dist/index.d.ts

@@ -4,3 +4,4 @@ export * from "./files";
 export * from "./communication";
 export * from "./setup";
 export * from "./storage";
+export * from "./oauth";

package/dist/index.js

@@ -21,3 +21,4 @@ __exportStar(require("./files"), exports);
 __exportStar(require("./communication"), exports);
 __exportStar(require("./setup"), exports);
 __exportStar(require("./storage"), exports);
+__exportStar(require("./oauth"), exports);

package/dist/oauth.d.ts

@@ -0,0 +1,55 @@
+import type { Storage, StorageSchema, SecretKey } from "./storage";
+/**
+ * OAuth Options.
+ *
+ * @property name - Provider name shown in login messages.
+ * @property authorizeUrl - Provider's authorization page.
+ * @property tokenUrl - Provider's token endpoint.
+ * @property redirectUri - Loopback URI registered with the provider.
+ * @property clientId - App's client id.
+ * @property clientSecret - App's client secret, if the provider requires one.
+ * @property storage - App storage to keep tokens in.
+ * @property storageKey - Schema key for the encrypted tokens.
+**/
+export type OAuthOptions<T extends StorageSchema> = {
+    name: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    redirectUri: string;
+    clientId: string;
+    clientSecret?: string;
+    storage: Storage<T>;
+    storageKey: SecretKey<T>;
+};
+/**
+ * Creates an OAuth client for a desktop app.
+ *
+ * Logs in through the system browser using PKCE and a one-shot
+ * loopback server. Tokens are stored encrypted and refreshed
+ * automatically.
+ *
+ * @param opts - Provider and storage configuration.
+ * @returns Functions to connect, disconnect, and get access tokens.
+**/
+export declare function createOAuth<T extends StorageSchema>(opts: OAuthOptions<T>): {
+    /**
+     * Opens the browser login. Calling again while a login
+     * is pending reopens the same login page.
+    **/
+    connect(): Promise<void>;
+    /**
+     * Clears the stored tokens.
+    **/
+    disconnect(): Promise<void>;
+    /**
+     * Gets a valid access token, refreshing it if near expiry.
+     * A rejected refresh token clears the login.
+     *
+     * @returns The access token, or null when not connected.
+    **/
+    getAccessToken(): Promise<string | null>;
+    /**
+     * Whether tokens are stored.
+    **/
+    isConnected(): Promise<boolean>;
+};

package/dist/oauth.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOAuth = createOAuth;
+const http_1 = require("http");
+const crypto_1 = require("crypto");
+const electron_1 = require("electron");
+const snatch_http_1 = require("snatch-http");
+const EXPIRY_MARGIN = 60_000;
+const LOGIN_TIMEOUT = 5 * 60_000;
+/**
+ * Creates an OAuth client for a desktop app.
+ *
+ * Logs in through the system browser using PKCE and a one-shot
+ * loopback server. Tokens are stored encrypted and refreshed
+ * automatically.
+ *
+ * @param opts - Provider and storage configuration.
+ * @returns Functions to connect, disconnect, and get access tokens.
+**/
+function createOAuth(opts) {
+    const { name, authorizeUrl, tokenUrl, redirectUri, clientId, clientSecret, storage, storageKey } = opts;
+    const redirect = new URL(redirectUri);
+    let pendingConnect = null;
+    let refreshing = null;
+    let loginUrl = null;
+    const loadTokens = () => storage.getSecret(storageKey);
+    const saveTokens = (tokens) => storage.setSecret(storageKey, tokens);
+    async function requestToken(params) {
+        const data = await snatch_http_1.api.post({
+            url: tokenUrl,
+            headers: { accept: "application/json; charset=utf-8" },
+            data: new URLSearchParams({
+                client_id: clientId,
+                ...(clientSecret && { client_secret: clientSecret }),
+                ...params
+            })
+        });
+        const tokens = {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt: Date.now() + data.expires_in * 1000
+        };
+        saveTokens(tokens); // refresh tokens are single-use: persist immediately
+        return tokens;
+    }
+    function listenForCode(state, onReady) {
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => done(new Error(`${name} login timed out.`)), LOGIN_TIMEOUT);
+            const server = (0, http_1.createServer)((req, res) => {
+                const url = new URL(req.url ?? "/", redirectUri);
+                if (url.pathname !== redirect.pathname)
+                    return void res.writeHead(404).end();
+                const code = url.searchParams.get("code");
+                const valid = !!code && url.searchParams.get("state") === state;
+                res.writeHead(valid ? 200 : 400, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end(valid
+                    ? `Connected to ${name}. You can close this tab.`
+                    : `${name} login failed. Try again from the app.`);
+                done(valid ? undefined : new Error(url.searchParams.get("error") ?? "Invalid callback."), code ?? undefined);
+            });
+            function done(err, code) {
+                clearTimeout(timer);
+                server.close();
+                err ? reject(err) : resolve(code);
+            }
+            server.once("error", err => done(err));
+            server.listen(Number(redirect.port), redirect.hostname, onReady);
+        });
+    }
+    async function runConnect() {
+        const verifier = (0, crypto_1.randomBytes)(32).toString("base64url");
+        const challenge = (0, crypto_1.createHash)("sha256").update(verifier).digest("base64url");
+        const state = (0, crypto_1.randomBytes)(16).toString("base64url");
+        const code = await listenForCode(state, () => {
+            const url = new URL(authorizeUrl);
+            url.search = new URLSearchParams({
+                client_id: clientId,
+                redirect_uri: redirectUri,
+                response_type: "code",
+                code_challenge: challenge,
+                code_challenge_method: "S256",
+                state
+            }).toString();
+            loginUrl = url.toString();
+            void electron_1.shell.openExternal(loginUrl);
+        });
+        await requestToken({
+            grant_type: "authorization_code",
+            redirect_uri: redirectUri,
+            code_verifier: verifier,
+            code
+        });
+    }
+    return {
+        /**
+         * Opens the browser login. Calling again while a login
+         * is pending reopens the same login page.
+        **/
+        connect() {
+            if (loginUrl)
+                void electron_1.shell.openExternal(loginUrl);
+            pendingConnect ??= runConnect().finally(() => {
+                pendingConnect = null;
+                loginUrl = null;
+            });
+            return pendingConnect;
+        },
+        /**
+         * Clears the stored tokens.
+        **/
+        async disconnect() {
+            saveTokens(null);
+        },
+        /**
+         * Gets a valid access token, refreshing it if near expiry.
+         * A rejected refresh token clears the login.
+         *
+         * @returns The access token, or null when not connected.
+        **/
+        async getAccessToken() {
+            const tokens = loadTokens();
+            if (!tokens)
+                return null;
+            if (Date.now() < tokens.expiresAt - EXPIRY_MARGIN)
+                return tokens.accessToken;
+            refreshing ??= requestToken({
+                grant_type: "refresh_token",
+                refresh_token: tokens.refreshToken
+            }).finally(() => (refreshing = null));
+            try {
+                return (await refreshing).accessToken;
+            }
+            catch (err) {
+                if (err instanceof snatch_http_1.ApiError && err.message === "invalid_grant")
+                    saveTokens(null);
+                throw err;
+            }
+        },
+        /**
+         * Whether tokens are stored.
+        **/
+        async isConnected() {
+            return loadTokens() !== null;
+        }
+    };
+}

package/dist/storage.d.ts

@@ -1,12 +1,9 @@
 import ElectronStore from "electron-store";
 type JSONType = "string" | "number" | "integer" | "boolean" | "object" | "array" | "null";
-type StorageSchema = Record<string, {
+export type StorageSchema = Record<string, {
     type: JSONType | readonly JSONType[];
     default: unknown;
 }>;
-type BaseStorage = {
-    access_token: string | null;
-};
 type TypeMap = {
     string: string;
     number: number;
@@ -17,10 +14,27 @@ type TypeMap = {
     null: null;
 };
 type FromType<T> = T extends readonly JSONType[] ? TypeMap[T[number]] : T extends JSONType ? TypeMap[T] : never;
-type InferSchema<T extends StorageSchema> = BaseStorage & {
-    [K in Exclude<keyof T, keyof BaseStorage>]: FromType<T[K]["type"]>;
+type InferSchema<T extends StorageSchema> = {
+    [K in keyof T]: FromType<T[K]["type"]>;
 };
+export type SecretKey<T extends StorageSchema> = {
+    [K in keyof T & string]: string extends InferSchema<T>[K] ? K : never;
+}[keyof T & string];
 export declare class Storage<const T extends StorageSchema> extends ElectronStore<InferSchema<T>> {
     constructor(schema: T);
+    /**
+     * Reads an encrypted value.
+     *
+     * @param key - Schema key holding the secret.
+     * @returns The decrypted value, or null if unset or unreadable.
+    **/
+    getSecret<V>(key: SecretKey<T>): V | null;
+    /**
+     * Encrypts and stores a value.
+     *
+     * @param key - Schema key holding the secret.
+     * @param value - Value to store, or null to clear it.
+    **/
+    setSecret<V>(key: SecretKey<T>, value: V | null): void;
 }
 export {};

package/dist/storage.js

@@ -5,17 +5,39 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Storage = void 0;
 const electron_store_1 = __importDefault(require("electron-store"));
+const electron_1 = require("electron");
 class Storage extends electron_store_1.default {
     constructor(schema) {
-        super({
-            schema: {
-                access_token: {
-                    type: ["string", "null"],
-                    default: null
-                },
-                ...schema
-            }
-        });
+        super({ schema });
+    }
+    /**
+     * Reads an encrypted value.
+     *
+     * @param key - Schema key holding the secret.
+     * @returns The decrypted value, or null if unset or unreadable.
+    **/
+    getSecret(key) {
+        const raw = this.get(key);
+        if (typeof raw !== "string")
+            return null;
+        try {
+            return JSON.parse(electron_1.safeStorage.decryptString(Buffer.from(raw, "base64")));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Encrypts and stores a value.
+     *
+     * @param key - Schema key holding the secret.
+     * @param value - Value to store, or null to clear it.
+    **/
+    setSecret(key, value) {
+        const raw = value === null
+            ? null
+            : electron_1.safeStorage.encryptString(JSON.stringify(value)).toString("base64");
+        this.set(key, raw);
     }
 }
 exports.Storage = Storage;

package/package.json

@@ -1,43 +1,76 @@
 {
-
   "name": "@proton-app/main",
-  "version": "0.1.7",
+  "version": "0.1.8",
+
   "description": "",
+
   "keywords": [],
+
   "author": "",
+
   "license": "ISC",
+
   "main": "./dist/index.js",
+
   "types": "./dist/index.d.ts",
+
   "files": [
+
     "dist"
+
   ],
+
   "publishConfig": {
+
     "access": "public"
+
   },
+
   "exports": {
+
     ".": {
+
       "default": "./dist/index.js",
+
       "types": "./dist/index.d.ts"
+
     },
+
     "./types": "./dist/index.d.ts"
+
   },
+
   "engines": {},
 
   "scripts": {
+
     "build": "tsc"
+
   },
 
   "dependencies": {
+
     "@bouko/ts": "^0.3.8",
+
     "electron-store": "^11.0.2",
-    "path": "^0.12.7"
+
+    "path": "^0.12.7",
+
+    "snatch-http": "^0.0.7"
+
   },
 
   "devDependencies": {
+
     "@types/react": "^19.2.13",
+
     "electron": "^39.2.7",
+
     "react-router-dom": "^7.12.0",
+
     "typescript": "^5.9.3"
+
   }
 
-}
+}
+