@qlover/oauth-wrapper 0.5.0 → 0.6.2

package/dist/index.d.ts

@@ -1,81 +1,9 @@
-import { LoginParams } from '@qlover/corekit-bridge/core';
-import { OAuthSessionPayload, OAuthProviderInterface, OAuthTokenRequest, OAuthTokenResponse, OAuthWrapperRepositoryInterface, OAuthUserInfoResponse, OAuthAuthorizeQuery, OAuthConsentBody, OAuthAuthorizePageData, OAuthAuthorizeValidationError, OAuthConsentResult, OAuthClientsInterface, OAuthClientsRepositoryInterface, OAuthClientListItem, OAuthClientDetail, OAuthClientCreate, OAuthClientCreateResponse, OAuthClientUpdate, OAuthClientSecretRotateResponse, OAuthTokenServiceInterface, OAuthSessionInterface, OAuthRfcCodeType, OAuthClientRow } from './core.js';
-export { CreateAuthorizationCodeInput, CreateOAuthRefreshTokenInput, OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, OAuthAuthorizeQuerySchema, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, OAuthClientDetailSchema, OAuthClientListItemSchema, OAuthClientRowSchema, OAuthClientSecretRotateResponseSchema, OAuthClientUpdateSchema, OAuthConsentBodySchema, OAuthOTPProviderInterface, OAuthRefreshTokenRow, OAuthRefreshTokenSchema, OAuthRfcCodes, OAuthRfcErrorCodesType, OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, OAuthTokenRequestSchema, OAuthTokenResponseSchema, OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, OAuthUserCredentialsRow, OAuthUserCredentialsSchema, OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, OAuthUserInfoResponseSchema, ResolveAuthorizePageResult, SignOtpResult, SignWithEmailOtpSchema, SignWithOtpParams, SignWithOtpSchema, SignWithPhoneOtpSchema, VerifyEmailOtpParams, VerifyMobileOtpParams, VerifyOtpParams, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState, signWithEmailOtpSchema, signWithPhoneOtpSchema } from './core.js';
+import { OAuthClientsInterface, OAuthClientsRepositoryInterface, OAuthClientListItem, OAuthClientDetail, OAuthClientCreate, OAuthClientCreateResponse, OAuthClientUpdate, OAuthClientSecretRotateResponse, OAuthSessionPayload, OAuthTokenServiceInterface, OAuthWrapperRepositoryInterface, OAuthTokenResponse, OAuthTokenRequest, OAuthProviderInterface, OAuthSessionInterface, WithUserSession, OAuthAuthorizeQuery, OAuthConsentBody, OAuthAuthorizePageData, OAuthAuthorizeValidationError, OAuthConsentResult, OAuthRfcCodeType, OAuthClientRow } from './core.js';
+export { CreateAuthorizationCodeInput, CreateOAuthRefreshTokenInput, OAuthAuthorizationCodeRow, OAuthAuthorizationCodeRowSchema, OAuthAuthorizeQuerySchema, OAuthClientCreateResponseSchema, OAuthClientCreateSchema, OAuthClientDetailSchema, OAuthClientListItemSchema, OAuthClientRowSchema, OAuthClientSecretRotateResponseSchema, OAuthClientUpdateSchema, OAuthConsentBodySchema, OAuthOTPProviderInterface, OAuthRefreshTokenRow, OAuthRefreshTokenSchema, OAuthRfcCodes, OAuthRfcErrorCodesType, OAuthTokenAuthorizationCodeRequest, OAuthTokenAuthorizationCodeSchema, OAuthTokenErrorResponse, OAuthTokenErrorResponseSchema, OAuthTokenRefreshRequest, OAuthTokenRefreshSchema, OAuthTokenRequestSchema, OAuthTokenResponseSchema, OAuthTokenRevokeRequest, OAuthTokenRevokeSchema, OAuthUserCredentialsRow, OAuthUserCredentialsSchema, OAuthUserInfoErrorResponse, OAuthUserInfoErrorResponseSchema, OAuthUserInfoResponse, OAuthUserInfoResponseSchema, ResolveAuthorizePageResult, SignOtpResult, SignWithEmailOtpSchema, SignWithOtpParams, SignWithOtpSchema, SignWithPhoneOtpSchema, VerifyEmailOtpParams, VerifyMobileOtpParams, VerifyOtpParams, computePkceS256Challenge, generatePkceVerifier, isOAuthRedirectUri, randomOAuthState, signWithEmailOtpSchema, signWithPhoneOtpSchema } from './core.js';
 import { EncryptorInterface, ExecutorError } from '@qlover/fe-corekit';
+import { LoginParams } from '@qlover/corekit-bridge/core';
 import 'zod';
 
-type OAuthUserProfile = {
-    id: string | number;
-    email?: string | null;
-    name?: string | null;
-    roles?: string[];
-    [key: string]: unknown;
-};
-type OAuthUserCredentials = {
-    token: string;
-    [key: string]: unknown;
-};
-type OAuthUserAccessToken = {
-    access_token: string;
-    expires_in: number;
-    refresh_token?: string | null;
-    [key: string]: unknown;
-};
-declare abstract class OAuthAbstractProvider<SessionPayload extends OAuthSessionPayload> implements OAuthProviderInterface<SessionPayload> {
-    protected authCodeTTLMs: number;
-    /**
-     * @override
-     */
-    abstract exchangeToken(_rawFields: Record<string, string> | OAuthTokenRequest): Promise<OAuthTokenResponse>;
-    /**
-     * @override
-     */
-    abstract revokeToken(_rawFields: Record<string, string>): Promise<void>;
-    /**
-     * @override
-     */
-    abstract getOAuthRepo(): OAuthWrapperRepositoryInterface;
-    /**
-     * @override
-     */
-    abstract clearSession(): Promise<void>;
-    /**
-     * @override
-     */
-    abstract getSession(): Promise<SessionPayload | null>;
-    /**
-     * @override
-     */
-    abstract login(params: LoginParams): Promise<SessionPayload>;
-    /**
-     * @override
-     */
-    abstract getUserInfoWithAccessToken(accessToken: string): Promise<OAuthUserInfoResponse>;
-    protected isQuery(query: unknown): query is OAuthAuthorizeQuery;
-    protected isValidateConsent(value: unknown): value is OAuthConsentBody;
-    protected generageSessionPayload(userInfo: OAuthUserProfile & {
-        sessionToken: string;
-    }): SessionPayload;
-    /**
-     * @override
-     */
-    logout(userId: string): Promise<void>;
-    /**
-     * @override
-     */
-    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<{
-        ok: true;
-        data: OAuthAuthorizePageData;
-    } | {
-        ok: false;
-        error: OAuthAuthorizeValidationError;
-    }>;
-    /**
-     * @override
-     */
-    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
-}
-
 /**
  * Business logic for OAuth client management in developer console.
  */
@@ -115,10 +43,30 @@ declare class OAuthClientsService implements OAuthClientsInterface {
     private mapToDetail;
 }
 
-type ExchangeProviderAccessToken = (params: {
-    token: string;
-    lang?: string;
-}) => Promise<OAuthUserAccessToken>;
+/**
+ * 主要用于标识交换的 access_token 包装层类型
+ */
+interface OAuthWrapperAccessToken {
+    provider_token?: string;
+    provider_refresh_token?: string;
+    /**
+     * 用于请求 api 时的 key 名字
+     */
+    token_type: string;
+    /**
+     * access_token 值
+     */
+    access_token: string;
+    /**
+     * 过期时间
+     */
+    expires_in: number;
+    /**
+     * 刷新 token
+     */
+    refresh_token: string;
+}
+type ExchangeProviderAccessToken = (params: OAuthSessionPayload) => Promise<OAuthWrapperAccessToken>;
 /**
  * OAuth 2.0 token endpoint (`POST /oauth/token`).
  *
@@ -153,6 +101,7 @@ declare class OAuthTokenService implements OAuthTokenServiceInterface {
     }>, verifiedClientId: string): Promise<OAuthTokenResponse>;
     protected fetchProviderAccessToken(userId: string): Promise<{
         access_token: string;
+        refresh_token: string;
         expires_in: number;
     }>;
     protected issueMiddlewareRefreshToken(clientId: string, userId: string): Promise<string>;
@@ -163,18 +112,22 @@ declare class OAuthTokenService implements OAuthTokenServiceInterface {
     revokeToken(rawFields: Record<string, string>): Promise<void>;
 }
 
-declare abstract class OAuthWrapperService<SessionPayload extends OAuthSessionPayload = OAuthSessionPayload> extends OAuthAbstractProvider<SessionPayload> {
-    protected oauthSession: OAuthSessionInterface<SessionPayload>;
+declare abstract class OAuthWrapperService<User, SessionPayload extends OAuthSessionPayload = OAuthSessionPayload> implements OAuthProviderInterface<User, SessionPayload> {
+    protected oauthSession: OAuthSessionInterface<SessionPayload, User>;
     protected oauthRepo: OAuthWrapperRepositoryInterface;
+    protected authCodeTTLMs: number;
     protected tokenService: OAuthTokenServiceInterface;
-    constructor(oauthSession: OAuthSessionInterface<SessionPayload>, tokenEncryption: EncryptorInterface<string, string>, oauthRepo: OAuthWrapperRepositoryInterface);
-    protected abstract providerLogin(params: LoginParams): Promise<OAuthUserCredentials>;
-    protected abstract providerExchangeAccessToken(params: {
-        token: string;
-        lang?: string;
-    }): Promise<OAuthUserAccessToken>;
-    protected abstract providerGetUserInfo(sessionToken: string): Promise<OAuthUserProfile>;
-    protected abstract providerGetUserInfoByAccessToken(accessToken: string): Promise<OAuthUserProfile>;
+    constructor(oauthSession: OAuthSessionInterface<SessionPayload, User>, tokenEncryption: EncryptorInterface<string, string>, oauthRepo: OAuthWrapperRepositoryInterface);
+    protected abstract providerLogin(params: LoginParams): Promise<WithUserSession<SessionPayload, User>>;
+    protected abstract providerExchangeAccessToken(params: SessionPayload): Promise<OAuthWrapperAccessToken>;
+    protected abstract providerGetUserInfo(sessionToken: string): Promise<User>;
+    protected abstract providerGetUserInfoByAccessToken(accessToken: string): Promise<User>;
+    /**
+     * @override
+     */
+    abstract refreshUser(params?: {
+        refresh_token: string;
+    }): Promise<WithUserSession<SessionPayload, User>>;
     /**
      * @override
      */
@@ -203,8 +156,28 @@ declare abstract class OAuthWrapperService<SessionPayload extends OAuthSessionPa
     /**
      * @override
      */
-    getUserInfoWithAccessToken(accessToken: string): Promise<OAuthUserInfoResponse>;
-    protected toUserInfoResponse(profile: OAuthUserProfile): OAuthUserInfoResponse;
+    getUserInfoWithAccessToken(accessToken: string): Promise<User>;
+    protected toUser(profile: unknown): User;
+    protected isQuery(query: unknown): query is OAuthAuthorizeQuery;
+    protected isValidateConsent(value: unknown): value is OAuthConsentBody;
+    /**
+     * @override
+     */
+    logout(userId: string): Promise<void>;
+    /**
+     * @override
+     */
+    resolveAuthorizePage(rawQuery: Record<string, string | string[] | undefined>): Promise<{
+        ok: true;
+        data: OAuthAuthorizePageData;
+    } | {
+        ok: false;
+        error: OAuthAuthorizeValidationError;
+    }>;
+    /**
+     * @override
+     */
+    processConsent(requestBody: unknown): Promise<OAuthConsentResult>;
 }
 
 declare class OAuthWrapperError extends ExecutorError {
@@ -255,4 +228,4 @@ declare function computeS256CodeChallenge(verifier: string): string;
  */
 declare function verifyPkceS256(verifier: string, challenge: string): boolean;
 
-export { type ExchangeProviderAccessToken, OAuthAbstractProvider, OAuthAuthorizePageData, OAuthAuthorizeQuery, OAuthAuthorizeValidationError, OAuthClientCreate, OAuthClientCreateResponse, OAuthClientDetail, OAuthClientListItem, OAuthClientRow, OAuthClientSecretRotateResponse, OAuthClientUpdate, OAuthClientsInterface, OAuthClientsRepositoryInterface, OAuthClientsService, OAuthConsentBody, OAuthConsentResult, OAuthProviderInterface, OAuthRfcCodeType, OAuthSessionInterface, OAuthSessionPayload, OAuthTokenRequest, OAuthTokenResponse, OAuthTokenService, OAuthTokenServiceInterface, type OAuthUserAccessToken, type OAuthUserCredentials, OAuthUserInfoResponse, type OAuthUserProfile, OAuthWrapperError, OAuthWrapperRepositoryInterface, OAuthWrapperService, buildOAuthRedirectUrl, computeS256CodeChallenge, hashClientSecret, isRedirectUriAllowed, isValidCodeChallenge, isValidCodeVerifier, normalizeQuery, parseScopeList, validatePkceParams, verifyClientSecret, verifyPkceS256 };
+export { type ExchangeProviderAccessToken, OAuthAuthorizePageData, OAuthAuthorizeQuery, OAuthAuthorizeValidationError, OAuthClientCreate, OAuthClientCreateResponse, OAuthClientDetail, OAuthClientListItem, OAuthClientRow, OAuthClientSecretRotateResponse, OAuthClientUpdate, OAuthClientsInterface, OAuthClientsRepositoryInterface, OAuthClientsService, OAuthConsentBody, OAuthConsentResult, OAuthProviderInterface, OAuthRfcCodeType, OAuthSessionInterface, OAuthSessionPayload, OAuthTokenRequest, OAuthTokenResponse, OAuthTokenService, OAuthTokenServiceInterface, type OAuthWrapperAccessToken, OAuthWrapperError, OAuthWrapperRepositoryInterface, OAuthWrapperService, WithUserSession, buildOAuthRedirectUrl, computeS256CodeChallenge, hashClientSecret, isRedirectUriAllowed, isValidCodeChallenge, isValidCodeVerifier, normalizeQuery, parseScopeList, validatePkceParams, verifyClientSecret, verifyPkceS256 };