@salesforce/b2c-tooling-sdk 1.10.0 → 1.11.0

package/dist/cjs/auth/oauth-jwt.js

@@ -1,343 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-/**
- * JWT Bearer OAuth authentication strategy (RFC 7523).
- *
- * Implements OAuth 2.0 JWT Bearer Token flow for Account Manager authentication.
- * Uses client certificate/key pair instead of client secret for enhanced security.
- *
- * @module auth/oauth-jwt
- */
-import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import { getLogger } from '../logging/logger.js';
-import { getOAuthCacheKey, getCachedOAuthToken, setCachedOAuthToken, invalidateCachedOAuthToken, decodeJWT, } from './oauth.js';
-import { globalAuthMiddlewareRegistry, applyAuthRequestMiddleware, applyAuthResponseMiddleware } from './middleware.js';
-/**
- * OAuth 2.0 JWT Bearer authentication strategy.
- *
- * Implements RFC 7523 (JSON Web Token (JWT) Profile for OAuth 2.0 Client
- * Authentication and Authorization Grants).
- *
- * Key differences from client credentials flow:
- * - Uses public/private key pair instead of client secret
- * - Sends JWT as `client_assertion` in POST body (not Authorization header)
- * - JWT is self-signed and short-lived (60 seconds)
- *
- * @example
- * ```typescript
- * const strategy = new JwtOAuthStrategy({
- *   clientId: 'my-client-id',
- *   certPath: './cert.pem',
- *   keyPath: './key.pem',
- *   accountManagerHost: 'account.demandware.com',
- * });
- *
- * const response = await strategy.fetch('https://api.example.com/data');
- * ```
- */
-export class JwtOAuthStrategy {
-    config;
-    logger = getLogger();
-    cacheKey;
-    _hasHadSuccess = false;
-    privateKey;
-    constructor(config) {
-        this.validateConfig(config);
-        this.config = config;
-        this.cacheKey = getOAuthCacheKey(this.config.clientId, 'jwt', this.config.accountManagerHost, this.config.scopes);
-        // Cache private key to avoid file I/O on every token request
-        const keyContent = fs.readFileSync(config.keyPath, 'utf8');
-        this.privateKey = crypto.createPrivateKey({
-            key: keyContent,
-            passphrase: config.passphrase,
-        });
-    }
-    /**
-     * Validates JWT configuration and checks that certificate/key files exist and are readable.
-     */
-    validateConfig(config) {
-        // Validate required fields
-        if (!config.clientId) {
-            throw new Error('JWT authentication requires clientId');
-        }
-        if (!config.certPath) {
-            throw new Error('JWT authentication requires certificate path (--jwt-cert)');
-        }
-        if (!config.keyPath) {
-            throw new Error('JWT authentication requires private key path (--jwt-key)');
-        }
-        if (!config.accountManagerHost) {
-            throw new Error('JWT authentication requires accountManagerHost');
-        }
-        // Validate certificate file exists and has content
-        if (!fs.existsSync(config.certPath)) {
-            throw new Error(`JWT certificate file not found: ${config.certPath}\n` +
-                `Generate a certificate pair with: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes`);
-        }
-        // Check certificate file is readable
-        try {
-            const certContent = fs.readFileSync(config.certPath, 'utf8');
-            if (!certContent.includes('BEGIN CERTIFICATE')) {
-                throw new Error(`Invalid certificate format in ${config.certPath}. Expected PEM format (BEGIN CERTIFICATE).`);
-            }
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.includes('Invalid certificate format')) {
-                throw error;
-            }
-            throw new Error(`Failed to read JWT certificate from ${config.certPath}: ${error}`);
-        }
-        // Validate key file exists
-        if (!fs.existsSync(config.keyPath)) {
-            throw new Error(`JWT private key file not found: ${config.keyPath}\n` +
-                `Generate a key pair with: openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes`);
-        }
-        // Validate private key is readable and valid
-        try {
-            const keyContent = fs.readFileSync(config.keyPath, 'utf8');
-            // Check key format
-            if (!keyContent.includes('BEGIN') || !keyContent.includes('PRIVATE KEY')) {
-                throw new Error(`Invalid private key format in ${config.keyPath}. Expected PEM format (BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY).`);
-            }
-            // Validate key can be loaded (will throw if encrypted and passphrase is wrong)
-            crypto.createPrivateKey({
-                key: keyContent,
-                passphrase: config.passphrase,
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            // Specific error for wrong passphrase
-            if (message.includes('bad decrypt') || message.includes('wrong passphrase') || message.includes('incorrect')) {
-                throw new Error(`Invalid passphrase for encrypted JWT private key.\n` +
-                    `Use --jwt-passphrase flag or SFCC_JWT_PASSPHRASE environment variable to provide the passphrase.`);
-            }
-            // Specific error for encrypted key without passphrase
-            if (message.includes('encrypted') || message.includes('passphrase')) {
-                throw new Error(`JWT private key is encrypted but no passphrase provided.\n` +
-                    `Use --jwt-passphrase flag or SFCC_JWT_PASSPHRASE environment variable.`);
-            }
-            // Specific error for invalid format
-            if (message.includes('Invalid private key format')) {
-                throw error;
-            }
-            // Generic error
-            throw new Error(`Invalid JWT private key at ${config.keyPath}: ${message}`);
-        }
-    }
-    /**
-     * Performs a fetch request with JWT Bearer authentication.
-     * Automatically injects the Authorization header with a fresh access token.
-     * Includes 401 retry logic and x-dw-client-id header.
-     */
-    async fetch(url, init = {}) {
-        const token = await this.getAccessToken();
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Bearer ${token}`);
-        headers.set('x-dw-client-id', this.config.clientId);
-        // Pass through dispatcher for TLS/mTLS support
-        let res = await fetch(url, { ...init, headers });
-        if (res.status !== 401) {
-            this._hasHadSuccess = true;
-        }
-        // If we previously had a successful response and now get a 401,
-        // the token likely expired. Retry once after invalidating the cached token.
-        // Skip retry on initial 401 to avoid retrying with bad credentials.
-        if (res.status === 401 && this._hasHadSuccess) {
-            this.invalidateToken();
-            const newToken = await this.getAccessToken();
-            headers.set('Authorization', `Bearer ${newToken}`);
-            res = await fetch(url, { ...init, headers });
-        }
-        return res;
-    }
-    /**
-     * Returns the Authorization header value for legacy clients.
-     */
-    async getAuthorizationHeader() {
-        const token = await this.getAccessToken();
-        return `Bearer ${token}`;
-    }
-    /**
-     * Gets the decoded JWT payload.
-     */
-    async getJWT() {
-        const token = await this.getAccessToken();
-        return decodeJWT(token);
-    }
-    /**
-     * Creates a new JwtOAuthStrategy with additional scopes merged in.
-     * Used by clients that have specific scope requirements.
-     *
-     * @param additionalScopes - Scopes to add to this strategy's existing scopes
-     * @returns A new JwtOAuthStrategy instance with merged scopes
-     */
-    withAdditionalScopes(additionalScopes) {
-        const mergedScopes = [...new Set([...(this.config.scopes || []), ...additionalScopes])];
-        return new JwtOAuthStrategy({
-            ...this.config,
-            scopes: mergedScopes,
-        });
-    }
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    async getTokenResponse() {
-        const cached = getCachedOAuthToken(this.cacheKey, this.config.scopes || []);
-        if (cached) {
-            this.logger.debug('[JwtOAuthStrategy] Reusing cached access token');
-            return cached;
-        }
-        // Get new token (returns full response)
-        return this.requestNewToken();
-    }
-    /**
-     * Invalidates the cached access token, forcing re-authentication on next request.
-     */
-    invalidateToken() {
-        invalidateCachedOAuthToken(this.cacheKey);
-        this.logger.trace('[JwtOAuthStrategy] Token invalidated');
-    }
-    /**
-     * Gets an access token string, using cached token if still valid.
-     */
-    async getAccessToken() {
-        // Check global cache first
-        const cached = getCachedOAuthToken(this.cacheKey, this.config.scopes || []);
-        if (cached) {
-            this.logger.trace('[JwtOAuthStrategy] Using cached access token from global cache');
-            return cached.accessToken;
-        }
-        // Request new token and return just the access token string
-        const tokenResponse = await this.requestNewToken();
-        return tokenResponse.accessToken;
-    }
-    /**
-     * Requests a new access token from Account Manager using JWT Bearer flow.
-     * Returns the full token response and caches it.
-     */
-    async requestNewToken() {
-        this.logger.trace('[JwtOAuthStrategy] Requesting new access token with JWT Bearer flow');
-        // Generate signed JWT
-        const jwt = await this.createSignedJwt();
-        // Request access token using JWT Bearer flow
-        const tokenUrl = `https://${this.config.accountManagerHost}/dwsso/oauth2/access_token`;
-        // IMPORTANT: JWT credentials go in POST body, NOT Authorization header
-        // This is the key difference from client_credentials flow
-        const params = new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
-            client_assertion: jwt, // ← JWT in body, not header
-        });
-        if (this.config.scopes && this.config.scopes.length > 0) {
-            params.append('scope', this.config.scopes.join(' '));
-        }
-        this.logger.trace({
-            tokenUrl,
-            clientId: this.config.clientId,
-            scopes: this.config.scopes,
-        }, '[JwtOAuthStrategy] Sending JWT Bearer token request');
-        // Build request object for middleware
-        let request = new Request(tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: params.toString(),
-        });
-        // Apply auth middleware (e.g., User-Agent)
-        const middleware = globalAuthMiddlewareRegistry.getMiddleware();
-        request = await applyAuthRequestMiddleware(request, middleware);
-        let response = await fetch(request);
-        // Apply auth response middleware
-        response = await applyAuthResponseMiddleware(request, response, middleware);
-        if (!response.ok) {
-            const errorText = await response.text();
-            this.logger.error({
-                status: response.status,
-                statusText: response.statusText,
-                error: errorText,
-            }, '[JwtOAuthStrategy] JWT authentication failed');
-            // Provide helpful error messages for common issues
-            if (response.status === 401) {
-                throw new Error(`JWT authentication failed (401): Invalid JWT signature or unregistered certificate. ` +
-                    `Ensure the certificate (${this.config.certPath}) is registered in Account Manager.`);
-            }
-            if (response.status === 400) {
-                throw new Error(`JWT authentication failed (400): ${errorText}`);
-            }
-            throw new Error(`JWT authentication failed: ${response.status} ${response.statusText}\n${errorText}`);
-        }
-        const data = (await response.json());
-        if (!data.access_token) {
-            throw new Error('No access token in response from Account Manager');
-        }
-        // Calculate token expiry (default 30 minutes if not specified)
-        const expiresInSeconds = data.expires_in ?? 1800;
-        const expiryDate = new Date(Date.now() + expiresInSeconds * 1000);
-        // Decode JWT to extract scopes (scope can be string or array)
-        const decoded = decodeJWT(data.access_token);
-        const scope = decoded.payload.scope;
-        const scopes = Array.isArray(scope) ? scope : scope?.split(' ') || this.config.scopes || [];
-        // Build and cache token response
-        const tokenResponse = {
-            accessToken: data.access_token,
-            expires: expiryDate,
-            scopes,
-        };
-        setCachedOAuthToken(this.cacheKey, tokenResponse);
-        this.logger.trace({
-            expiresIn: expiresInSeconds,
-            expiresAt: expiryDate.toISOString(),
-            scopes,
-        }, '[JwtOAuthStrategy] Access token obtained successfully');
-        return tokenResponse;
-    }
-    /**
-     * Creates and signs a JWT token for OAuth authentication.
-     * Uses RS256 algorithm and Base64URL encoding per RFC 7519.
-     */
-    async createSignedJwt() {
-        const header = {
-            alg: 'RS256',
-            typ: 'JWT',
-        };
-        const encodedHeader = base64UrlEncode(JSON.stringify(header));
-        const now = Math.floor(Date.now() / 1000);
-        const tokenUrl = `https://${this.config.accountManagerHost}/dwsso/oauth2/access_token`;
-        const payload = {
-            iss: this.config.clientId,
-            sub: this.config.clientId,
-            aud: tokenUrl,
-            exp: now + 60,
-        };
-        const encodedPayload = base64UrlEncode(JSON.stringify(payload));
-        const signatureInput = `${encodedHeader}.${encodedPayload}`;
-        const signature = crypto.sign('RSA-SHA256', Buffer.from(signatureInput), this.privateKey);
-        const encodedSignature = base64UrlEncode(signature);
-        const jwt = `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
-        this.logger.trace({
-            header,
-            payload: {
-                ...payload,
-                exp: new Date(payload.exp * 1000).toISOString(),
-            },
-        }, '[JwtOAuthStrategy] Generated JWT token');
-        return jwt;
-    }
-}
-/**
- * Encodes data as Base64URL (RFC 4648 Section 5).
- * Replaces +/= with URL-safe characters.
- */
-function base64UrlEncode(data) {
-    const buffer = typeof data === 'string' ? Buffer.from(data) : data;
-    const base64 = buffer.toString('base64');
-    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-//# sourceMappingURL=oauth-jwt.js.map

package/dist/cjs/auth/oauth-jwt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-jwt.js","sourceRoot":"","sources":["../../../src/auth/oauth-jwt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EAAC,4BAA4B,EAAE,0BAA0B,EAAE,2BAA2B,EAAC,MAAM,iBAAiB,CAAC;AAgCtH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,gBAAgB;IACV,MAAM,CAAiB;IACvB,MAAM,GAAG,SAAS,EAAE,CAAC;IACrB,QAAQ,CAAS;IAC1B,cAAc,GAAG,KAAK,CAAC;IACd,UAAU,CAAmB;IAE9C,YAAY,MAAsB;QAChC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAElH,6DAA6D;QAC7D,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;YACxC,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAsB;QAC3C,2BAA2B;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,QAAQ,IAAI;gBACpD,qHAAqH,CACxH,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,QAAQ,4CAA4C,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,OAAO,IAAI;gBACnD,6GAA6G,CAChH,CAAC;QACJ,CAAC;QAED,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE3D,mBAAmB;YACnB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,OAAO,qEAAqE,CACrH,CAAC;YACJ,CAAC;YAED,+EAA+E;YAC/E,MAAM,CAAC,gBAAgB,CAAC;gBACtB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEvE,sCAAsC;YACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7G,MAAM,IAAI,KAAK,CACb,qDAAqD;oBACnD,kGAAkG,CACrG,CAAC;YACJ,CAAC;YAED,sDAAsD;YACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,4DAA4D;oBAC1D,wEAAwE,CAC3E,CAAC;YACJ,CAAC;YAED,oCAAoC;YACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBACnD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,gBAAgB;YAChB,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,+CAA+C;QAC/C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,gEAAgE;QAChE,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,gBAA0B;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,gBAAgB,CAAC;YAC1B,GAAG,IAAI,CAAC,MAAM;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wCAAwC;QACxC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,2BAA2B;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,4DAA4D;QAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,WAAW,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAEzF,sBAAsB;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEzC,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,kBAAkB,4BAA4B,CAAC;QAEvF,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,qBAAqB,EAAE,wDAAwD;YAC/E,gBAAgB,EAAE,GAAG,EAAE,4BAA4B;SACpD,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;YACE,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC3B,EACD,qDAAqD,CACtD,CAAC;QAEF,sCAAsC;QACtC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,UAAU,GAAG,4BAA4B,CAAC,aAAa,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEhE,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,iCAAiC;QACjC,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;gBACE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,KAAK,EAAE,SAAS;aACjB,EACD,8CAA8C,CAC/C,CAAC;YAEF,mDAAmD;YACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CACb,sFAAsF;oBACpF,2BAA2B,IAAI,CAAC,MAAM,CAAC,QAAQ,qCAAqC,CACvF,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAElE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAsC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAE5F,iCAAiC;QACjC,MAAM,aAAa,GAAwB;YACzC,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,UAAU;YACnB,MAAM;SACP,CAAC;QACF,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;YACE,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE;YACnC,MAAM;SACP,EACD,uDAAuD,CACxD,CAAC;QAEF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,MAAM,GAAc;YACxB,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,KAAK;SACX,CAAC;QACF,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,kBAAkB,4BAA4B,CAAC;QACvF,MAAM,OAAO,GAAe;YAC1B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,GAAG,GAAG,EAAE;SACd,CAAC;QACF,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEhE,MAAM,cAAc,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1F,MAAM,gBAAgB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAEpD,MAAM,GAAG,GAAG,GAAG,aAAa,IAAI,cAAc,IAAI,gBAAgB,EAAE,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;YACE,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;aAChD;SACF,EACD,wCAAwC,CACzC,CAAC;QAEF,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAqB;IAC5C,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/cjs/auth/oauth.d.ts

@@ -1,88 +0,0 @@
-import type { AuthStrategy, AccessTokenResponse, DecodedJWT, FetchInit } from './types.js';
-export interface OAuthConfig {
-    clientId: string;
-    clientSecret: string;
-    scopes?: string[];
-    accountManagerHost?: string;
-}
-/**
- * Decodes a JWT token without verification.
- * Exported for use by other auth strategies.
- */
-export declare function decodeJWT(jwt: string): DecodedJWT;
-/**
- * Generates a cache key for OAuth tokens.
- * Includes auth method to distinguish between client-credentials and JWT tokens.
- *
- * @param clientId - OAuth client ID
- * @param method - Authentication method (client-credentials or jwt)
- * @param accountManagerHost - Account Manager hostname
- * @param scopes - OAuth scopes (optional)
- * @returns Cache key string
- */
-export declare function getOAuthCacheKey(clientId: string, method: 'client-credentials' | 'jwt', accountManagerHost: string, scopes?: string[]): string;
-/**
- * Gets a cached OAuth token if valid.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- * @param requiredScopes - Scopes that must be present in the cached token
- * @returns Cached token response if valid, undefined otherwise
- */
-export declare function getCachedOAuthToken(cacheKey: string, requiredScopes?: string[]): AccessTokenResponse | undefined;
-/**
- * Stores an OAuth token in the global cache.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- * @param tokenResponse - Token response to cache
- */
-export declare function setCachedOAuthToken(cacheKey: string, tokenResponse: AccessTokenResponse): void;
-/**
- * Invalidates a cached OAuth token.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- */
-export declare function invalidateCachedOAuthToken(cacheKey: string): void;
-export declare class OAuthStrategy implements AuthStrategy {
-    private config;
-    private accountManagerHost;
-    private _hasHadSuccess;
-    private cacheKey;
-    constructor(config: OAuthConfig);
-    fetch(url: string, init?: FetchInit): Promise<Response>;
-    getAuthorizationHeader(): Promise<string>;
-    /**
-     * Gets the decoded JWT payload
-     */
-    getJWT(): Promise<DecodedJWT>;
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    getTokenResponse(): Promise<AccessTokenResponse>;
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken(): void;
-    /**
-     * Creates a new OAuthStrategy with additional scopes merged in.
-     * Used by clients that have specific scope requirements.
-     *
-     * @param additionalScopes - Scopes to add to this strategy's existing scopes
-     * @returns A new OAuthStrategy instance with merged scopes
-     */
-    withAdditionalScopes(additionalScopes: string[]): OAuthStrategy;
-    /**
-     * Gets an access token, using cache if valid
-     */
-    private getAccessToken;
-    /**
-     * Returns a fresh token, coalescing concurrent callers onto a single in-flight
-     * token request keyed by cacheKey. Prevents stampeding the AM token endpoint
-     * when many requests trigger refresh at once.
-     */
-    private refreshTokenSingleflight;
-    /**
-     * Performs client credentials grant flow
-     */
-    private clientCredentialsGrant;
-}