@salesforce/b2c-tooling-sdk 1.10.0 → 1.11.0

package/dist/cjs/auth/oauth.js

@@ -1,252 +0,0 @@
-import { getLogger } from '../logging/logger.js';
-import { DEFAULT_ACCOUNT_MANAGER_HOST } from '../defaults.js';
-import { globalAuthMiddlewareRegistry, applyAuthRequestMiddleware, applyAuthResponseMiddleware } from './middleware.js';
-// Module-level token cache to support multiple instances with same clientId
-const ACCESS_TOKEN_CACHE = new Map();
-// In-flight token requests, keyed by cacheKey, so concurrent callers coalesce
-// onto a single token-endpoint round trip instead of stampeding the server.
-const PENDING_TOKEN_REQUESTS = new Map();
-/**
- * Decodes a JWT token without verification.
- * Exported for use by other auth strategies.
- */
-export function decodeJWT(jwt) {
-    const parts = jwt.split('.');
-    if (parts.length !== 3) {
-        throw new Error('Invalid JWT format');
-    }
-    const header = JSON.parse(Buffer.from(parts[0], 'base64').toString());
-    const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-    return { header, payload };
-}
-/**
- * Generates a cache key for OAuth tokens.
- * Includes auth method to distinguish between client-credentials and JWT tokens.
- *
- * @param clientId - OAuth client ID
- * @param method - Authentication method (client-credentials or jwt)
- * @param accountManagerHost - Account Manager hostname
- * @param scopes - OAuth scopes (optional)
- * @returns Cache key string
- */
-export function getOAuthCacheKey(clientId, method, accountManagerHost, scopes) {
-    const scopesKey = scopes?.sort().join(',') || '';
-    return `${accountManagerHost}:${clientId}:${method}:${scopesKey}`;
-}
-/**
- * Gets a cached OAuth token if valid.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- * @param requiredScopes - Scopes that must be present in the cached token
- * @returns Cached token response if valid, undefined otherwise
- */
-export function getCachedOAuthToken(cacheKey, requiredScopes = []) {
-    const cached = ACCESS_TOKEN_CACHE.get(cacheKey);
-    if (!cached)
-        return undefined;
-    const now = new Date();
-    const hasAllScopes = requiredScopes.every((scope) => cached.scopes.includes(scope));
-    // Check if token is expired or missing required scopes
-    if (!hasAllScopes || now.getTime() > cached.expires.getTime()) {
-        ACCESS_TOKEN_CACHE.delete(cacheKey);
-        return undefined;
-    }
-    return cached;
-}
-/**
- * Stores an OAuth token in the global cache.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- * @param tokenResponse - Token response to cache
- */
-export function setCachedOAuthToken(cacheKey, tokenResponse) {
-    ACCESS_TOKEN_CACHE.set(cacheKey, tokenResponse);
-}
-/**
- * Invalidates a cached OAuth token.
- *
- * @param cacheKey - Cache key from getOAuthCacheKey()
- */
-export function invalidateCachedOAuthToken(cacheKey) {
-    ACCESS_TOKEN_CACHE.delete(cacheKey);
-}
-export class OAuthStrategy {
-    config;
-    accountManagerHost;
-    _hasHadSuccess = false;
-    cacheKey;
-    constructor(config) {
-        this.config = config;
-        this.accountManagerHost = config.accountManagerHost || DEFAULT_ACCOUNT_MANAGER_HOST;
-        this.cacheKey = getOAuthCacheKey(this.config.clientId, 'client-credentials', this.accountManagerHost, this.config.scopes);
-    }
-    async fetch(url, init = {}) {
-        const token = await this.getAccessToken();
-        const headers = new Headers(init.headers);
-        headers.set('Authorization', `Bearer ${token}`);
-        headers.set('x-dw-client-id', this.config.clientId);
-        // Pass through dispatcher for TLS/mTLS support
-        // Node.js fetch accepts dispatcher as an undocumented option
-        let res = await fetch(url, { ...init, headers });
-        if (res.status !== 401) {
-            this._hasHadSuccess = true;
-        }
-        // RESILIENCE: If we previously had a successful response and now get a 401,
-        // the token likely expired. Retry once after invalidating the cached token.
-        // Skip retry on initial 401 to avoid retrying with bad credentials.
-        if (res.status === 401 && this._hasHadSuccess) {
-            this.invalidateToken();
-            const newToken = await this.getAccessToken();
-            headers.set('Authorization', `Bearer ${newToken}`);
-            res = await fetch(url, { ...init, headers });
-        }
-        return res;
-    }
-    async getAuthorizationHeader() {
-        const token = await this.getAccessToken();
-        return `Bearer ${token}`;
-    }
-    /**
-     * Gets the decoded JWT payload
-     */
-    async getJWT() {
-        const token = await this.getAccessToken();
-        return decodeJWT(token);
-    }
-    /**
-     * Gets the full token response including expiration and scopes.
-     * Useful for commands that need to display or return token metadata.
-     */
-    async getTokenResponse() {
-        const logger = getLogger();
-        const cached = getCachedOAuthToken(this.cacheKey, this.config.scopes || []);
-        if (cached) {
-            logger.debug('[OAuthStrategy] Reusing cached access token');
-            return cached;
-        }
-        return this.refreshTokenSingleflight();
-    }
-    /**
-     * Invalidates the cached token, forcing re-authentication on next request
-     */
-    invalidateToken() {
-        invalidateCachedOAuthToken(this.cacheKey);
-    }
-    /**
-     * Creates a new OAuthStrategy with additional scopes merged in.
-     * Used by clients that have specific scope requirements.
-     *
-     * @param additionalScopes - Scopes to add to this strategy's existing scopes
-     * @returns A new OAuthStrategy instance with merged scopes
-     */
-    withAdditionalScopes(additionalScopes) {
-        const mergedScopes = [...new Set([...(this.config.scopes || []), ...additionalScopes])];
-        return new OAuthStrategy({
-            ...this.config,
-            scopes: mergedScopes,
-        });
-    }
-    /**
-     * Gets an access token, using cache if valid
-     */
-    async getAccessToken() {
-        const logger = getLogger();
-        const cached = getCachedOAuthToken(this.cacheKey, this.config.scopes || []);
-        if (cached) {
-            logger.debug('[OAuthStrategy] Reusing cached access token');
-            return cached.accessToken;
-        }
-        const tokenResponse = await this.refreshTokenSingleflight();
-        return tokenResponse.accessToken;
-    }
-    /**
-     * Returns a fresh token, coalescing concurrent callers onto a single in-flight
-     * token request keyed by cacheKey. Prevents stampeding the AM token endpoint
-     * when many requests trigger refresh at once.
-     */
-    refreshTokenSingleflight() {
-        const existing = PENDING_TOKEN_REQUESTS.get(this.cacheKey);
-        if (existing) {
-            getLogger().debug('[OAuthStrategy] Joining in-flight token request');
-            return existing;
-        }
-        const pending = (async () => {
-            getLogger().debug('[OAuthStrategy] Requesting new access token');
-            const tokenResponse = await this.clientCredentialsGrant();
-            setCachedOAuthToken(this.cacheKey, tokenResponse);
-            return tokenResponse;
-        })().finally(() => {
-            PENDING_TOKEN_REQUESTS.delete(this.cacheKey);
-        });
-        PENDING_TOKEN_REQUESTS.set(this.cacheKey, pending);
-        return pending;
-    }
-    /**
-     * Performs client credentials grant flow
-     */
-    async clientCredentialsGrant() {
-        const logger = getLogger();
-        const url = `https://${this.accountManagerHost}/dwsso/oauth2/access_token`;
-        const method = 'POST';
-        const params = new URLSearchParams({
-            grant_type: 'client_credentials',
-        });
-        if (this.config.scopes && this.config.scopes.length > 0) {
-            params.append('scope', this.config.scopes.join(' '));
-        }
-        const credentials = Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
-        // Build request object for middleware
-        let request = new Request(url, {
-            method,
-            headers: {
-                Authorization: `Basic ${credentials}`,
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: params.toString(),
-        });
-        // Apply auth middleware (e.g., User-Agent)
-        const middleware = globalAuthMiddlewareRegistry.getMiddleware();
-        request = await applyAuthRequestMiddleware(request, middleware);
-        // Convert headers to object for logging
-        const requestHeaders = {};
-        request.headers.forEach((value, key) => {
-            requestHeaders[key] = value;
-        });
-        logger.debug({ clientId: this.config.clientId }, `[Auth] Using OAuth client_credentials grant for client: ${this.config.clientId}`);
-        // Debug: Log request start
-        logger.debug({ method, url }, `[Auth REQ] ${method} ${url}`);
-        // Trace: Log request details
-        logger.trace({ method, url, headers: requestHeaders, body: params.toString() }, `[Auth REQ BODY] ${method} ${url}`);
-        const startTime = Date.now();
-        let response = await fetch(request);
-        // Apply response middleware
-        response = await applyAuthResponseMiddleware(request, response, middleware);
-        const duration = Date.now() - startTime;
-        // Debug: Log response summary
-        logger.debug({ method, url, status: response.status, duration }, `[Auth RESP] ${method} ${url} ${response.status} ${duration}ms`);
-        // Get response headers
-        const responseHeaders = {};
-        response.headers.forEach((value, key) => {
-            responseHeaders[key] = value;
-        });
-        if (!response.ok) {
-            const errorText = await response.text();
-            logger.trace({ method, url, headers: responseHeaders, body: errorText }, `[Auth RESP BODY] ${method} ${url}`);
-            throw new Error(`Failed to get access token: ${response.status} ${response.statusText} - ${errorText}`);
-        }
-        const data = (await response.json());
-        // Trace: Log response details
-        logger.trace({ method, url, headers: responseHeaders, body: data }, `[Auth RESP BODY] ${method} ${url}`);
-        const jwt = decodeJWT(data.access_token);
-        logger.trace({ jwt: jwt.payload }, '[Auth] JWT payload');
-        const now = new Date();
-        const expiration = new Date(now.getTime() + data.expires_in * 1000);
-        const scopes = data.scope?.split(' ') ?? [];
-        return {
-            accessToken: data.access_token,
-            expires: expiration,
-            scopes,
-        };
-    }
-}
-//# sourceMappingURL=oauth.js.map

package/dist/cjs/auth/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,SAAS,EAAC,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAC,4BAA4B,EAAC,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAC,4BAA4B,EAAE,0BAA0B,EAAE,2BAA2B,EAAC,MAAM,iBAAiB,CAAC;AAEtH,4EAA4E;AAC5E,MAAM,kBAAkB,GAAqC,IAAI,GAAG,EAAE,CAAC;AAEvE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,sBAAsB,GAA8C,IAAI,GAAG,EAAE,CAAC;AASpF;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAoC,EACpC,kBAA0B,EAC1B,MAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,GAAG,kBAAkB,IAAI,QAAQ,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,iBAA2B,EAAE;IACjF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpF,uDAAuD;IACvD,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,aAAkC;IACtF,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,OAAO,aAAa;IAKJ;IAJZ,kBAAkB,CAAS;IAC3B,cAAc,GAAG,KAAK,CAAC;IACvB,QAAQ,CAAS;IAEzB,YAAoB,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;QACrC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QACpF,IAAI,CAAC,QAAQ,GAAG,gBAAgB,CAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,oBAAoB,EACpB,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAkB,EAAE;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpD,+CAA+C;QAC/C,6DAA6D;QAC7D,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,oEAAoE;QACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;YACnD,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAC,GAAG,IAAI,EAAE,OAAO,EAAgB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,oBAAoB,CAAC,gBAA0B;QAC7C,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,IAAI,aAAa,CAAC;YACvB,GAAG,IAAI,CAAC,MAAM;YACd,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,WAAW,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,wBAAwB;QAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC1D,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAClD,OAAO,aAAa,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAChB,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QACH,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,kBAAkB,4BAA4B,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC;QAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1G,sCAAsC;QACtC,IAAI,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,SAAS,WAAW,EAAE;gBACrC,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,UAAU,GAAG,4BAA4B,CAAC,aAAa,EAAE,CAAC;QAChE,OAAO,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEhE,wCAAwC;QACxC,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrC,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CACV,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAC,EAChC,2DAA2D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAClF,CAAC;QACF,2BAA2B;QAC3B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAC,EAAE,cAAc,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAE3D,6BAA6B;QAC7B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAC,EAAE,mBAAmB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAElH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,4BAA4B;QAC5B,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAExC,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CACV,EAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAC,EAChD,eAAe,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAChE,CAAC;QAEF,uBAAuB;QACvB,MAAM,eAAe,GAA2B,EAAE,CAAC;QACnD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtC,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,MAAM,SAAS,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QAEF,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,EAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAC,EAAE,oBAAoB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAEvG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAC,EAAE,oBAAoB,CAAC,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,OAAO,EAAE,UAAU;YACnB,MAAM;SACP,CAAC;IACJ,CAAC;CACF"}

package/dist/cjs/auth/resolve.d.ts

@@ -1,100 +0,0 @@
-/**
- * Auth strategy resolution utilities.
- *
- * This module provides functions to automatically select and create the appropriate
- * authentication strategy based on available credentials and allowed methods.
- *
- * ## Usage
- *
- * ```typescript
- * import { resolveAuthStrategy, checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
- *
- * // Auto-select best strategy based on credentials
- * const strategy = resolveAuthStrategy({
- *   clientId: 'my-client-id',
- *   clientSecret: process.env.CLIENT_SECRET,
- * });
- *
- * // Check which methods are available
- * const { available, unavailable } = checkAvailableAuthMethods(credentials);
- * ```
- *
- * @module auth/resolve
- */
-import type { AuthStrategy, AuthMethod, AuthCredentials } from './types.js';
-/**
- * Options for resolving an auth strategy.
- */
-export interface ResolveAuthStrategyOptions {
-    /**
-     * Allowed authentication methods in priority order.
-     * The first method with available credentials will be used.
-     * Defaults to all methods: ['client-credentials', 'implicit', 'basic', 'api-key']
-     */
-    allowedMethods?: AuthMethod[];
-}
-/**
- * Result of checking which auth methods are available.
- */
-export interface AvailableAuthMethods {
-    /** Methods that have all required credentials configured */
-    available: AuthMethod[];
-    /** Methods that are missing required credentials */
-    unavailable: {
-        method: AuthMethod;
-        reason: string;
-    }[];
-}
-/**
- * Checks which auth methods have the required credentials available.
- *
- * @param credentials - The available credentials
- * @param allowedMethods - Methods to check (defaults to all)
- * @returns Object with available and unavailable methods
- *
- * @example
- * ```typescript
- * import { checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
- *
- * const result = checkAvailableAuthMethods({
- *   clientId: 'my-client',
- *   clientSecret: 'my-secret',
- * });
- *
- * console.log(result.available); // ['client-credentials', 'implicit']
- * ```
- */
-export declare function checkAvailableAuthMethods(credentials: AuthCredentials, allowedMethods?: AuthMethod[]): AvailableAuthMethods;
-/**
- * Resolves and creates the appropriate auth strategy based on credentials and allowed methods.
- *
- * Iterates through allowed methods in priority order and returns the first strategy
- * for which the required credentials are available.
- *
- * @param credentials - The available credentials
- * @param options - Resolution options (allowed methods, etc.)
- * @returns The resolved auth strategy
- * @throws Error if no allowed method has the required credentials
- *
- * @example
- * ```typescript
- * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // Will use client-credentials if secret is available, otherwise implicit
- * const strategy = resolveAuthStrategy({
- *   clientId: 'my-client-id',
- *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
- *   scopes: ['sfcc.products'],
- * });
- *
- * // Force implicit auth only
- * const implicitStrategy = resolveAuthStrategy(
- *   { clientId: 'my-client-id' },
- *   { allowedMethods: ['implicit'] }
- * );
- *
- * // Use the strategy
- * const response = await strategy.fetch('https://example.com/api');
- * ```
- */
-export declare function resolveAuthStrategy(credentials: AuthCredentials, options?: ResolveAuthStrategyOptions): AuthStrategy;

package/dist/cjs/auth/resolve.js

@@ -1,175 +0,0 @@
-/*
- * Copyright (c) 2025, Salesforce, Inc.
- * SPDX-License-Identifier: Apache-2
- * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
- */
-/**
- * Auth strategy resolution utilities.
- *
- * This module provides functions to automatically select and create the appropriate
- * authentication strategy based on available credentials and allowed methods.
- *
- * ## Usage
- *
- * ```typescript
- * import { resolveAuthStrategy, checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
- *
- * // Auto-select best strategy based on credentials
- * const strategy = resolveAuthStrategy({
- *   clientId: 'my-client-id',
- *   clientSecret: process.env.CLIENT_SECRET,
- * });
- *
- * // Check which methods are available
- * const { available, unavailable } = checkAvailableAuthMethods(credentials);
- * ```
- *
- * @module auth/resolve
- */
-import { ALL_AUTH_METHODS } from './types.js';
-import { OAuthStrategy } from './oauth.js';
-import { ImplicitOAuthStrategy } from './oauth-implicit.js';
-import { BasicAuthStrategy } from './basic.js';
-import { ApiKeyStrategy } from './api-key.js';
-/**
- * Checks which auth methods have the required credentials available.
- *
- * @param credentials - The available credentials
- * @param allowedMethods - Methods to check (defaults to all)
- * @returns Object with available and unavailable methods
- *
- * @example
- * ```typescript
- * import { checkAvailableAuthMethods } from '@salesforce/b2c-tooling-sdk';
- *
- * const result = checkAvailableAuthMethods({
- *   clientId: 'my-client',
- *   clientSecret: 'my-secret',
- * });
- *
- * console.log(result.available); // ['client-credentials', 'implicit']
- * ```
- */
-export function checkAvailableAuthMethods(credentials, allowedMethods = ALL_AUTH_METHODS) {
-    const available = [];
-    const unavailable = [];
-    for (const method of allowedMethods) {
-        switch (method) {
-            case 'client-credentials':
-                if (credentials.clientId && credentials.clientSecret) {
-                    available.push(method);
-                }
-                else if (!credentials.clientId) {
-                    unavailable.push({ method, reason: 'clientId is required' });
-                }
-                else {
-                    unavailable.push({ method, reason: 'clientSecret is required' });
-                }
-                break;
-            case 'implicit':
-                if (credentials.clientId) {
-                    available.push(method);
-                }
-                else {
-                    unavailable.push({ method, reason: 'clientId is required' });
-                }
-                break;
-            case 'basic':
-                if (credentials.username && credentials.password) {
-                    available.push(method);
-                }
-                else if (!credentials.username) {
-                    unavailable.push({ method, reason: 'username is required' });
-                }
-                else {
-                    unavailable.push({ method, reason: 'password is required' });
-                }
-                break;
-            case 'api-key':
-                if (credentials.apiKey) {
-                    available.push(method);
-                }
-                else {
-                    unavailable.push({ method, reason: 'apiKey is required' });
-                }
-                break;
-        }
-    }
-    return { available, unavailable };
-}
-/**
- * Resolves and creates the appropriate auth strategy based on credentials and allowed methods.
- *
- * Iterates through allowed methods in priority order and returns the first strategy
- * for which the required credentials are available.
- *
- * @param credentials - The available credentials
- * @param options - Resolution options (allowed methods, etc.)
- * @returns The resolved auth strategy
- * @throws Error if no allowed method has the required credentials
- *
- * @example
- * ```typescript
- * import { resolveAuthStrategy } from '@salesforce/b2c-tooling-sdk';
- *
- * // Will use client-credentials if secret is available, otherwise implicit
- * const strategy = resolveAuthStrategy({
- *   clientId: 'my-client-id',
- *   clientSecret: process.env.CLIENT_SECRET, // may be undefined
- *   scopes: ['sfcc.products'],
- * });
- *
- * // Force implicit auth only
- * const implicitStrategy = resolveAuthStrategy(
- *   { clientId: 'my-client-id' },
- *   { allowedMethods: ['implicit'] }
- * );
- *
- * // Use the strategy
- * const response = await strategy.fetch('https://example.com/api');
- * ```
- */
-export function resolveAuthStrategy(credentials, options = {}) {
-    const allowedMethods = options.allowedMethods || ALL_AUTH_METHODS;
-    for (const method of allowedMethods) {
-        switch (method) {
-            case 'client-credentials':
-                if (credentials.clientId && credentials.clientSecret) {
-                    return new OAuthStrategy({
-                        clientId: credentials.clientId,
-                        clientSecret: credentials.clientSecret,
-                        scopes: credentials.scopes,
-                        accountManagerHost: credentials.accountManagerHost,
-                    });
-                }
-                break;
-            case 'implicit':
-                if (credentials.clientId) {
-                    return new ImplicitOAuthStrategy({
-                        clientId: credentials.clientId,
-                        scopes: credentials.scopes,
-                        accountManagerHost: credentials.accountManagerHost,
-                        redirectUri: credentials.redirectUri,
-                        openBrowser: credentials.openBrowser,
-                    });
-                }
-                break;
-            case 'basic':
-                if (credentials.username && credentials.password) {
-                    return new BasicAuthStrategy(credentials.username, credentials.password);
-                }
-                break;
-            case 'api-key':
-                if (credentials.apiKey) {
-                    return new ApiKeyStrategy(credentials.apiKey, credentials.apiKeyHeaderName);
-                }
-                break;
-        }
-    }
-    // Build helpful error message
-    const { unavailable } = checkAvailableAuthMethods(credentials, allowedMethods);
-    const details = unavailable.map((u) => `${u.method}: ${u.reason}`).join('; ');
-    throw new Error(`No valid auth method available. Allowed methods: [${allowedMethods.join(', ')}]. ` +
-        `Missing credentials: ${details}`);
-}
-//# sourceMappingURL=resolve.js.map

package/dist/cjs/auth/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAC,aAAa,EAAC,MAAM,YAAY,CAAC;AACzC,OAAO,EAAC,qBAAqB,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAC,cAAc,EAAC,MAAM,cAAc,CAAC;AAwB5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA4B,EAC5B,iBAA+B,gBAAgB;IAE/C,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,MAAM,WAAW,GAA2C,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjC,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,EAAC,SAAS,EAAE,WAAW,EAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAElE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB;gBACvB,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrD,OAAO,IAAI,aAAa,CAAC;wBACvB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,UAAU;gBACb,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,IAAI,qBAAqB,CAAC;wBAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;wBAClD,WAAW,EAAE,WAAW,CAAC,WAAW;wBACpC,WAAW,EAAE,WAAW,CAAC,WAAW;qBACrC,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YAER,KAAK,OAAO;gBACV,IAAI,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;oBACjD,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC3E,CAAC;gBACD,MAAM;YAER,KAAK,SAAS;gBACZ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;oBACvB,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBAC9E,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,EAAC,WAAW,EAAC,GAAG,yBAAyB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9E,MAAM,IAAI,KAAK,CACb,qDAAqD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACjF,wBAAwB,OAAO,EAAE,CACpC,CAAC;AACJ,CAAC"}

package/dist/cjs/auth/stateful-oauth-strategy.d.ts

@@ -1,39 +0,0 @@
-/**
- * OAuth strategy that uses stateful (persisted) tokens from the same store as sfcc-ci.
- * Uses stateful auth only when present and valid; on 401 attempts refresh when renew
- * credentials or refresh_token are stored.
- *
- * @module auth/stateful-oauth-strategy
- */
-import type { AuthStrategy, AccessTokenResponse, DecodedJWT, FetchInit } from './types.js';
-import { type StatefulSession } from './stateful-store.js';
-export interface StatefulOAuthStrategyOptions {
-    accountManagerHost: string;
-    scopes?: string[];
-}
-/**
- * Auth strategy that uses the stateful store (sfcc-ci compatible).
- * On 401, attempts to refresh using stored refresh_token or client_credentials (renew base);
- * on refresh failure clears the stored session.
- */
-export declare class StatefulOAuthStrategy implements AuthStrategy {
-    private accountManagerHost;
-    private scopes;
-    private _session;
-    private _hasHadSuccess;
-    constructor(session: StatefulSession, options: StatefulOAuthStrategyOptions);
-    fetch(url: string, init?: FetchInit): Promise<Response>;
-    getAuthorizationHeader(): Promise<string>;
-    /**
-     * Returns the current token as AccessTokenResponse (expires/scopes from JWT).
-     */
-    getTokenResponse(): Promise<AccessTokenResponse>;
-    getJWT(): Promise<DecodedJWT>;
-    invalidateToken(): void;
-    private getAccessToken;
-    /**
-     * Attempts to refresh the access token using stored refresh_token or client_credentials (renew base).
-     * Requires SFCC_CLIENT_RENEW_BASE (client:secret) for both flows; updates store on success.
-     */
-    private tryRefresh;
-}