@se-studio/contentful-cms 3.5.2 → 3.6.0

package/dist/hosted/oauth/cached-cma.js

@@ -0,0 +1,41 @@
+import { isUnusableContentfulCacheReason, patValidationFailureReason } from './log.js';
+export const CONTENTFUL_SESSION_EXPIRED = 'Contentful session expired. Sign in with Contentful again.';
+export class CachedContentfulTokenError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'CachedContentfulTokenError';
+        this.reason = reason;
+    }
+}
+export function isCachedContentfulTokenError(error) {
+    return error instanceof CachedContentfulTokenError;
+}
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export async function loadAndValidateContentfulToken(store, sub, spaceId, validateContentfulToken) {
+    const token = await store.getContentfulToken(sub, spaceId);
+    if (!token) {
+        throw new CachedContentfulTokenError('missing_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+    }
+    if (validateContentfulToken) {
+        try {
+            await validateContentfulToken(token);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const reason = patValidationFailureReason(message);
+            if (isUnusableContentfulCacheReason(reason)) {
+                await store.deleteContentfulToken(sub, spaceId);
+                throw new CachedContentfulTokenError('invalid_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+            }
+            throw error;
+        }
+    }
+    await store.touchContentfulToken(sub, spaceId);
+    return token;
+}
+//# sourceMappingURL=cached-cma.js.map

package/dist/hosted/oauth/cached-cma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGvF,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAE/D,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,MAAM,CAA0D;IAEzE,YAAY,MAA+D,EAAE,OAAe;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,KAAK,YAAY,0BAA0B,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,GAAW,EACX,OAA2B,EAC3B,uBAA0D;IAE1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,uBAAuB,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hosted/oauth/complete.d.ts

@@ -6,6 +6,7 @@ export declare function completeAuthorizationCodeGrant(store: OAuthStore, input:
     clientId: string;
     codeVerifier: string;
     spaceId?: string;
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/complete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA4CD"}
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAmDD"}

package/dist/hosted/oauth/complete.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 import { generateAuthCode } from './pkce.js';
 import { redirectUrisEquivalent } from './redirect-uri.js';
@@ -13,7 +14,7 @@ export async function issueAuthorizationRedirect(store, authRequestId, sub, requ
     return redirect.toString();
 }
 export async function completeAuthorizationCodeGrant(store, input) {
-    const codeRecord = await store.consumeAuthCode(input.code);
+    const codeRecord = await store.peekAuthCode(input.code);
     if (!codeRecord) {
         throw new Error('Invalid or expired authorization code.');
     }
@@ -32,9 +33,10 @@ export async function completeAuthorizationCodeGrant(store, input) {
     if (digest !== authRequest.codeChallenge) {
         throw new Error('Invalid code_verifier.');
     }
-    const contentfulToken = await store.getContentfulToken(codeRecord.sub, input.spaceId);
-    if (!contentfulToken) {
-        throw new Error('Contentful session expired. Sign in with Contentful again.');
+    await loadAndValidateContentfulToken(store, codeRecord.sub, input.spaceId, input.validateContentfulToken);
+    const consumed = await store.consumeAuthCode(input.code);
+    if (!consumed) {
+        throw new Error('Invalid or expired authorization code.');
     }
     const { accessToken, expiresIn } = await signMcpAccessToken(codeRecord.sub, authRequest.resource);
     const refreshToken = randomUUID();

package/dist/hosted/oauth/complete.js.map

@@ -1 +1 @@
-{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAMC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAgB/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAW/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}

package/dist/hosted/oauth/handlers.js

@@ -2,9 +2,10 @@ import { validatePatForDeployment } from '../../config/hosted.js';
 import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
 import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
 import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
-import { authorizationCodeGrantFailureReason, oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason, } from './log.js';
+import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
 import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
-import { completeRefreshTokenGrant, isRefreshTokenGrantError } from './refresh.js';
+import { completeRefreshTokenGrant } from './refresh.js';
+import { oauthTokenGrantFailureResponse } from './token-grant-response.js';
 function errorRedirect(redirectUri, message, state) {
     if (!redirectUri) {
         return new Response(message, { status: 400 });
@@ -115,6 +116,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 codeVerifier,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             recordOAuthTelemetrySuccess('authorization-code');
             await flushTelemetry();
@@ -126,12 +130,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const reason = authorizationCodeGrantFailureReason(message);
-            oauthLogAuthFailure('authorization-code', reason);
-            recordOAuthTelemetryFailure('authorization-code', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'authorization-code');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     if (grantType === 'refresh_token') {
@@ -149,6 +150,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 resource,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             oauthLogVerbose('refresh-token ok');
             recordOAuthTelemetrySuccess('refresh-token');
@@ -161,12 +165,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const reason = isRefreshTokenGrantError(error) ? error.reason : 'refresh_token_grant_failed';
-            const message = error instanceof Error ? error.message : String(error);
-            oauthLogAuthFailure('refresh-token', reason);
-            recordOAuthTelemetryFailure('refresh-token', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'refresh-token');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     recordOAuthTelemetryFailure('token', 'unsupported_grant_type');
@@ -188,7 +189,10 @@ export async function handleLinkContentfulPost(request, ctx) {
     }
     try {
         const user = await validatePatForDeployment(contentfulToken, ctx.deployment);
-        await ctx.store.storeContentfulToken(user.userId, user.token, ctx.deployment.spaceId);
+        await ctx.store.storeContentfulToken(user.userId, user.token, ctx.deployment.spaceId, {
+            userId: user.userId,
+            email: user.email,
+        });
         oauthLogVerbose('link-contentful ok', {
             userId: user.userId,
             email: user.email,

package/dist/hosted/oauth/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,eAAe,EACf,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AASnF,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC5D,mBAAmB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAClD,2BAA2B,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAC7F,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,mBAAmB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC7C,2BAA2B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtF,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAQ3E,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAC7E,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE;YACpF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/log.d.ts

@@ -6,5 +6,7 @@ export declare function oauthLogMcpHandlerError(message: string, details?: Recor
 /** Always emitted for auth failures — visible in Vercel runtime logs. */
 export declare function oauthLogAuthFailure(route: string, reason: string, details?: Record<string, unknown>): void;
 export declare function authorizationCodeGrantFailureReason(message: string): string;
+export declare function isUnusableContentfulCacheReason(reason: string): boolean;
+export declare function isTransientContentfulFailure(reason: string): boolean;
 export declare function patValidationFailureReason(message: string): string;
 //# sourceMappingURL=log.d.ts.map

package/dist/hosted/oauth/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}

package/dist/hosted/oauth/log.js

@@ -40,6 +40,16 @@ export function authorizationCodeGrantFailureReason(message) {
     }
     return 'invalid_grant';
 }
+export function isUnusableContentfulCacheReason(reason) {
+    return (reason === 'invalid_contentful_token' ||
+        reason === 'space_access_denied' ||
+        reason === 'missing_contentful_token');
+}
+export function isTransientContentfulFailure(reason) {
+    return (reason === 'contentful_api_error' ||
+        reason === 'space_check_failed' ||
+        reason === 'pat_validation_failed');
+}
 export function patValidationFailureReason(message) {
     if (message.includes('does not have access to the configured Contentful space')) {
         return 'space_access_denied';

package/dist/hosted/oauth/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,OAAO,CACL,MAAM,KAAK,0BAA0B;QACrC,MAAM,KAAK,qBAAqB;QAChC,MAAM,KAAK,0BAA0B,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CACL,MAAM,KAAK,sBAAsB;QACjC,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/hosted/oauth/pat-cache.d.ts

@@ -0,0 +1,11 @@
+import type { HostedDeploymentConfig, ValidatePatResult } from '../../config/hosted.js';
+import type { CachedContentfulToken, OAuthStore } from './store.js';
+export declare const DEFAULT_PAT_REVALIDATE_SECONDS: number;
+export declare function getPatRevalidateSeconds(): number;
+export declare function isCachedPatFresh(record: CachedContentfulToken, now?: number): boolean;
+/**
+ * Use a cached PAT identity when still fresh; otherwise live-validate against CMA
+ * and rewrite the Redis envelope.
+ */
+export declare function resolvePatForDeployment(store: OAuthStore, sub: string, token: string, deployment: HostedDeploymentConfig): Promise<ValidatePatResult>;
+//# sourceMappingURL=pat-cache.d.ts.map

package/dist/hosted/oauth/pat-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat-cache.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/pat-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAExF,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,8BAA8B,QAAU,CAAC;AAItD,wBAAgB,uBAAuB,IAAI,MAAM,CAMhD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,SAAa,GAAG,OAAO,CAKzF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,sBAAsB,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/dist/hosted/oauth/pat-cache.js

@@ -0,0 +1,42 @@
+import { validatePatForDeployment } from '../../config/hosted.js';
+export const DEFAULT_PAT_REVALIDATE_SECONDS = 15 * 60;
+const MIN_PAT_REVALIDATE_SECONDS = 60;
+const MAX_PAT_REVALIDATE_SECONDS = 24 * 60 * 60;
+export function getPatRevalidateSeconds() {
+    const raw = process.env['CMS_EDIT_PAT_REVALIDATE_SECONDS']?.trim();
+    if (!raw)
+        return DEFAULT_PAT_REVALIDATE_SECONDS;
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isNaN(parsed))
+        return DEFAULT_PAT_REVALIDATE_SECONDS;
+    return Math.min(MAX_PAT_REVALIDATE_SECONDS, Math.max(MIN_PAT_REVALIDATE_SECONDS, parsed));
+}
+export function isCachedPatFresh(record, now = Date.now()) {
+    if (!record.userId || !record.email || !record.lastValidatedAt)
+        return false;
+    const validatedAt = Date.parse(record.lastValidatedAt);
+    if (Number.isNaN(validatedAt))
+        return false;
+    return now - validatedAt < getPatRevalidateSeconds() * 1000;
+}
+/**
+ * Use a cached PAT identity when still fresh; otherwise live-validate against CMA
+ * and rewrite the Redis envelope.
+ */
+export async function resolvePatForDeployment(store, sub, token, deployment) {
+    const record = await store.getContentfulTokenRecord(sub, deployment.spaceId);
+    if (record &&
+        record.token === token &&
+        isCachedPatFresh(record) &&
+        record.userId &&
+        record.email) {
+        return { token, userId: record.userId, email: record.email };
+    }
+    const user = await validatePatForDeployment(token, deployment);
+    await store.storeContentfulToken(sub, user.token, deployment.spaceId, {
+        userId: user.userId,
+        email: user.email,
+    });
+    return user;
+}
+//# sourceMappingURL=pat-cache.js.map

package/dist/hosted/oauth/pat-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pat-cache.js","sourceRoot":"","sources":["../../../src/hosted/oauth/pat-cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAGlE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,CAAC;AACtD,MAAM,0BAA0B,GAAG,EAAE,CAAC;AACtC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,8BAA8B,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA6B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,GAAG,GAAG,WAAW,GAAG,uBAAuB,EAAE,GAAG,IAAI,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAiB,EACjB,GAAW,EACX,KAAa,EACb,UAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7E,IACE,MAAM;QACN,MAAM,CAAC,KAAK,KAAK,KAAK;QACtB,gBAAgB,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,KAAK,EACZ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE;QACpE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/hosted/oauth/refresh.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthStore } from './store.js';
-export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token';
+export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token' | 'invalid_contentful_token';
 export declare class RefreshTokenGrantError extends Error {
     readonly reason: RefreshTokenGrantFailureReason;
     constructor(reason: RefreshTokenGrantFailureReason, message?: string);
@@ -11,6 +11,8 @@ export declare function completeRefreshTokenGrant(store: OAuthStore, input: {
     resource?: string;
     /** Host Contentful space — refresh must not mint a JWT if the CMA cache is gone. */
     spaceId?: string;
+    /** When set, refuse refresh if Contentful rejects the cached CMA token. */
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAoCD"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA0CD"}

package/dist/hosted/oauth/refresh.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { isCachedContentfulTokenError, loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 export class RefreshTokenGrantError extends Error {
     reason;
@@ -22,10 +23,15 @@ export async function completeRefreshTokenGrant(store, input) {
     if (input.resource && input.resource !== record.resource) {
         throw new RefreshTokenGrantError('refresh_resource_mismatch', 'Invalid resource.');
     }
-    const contentfulToken = await store.getContentfulToken(record.sub, input.spaceId);
-    if (!contentfulToken) {
-        await store.revokeRefreshToken(input.refreshToken);
-        throw new RefreshTokenGrantError('missing_contentful_token', 'Contentful session expired. Sign in with Contentful again.');
+    try {
+        await loadAndValidateContentfulToken(store, record.sub, input.spaceId, input.validateContentfulToken);
+    }
+    catch (error) {
+        if (isCachedContentfulTokenError(error)) {
+            await store.revokeRefreshToken(input.refreshToken);
+            throw new RefreshTokenGrantError(error.reason, error.message);
+        }
+        throw error;
     }
     await store.revokeRefreshToken(input.refreshToken);
     const newRefreshToken = randomUUID();

package/dist/hosted/oauth/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAS9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAMC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,EAC1B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAU9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAQC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,8BAA8B,CAClC,KAAK,EACL,MAAM,CAAC,GAAG,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/store.d.ts

@@ -22,6 +22,14 @@ export interface RefreshTokenRecord {
     clientId: string;
     resource: string;
 }
+/** Redis value for a cached CMA PAT. Legacy keys store the raw token string. */
+export interface CachedContentfulToken {
+    token: string;
+    userId?: string;
+    email?: string;
+    lastValidatedAt?: string;
+}
+export declare function parseCachedContentfulToken(raw: unknown): CachedContentfulToken | null;
 /**
  * Contentful CMA token cache key — space-scoped for shared Redis across hosts.
  */
@@ -48,9 +56,17 @@ export interface OAuthStore {
     }>;
     getPendingAuthRequest(authRequestId: string): Promise<PendingAuthRequest | null>;
     saveAuthCode(code: string, record: AuthCodeRecord): Promise<void>;
+    peekAuthCode(code: string): Promise<AuthCodeRecord | null>;
     consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
-    storeContentfulToken(sub: string, token: string, spaceId?: string): Promise<void>;
+    storeContentfulToken(sub: string, token: string, spaceId?: string, identity?: {
+        userId: string;
+        email: string;
+    }): Promise<void>;
     getContentfulToken(sub: string, spaceId?: string): Promise<string | null>;
+    getContentfulTokenRecord(sub: string, spaceId?: string): Promise<CachedContentfulToken | null>;
+    /** Slide CMA TTL only after Contentful accepted the token. */
+    touchContentfulToken(sub: string, spaceId?: string): Promise<void>;
+    deleteContentfulToken(sub: string, spaceId?: string): Promise<void>;
     saveRefreshToken(token: string, record: RefreshTokenRecord): Promise<void>;
     getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
     revokeRefreshToken(token: string): Promise<void>;

package/dist/hosted/oauth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CA6G/D"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAsBrF;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAcD,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC3C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC/F,8DAA8D;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAmJ/D"}

package/dist/hosted/oauth/store.js

@@ -4,6 +4,34 @@ const AUTH_CODE_TTL_SECONDS = 120;
 /** Match MCP refresh lifetime so CMA cache does not die while Grok can still refresh JWTs. */
 export const CONTENTFUL_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
 const REFRESH_TOKEN_TTL_SECONDS = CONTENTFUL_TOKEN_TTL_SECONDS;
+export function parseCachedContentfulToken(raw) {
+    if (typeof raw !== 'string' || raw.length === 0)
+        return null;
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed.token === 'string' && parsed.token.length > 0) {
+                return {
+                    token: parsed.token,
+                    ...(typeof parsed.userId === 'string' ? { userId: parsed.userId } : {}),
+                    ...(typeof parsed.email === 'string' ? { email: parsed.email } : {}),
+                    ...(typeof parsed.lastValidatedAt === 'string'
+                        ? { lastValidatedAt: parsed.lastValidatedAt }
+                        : {}),
+                };
+            }
+        }
+        catch {
+            return null;
+        }
+        return null;
+    }
+    return { token: raw };
+}
+function serializeCachedContentfulToken(record) {
+    return JSON.stringify(record);
+}
 /**
  * Contentful CMA token cache key — space-scoped for shared Redis across hosts.
  */
@@ -31,6 +59,17 @@ export function resolveOAuthSpaceId(explicit) {
 export function refreshTokenKey(token) {
     return `cms-edit:oauth:refresh:${token}`;
 }
+function authCodeKey(code) {
+    return `cms-edit:oauth:code:${code}`;
+}
+function parseAuthCodeRecord(raw) {
+    if (!raw)
+        return null;
+    if (typeof raw === 'string') {
+        return JSON.parse(raw);
+    }
+    return raw;
+}
 export function createOAuthStore(redis) {
     return {
         async registerOAuthClient(input) {
@@ -69,50 +108,85 @@ export function createOAuthStore(redis) {
             return raw;
         },
         async saveAuthCode(code, record) {
-            await redis.set(`cms-edit:oauth:code:${code}`, JSON.stringify(record), {
+            await redis.set(authCodeKey(code), JSON.stringify(record), {
                 ex: AUTH_CODE_TTL_SECONDS,
             });
         },
+        async peekAuthCode(code) {
+            return parseAuthCodeRecord(await redis.get(authCodeKey(code)));
+        },
         async consumeAuthCode(code) {
-            const key = `cms-edit:oauth:code:${code}`;
+            const key = authCodeKey(code);
             const raw = await redis.get(key);
             if (!raw)
                 return null;
             await redis.del(key);
-            if (typeof raw === 'string') {
-                return JSON.parse(raw);
-            }
-            return raw;
+            return parseAuthCodeRecord(raw);
         },
-        async storeContentfulToken(sub, token, spaceId) {
+        async storeContentfulToken(sub, token, spaceId, identity) {
             const resolved = resolveOAuthSpaceId(spaceId);
             if (!resolved) {
                 throw new Error('CONTENTFUL_SPACE_ID (or explicit spaceId) is required to store Contentful OAuth tokens');
             }
             const key = contentfulTokenKey(sub, resolved);
-            await redis.set(key, token, { ex: CONTENTFUL_TOKEN_TTL_SECONDS });
+            const record = {
+                token,
+                ...(identity
+                    ? {
+                        userId: identity.userId,
+                        email: identity.email,
+                        lastValidatedAt: new Date().toISOString(),
+                    }
+                    : {}),
+            };
+            await redis.set(key, serializeCachedContentfulToken(record), {
+                ex: CONTENTFUL_TOKEN_TTL_SECONDS,
+            });
         },
         async getContentfulToken(sub, spaceId) {
+            const record = await this.getContentfulTokenRecord(sub, spaceId);
+            return record?.token ?? null;
+        },
+        async getContentfulTokenRecord(sub, spaceId) {
             const resolved = resolveOAuthSpaceId(spaceId);
             if (!resolved) {
                 return null;
             }
             const key = contentfulTokenKey(sub, resolved);
-            const token = await redis.get(key);
-            if (typeof token === 'string' && token.length > 0) {
-                // Sliding TTL: active MCP use keeps the Contentful link alive across deploys.
-                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
-                return token;
-            }
+            const scoped = parseCachedContentfulToken(await redis.get(key));
+            if (scoped)
+                return scoped;
             // Soft cutover: pre-3.4.5 unscoped tokens (same Redis / shared cmsedit-sessions).
             // Migrate into the space-scoped key so subsequent hosts stay isolated.
-            const legacy = await redis.get(legacyContentfulTokenKey(sub));
-            if (typeof legacy === 'string' && legacy.length > 0) {
-                await redis.set(key, legacy, { ex: CONTENTFUL_TOKEN_TTL_SECONDS });
+            const legacyRaw = await redis.get(legacyContentfulTokenKey(sub));
+            const legacy = parseCachedContentfulToken(legacyRaw);
+            if (legacy) {
+                await redis.set(key, serializeCachedContentfulToken(legacy), {
+                    ex: CONTENTFUL_TOKEN_TTL_SECONDS,
+                });
                 return legacy;
             }
             return null;
         },
+        async touchContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            if (!resolved) {
+                return;
+            }
+            const key = contentfulTokenKey(sub, resolved);
+            const token = await redis.get(key);
+            if (typeof token === 'string' && token.length > 0) {
+                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
+            }
+        },
+        async deleteContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            const keys = [legacyContentfulTokenKey(sub)];
+            if (resolved) {
+                keys.unshift(contentfulTokenKey(sub, resolved));
+            }
+            await Promise.all(keys.map((key) => redis.del(key)));
+        },
         async saveRefreshToken(token, record) {
             await redis.set(refreshTokenKey(token), JSON.stringify(record), {
                 ex: REFRESH_TOKEN_TTL_SECONDS,