@shipfox/api-integration-jira 4.0.0 → 5.0.0

package/dist/core/install.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/install.ts"],"sourcesContent":["import type {UserContextMembership} from '@shipfox/api-auth-context';\nimport type {IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {JiraAccessibleResource, JiraApiClient, JiraAuthorization} from '#api/client.js';\nimport type {JiraPendingSelectionStore} from '#core/pending.js';\nimport type {JiraTokenStore} from '#core/tokens.js';\nimport {\n  JiraInstallationAlreadyLinkedError,\n  JiraInstallStateActorMismatchError,\n  JiraIntegrationProviderError,\n  JiraOAuthCallbackError,\n  JiraOfflineAccessNotGrantedError,\n  JiraPendingSelectionNotFoundError,\n  JiraSiteSelectionMismatchError,\n} from './errors.js';\nimport {assertJiraAuthorizationScopes} from './scopes.js';\nimport {verifyJiraInstallState} from './state.js';\n\nexport interface ConnectJiraInstallationInput {\n  workspaceId: string;\n  cloudId: string;\n  siteUrl: string;\n  siteName: string;\n  authorizingAccountId: string;\n  scopes: string[];\n  tokenExpiresAt: Date | null;\n  displayName: string;\n}\n\nexport interface HandleJiraCallbackParams {\n  jira: JiraApiClient;\n  tokenStore: Pick<JiraTokenStore, 'storeTokens'>;\n  pendingStore: Pick<JiraPendingSelectionStore, 'save' | 'load' | 'clear'>;\n  code: string;\n  state: string;\n  sessionUserId: string;\n  sessionMemberships: ReadonlyArray<UserContextMembership>;\n  requireWorkspaceMembership(input: {\n    workspaceId: string;\n    userId: string;\n    memberships: ReadonlyArray<UserContextMembership>;\n  }): Promise<unknown>;\n  getExistingJiraConnection(input: {\n    cloudId: string;\n  }): Promise<IntegrationConnection<'jira'> | undefined>;\n  connectJiraInstallation(\n    input: ConnectJiraInstallationInput,\n  ): Promise<IntegrationConnection<'jira'>>;\n  disconnectJiraInstallation(input: {connectionId: string}): Promise<void>;\n}\n\nexport async function handleJiraCallback(\n  params: HandleJiraCallbackParams,\n): Promise<IntegrationConnection<'jira'> | {sites: JiraAccessibleResource[]}> {\n  const claims = await verifyClaims(params, params.state);\n  const authorization = await params.jira.exchangeAuthorizationCode({code: params.code});\n  if (!authorization.refreshToken) throw new JiraOfflineAccessNotGrantedError();\n  const sites = await params.jira.getAccessibleResources({accessToken: authorization.accessToken});\n  if (sites.length === 0)\n    throw new JiraIntegrationProviderError(\n      'access-denied',\n      'Jira authorization did not grant access to a site',\n    );\n  if (sites.length > 1) {\n    await params.pendingStore.save({\n      workspaceId: claims.workspaceId,\n      state: params.state,\n      authorization,\n      sites,\n    });\n    return {sites};\n  }\n  const site = sites[0];\n  if (!site) {\n    throw new JiraIntegrationProviderError(\n      'malformed-provider-response',\n      'Jira accessible-resources response did not contain a selected site',\n    );\n  }\n  assertJiraAuthorizationScopes(site.scopes);\n  return resolveJiraSite({...params, authorization, site, claims});\n}\n\nexport async function handleJiraSiteSelection(\n  params: Omit<HandleJiraCallbackParams, 'code'> & {cloudId: string},\n): Promise<IntegrationConnection<'jira'>> {\n  const claims = await verifyClaims(params, params.state);\n  const pending = await params.pendingStore.load({\n    workspaceId: claims.workspaceId,\n    state: params.state,\n  });\n  if (!pending) throw new JiraPendingSelectionNotFoundError();\n  const site = pending.sites.find((candidate) => candidate.cloudId === params.cloudId);\n  if (!site) throw new JiraSiteSelectionMismatchError(params.cloudId);\n  assertJiraAuthorizationScopes(site.scopes);\n  const connection = await resolveJiraSite({\n    ...params,\n    authorization: pending.authorization,\n    site,\n    claims,\n  });\n  await params.pendingStore.clear({workspaceId: claims.workspaceId, state: params.state});\n  return connection;\n}\n\nexport async function handleJiraOAuthCallbackError(params: {\n  state: string;\n  error: string;\n  errorDescription?: string | undefined;\n  sessionUserId: string;\n  sessionMemberships: ReadonlyArray<UserContextMembership>;\n  requireWorkspaceMembership(input: {\n    workspaceId: string;\n    userId: string;\n    memberships: ReadonlyArray<UserContextMembership>;\n  }): Promise<unknown>;\n}): Promise<never> {\n  await verifyClaims(params, params.state);\n  throw new JiraOAuthCallbackError(params.error, params.errorDescription);\n}\n\nasync function verifyClaims(\n  params: Pick<\n    HandleJiraCallbackParams,\n    'sessionUserId' | 'sessionMemberships' | 'requireWorkspaceMembership'\n  >,\n  state: string,\n) {\n  const claims = verifyJiraInstallState(state);\n  if (claims.userId !== params.sessionUserId) throw new JiraInstallStateActorMismatchError();\n  await params.requireWorkspaceMembership({\n    workspaceId: claims.workspaceId,\n    userId: claims.userId,\n    memberships: params.sessionMemberships,\n  });\n  return claims;\n}\n\nasync function resolveJiraSite(\n  params: Omit<HandleJiraCallbackParams, 'code'> & {\n    authorization: JiraAuthorization;\n    site: JiraAccessibleResource;\n    claims: {workspaceId: string; userId: string};\n  },\n): Promise<IntegrationConnection<'jira'>> {\n  const existing = await params.getExistingJiraConnection({cloudId: params.site.cloudId});\n  if (existing && existing.workspaceId !== params.claims.workspaceId)\n    throw new JiraInstallationAlreadyLinkedError(params.site.cloudId);\n  let connectionId: string | undefined;\n  try {\n    const identity = await params.jira.getMyself({\n      accessToken: params.authorization.accessToken,\n      cloudId: params.site.cloudId,\n    });\n    const connection = await params.connectJiraInstallation({\n      workspaceId: params.claims.workspaceId,\n      cloudId: params.site.cloudId,\n      siteUrl: params.site.url,\n      siteName: params.site.name,\n      authorizingAccountId: identity.accountId,\n      scopes: params.site.scopes,\n      tokenExpiresAt: params.authorization.expiresAt ?? null,\n      displayName: `Jira ${params.site.name}`,\n    });\n    connectionId = connection.id;\n    await params.tokenStore.storeTokens({\n      connectionId: connection.id,\n      accessToken: params.authorization.accessToken,\n      refreshToken: params.authorization.refreshToken,\n      editedBy: params.claims.userId,\n    });\n    return connection;\n  } catch (error) {\n    if (connectionId && !existing) await bestEffortDisconnect(params, connectionId);\n    throw error;\n  }\n}\n\nasync function bestEffortDisconnect(\n  params: Pick<HandleJiraCallbackParams, 'disconnectJiraInstallation'>,\n  connectionId: string,\n): Promise<void> {\n  try {\n    await params.disconnectJiraInstallation({connectionId});\n  } catch (error) {\n    logger().warn(\n      {err: error, connectionId},\n      'Jira connect compensation failed after token storage rejection',\n    );\n  }\n}\n"],"names":["logger","JiraInstallationAlreadyLinkedError","JiraInstallStateActorMismatchError","JiraIntegrationProviderError","JiraOAuthCallbackError","JiraOfflineAccessNotGrantedError","JiraPendingSelectionNotFoundError","JiraSiteSelectionMismatchError","assertJiraAuthorizationScopes","verifyJiraInstallState","handleJiraCallback","params","claims","verifyClaims","state","authorization","jira","exchangeAuthorizationCode","code","refreshToken","sites","getAccessibleResources","accessToken","length","pendingStore","save","workspaceId","site","scopes","resolveJiraSite","handleJiraSiteSelection","pending","load","find","candidate","cloudId","connection","clear","handleJiraOAuthCallbackError","error","errorDescription","userId","sessionUserId","requireWorkspaceMembership","memberships","sessionMemberships","existing","getExistingJiraConnection","connectionId","identity","getMyself","connectJiraInstallation","siteUrl","url","siteName","name","authorizingAccountId","accountId","tokenExpiresAt","expiresAt","displayName","id","tokenStore","storeTokens","editedBy","bestEffortDisconnect","disconnectJiraInstallation","warn","err"],"mappings":"AAEA,SAAQA,MAAM,QAAO,8BAA8B;AAInD,SACEC,kCAAkC,EAClCC,kCAAkC,EAClCC,4BAA4B,EAC5BC,sBAAsB,EACtBC,gCAAgC,EAChCC,iCAAiC,EACjCC,8BAA8B,QACzB,cAAc;AACrB,SAAQC,6BAA6B,QAAO,cAAc;AAC1D,SAAQC,sBAAsB,QAAO,aAAa;AAmClD,OAAO,eAAeC,mBACpBC,MAAgC;IAEhC,MAAMC,SAAS,MAAMC,aAAaF,QAAQA,OAAOG,KAAK;IACtD,MAAMC,gBAAgB,MAAMJ,OAAOK,IAAI,CAACC,yBAAyB,CAAC;QAACC,MAAMP,OAAOO,IAAI;IAAA;IACpF,IAAI,CAACH,cAAcI,YAAY,EAAE,MAAM,IAAId;IAC3C,MAAMe,QAAQ,MAAMT,OAAOK,IAAI,CAACK,sBAAsB,CAAC;QAACC,aAAaP,cAAcO,WAAW;IAAA;IAC9F,IAAIF,MAAMG,MAAM,KAAK,GACnB,MAAM,IAAIpB,6BACR,iBACA;IAEJ,IAAIiB,MAAMG,MAAM,GAAG,GAAG;QACpB,MAAMZ,OAAOa,YAAY,CAACC,IAAI,CAAC;YAC7BC,aAAad,OAAOc,WAAW;YAC/BZ,OAAOH,OAAOG,KAAK;YACnBC;YACAK;QACF;QACA,OAAO;YAACA;QAAK;IACf;IACA,MAAMO,OAAOP,KAAK,CAAC,EAAE;IACrB,IAAI,CAACO,MAAM;QACT,MAAM,IAAIxB,6BACR,+BACA;IAEJ;IACAK,8BAA8BmB,KAAKC,MAAM;IACzC,OAAOC,gBAAgB;QAAC,GAAGlB,MAAM;QAAEI;QAAeY;QAAMf;IAAM;AAChE;AAEA,OAAO,eAAekB,wBACpBnB,MAAkE;IAElE,MAAMC,SAAS,MAAMC,aAAaF,QAAQA,OAAOG,KAAK;IACtD,MAAMiB,UAAU,MAAMpB,OAAOa,YAAY,CAACQ,IAAI,CAAC;QAC7CN,aAAad,OAAOc,WAAW;QAC/BZ,OAAOH,OAAOG,KAAK;IACrB;IACA,IAAI,CAACiB,SAAS,MAAM,IAAIzB;IACxB,MAAMqB,OAAOI,QAAQX,KAAK,CAACa,IAAI,CAAC,CAACC,YAAcA,UAAUC,OAAO,KAAKxB,OAAOwB,OAAO;IACnF,IAAI,CAACR,MAAM,MAAM,IAAIpB,+BAA+BI,OAAOwB,OAAO;IAClE3B,8BAA8BmB,KAAKC,MAAM;IACzC,MAAMQ,aAAa,MAAMP,gBAAgB;QACvC,GAAGlB,MAAM;QACTI,eAAegB,QAAQhB,aAAa;QACpCY;QACAf;IACF;IACA,MAAMD,OAAOa,YAAY,CAACa,KAAK,CAAC;QAACX,aAAad,OAAOc,WAAW;QAAEZ,OAAOH,OAAOG,KAAK;IAAA;IACrF,OAAOsB;AACT;AAEA,OAAO,eAAeE,6BAA6B3B,MAWlD;IACC,MAAME,aAAaF,QAAQA,OAAOG,KAAK;IACvC,MAAM,IAAIV,uBAAuBO,OAAO4B,KAAK,EAAE5B,OAAO6B,gBAAgB;AACxE;AAEA,eAAe3B,aACbF,MAGC,EACDG,KAAa;IAEb,MAAMF,SAASH,uBAAuBK;IACtC,IAAIF,OAAO6B,MAAM,KAAK9B,OAAO+B,aAAa,EAAE,MAAM,IAAIxC;IACtD,MAAMS,OAAOgC,0BAA0B,CAAC;QACtCjB,aAAad,OAAOc,WAAW;QAC/Be,QAAQ7B,OAAO6B,MAAM;QACrBG,aAAajC,OAAOkC,kBAAkB;IACxC;IACA,OAAOjC;AACT;AAEA,eAAeiB,gBACblB,MAIC;IAED,MAAMmC,WAAW,MAAMnC,OAAOoC,yBAAyB,CAAC;QAACZ,SAASxB,OAAOgB,IAAI,CAACQ,OAAO;IAAA;IACrF,IAAIW,YAAYA,SAASpB,WAAW,KAAKf,OAAOC,MAAM,CAACc,WAAW,EAChE,MAAM,IAAIzB,mCAAmCU,OAAOgB,IAAI,CAACQ,OAAO;IAClE,IAAIa;IACJ,IAAI;QACF,MAAMC,WAAW,MAAMtC,OAAOK,IAAI,CAACkC,SAAS,CAAC;YAC3C5B,aAAaX,OAAOI,aAAa,CAACO,WAAW;YAC7Ca,SAASxB,OAAOgB,IAAI,CAACQ,OAAO;QAC9B;QACA,MAAMC,aAAa,MAAMzB,OAAOwC,uBAAuB,CAAC;YACtDzB,aAAaf,OAAOC,MAAM,CAACc,WAAW;YACtCS,SAASxB,OAAOgB,IAAI,CAACQ,OAAO;YAC5BiB,SAASzC,OAAOgB,IAAI,CAAC0B,GAAG;YACxBC,UAAU3C,OAAOgB,IAAI,CAAC4B,IAAI;YAC1BC,sBAAsBP,SAASQ,SAAS;YACxC7B,QAAQjB,OAAOgB,IAAI,CAACC,MAAM;YAC1B8B,gBAAgB/C,OAAOI,aAAa,CAAC4C,SAAS,IAAI;YAClDC,aAAa,CAAC,KAAK,EAAEjD,OAAOgB,IAAI,CAAC4B,IAAI,EAAE;QACzC;QACAP,eAAeZ,WAAWyB,EAAE;QAC5B,MAAMlD,OAAOmD,UAAU,CAACC,WAAW,CAAC;YAClCf,cAAcZ,WAAWyB,EAAE;YAC3BvC,aAAaX,OAAOI,aAAa,CAACO,WAAW;YAC7CH,cAAcR,OAAOI,aAAa,CAACI,YAAY;YAC/C6C,UAAUrD,OAAOC,MAAM,CAAC6B,MAAM;QAChC;QACA,OAAOL;IACT,EAAE,OAAOG,OAAO;QACd,IAAIS,gBAAgB,CAACF,UAAU,MAAMmB,qBAAqBtD,QAAQqC;QAClE,MAAMT;IACR;AACF;AAEA,eAAe0B,qBACbtD,MAAoE,EACpEqC,YAAoB;IAEpB,IAAI;QACF,MAAMrC,OAAOuD,0BAA0B,CAAC;YAAClB;QAAY;IACvD,EAAE,OAAOT,OAAO;QACdvC,SAASmE,IAAI,CACX;YAACC,KAAK7B;YAAOS;QAAY,GACzB;IAEJ;AACF"}

package/dist/core/pending.d.ts

@@ -0,0 +1,43 @@
+import type { JiraAccessibleResource, JiraAuthorization } from '#api/client.js';
+export interface JiraPendingSelectionSecretsStore {
+    getSecret(params: {
+        workspaceId: string;
+        namespace: string;
+        key: string;
+    }): Promise<string | null>;
+    setSecrets(params: {
+        workspaceId: string;
+        namespace: string;
+        values: Record<string, string>;
+        editedBy?: string | null | undefined;
+    }): Promise<void>;
+    deleteSecrets(params: {
+        workspaceId: string;
+        namespace: string;
+    }): Promise<number>;
+}
+export interface JiraPendingSelectionStore {
+    save(params: {
+        workspaceId: string;
+        state: string;
+        authorization: JiraAuthorization;
+        sites: JiraAccessibleResource[];
+    }): Promise<void>;
+    load(params: {
+        workspaceId: string;
+        state: string;
+    }): Promise<{
+        authorization: JiraAuthorization;
+        sites: JiraAccessibleResource[];
+    } | undefined>;
+    clear(params: {
+        workspaceId: string;
+        state: string;
+    }): Promise<void>;
+    pruneExpiredPendingSelections(now: Date): Promise<void>;
+}
+export declare function jiraPendingSecretsNamespace(state: string): string;
+export declare function createJiraPendingSelectionStore(params: {
+    secrets: JiraPendingSelectionSecretsStore;
+}): JiraPendingSelectionStore;
+//# sourceMappingURL=pending.d.ts.map

package/dist/core/pending.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.d.ts","sourceRoot":"","sources":["../../src/core/pending.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,sBAAsB,EAAE,iBAAiB,EAAC,MAAM,gBAAgB,CAAC;AAa9E,MAAM,WAAW,gCAAgC;IAC/C,SAAS,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjG,UAAU,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,aAAa,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,MAAM,EAAE;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,iBAAiB,CAAC;QACjC,KAAK,EAAE,sBAAsB,EAAE,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC,MAAM,EAAE;QACX,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAC,aAAa,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,sBAAsB,EAAE,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IAC7F,KAAK,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,6BAA6B,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,OAAO,EAAE,gCAAgC,CAAC;CAC3C,GAAG,yBAAyB,CA+F5B"}

package/dist/core/pending.js

@@ -0,0 +1,107 @@
+import { createHash } from 'node:crypto';
+import { deleteJiraPendingSelection, getJiraPendingSelection, listExpiredJiraPendingSelections, saveJiraPendingSelection } from '#db/pending-selections.js';
+const PENDING_SELECTION_TTL_MS = 30 * 60 * 1000;
+const ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';
+const REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';
+const TOKEN_EXPIRES_AT_KEY = 'TOKEN_EXPIRES_AT';
+export function jiraPendingSecretsNamespace(state) {
+    return `system/integrations/jira/pending/${stateHash(state)}`;
+}
+export function createJiraPendingSelectionStore(params) {
+    async function clear(input) {
+        const hash = stateHash(input.state);
+        await Promise.all([
+            deleteJiraPendingSelection({
+                stateHash: hash,
+                workspaceId: input.workspaceId
+            }),
+            params.secrets.deleteSecrets({
+                workspaceId: input.workspaceId,
+                namespace: jiraPendingSecretsNamespace(input.state)
+            })
+        ]);
+    }
+    return {
+        async save (input) {
+            const expiresAt = new Date(Date.now() + PENDING_SELECTION_TTL_MS);
+            const values = {
+                [ACCESS_TOKEN_KEY]: input.authorization.accessToken
+            };
+            if (input.authorization.refreshToken) values[REFRESH_TOKEN_KEY] = input.authorization.refreshToken;
+            if (input.authorization.expiresAt) values[TOKEN_EXPIRES_AT_KEY] = input.authorization.expiresAt.toISOString();
+            await params.secrets.setSecrets({
+                workspaceId: input.workspaceId,
+                namespace: jiraPendingSecretsNamespace(input.state),
+                values
+            });
+            await saveJiraPendingSelection({
+                stateHash: stateHash(input.state),
+                workspaceId: input.workspaceId,
+                expiresAt,
+                sites: input.sites
+            });
+        },
+        async load (input) {
+            const pending = await getJiraPendingSelection({
+                stateHash: stateHash(input.state),
+                workspaceId: input.workspaceId
+            });
+            if (!pending) return undefined;
+            if (pending.expiresAt < new Date()) {
+                await clear(input);
+                return undefined;
+            }
+            const namespace = jiraPendingSecretsNamespace(input.state);
+            const [accessToken, refreshToken, tokenExpiresAt] = await Promise.all([
+                params.secrets.getSecret({
+                    workspaceId: input.workspaceId,
+                    namespace,
+                    key: ACCESS_TOKEN_KEY
+                }),
+                params.secrets.getSecret({
+                    workspaceId: input.workspaceId,
+                    namespace,
+                    key: REFRESH_TOKEN_KEY
+                }),
+                params.secrets.getSecret({
+                    workspaceId: input.workspaceId,
+                    namespace,
+                    key: TOKEN_EXPIRES_AT_KEY
+                })
+            ]);
+            if (!accessToken || !refreshToken) {
+                await clear(input);
+                return undefined;
+            }
+            const expiresAt = tokenExpiresAt ? new Date(tokenExpiresAt) : undefined;
+            return {
+                authorization: {
+                    accessToken,
+                    refreshToken,
+                    expiresAt: expiresAt && !Number.isNaN(expiresAt.getTime()) ? expiresAt : undefined,
+                    scopes: []
+                },
+                sites: pending.sites
+            };
+        },
+        clear,
+        async pruneExpiredPendingSelections (now) {
+            const expired = await listExpiredJiraPendingSelections(now);
+            await Promise.all(expired.map(async (pending)=>{
+                await params.secrets.deleteSecrets({
+                    workspaceId: pending.workspaceId,
+                    namespace: `system/integrations/jira/pending/${pending.stateHash}`
+                });
+                await deleteJiraPendingSelection({
+                    stateHash: pending.stateHash,
+                    workspaceId: pending.workspaceId
+                });
+            }));
+        }
+    };
+}
+function stateHash(state) {
+    return createHash('sha256').update(state).digest('hex');
+}
+
+//# sourceMappingURL=pending.js.map

package/dist/core/pending.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/pending.ts"],"sourcesContent":["import {createHash} from 'node:crypto';\nimport type {JiraAccessibleResource, JiraAuthorization} from '#api/client.js';\nimport {\n  deleteJiraPendingSelection,\n  getJiraPendingSelection,\n  listExpiredJiraPendingSelections,\n  saveJiraPendingSelection,\n} from '#db/pending-selections.js';\n\nconst PENDING_SELECTION_TTL_MS = 30 * 60 * 1000;\nconst ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';\nconst REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';\nconst TOKEN_EXPIRES_AT_KEY = 'TOKEN_EXPIRES_AT';\n\nexport interface JiraPendingSelectionSecretsStore {\n  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;\n  setSecrets(params: {\n    workspaceId: string;\n    namespace: string;\n    values: Record<string, string>;\n    editedBy?: string | null | undefined;\n  }): Promise<void>;\n  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;\n}\n\nexport interface JiraPendingSelectionStore {\n  save(params: {\n    workspaceId: string;\n    state: string;\n    authorization: JiraAuthorization;\n    sites: JiraAccessibleResource[];\n  }): Promise<void>;\n  load(params: {\n    workspaceId: string;\n    state: string;\n  }): Promise<{authorization: JiraAuthorization; sites: JiraAccessibleResource[]} | undefined>;\n  clear(params: {workspaceId: string; state: string}): Promise<void>;\n  pruneExpiredPendingSelections(now: Date): Promise<void>;\n}\n\nexport function jiraPendingSecretsNamespace(state: string): string {\n  return `system/integrations/jira/pending/${stateHash(state)}`;\n}\n\nexport function createJiraPendingSelectionStore(params: {\n  secrets: JiraPendingSelectionSecretsStore;\n}): JiraPendingSelectionStore {\n  async function clear(input: {workspaceId: string; state: string}): Promise<void> {\n    const hash = stateHash(input.state);\n    await Promise.all([\n      deleteJiraPendingSelection({stateHash: hash, workspaceId: input.workspaceId}),\n      params.secrets.deleteSecrets({\n        workspaceId: input.workspaceId,\n        namespace: jiraPendingSecretsNamespace(input.state),\n      }),\n    ]);\n  }\n\n  return {\n    async save(input) {\n      const expiresAt = new Date(Date.now() + PENDING_SELECTION_TTL_MS);\n      const values: Record<string, string> = {[ACCESS_TOKEN_KEY]: input.authorization.accessToken};\n      if (input.authorization.refreshToken)\n        values[REFRESH_TOKEN_KEY] = input.authorization.refreshToken;\n      if (input.authorization.expiresAt)\n        values[TOKEN_EXPIRES_AT_KEY] = input.authorization.expiresAt.toISOString();\n      await params.secrets.setSecrets({\n        workspaceId: input.workspaceId,\n        namespace: jiraPendingSecretsNamespace(input.state),\n        values,\n      });\n      await saveJiraPendingSelection({\n        stateHash: stateHash(input.state),\n        workspaceId: input.workspaceId,\n        expiresAt,\n        sites: input.sites,\n      });\n    },\n\n    async load(input) {\n      const pending = await getJiraPendingSelection({\n        stateHash: stateHash(input.state),\n        workspaceId: input.workspaceId,\n      });\n      if (!pending) return undefined;\n      if (pending.expiresAt < new Date()) {\n        await clear(input);\n        return undefined;\n      }\n      const namespace = jiraPendingSecretsNamespace(input.state);\n      const [accessToken, refreshToken, tokenExpiresAt] = await Promise.all([\n        params.secrets.getSecret({\n          workspaceId: input.workspaceId,\n          namespace,\n          key: ACCESS_TOKEN_KEY,\n        }),\n        params.secrets.getSecret({\n          workspaceId: input.workspaceId,\n          namespace,\n          key: REFRESH_TOKEN_KEY,\n        }),\n        params.secrets.getSecret({\n          workspaceId: input.workspaceId,\n          namespace,\n          key: TOKEN_EXPIRES_AT_KEY,\n        }),\n      ]);\n      if (!accessToken || !refreshToken) {\n        await clear(input);\n        return undefined;\n      }\n      const expiresAt = tokenExpiresAt ? new Date(tokenExpiresAt) : undefined;\n      return {\n        authorization: {\n          accessToken,\n          refreshToken,\n          expiresAt: expiresAt && !Number.isNaN(expiresAt.getTime()) ? expiresAt : undefined,\n          scopes: [],\n        },\n        sites: pending.sites,\n      };\n    },\n\n    clear,\n\n    async pruneExpiredPendingSelections(now) {\n      const expired = await listExpiredJiraPendingSelections(now);\n      await Promise.all(\n        expired.map(async (pending) => {\n          await params.secrets.deleteSecrets({\n            workspaceId: pending.workspaceId,\n            namespace: `system/integrations/jira/pending/${pending.stateHash}`,\n          });\n          await deleteJiraPendingSelection({\n            stateHash: pending.stateHash,\n            workspaceId: pending.workspaceId,\n          });\n        }),\n      );\n    },\n  };\n}\n\nfunction stateHash(state: string): string {\n  return createHash('sha256').update(state).digest('hex');\n}\n"],"names":["createHash","deleteJiraPendingSelection","getJiraPendingSelection","listExpiredJiraPendingSelections","saveJiraPendingSelection","PENDING_SELECTION_TTL_MS","ACCESS_TOKEN_KEY","REFRESH_TOKEN_KEY","TOKEN_EXPIRES_AT_KEY","jiraPendingSecretsNamespace","state","stateHash","createJiraPendingSelectionStore","params","clear","input","hash","Promise","all","workspaceId","secrets","deleteSecrets","namespace","save","expiresAt","Date","now","values","authorization","accessToken","refreshToken","toISOString","setSecrets","sites","load","pending","undefined","tokenExpiresAt","getSecret","key","Number","isNaN","getTime","scopes","pruneExpiredPendingSelections","expired","map","update","digest"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AAEvC,SACEC,0BAA0B,EAC1BC,uBAAuB,EACvBC,gCAAgC,EAChCC,wBAAwB,QACnB,4BAA4B;AAEnC,MAAMC,2BAA2B,KAAK,KAAK;AAC3C,MAAMC,mBAAmB;AACzB,MAAMC,oBAAoB;AAC1B,MAAMC,uBAAuB;AA4B7B,OAAO,SAASC,4BAA4BC,KAAa;IACvD,OAAO,CAAC,iCAAiC,EAAEC,UAAUD,QAAQ;AAC/D;AAEA,OAAO,SAASE,gCAAgCC,MAE/C;IACC,eAAeC,MAAMC,KAA2C;QAC9D,MAAMC,OAAOL,UAAUI,MAAML,KAAK;QAClC,MAAMO,QAAQC,GAAG,CAAC;YAChBjB,2BAA2B;gBAACU,WAAWK;gBAAMG,aAAaJ,MAAMI,WAAW;YAAA;YAC3EN,OAAOO,OAAO,CAACC,aAAa,CAAC;gBAC3BF,aAAaJ,MAAMI,WAAW;gBAC9BG,WAAWb,4BAA4BM,MAAML,KAAK;YACpD;SACD;IACH;IAEA,OAAO;QACL,MAAMa,MAAKR,KAAK;YACd,MAAMS,YAAY,IAAIC,KAAKA,KAAKC,GAAG,KAAKrB;YACxC,MAAMsB,SAAiC;gBAAC,CAACrB,iBAAiB,EAAES,MAAMa,aAAa,CAACC,WAAW;YAAA;YAC3F,IAAId,MAAMa,aAAa,CAACE,YAAY,EAClCH,MAAM,CAACpB,kBAAkB,GAAGQ,MAAMa,aAAa,CAACE,YAAY;YAC9D,IAAIf,MAAMa,aAAa,CAACJ,SAAS,EAC/BG,MAAM,CAACnB,qBAAqB,GAAGO,MAAMa,aAAa,CAACJ,SAAS,CAACO,WAAW;YAC1E,MAAMlB,OAAOO,OAAO,CAACY,UAAU,CAAC;gBAC9Bb,aAAaJ,MAAMI,WAAW;gBAC9BG,WAAWb,4BAA4BM,MAAML,KAAK;gBAClDiB;YACF;YACA,MAAMvB,yBAAyB;gBAC7BO,WAAWA,UAAUI,MAAML,KAAK;gBAChCS,aAAaJ,MAAMI,WAAW;gBAC9BK;gBACAS,OAAOlB,MAAMkB,KAAK;YACpB;QACF;QAEA,MAAMC,MAAKnB,KAAK;YACd,MAAMoB,UAAU,MAAMjC,wBAAwB;gBAC5CS,WAAWA,UAAUI,MAAML,KAAK;gBAChCS,aAAaJ,MAAMI,WAAW;YAChC;YACA,IAAI,CAACgB,SAAS,OAAOC;YACrB,IAAID,QAAQX,SAAS,GAAG,IAAIC,QAAQ;gBAClC,MAAMX,MAAMC;gBACZ,OAAOqB;YACT;YACA,MAAMd,YAAYb,4BAA4BM,MAAML,KAAK;YACzD,MAAM,CAACmB,aAAaC,cAAcO,eAAe,GAAG,MAAMpB,QAAQC,GAAG,CAAC;gBACpEL,OAAOO,OAAO,CAACkB,SAAS,CAAC;oBACvBnB,aAAaJ,MAAMI,WAAW;oBAC9BG;oBACAiB,KAAKjC;gBACP;gBACAO,OAAOO,OAAO,CAACkB,SAAS,CAAC;oBACvBnB,aAAaJ,MAAMI,WAAW;oBAC9BG;oBACAiB,KAAKhC;gBACP;gBACAM,OAAOO,OAAO,CAACkB,SAAS,CAAC;oBACvBnB,aAAaJ,MAAMI,WAAW;oBAC9BG;oBACAiB,KAAK/B;gBACP;aACD;YACD,IAAI,CAACqB,eAAe,CAACC,cAAc;gBACjC,MAAMhB,MAAMC;gBACZ,OAAOqB;YACT;YACA,MAAMZ,YAAYa,iBAAiB,IAAIZ,KAAKY,kBAAkBD;YAC9D,OAAO;gBACLR,eAAe;oBACbC;oBACAC;oBACAN,WAAWA,aAAa,CAACgB,OAAOC,KAAK,CAACjB,UAAUkB,OAAO,MAAMlB,YAAYY;oBACzEO,QAAQ,EAAE;gBACZ;gBACAV,OAAOE,QAAQF,KAAK;YACtB;QACF;QAEAnB;QAEA,MAAM8B,+BAA8BlB,GAAG;YACrC,MAAMmB,UAAU,MAAM1C,iCAAiCuB;YACvD,MAAMT,QAAQC,GAAG,CACf2B,QAAQC,GAAG,CAAC,OAAOX;gBACjB,MAAMtB,OAAOO,OAAO,CAACC,aAAa,CAAC;oBACjCF,aAAagB,QAAQhB,WAAW;oBAChCG,WAAW,CAAC,iCAAiC,EAAEa,QAAQxB,SAAS,EAAE;gBACpE;gBACA,MAAMV,2BAA2B;oBAC/BU,WAAWwB,QAAQxB,SAAS;oBAC5BQ,aAAagB,QAAQhB,WAAW;gBAClC;YACF;QAEJ;IACF;AACF;AAEA,SAASR,UAAUD,KAAa;IAC9B,OAAOV,WAAW,UAAU+C,MAAM,CAACrC,OAAOsC,MAAM,CAAC;AACnD"}

package/dist/core/scopes.d.ts

@@ -0,0 +1,4 @@
+export declare const JIRA_OAUTH_SCOPES: readonly ["read:jira-work", "write:jira-work", "read:jira-user", "manage:jira-webhook", "offline_access"];
+export declare function formatJiraOAuthScopes(): string;
+export declare function assertJiraAuthorizationScopes(scopes: readonly string[]): void;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/core/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/core/scopes.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,iBAAiB,2GAMpB,CAAC;AAEX,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAI7E"}

package/dist/core/scopes.js

@@ -0,0 +1,23 @@
+import { logger } from '@shipfox/node-opentelemetry';
+import { JiraAuthorizationScopeMismatchError } from './errors.js';
+export const JIRA_OAUTH_SCOPES = [
+    'read:jira-work',
+    'write:jira-work',
+    'read:jira-user',
+    'manage:jira-webhook',
+    'offline_access'
+];
+export function formatJiraOAuthScopes() {
+    return JIRA_OAUTH_SCOPES.join(' ');
+}
+export function assertJiraAuthorizationScopes(scopes) {
+    const usableScopes = scopes.filter((scope)=>scope.trim().length > 0);
+    if (usableScopes.length === 0) throw new JiraAuthorizationScopeMismatchError([
+        'site scopes'
+    ]);
+    logger().info({
+        scopes: usableScopes
+    }, 'Jira site authorization scopes granted');
+}
+
+//# sourceMappingURL=scopes.js.map

package/dist/core/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/scopes.ts"],"sourcesContent":["import {logger} from '@shipfox/node-opentelemetry';\nimport {JiraAuthorizationScopeMismatchError} from './errors.js';\n\nexport const JIRA_OAUTH_SCOPES = [\n  'read:jira-work',\n  'write:jira-work',\n  'read:jira-user',\n  'manage:jira-webhook',\n  'offline_access',\n] as const;\n\nexport function formatJiraOAuthScopes(): string {\n  return JIRA_OAUTH_SCOPES.join(' ');\n}\n\nexport function assertJiraAuthorizationScopes(scopes: readonly string[]): void {\n  const usableScopes = scopes.filter((scope) => scope.trim().length > 0);\n  if (usableScopes.length === 0) throw new JiraAuthorizationScopeMismatchError(['site scopes']);\n  logger().info({scopes: usableScopes}, 'Jira site authorization scopes granted');\n}\n"],"names":["logger","JiraAuthorizationScopeMismatchError","JIRA_OAUTH_SCOPES","formatJiraOAuthScopes","join","assertJiraAuthorizationScopes","scopes","usableScopes","filter","scope","trim","length","info"],"mappings":"AAAA,SAAQA,MAAM,QAAO,8BAA8B;AACnD,SAAQC,mCAAmC,QAAO,cAAc;AAEhE,OAAO,MAAMC,oBAAoB;IAC/B;IACA;IACA;IACA;IACA;CACD,CAAU;AAEX,OAAO,SAASC;IACd,OAAOD,kBAAkBE,IAAI,CAAC;AAChC;AAEA,OAAO,SAASC,8BAA8BC,MAAyB;IACrE,MAAMC,eAAeD,OAAOE,MAAM,CAAC,CAACC,QAAUA,MAAMC,IAAI,GAAGC,MAAM,GAAG;IACpE,IAAIJ,aAAaI,MAAM,KAAK,GAAG,MAAM,IAAIV,oCAAoC;QAAC;KAAc;IAC5FD,SAASY,IAAI,CAAC;QAACN,QAAQC;IAAY,GAAG;AACxC"}

package/dist/core/state.d.ts

@@ -0,0 +1,12 @@
+export interface JiraInstallStateClaims {
+    workspaceId: string;
+    userId: string;
+}
+export declare function signJiraInstallState(params: {
+    workspaceId: string;
+    userId: string;
+    nonce?: string | undefined;
+    now?: Date | undefined;
+}): string;
+export declare function verifyJiraInstallState(state: string, now?: Date): JiraInstallStateClaims;
+//# sourceMappingURL=state.d.ts.map

package/dist/core/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/core/state.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB,GAAG,MAAM,CAUT;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,IAAiB,GACrB,sBAAsB,CAWxB"}

package/dist/core/state.js

@@ -0,0 +1,51 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { config } from '#config.js';
+import { JiraInstallStateError } from './errors.js';
+const STATE_TTL_SECONDS = 30 * 60;
+export function signJiraInstallState(params) {
+    const now = params.now ?? new Date();
+    const payload = {
+        workspaceId: params.workspaceId,
+        userId: params.userId,
+        nonce: params.nonce ?? randomUUID(),
+        expiresAt: Math.floor(now.getTime() / 1000) + STATE_TTL_SECONDS
+    };
+    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${encodedPayload}.${sign(encodedPayload)}`;
+}
+export function verifyJiraInstallState(state, now = new Date()) {
+    const [encodedPayload, signature, extra] = state.split('.');
+    if (!encodedPayload || !signature || extra !== undefined) throw new JiraInstallStateError();
+    if (!constantTimeEqual(signature, sign(encodedPayload))) {
+        throw new JiraInstallStateError('Invalid Jira install state signature');
+    }
+    const payload = parsePayload(encodedPayload);
+    if (payload.expiresAt < Math.floor(now.getTime() / 1000)) {
+        throw new JiraInstallStateError('Expired Jira install state');
+    }
+    return {
+        workspaceId: payload.workspaceId,
+        userId: payload.userId
+    };
+}
+function sign(encodedPayload) {
+    return createHmac('sha256', config.JIRA_OAUTH_CLIENT_SECRET).update(encodedPayload).digest('base64url');
+}
+function constantTimeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function parsePayload(encodedPayload) {
+    try {
+        const parsed = JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8'));
+        if (typeof parsed.workspaceId !== 'string' || typeof parsed.userId !== 'string' || typeof parsed.nonce !== 'string' || typeof parsed.expiresAt !== 'number') {
+            throw new Error('Invalid payload shape');
+        }
+        return parsed;
+    } catch  {
+        throw new JiraInstallStateError('Invalid Jira install state payload');
+    }
+}
+
+//# sourceMappingURL=state.js.map

package/dist/core/state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/state.ts"],"sourcesContent":["import {createHmac, randomUUID, timingSafeEqual} from 'node:crypto';\nimport {config} from '#config.js';\nimport {JiraInstallStateError} from './errors.js';\n\nconst STATE_TTL_SECONDS = 30 * 60;\n\ninterface JiraInstallStatePayload {\n  workspaceId: string;\n  userId: string;\n  nonce: string;\n  expiresAt: number;\n}\n\nexport interface JiraInstallStateClaims {\n  workspaceId: string;\n  userId: string;\n}\n\nexport function signJiraInstallState(params: {\n  workspaceId: string;\n  userId: string;\n  nonce?: string | undefined;\n  now?: Date | undefined;\n}): string {\n  const now = params.now ?? new Date();\n  const payload: JiraInstallStatePayload = {\n    workspaceId: params.workspaceId,\n    userId: params.userId,\n    nonce: params.nonce ?? randomUUID(),\n    expiresAt: Math.floor(now.getTime() / 1000) + STATE_TTL_SECONDS,\n  };\n  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');\n  return `${encodedPayload}.${sign(encodedPayload)}`;\n}\n\nexport function verifyJiraInstallState(\n  state: string,\n  now: Date = new Date(),\n): JiraInstallStateClaims {\n  const [encodedPayload, signature, extra] = state.split('.');\n  if (!encodedPayload || !signature || extra !== undefined) throw new JiraInstallStateError();\n  if (!constantTimeEqual(signature, sign(encodedPayload))) {\n    throw new JiraInstallStateError('Invalid Jira install state signature');\n  }\n  const payload = parsePayload(encodedPayload);\n  if (payload.expiresAt < Math.floor(now.getTime() / 1000)) {\n    throw new JiraInstallStateError('Expired Jira install state');\n  }\n  return {workspaceId: payload.workspaceId, userId: payload.userId};\n}\n\nfunction sign(encodedPayload: string): string {\n  return createHmac('sha256', config.JIRA_OAUTH_CLIENT_SECRET)\n    .update(encodedPayload)\n    .digest('base64url');\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const left = Buffer.from(a);\n  const right = Buffer.from(b);\n  return left.length === right.length && timingSafeEqual(left, right);\n}\n\nfunction parsePayload(encodedPayload: string): JiraInstallStatePayload {\n  try {\n    const parsed = JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8'));\n    if (\n      typeof parsed.workspaceId !== 'string' ||\n      typeof parsed.userId !== 'string' ||\n      typeof parsed.nonce !== 'string' ||\n      typeof parsed.expiresAt !== 'number'\n    ) {\n      throw new Error('Invalid payload shape');\n    }\n    return parsed;\n  } catch {\n    throw new JiraInstallStateError('Invalid Jira install state payload');\n  }\n}\n"],"names":["createHmac","randomUUID","timingSafeEqual","config","JiraInstallStateError","STATE_TTL_SECONDS","signJiraInstallState","params","now","Date","payload","workspaceId","userId","nonce","expiresAt","Math","floor","getTime","encodedPayload","Buffer","from","JSON","stringify","toString","sign","verifyJiraInstallState","state","signature","extra","split","undefined","constantTimeEqual","parsePayload","JIRA_OAUTH_CLIENT_SECRET","update","digest","a","b","left","right","length","parsed","parse","Error"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,UAAU,EAAEC,eAAe,QAAO,cAAc;AACpE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,qBAAqB,QAAO,cAAc;AAElD,MAAMC,oBAAoB,KAAK;AAc/B,OAAO,SAASC,qBAAqBC,MAKpC;IACC,MAAMC,MAAMD,OAAOC,GAAG,IAAI,IAAIC;IAC9B,MAAMC,UAAmC;QACvCC,aAAaJ,OAAOI,WAAW;QAC/BC,QAAQL,OAAOK,MAAM;QACrBC,OAAON,OAAOM,KAAK,IAAIZ;QACvBa,WAAWC,KAAKC,KAAK,CAACR,IAAIS,OAAO,KAAK,QAAQZ;IAChD;IACA,MAAMa,iBAAiBC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACZ,UAAUa,QAAQ,CAAC;IACrE,OAAO,GAAGL,eAAe,CAAC,EAAEM,KAAKN,iBAAiB;AACpD;AAEA,OAAO,SAASO,uBACdC,KAAa,EACblB,MAAY,IAAIC,MAAM;IAEtB,MAAM,CAACS,gBAAgBS,WAAWC,MAAM,GAAGF,MAAMG,KAAK,CAAC;IACvD,IAAI,CAACX,kBAAkB,CAACS,aAAaC,UAAUE,WAAW,MAAM,IAAI1B;IACpE,IAAI,CAAC2B,kBAAkBJ,WAAWH,KAAKN,kBAAkB;QACvD,MAAM,IAAId,sBAAsB;IAClC;IACA,MAAMM,UAAUsB,aAAad;IAC7B,IAAIR,QAAQI,SAAS,GAAGC,KAAKC,KAAK,CAACR,IAAIS,OAAO,KAAK,OAAO;QACxD,MAAM,IAAIb,sBAAsB;IAClC;IACA,OAAO;QAACO,aAAaD,QAAQC,WAAW;QAAEC,QAAQF,QAAQE,MAAM;IAAA;AAClE;AAEA,SAASY,KAAKN,cAAsB;IAClC,OAAOlB,WAAW,UAAUG,OAAO8B,wBAAwB,EACxDC,MAAM,CAAChB,gBACPiB,MAAM,CAAC;AACZ;AAEA,SAASJ,kBAAkBK,CAAS,EAAEC,CAAS;IAC7C,MAAMC,OAAOnB,OAAOC,IAAI,CAACgB;IACzB,MAAMG,QAAQpB,OAAOC,IAAI,CAACiB;IAC1B,OAAOC,KAAKE,MAAM,KAAKD,MAAMC,MAAM,IAAItC,gBAAgBoC,MAAMC;AAC/D;AAEA,SAASP,aAAad,cAAsB;IAC1C,IAAI;QACF,MAAMuB,SAASpB,KAAKqB,KAAK,CAACvB,OAAOC,IAAI,CAACF,gBAAgB,aAAaK,QAAQ,CAAC;QAC5E,IACE,OAAOkB,OAAO9B,WAAW,KAAK,YAC9B,OAAO8B,OAAO7B,MAAM,KAAK,YACzB,OAAO6B,OAAO5B,KAAK,KAAK,YACxB,OAAO4B,OAAO3B,SAAS,KAAK,UAC5B;YACA,MAAM,IAAI6B,MAAM;QAClB;QACA,OAAOF;IACT,EAAE,OAAM;QACN,MAAM,IAAIrC,sBAAsB;IAClC;AACF"}

package/dist/core/tokens.d.ts

@@ -1,3 +1,4 @@
+import { type JiraApiClient } from '#api/client.js';
 export interface JiraConnectionResolverResult {
     workspaceId: string;
 }
@@ -17,6 +18,10 @@ export interface JiraSecretsStore {
 export interface CreateJiraTokenStoreParams {
     resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult | undefined>;
     secrets: JiraSecretsStore;
+    client?: JiraApiClient | undefined;
+    markConnectionError?: (params: {
+        connectionId: string;
+    }) => Promise<void>;
 }
 export interface StoreJiraTokensParams {
     connectionId: string;
@@ -26,6 +31,7 @@ export interface StoreJiraTokensParams {
 }
 export interface GetJiraAccessTokenParams {
     connectionId: string;
+    forceRefresh?: boolean | undefined;
 }
 export interface JiraTokenStore {
     storeTokens(params: StoreJiraTokensParams): Promise<void>;

package/dist/core/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjG,UAAU,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;IAC3F,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG,cAAc,CAgCvF"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/core/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAkBvE,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjG,UAAU,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;KACtC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;IAC3F,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG,cAAc,CA6DvF"}

package/dist/core/tokens.js

@@ -1,15 +1,30 @@
-import { JiraAccessTokenMissingError, JiraConnectionNotFoundError } from '#core/errors.js';
+import { createJiraApiClient } from '#api/client.js';
+import { JiraAccessTokenMissingError, JiraConnectionNotFoundError, JiraIntegrationProviderError, JiraTokenUnrefreshableError } from '#core/errors.js';
+import { getJiraInstallationByConnectionId, updateJiraInstallationTokenExpiry, withJiraRefreshLock } from '#db/installations.js';
 const ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';
 const REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';
+const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+const tokenRefreshes = new Map();
 export function jiraSecretsNamespace(connectionId) {
     return `system/integrations/jira/${connectionId}`;
 }
 export function createJiraTokenStore(params) {
+    const client = params.client ?? createJiraApiClient();
     async function resolveWorkspaceId(connectionId) {
         const connection = await params.resolveConnection(connectionId);
         if (!connection) throw new JiraConnectionNotFoundError(connectionId);
         return connection.workspaceId;
     }
+    const readSecretToken = (workspaceId, connectionId, key)=>params.secrets.getSecret({
+            workspaceId,
+            namespace: jiraSecretsNamespace(connectionId),
+            key
+        });
+    async function readAccessToken(workspaceId, connectionId) {
+        const token = await readSecretToken(workspaceId, connectionId, ACCESS_TOKEN_KEY);
+        if (!token) throw new JiraAccessTokenMissingError(connectionId);
+        return token;
+    }
     return {
         async storeTokens (input) {
             const workspaceId = await resolveWorkspaceId(input.connectionId);
@@ -26,15 +41,76 @@ export function createJiraTokenStore(params) {
         },
         async getAccessToken (input) {
             const workspaceId = await resolveWorkspaceId(input.connectionId);
-            const token = await params.secrets.getSecret({
+            const accessToken = await readAccessToken(workspaceId, input.connectionId);
+            if (!input.forceRefresh && !shouldRefresh((await getJiraInstallationByConnectionId(input.connectionId))?.tokenExpiresAt ?? null)) return accessToken;
+            const inFlight = tokenRefreshes.get(input.connectionId);
+            if (inFlight) return inFlight;
+            const refresh = refreshAccessTokenWithLock({
+                connectionId: input.connectionId,
                 workspaceId,
-                namespace: jiraSecretsNamespace(input.connectionId),
-                key: ACCESS_TOKEN_KEY
+                originalAccessToken: accessToken,
+                forceRefresh: input.forceRefresh === true,
+                client,
+                secrets: params.secrets,
+                readAccessToken,
+                readSecretToken,
+                markConnectionError: params.markConnectionError
             });
-            if (!token) throw new JiraAccessTokenMissingError(input.connectionId);
-            return token;
+            tokenRefreshes.set(input.connectionId, refresh);
+            void refresh.then(()=>clearTokenRefresh(input.connectionId, refresh), ()=>clearTokenRefresh(input.connectionId, refresh));
+            return refresh;
         }
     };
 }
+function shouldRefresh(expiresAt) {
+    return expiresAt !== null && expiresAt.getTime() <= Date.now() + TOKEN_REFRESH_MARGIN_MS;
+}
+function clearTokenRefresh(connectionId, refresh) {
+    if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);
+}
+async function refreshAccessTokenWithLock(params) {
+    const lock = await withJiraRefreshLock(params.connectionId, ()=>refreshAccessTokenForConnection(params));
+    if (lock.acquired) return lock.value;
+    const reread = await params.readAccessToken(params.workspaceId, params.connectionId);
+    if (reread !== params.originalAccessToken) return reread;
+    throw new JiraIntegrationProviderError('provider-unavailable', 'Jira token refresh is already in progress');
+}
+async function refreshAccessTokenForConnection(params) {
+    const current = await params.readAccessToken(params.workspaceId, params.connectionId);
+    const installation = await getJiraInstallationByConnectionId(params.connectionId);
+    if (current !== params.originalAccessToken || !params.forceRefresh && !shouldRefresh(installation?.tokenExpiresAt ?? null)) return current;
+    const refreshToken = await params.readSecretToken(params.workspaceId, params.connectionId, REFRESH_TOKEN_KEY);
+    if (!refreshToken) {
+        if (params.forceRefresh || shouldRefresh(installation?.tokenExpiresAt ?? null)) throw new JiraTokenUnrefreshableError(params.connectionId);
+        return current;
+    }
+    try {
+        const refreshed = await params.client.refreshAccessToken({
+            refreshToken
+        });
+        if (!refreshed.refreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);
+        await params.secrets.setSecrets({
+            workspaceId: params.workspaceId,
+            namespace: jiraSecretsNamespace(params.connectionId),
+            values: {
+                [ACCESS_TOKEN_KEY]: refreshed.accessToken,
+                [REFRESH_TOKEN_KEY]: refreshed.refreshToken
+            }
+        });
+        await updateJiraInstallationTokenExpiry({
+            connectionId: params.connectionId,
+            tokenExpiresAt: refreshed.expiresAt ?? null,
+            scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined
+        });
+        return refreshed.accessToken;
+    } catch (error) {
+        if (error instanceof JiraIntegrationProviderError && error.reason === 'access-denied') {
+            await params.markConnectionError?.({
+                connectionId: params.connectionId
+            });
+        }
+        throw error;
+    }
+}
 
 //# sourceMappingURL=tokens.js.map

package/dist/core/tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/tokens.ts"],"sourcesContent":["import {JiraAccessTokenMissingError, JiraConnectionNotFoundError} from '#core/errors.js';\n\nconst ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';\nconst REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';\n\nexport interface JiraConnectionResolverResult {\n  workspaceId: string;\n}\n\nexport interface JiraSecretsStore {\n  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;\n  setSecrets(params: {\n    workspaceId: string;\n    namespace: string;\n    values: Record<string, string>;\n    editedBy?: string | null | undefined;\n  }): Promise<void>;\n}\n\nexport interface CreateJiraTokenStoreParams {\n  resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult | undefined>;\n  secrets: JiraSecretsStore;\n}\n\nexport interface StoreJiraTokensParams {\n  connectionId: string;\n  accessToken: string;\n  refreshToken?: string | undefined;\n  editedBy?: string | null | undefined;\n}\n\nexport interface GetJiraAccessTokenParams {\n  connectionId: string;\n}\n\nexport interface JiraTokenStore {\n  storeTokens(params: StoreJiraTokensParams): Promise<void>;\n  getAccessToken(params: GetJiraAccessTokenParams): Promise<string>;\n}\n\nexport function jiraSecretsNamespace(connectionId: string): string {\n  return `system/integrations/jira/${connectionId}`;\n}\n\nexport function createJiraTokenStore(params: CreateJiraTokenStoreParams): JiraTokenStore {\n  async function resolveWorkspaceId(connectionId: string): Promise<string> {\n    const connection = await params.resolveConnection(connectionId);\n    if (!connection) throw new JiraConnectionNotFoundError(connectionId);\n    return connection.workspaceId;\n  }\n\n  return {\n    async storeTokens(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const values: Record<string, string> = {[ACCESS_TOKEN_KEY]: input.accessToken};\n      if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;\n\n      await params.secrets.setSecrets({\n        workspaceId,\n        namespace: jiraSecretsNamespace(input.connectionId),\n        values,\n        editedBy: input.editedBy,\n      });\n    },\n\n    async getAccessToken(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const token = await params.secrets.getSecret({\n        workspaceId,\n        namespace: jiraSecretsNamespace(input.connectionId),\n        key: ACCESS_TOKEN_KEY,\n      });\n      if (!token) throw new JiraAccessTokenMissingError(input.connectionId);\n      return token;\n    },\n  };\n}\n"],"names":["JiraAccessTokenMissingError","JiraConnectionNotFoundError","ACCESS_TOKEN_KEY","REFRESH_TOKEN_KEY","jiraSecretsNamespace","connectionId","createJiraTokenStore","params","resolveWorkspaceId","connection","resolveConnection","workspaceId","storeTokens","input","values","accessToken","refreshToken","secrets","setSecrets","namespace","editedBy","getAccessToken","token","getSecret","key"],"mappings":"AAAA,SAAQA,2BAA2B,EAAEC,2BAA2B,QAAO,kBAAkB;AAEzF,MAAMC,mBAAmB;AACzB,MAAMC,oBAAoB;AAqC1B,OAAO,SAASC,qBAAqBC,YAAoB;IACvD,OAAO,CAAC,yBAAyB,EAAEA,cAAc;AACnD;AAEA,OAAO,SAASC,qBAAqBC,MAAkC;IACrE,eAAeC,mBAAmBH,YAAoB;QACpD,MAAMI,aAAa,MAAMF,OAAOG,iBAAiB,CAACL;QAClD,IAAI,CAACI,YAAY,MAAM,IAAIR,4BAA4BI;QACvD,OAAOI,WAAWE,WAAW;IAC/B;IAEA,OAAO;QACL,MAAMC,aAAYC,KAAK;YACrB,MAAMF,cAAc,MAAMH,mBAAmBK,MAAMR,YAAY;YAC/D,MAAMS,SAAiC;gBAAC,CAACZ,iBAAiB,EAAEW,MAAME,WAAW;YAAA;YAC7E,IAAIF,MAAMG,YAAY,EAAEF,MAAM,CAACX,kBAAkB,GAAGU,MAAMG,YAAY;YAEtE,MAAMT,OAAOU,OAAO,CAACC,UAAU,CAAC;gBAC9BP;gBACAQ,WAAWf,qBAAqBS,MAAMR,YAAY;gBAClDS;gBACAM,UAAUP,MAAMO,QAAQ;YAC1B;QACF;QAEA,MAAMC,gBAAeR,KAAK;YACxB,MAAMF,cAAc,MAAMH,mBAAmBK,MAAMR,YAAY;YAC/D,MAAMiB,QAAQ,MAAMf,OAAOU,OAAO,CAACM,SAAS,CAAC;gBAC3CZ;gBACAQ,WAAWf,qBAAqBS,MAAMR,YAAY;gBAClDmB,KAAKtB;YACP;YACA,IAAI,CAACoB,OAAO,MAAM,IAAItB,4BAA4Ba,MAAMR,YAAY;YACpE,OAAOiB;QACT;IACF;AACF"}
+{"version":3,"sources":["../../src/core/tokens.ts"],"sourcesContent":["import {createJiraApiClient, type JiraApiClient} from '#api/client.js';\nimport {\n  JiraAccessTokenMissingError,\n  JiraConnectionNotFoundError,\n  JiraIntegrationProviderError,\n  JiraTokenUnrefreshableError,\n} from '#core/errors.js';\nimport {\n  getJiraInstallationByConnectionId,\n  updateJiraInstallationTokenExpiry,\n  withJiraRefreshLock,\n} from '#db/installations.js';\n\nconst ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';\nconst REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';\nconst TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst tokenRefreshes = new Map<string, Promise<string>>();\n\nexport interface JiraConnectionResolverResult {\n  workspaceId: string;\n}\n\nexport interface JiraSecretsStore {\n  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;\n  setSecrets(params: {\n    workspaceId: string;\n    namespace: string;\n    values: Record<string, string>;\n    editedBy?: string | null | undefined;\n  }): Promise<void>;\n}\n\nexport interface CreateJiraTokenStoreParams {\n  resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult | undefined>;\n  secrets: JiraSecretsStore;\n  client?: JiraApiClient | undefined;\n  markConnectionError?: (params: {connectionId: string}) => Promise<void>;\n}\n\nexport interface StoreJiraTokensParams {\n  connectionId: string;\n  accessToken: string;\n  refreshToken?: string | undefined;\n  editedBy?: string | null | undefined;\n}\n\nexport interface GetJiraAccessTokenParams {\n  connectionId: string;\n  forceRefresh?: boolean | undefined;\n}\n\nexport interface JiraTokenStore {\n  storeTokens(params: StoreJiraTokensParams): Promise<void>;\n  getAccessToken(params: GetJiraAccessTokenParams): Promise<string>;\n}\n\nexport function jiraSecretsNamespace(connectionId: string): string {\n  return `system/integrations/jira/${connectionId}`;\n}\n\nexport function createJiraTokenStore(params: CreateJiraTokenStoreParams): JiraTokenStore {\n  const client = params.client ?? createJiraApiClient();\n  async function resolveWorkspaceId(connectionId: string): Promise<string> {\n    const connection = await params.resolveConnection(connectionId);\n    if (!connection) throw new JiraConnectionNotFoundError(connectionId);\n    return connection.workspaceId;\n  }\n  const readSecretToken = (\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ) => params.secrets.getSecret({workspaceId, namespace: jiraSecretsNamespace(connectionId), key});\n  async function readAccessToken(workspaceId: string, connectionId: string): Promise<string> {\n    const token = await readSecretToken(workspaceId, connectionId, ACCESS_TOKEN_KEY);\n    if (!token) throw new JiraAccessTokenMissingError(connectionId);\n    return token;\n  }\n\n  return {\n    async storeTokens(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const values: Record<string, string> = {[ACCESS_TOKEN_KEY]: input.accessToken};\n      if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;\n      await params.secrets.setSecrets({\n        workspaceId,\n        namespace: jiraSecretsNamespace(input.connectionId),\n        values,\n        editedBy: input.editedBy,\n      });\n    },\n    async getAccessToken(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const accessToken = await readAccessToken(workspaceId, input.connectionId);\n      if (\n        !input.forceRefresh &&\n        !shouldRefresh(\n          (await getJiraInstallationByConnectionId(input.connectionId))?.tokenExpiresAt ?? null,\n        )\n      )\n        return accessToken;\n      const inFlight = tokenRefreshes.get(input.connectionId);\n      if (inFlight) return inFlight;\n      const refresh = refreshAccessTokenWithLock({\n        connectionId: input.connectionId,\n        workspaceId,\n        originalAccessToken: accessToken,\n        forceRefresh: input.forceRefresh === true,\n        client,\n        secrets: params.secrets,\n        readAccessToken,\n        readSecretToken,\n        markConnectionError: params.markConnectionError,\n      });\n      tokenRefreshes.set(input.connectionId, refresh);\n      void refresh.then(\n        () => clearTokenRefresh(input.connectionId, refresh),\n        () => clearTokenRefresh(input.connectionId, refresh),\n      );\n      return refresh;\n    },\n  };\n}\n\nfunction shouldRefresh(expiresAt: Date | null): boolean {\n  return expiresAt !== null && expiresAt.getTime() <= Date.now() + TOKEN_REFRESH_MARGIN_MS;\n}\n\nfunction clearTokenRefresh(connectionId: string, refresh: Promise<string>): void {\n  if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);\n}\n\nasync function refreshAccessTokenWithLock(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n}): Promise<string> {\n  const lock = await withJiraRefreshLock(params.connectionId, () =>\n    refreshAccessTokenForConnection(params),\n  );\n  if (lock.acquired) return lock.value;\n  const reread = await params.readAccessToken(params.workspaceId, params.connectionId);\n  if (reread !== params.originalAccessToken) return reread;\n  throw new JiraIntegrationProviderError(\n    'provider-unavailable',\n    'Jira token refresh is already in progress',\n  );\n}\n\nasync function refreshAccessTokenForConnection(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n}): Promise<string> {\n  const current = await params.readAccessToken(params.workspaceId, params.connectionId);\n  const installation = await getJiraInstallationByConnectionId(params.connectionId);\n  if (\n    current !== params.originalAccessToken ||\n    (!params.forceRefresh && !shouldRefresh(installation?.tokenExpiresAt ?? null))\n  )\n    return current;\n  const refreshToken = await params.readSecretToken(\n    params.workspaceId,\n    params.connectionId,\n    REFRESH_TOKEN_KEY,\n  );\n  if (!refreshToken) {\n    if (params.forceRefresh || shouldRefresh(installation?.tokenExpiresAt ?? null))\n      throw new JiraTokenUnrefreshableError(params.connectionId);\n    return current;\n  }\n  try {\n    const refreshed = await params.client.refreshAccessToken({refreshToken});\n    if (!refreshed.refreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);\n    await params.secrets.setSecrets({\n      workspaceId: params.workspaceId,\n      namespace: jiraSecretsNamespace(params.connectionId),\n      values: {\n        [ACCESS_TOKEN_KEY]: refreshed.accessToken,\n        [REFRESH_TOKEN_KEY]: refreshed.refreshToken,\n      },\n    });\n    await updateJiraInstallationTokenExpiry({\n      connectionId: params.connectionId,\n      tokenExpiresAt: refreshed.expiresAt ?? null,\n      scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined,\n    });\n    return refreshed.accessToken;\n  } catch (error) {\n    if (error instanceof JiraIntegrationProviderError && error.reason === 'access-denied') {\n      await params.markConnectionError?.({connectionId: params.connectionId});\n    }\n    throw error;\n  }\n}\n"],"names":["createJiraApiClient","JiraAccessTokenMissingError","JiraConnectionNotFoundError","JiraIntegrationProviderError","JiraTokenUnrefreshableError","getJiraInstallationByConnectionId","updateJiraInstallationTokenExpiry","withJiraRefreshLock","ACCESS_TOKEN_KEY","REFRESH_TOKEN_KEY","TOKEN_REFRESH_MARGIN_MS","tokenRefreshes","Map","jiraSecretsNamespace","connectionId","createJiraTokenStore","params","client","resolveWorkspaceId","connection","resolveConnection","workspaceId","readSecretToken","key","secrets","getSecret","namespace","readAccessToken","token","storeTokens","input","values","accessToken","refreshToken","setSecrets","editedBy","getAccessToken","forceRefresh","shouldRefresh","tokenExpiresAt","inFlight","get","refresh","refreshAccessTokenWithLock","originalAccessToken","markConnectionError","set","then","clearTokenRefresh","expiresAt","getTime","Date","now","delete","lock","refreshAccessTokenForConnection","acquired","value","reread","current","installation","refreshed","refreshAccessToken","scopes","length","undefined","error","reason"],"mappings":"AAAA,SAAQA,mBAAmB,QAA2B,iBAAiB;AACvE,SACEC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,2BAA2B,QACtB,kBAAkB;AACzB,SACEC,iCAAiC,EACjCC,iCAAiC,EACjCC,mBAAmB,QACd,uBAAuB;AAE9B,MAAMC,mBAAmB;AACzB,MAAMC,oBAAoB;AAC1B,MAAMC,0BAA0B,IAAI,KAAK;AACzC,MAAMC,iBAAiB,IAAIC;AAwC3B,OAAO,SAASC,qBAAqBC,YAAoB;IACvD,OAAO,CAAC,yBAAyB,EAAEA,cAAc;AACnD;AAEA,OAAO,SAASC,qBAAqBC,MAAkC;IACrE,MAAMC,SAASD,OAAOC,MAAM,IAAIjB;IAChC,eAAekB,mBAAmBJ,YAAoB;QACpD,MAAMK,aAAa,MAAMH,OAAOI,iBAAiB,CAACN;QAClD,IAAI,CAACK,YAAY,MAAM,IAAIjB,4BAA4BY;QACvD,OAAOK,WAAWE,WAAW;IAC/B;IACA,MAAMC,kBAAkB,CACtBD,aACAP,cACAS,MACGP,OAAOQ,OAAO,CAACC,SAAS,CAAC;YAACJ;YAAaK,WAAWb,qBAAqBC;YAAeS;QAAG;IAC9F,eAAeI,gBAAgBN,WAAmB,EAAEP,YAAoB;QACtE,MAAMc,QAAQ,MAAMN,gBAAgBD,aAAaP,cAAcN;QAC/D,IAAI,CAACoB,OAAO,MAAM,IAAI3B,4BAA4Ba;QAClD,OAAOc;IACT;IAEA,OAAO;QACL,MAAMC,aAAYC,KAAK;YACrB,MAAMT,cAAc,MAAMH,mBAAmBY,MAAMhB,YAAY;YAC/D,MAAMiB,SAAiC;gBAAC,CAACvB,iBAAiB,EAAEsB,MAAME,WAAW;YAAA;YAC7E,IAAIF,MAAMG,YAAY,EAAEF,MAAM,CAACtB,kBAAkB,GAAGqB,MAAMG,YAAY;YACtE,MAAMjB,OAAOQ,OAAO,CAACU,UAAU,CAAC;gBAC9Bb;gBACAK,WAAWb,qBAAqBiB,MAAMhB,YAAY;gBAClDiB;gBACAI,UAAUL,MAAMK,QAAQ;YAC1B;QACF;QACA,MAAMC,gBAAeN,KAAK;YACxB,MAAMT,cAAc,MAAMH,mBAAmBY,MAAMhB,YAAY;YAC/D,MAAMkB,cAAc,MAAML,gBAAgBN,aAAaS,MAAMhB,YAAY;YACzE,IACE,CAACgB,MAAMO,YAAY,IACnB,CAACC,cACC,AAAC,CAAA,MAAMjC,kCAAkCyB,MAAMhB,YAAY,CAAA,GAAIyB,kBAAkB,OAGnF,OAAOP;YACT,MAAMQ,WAAW7B,eAAe8B,GAAG,CAACX,MAAMhB,YAAY;YACtD,IAAI0B,UAAU,OAAOA;YACrB,MAAME,UAAUC,2BAA2B;gBACzC7B,cAAcgB,MAAMhB,YAAY;gBAChCO;gBACAuB,qBAAqBZ;gBACrBK,cAAcP,MAAMO,YAAY,KAAK;gBACrCpB;gBACAO,SAASR,OAAOQ,OAAO;gBACvBG;gBACAL;gBACAuB,qBAAqB7B,OAAO6B,mBAAmB;YACjD;YACAlC,eAAemC,GAAG,CAAChB,MAAMhB,YAAY,EAAE4B;YACvC,KAAKA,QAAQK,IAAI,CACf,IAAMC,kBAAkBlB,MAAMhB,YAAY,EAAE4B,UAC5C,IAAMM,kBAAkBlB,MAAMhB,YAAY,EAAE4B;YAE9C,OAAOA;QACT;IACF;AACF;AAEA,SAASJ,cAAcW,SAAsB;IAC3C,OAAOA,cAAc,QAAQA,UAAUC,OAAO,MAAMC,KAAKC,GAAG,KAAK1C;AACnE;AAEA,SAASsC,kBAAkBlC,YAAoB,EAAE4B,OAAwB;IACvE,IAAI/B,eAAe8B,GAAG,CAAC3B,kBAAkB4B,SAAS/B,eAAe0C,MAAM,CAACvC;AAC1E;AAEA,eAAe6B,2BAA2B3B,MAczC;IACC,MAAMsC,OAAO,MAAM/C,oBAAoBS,OAAOF,YAAY,EAAE,IAC1DyC,gCAAgCvC;IAElC,IAAIsC,KAAKE,QAAQ,EAAE,OAAOF,KAAKG,KAAK;IACpC,MAAMC,SAAS,MAAM1C,OAAOW,eAAe,CAACX,OAAOK,WAAW,EAAEL,OAAOF,YAAY;IACnF,IAAI4C,WAAW1C,OAAO4B,mBAAmB,EAAE,OAAOc;IAClD,MAAM,IAAIvD,6BACR,wBACA;AAEJ;AAEA,eAAeoD,gCAAgCvC,MAc9C;IACC,MAAM2C,UAAU,MAAM3C,OAAOW,eAAe,CAACX,OAAOK,WAAW,EAAEL,OAAOF,YAAY;IACpF,MAAM8C,eAAe,MAAMvD,kCAAkCW,OAAOF,YAAY;IAChF,IACE6C,YAAY3C,OAAO4B,mBAAmB,IACrC,CAAC5B,OAAOqB,YAAY,IAAI,CAACC,cAAcsB,cAAcrB,kBAAkB,OAExE,OAAOoB;IACT,MAAM1B,eAAe,MAAMjB,OAAOM,eAAe,CAC/CN,OAAOK,WAAW,EAClBL,OAAOF,YAAY,EACnBL;IAEF,IAAI,CAACwB,cAAc;QACjB,IAAIjB,OAAOqB,YAAY,IAAIC,cAAcsB,cAAcrB,kBAAkB,OACvE,MAAM,IAAInC,4BAA4BY,OAAOF,YAAY;QAC3D,OAAO6C;IACT;IACA,IAAI;QACF,MAAME,YAAY,MAAM7C,OAAOC,MAAM,CAAC6C,kBAAkB,CAAC;YAAC7B;QAAY;QACtE,IAAI,CAAC4B,UAAU5B,YAAY,EAAE,MAAM,IAAI7B,4BAA4BY,OAAOF,YAAY;QACtF,MAAME,OAAOQ,OAAO,CAACU,UAAU,CAAC;YAC9Bb,aAAaL,OAAOK,WAAW;YAC/BK,WAAWb,qBAAqBG,OAAOF,YAAY;YACnDiB,QAAQ;gBACN,CAACvB,iBAAiB,EAAEqD,UAAU7B,WAAW;gBACzC,CAACvB,kBAAkB,EAAEoD,UAAU5B,YAAY;YAC7C;QACF;QACA,MAAM3B,kCAAkC;YACtCQ,cAAcE,OAAOF,YAAY;YACjCyB,gBAAgBsB,UAAUZ,SAAS,IAAI;YACvCc,QAAQF,UAAUE,MAAM,CAACC,MAAM,GAAG,IAAIH,UAAUE,MAAM,GAAGE;QAC3D;QACA,OAAOJ,UAAU7B,WAAW;IAC9B,EAAE,OAAOkC,OAAO;QACd,IAAIA,iBAAiB/D,gCAAgC+D,MAAMC,MAAM,KAAK,iBAAiB;YACrF,MAAMnD,OAAO6B,mBAAmB,GAAG;gBAAC/B,cAAcE,OAAOF,YAAY;YAAA;QACvE;QACA,MAAMoD;IACR;AACF"}