@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/modules/accounts/validation/schemas.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+
+/**
+ * v4 validation surface — Zod schemas piped through `validate('json' | ...)`
+ * at the route, with `c.req.valid('json')` reading parsed input. The route
+ * registry captures these schemas so MCP tools, the typed-client export, and
+ * the eventual OpenAPI compat layer all see the same contract.
+ *
+ * Field shapes mirror this module's `accounts` table (../schema.ts).
+ * Consumers who customize the schema via `createApp({ schema })` should also
+ * customize these schemas (extend / override) so server-side validation
+ * matches the persisted shape.
+ */
+
+const FIREBASE_UID_MAX = 128;
+const EMAIL_MAX = 320;
+const DISPLAY_NAME_MAX = 200;
+
+export const createAccountSchema = z
+  .object({
+    /**
+     * Stable subject identifier from the AuthProvider. Optional at create
+     * time so service-side flows (e.g., admin-creates-pending-account)
+     * can fill it in later when the user first signs in.
+     */
+    firebaseUid: z.string().min(1).max(FIREBASE_UID_MAX).optional(),
+    email: z.string().email().max(EMAIL_MAX),
+    emailVerified: z.boolean().optional(),
+    displayName: z.string().min(1).max(DISPLAY_NAME_MAX).optional(),
+    isActive: z.boolean().optional(),
+    roleId: z.string().uuid().optional(),
+  })
+  .strict();
+
+export const updateAccountSchema = z
+  .object({
+    firebaseUid: z.string().min(1).max(FIREBASE_UID_MAX).optional(),
+    email: z.string().email().max(EMAIL_MAX).optional(),
+    emailVerified: z.boolean().optional(),
+    displayName: z.string().min(1).max(DISPLAY_NAME_MAX).optional(),
+    isActive: z.boolean().optional(),
+    /** `null` clears the role assignment (FK is nullable). */
+    roleId: z.string().uuid().nullable().optional(),
+  })
+  .strict();
+
+export const accountIdParamSchema = z.object({
+  id: z.string().uuid(),
+});
+
+/**
+ * `?search=foo&page=1&perPage=20&isActive=true&roleId=...`
+ *
+ * `coerce.number` lets the client send the values as strings (the only
+ * shape `c.req.query()` produces) and still get number-typed values out.
+ */
+export const listAccountsQuerySchema = z
+  .object({
+    search: z.string().min(1).optional(),
+    isActive: z.enum(["true", "false"]).optional(),
+    roleId: z.string().uuid().optional(),
+    page: z.coerce.number().int().positive().default(1),
+    perPage: z.coerce.number().int().positive().max(100).default(20),
+  })
+  .strict();
+
+export type CreateAccountInput = z.infer<typeof createAccountSchema>;
+export type UpdateAccountInput = z.infer<typeof updateAccountSchema>;
+export type ListAccountsQuery = z.infer<typeof listAccountsQuerySchema>;
+export type AccountIdParam = z.infer<typeof accountIdParamSchema>;

package/lib/modules/oauth/adapters/GmailOAuthAdapter.ts

@@ -0,0 +1,35 @@
+import { GoogleOAuthAdapter, type GoogleOAuthAdapterOptions } from "./GoogleOAuthAdapter.js";
+
+/**
+ * Gmail-flavored Google OAuth adapter — convenience subclass that
+ * pre-fills `providerCode: "gmail"`.
+ *
+ * Same OAuth 2.0 flow as `GoogleOAuthAdapter` (Gmail uses the same
+ * Google Identity endpoints; Gmail-specific scopes like
+ * `https://www.googleapis.com/auth/gmail.readonly` are caller-
+ * supplied via `AuthUrlOptions.scopes`, not adapter-specific).
+ *
+ * Why a separate class instead of a runtime tag: connection rows
+ * carry `providerCode` as the cross-table key, and consumers
+ * frequently want Gmail-scoped connections to live alongside
+ * generic Google sign-in connections without colliding on the
+ * unique (account_id, provider_code) composite. Registering both
+ * `GoogleOAuthAdapter` (`"google"`) and `GmailOAuthAdapter`
+ * (`"gmail"`) in the same registry gives consumers two distinct
+ * provider rows per account.
+ *
+ * Usage:
+ *
+ *   const adapters = oauthAdapterRegistry(
+ *     new GoogleOAuthAdapter(),
+ *     new GmailOAuthAdapter(),
+ *   );
+ *
+ * All other options forward to the underlying `GoogleOAuthAdapter`
+ * (defaultAccessType, defaultPrompt, fetchImpl, …).
+ */
+export class GmailOAuthAdapter extends GoogleOAuthAdapter {
+  constructor(opts: Omit<GoogleOAuthAdapterOptions, "providerCode"> = {}) {
+    super({ ...opts, providerCode: "gmail" });
+  }
+}

package/lib/modules/oauth/adapters/GoogleOAuthAdapter.ts

@@ -0,0 +1,278 @@
+import type {
+  AuthUrlOptions,
+  ExchangeCodeOptions,
+  OAuthAdapter,
+  OAuthClientCredentials,
+  TokenResponse,
+} from "./OAuthAdapter.js";
+import {
+  InvalidCredentialsError,
+  OAuthRateLimitError,
+  TokenExchangeError,
+  TokenRefreshError,
+} from "./OAuthAdapter.js";
+
+/**
+ * Google OAuth 2.0 adapter — fetch-based, no SDK dependency.
+ *
+ * Implements the framework's `OAuthAdapter` interface against
+ * Google's OAuth 2.0 endpoints directly:
+ *   - Authorization:  https://accounts.google.com/o/oauth2/v2/auth
+ *   - Token exchange: https://oauth2.googleapis.com/token
+ *   - User info:      https://openidconnect.googleapis.com/v1/userinfo
+ *   - Revoke:         https://oauth2.googleapis.com/revoke
+ *
+ * Replaces v3's `googleapis`-SDK-backed adapter. Fetch-based means
+ * the adapter works in every runtime (Node, Workers, Bun) without
+ * a 5+ MB SDK in the bundle. Consumers who want the full Google
+ * SDK ergonomics for non-OAuth API calls (Gmail / Drive / Calendar
+ * etc.) install `googleapis` separately.
+ *
+ * Provider-specific defaults the framework's contract doesn't
+ * model:
+ *   - `access_type: "offline"` — required to receive a refresh
+ *     token. Set via `providerOptions` if you want the v3 default
+ *     behavior.
+ *   - `prompt: "consent"` — forces re-consent so a fresh refresh
+ *     token is reissued even when the user has already granted
+ *     access. Useful for "reconnect" flows.
+ *   - `include_granted_scopes: true` — incremental authorization
+ *     across multiple Google scopes.
+ *
+ * Default authorize URL adds `access_type=offline&prompt=consent`
+ * automatically — that's the v3 behavior and the most common
+ * Google flow. Override via `opts.providerOptions` per-call:
+ *   ```ts
+ *   adapter.buildAuthorizationUrl(creds, {
+ *     state, scopes,
+ *     providerOptions: { prompt: "select_account" },
+ *   });
+ *   ```
+ */
+
+const AUTHORIZE_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const USERINFO_ENDPOINT = "https://openidconnect.googleapis.com/v1/userinfo";
+const REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+
+export interface GoogleOAuthAdapterOptions {
+  /** Stable provider identifier. Default `"google"`. */
+  providerCode?: string;
+  /** Override `fetch` (tests). */
+  fetchImpl?: typeof fetch;
+  /** Default `access_type`. Default `"offline"` (returns a refresh token). */
+  defaultAccessType?: "online" | "offline";
+  /** Default `prompt`. Default `"consent"` (forces fresh refresh token). */
+  defaultPrompt?: "none" | "consent" | "select_account";
+}
+
+export class GoogleOAuthAdapter implements OAuthAdapter {
+  readonly providerCode: string;
+  private readonly fetchImpl: typeof fetch;
+  private readonly defaultAccessType: "online" | "offline";
+  private readonly defaultPrompt: "none" | "consent" | "select_account";
+
+  constructor(opts: GoogleOAuthAdapterOptions = {}) {
+    this.providerCode = opts.providerCode ?? "google";
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    this.defaultAccessType = opts.defaultAccessType ?? "offline";
+    this.defaultPrompt = opts.defaultPrompt ?? "consent";
+  }
+
+  buildAuthorizationUrl(credentials: OAuthClientCredentials, opts: AuthUrlOptions): string {
+    const params = new URLSearchParams({
+      client_id: credentials.clientId,
+      redirect_uri: credentials.redirectUri,
+      response_type: "code",
+      scope: opts.scopes.join(" "),
+      state: opts.state,
+      access_type: this.defaultAccessType,
+      prompt: this.defaultPrompt,
+      include_granted_scopes: "true",
+    });
+
+    // PKCE: emit challenge params when supplied. Adapters that don't
+    // receive a challenge (consumers running against the old contract)
+    // still produce a valid URL — the params are simply omitted.
+    if (opts.codeChallenge) {
+      params.set("code_challenge", opts.codeChallenge);
+      params.set("code_challenge_method", opts.codeChallengeMethod ?? "S256");
+    }
+
+    // Provider-specific overrides win.
+    if (opts.providerOptions) {
+      for (const [key, val] of Object.entries(opts.providerOptions)) {
+        params.set(key, String(val));
+      }
+    }
+
+    return `${AUTHORIZE_ENDPOINT}?${params.toString()}`;
+  }
+
+  async exchangeCodeForTokens(
+    code: string,
+    credentials: OAuthClientCredentials,
+    opts: ExchangeCodeOptions = {},
+  ): Promise<TokenResponse> {
+    const formBody = new URLSearchParams({
+      code,
+      client_id: credentials.clientId,
+      client_secret: credentials.clientSecret,
+      redirect_uri: credentials.redirectUri,
+      grant_type: "authorization_code",
+    });
+    if (opts.codeVerifier) formBody.set("code_verifier", opts.codeVerifier);
+
+    const response = await this.fetchImpl(TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: formBody.toString(),
+      signal: opts.signal,
+    });
+
+    if (!response.ok) {
+      throw this.translateError(response, "exchange");
+    }
+
+    const body = (await response.json()) as GoogleTokenResponse;
+    return tokenResponseFromGoogle(body);
+  }
+
+  async refreshTokens(
+    refreshToken: string,
+    credentials: OAuthClientCredentials,
+    opts: { signal?: AbortSignal } = {},
+  ): Promise<TokenResponse> {
+    const response = await this.fetchImpl(TOKEN_ENDPOINT, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        refresh_token: refreshToken,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
+        grant_type: "refresh_token",
+      }).toString(),
+      signal: opts.signal,
+    });
+
+    if (!response.ok) {
+      throw this.translateError(response, "refresh");
+    }
+
+    const body = (await response.json()) as GoogleTokenResponse;
+    // Refresh responses don't always include a fresh refresh_token —
+    // when omitted, Google expects callers to keep using the
+    // existing one. Pass through what they sent (typically just
+    // the new access_token + expires_in).
+    return {
+      ...tokenResponseFromGoogle(body),
+      // Preserve the original refresh token when Google doesn't
+      // rotate (most refresh responses don't).
+      refreshToken: body.refresh_token ?? refreshToken,
+    };
+  }
+
+  async getProviderAccountId(
+    tokens: TokenResponse,
+    _credentials: OAuthClientCredentials,
+    opts: { signal?: AbortSignal } = {},
+  ): Promise<string> {
+    void _credentials;
+    if (!tokens.accessToken) {
+      throw new TokenExchangeError(
+        this.providerCode,
+        "cannot resolve provider account id without an access token",
+      );
+    }
+    const response = await this.fetchImpl(USERINFO_ENDPOINT, {
+      headers: { authorization: `Bearer ${tokens.accessToken}` },
+      signal: opts.signal,
+    });
+    if (!response.ok) {
+      throw this.translateError(response, "userinfo");
+    }
+    const body = (await response.json()) as GoogleUserInfo;
+    if (!body.sub) {
+      throw new TokenExchangeError(this.providerCode, "userinfo response missing `sub` claim");
+    }
+    return body.sub;
+  }
+
+  async revokeAccess(
+    accessToken: string,
+    _credentials: OAuthClientCredentials,
+    opts: { signal?: AbortSignal } = {},
+  ): Promise<void> {
+    void _credentials;
+    // Google's revoke endpoint accepts the token via querystring.
+    // Failures are best-effort; the routes layer doesn't abort the
+    // local clear when revoke throws (per OAuthAdapter contract).
+    await this.fetchImpl(`${REVOKE_ENDPOINT}?token=${encodeURIComponent(accessToken)}`, {
+      method: "POST",
+      signal: opts.signal,
+    });
+  }
+
+  private translateError(
+    response: Response,
+    operation: "exchange" | "refresh" | "userinfo",
+  ): Error {
+    if (response.status === 401) {
+      return new InvalidCredentialsError(
+        this.providerCode,
+        `Google ${operation}: invalid credentials (401)`,
+      );
+    }
+    if (response.status === 429) {
+      const retryAfter = response.headers.get("retry-after");
+      return new OAuthRateLimitError(
+        this.providerCode,
+        `Google ${operation}: rate limit (429)`,
+        retryAfter ? Number.parseInt(retryAfter, 10) : undefined,
+      );
+    }
+    if (operation === "exchange") {
+      return new TokenExchangeError(
+        this.providerCode,
+        `Google ${operation}: ${response.status} ${response.statusText}`,
+      );
+    }
+    return new TokenRefreshError(
+      this.providerCode,
+      `Google ${operation}: ${response.status} ${response.statusText}`,
+    );
+  }
+}
+
+// ─── Internal types ────────────────────────────────────────────────────
+
+interface GoogleTokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  expires_in?: number;
+  scope?: string;
+  token_type?: string;
+  id_token?: string;
+}
+
+interface GoogleUserInfo {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  picture?: string;
+}
+
+function tokenResponseFromGoogle(body: GoogleTokenResponse): TokenResponse {
+  return {
+    accessToken: body.access_token,
+    refreshToken: body.refresh_token,
+    expiresAt:
+      body.expires_in !== undefined ? new Date(Date.now() + body.expires_in * 1000) : undefined,
+    scope: body.scope,
+    tokenType: body.token_type,
+    metadata: {
+      ...(body.id_token ? { id_token: body.id_token } : {}),
+    },
+  };
+}

package/lib/modules/oauth/adapters/MicrosoftOAuthAdapter.ts

@@ -0,0 +1,269 @@
+import type {
+  AuthUrlOptions,
+  ExchangeCodeOptions,
+  OAuthAdapter,
+  OAuthClientCredentials,
+  TokenResponse,
+} from "./OAuthAdapter.js";
+import {
+  InvalidCredentialsError,
+  OAuthRateLimitError,
+  TokenExchangeError,
+  TokenRefreshError,
+} from "./OAuthAdapter.js";
+
+/**
+ * Microsoft / Azure AD OAuth 2.0 adapter — fetch-based, no SDK.
+ *
+ * Implements the framework's `OAuthAdapter` interface against
+ * Microsoft's v2.0 endpoints directly:
+ *   - Authorization:  https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
+ *   - Token exchange: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
+ *   - User info:      https://graph.microsoft.com/v1.0/me
+ *   - Revoke: standard OAuth 2.0 has no Microsoft revoke endpoint.
+ *     `revokeAccess` is a best-effort no-op (returns silently); the
+ *     routes layer's local clear runs unconditionally per the
+ *     `OAuthAdapter` contract.
+ *
+ * Tenant handling: defaults to `"common"` (multi-tenant apps —
+ * accepts personal MS accounts + work accounts). Override via
+ * `tenant` in the constructor for single-tenant deployments
+ * (`new MicrosoftOAuthAdapter({ tenant: "contoso.onmicrosoft.com" })`)
+ * or per-call via `opts.providerOptions.tenant` on `buildAuthorizationUrl`.
+ *
+ * Microsoft's `provider_account_id` resolves from the Graph `/me`
+ * endpoint's `id` field — a stable directory object identifier
+ * suitable for cross-session linkage. The `oid` claim from the
+ * id_token is equivalent for token-only resolution paths.
+ */
+
+const AUTHORIZE_PATH = "/oauth2/v2.0/authorize";
+const TOKEN_PATH = "/oauth2/v2.0/token";
+const ME_ENDPOINT = "https://graph.microsoft.com/v1.0/me";
+
+export interface MicrosoftOAuthAdapterOptions {
+  /** Stable provider identifier. Default `"microsoft"`. */
+  providerCode?: string;
+  /**
+   * Microsoft tenant. Default `"common"` (multi-tenant). Use
+   * `"organizations"` to restrict to work/school accounts,
+   * `"consumers"` for personal MS accounts only, or a tenant ID /
+   * domain for a single-tenant app.
+   */
+  tenant?: string;
+  /** Override `fetch` (tests). */
+  fetchImpl?: typeof fetch;
+}
+
+export class MicrosoftOAuthAdapter implements OAuthAdapter {
+  readonly providerCode: string;
+  private readonly tenant: string;
+  private readonly fetchImpl: typeof fetch;
+
+  constructor(opts: MicrosoftOAuthAdapterOptions = {}) {
+    this.providerCode = opts.providerCode ?? "microsoft";
+    this.tenant = opts.tenant ?? "common";
+    this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  }
+
+  buildAuthorizationUrl(credentials: OAuthClientCredentials, opts: AuthUrlOptions): string {
+    const tenant = this.resolveTenant(opts.providerOptions);
+    const params = new URLSearchParams({
+      client_id: credentials.clientId,
+      redirect_uri: credentials.redirectUri,
+      response_type: "code",
+      scope: opts.scopes.join(" "),
+      state: opts.state,
+      response_mode: "query",
+    });
+
+    // PKCE: emit challenge params when supplied (F12).
+    if (opts.codeChallenge) {
+      params.set("code_challenge", opts.codeChallenge);
+      params.set("code_challenge_method", opts.codeChallengeMethod ?? "S256");
+    }
+
+    // Pass-through provider options excluding `tenant` (consumed above).
+    if (opts.providerOptions) {
+      for (const [key, val] of Object.entries(opts.providerOptions)) {
+        if (key === "tenant") continue;
+        params.set(key, String(val));
+      }
+    }
+
+    return `https://login.microsoftonline.com/${encodeURIComponent(tenant)}${AUTHORIZE_PATH}?${params.toString()}`;
+  }
+
+  async exchangeCodeForTokens(
+    code: string,
+    credentials: OAuthClientCredentials,
+    opts: ExchangeCodeOptions = {},
+  ): Promise<TokenResponse> {
+    const url = this.tokenUrl();
+    const formBody = new URLSearchParams({
+      code,
+      client_id: credentials.clientId,
+      client_secret: credentials.clientSecret,
+      redirect_uri: credentials.redirectUri,
+      grant_type: "authorization_code",
+    });
+    if (opts.codeVerifier) formBody.set("code_verifier", opts.codeVerifier);
+
+    const response = await this.fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: formBody.toString(),
+      signal: opts.signal,
+    });
+
+    if (!response.ok) {
+      throw this.translateError(response, "exchange");
+    }
+
+    const body = (await response.json()) as MicrosoftTokenResponse;
+    return tokenResponseFromMicrosoft(body);
+  }
+
+  async refreshTokens(
+    refreshToken: string,
+    credentials: OAuthClientCredentials,
+    opts: { signal?: AbortSignal } = {},
+  ): Promise<TokenResponse> {
+    const url = this.tokenUrl();
+    const response = await this.fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        refresh_token: refreshToken,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
+        grant_type: "refresh_token",
+      }).toString(),
+      signal: opts.signal,
+    });
+
+    if (!response.ok) {
+      throw this.translateError(response, "refresh");
+    }
+
+    const body = (await response.json()) as MicrosoftTokenResponse;
+    // Microsoft typically rotates refresh tokens on refresh; pass
+    // through what they send. Fall back to the original on the
+    // off-chance Microsoft omits it (consistent with Google's
+    // behavior for the same edge case).
+    return {
+      ...tokenResponseFromMicrosoft(body),
+      refreshToken: body.refresh_token ?? refreshToken,
+    };
+  }
+
+  async getProviderAccountId(
+    tokens: TokenResponse,
+    _credentials: OAuthClientCredentials,
+    opts: { signal?: AbortSignal } = {},
+  ): Promise<string> {
+    void _credentials;
+    if (!tokens.accessToken) {
+      throw new TokenExchangeError(
+        this.providerCode,
+        "cannot resolve provider account id without an access token",
+      );
+    }
+    const response = await this.fetchImpl(ME_ENDPOINT, {
+      headers: { authorization: `Bearer ${tokens.accessToken}` },
+      signal: opts.signal,
+    });
+    if (!response.ok) {
+      throw this.translateError(response, "userinfo");
+    }
+    const body = (await response.json()) as MicrosoftMeResponse;
+    if (!body.id) {
+      throw new TokenExchangeError(this.providerCode, "Graph /me response missing `id` field");
+    }
+    return body.id;
+  }
+
+  // Microsoft has no token-revoke endpoint in OAuth 2.0. Best-effort
+  // no-op per the OAuthAdapter contract; the routes layer's local
+  // clear runs regardless.
+  async revokeAccess(): Promise<void> {
+    return;
+  }
+
+  // ─── Internals ──────────────────────────────────────────────────────
+
+  private resolveTenant(providerOptions: AuthUrlOptions["providerOptions"]): string {
+    const override = providerOptions?.tenant;
+    if (typeof override === "string" && override.length > 0) return override;
+    return this.tenant;
+  }
+
+  private tokenUrl(tenantOverride?: string): string {
+    const tenant = tenantOverride ?? this.tenant;
+    return `https://login.microsoftonline.com/${encodeURIComponent(tenant)}${TOKEN_PATH}`;
+  }
+
+  private translateError(
+    response: Response,
+    operation: "exchange" | "refresh" | "userinfo",
+  ): Error {
+    if (response.status === 401) {
+      return new InvalidCredentialsError(
+        this.providerCode,
+        `Microsoft ${operation}: invalid credentials (401)`,
+      );
+    }
+    if (response.status === 429) {
+      const retryAfter = response.headers.get("retry-after");
+      return new OAuthRateLimitError(
+        this.providerCode,
+        `Microsoft ${operation}: rate limit (429)`,
+        retryAfter ? Number.parseInt(retryAfter, 10) : undefined,
+      );
+    }
+    if (operation === "exchange") {
+      return new TokenExchangeError(
+        this.providerCode,
+        `Microsoft ${operation}: ${response.status} ${response.statusText}`,
+      );
+    }
+    return new TokenRefreshError(
+      this.providerCode,
+      `Microsoft ${operation}: ${response.status} ${response.statusText}`,
+    );
+  }
+}
+
+// ─── Internal types ────────────────────────────────────────────────────
+
+interface MicrosoftTokenResponse {
+  token_type?: string;
+  scope?: string;
+  expires_in?: number;
+  ext_expires_in?: number;
+  access_token: string;
+  refresh_token?: string;
+  id_token?: string;
+}
+
+interface MicrosoftMeResponse {
+  id?: string;
+  userPrincipalName?: string;
+  mail?: string;
+  displayName?: string;
+}
+
+function tokenResponseFromMicrosoft(body: MicrosoftTokenResponse): TokenResponse {
+  return {
+    accessToken: body.access_token,
+    refreshToken: body.refresh_token,
+    expiresAt:
+      body.expires_in !== undefined ? new Date(Date.now() + body.expires_in * 1000) : undefined,
+    scope: body.scope,
+    tokenType: body.token_type,
+    metadata: {
+      ...(body.id_token ? { id_token: body.id_token } : {}),
+      ...(body.ext_expires_in !== undefined ? { ext_expires_in: body.ext_expires_in } : {}),
+    },
+  };
+}