@su-record/vibe 2.7.10 → 2.7.11

package/dist/pc/google/OAuthFlow.test.js

@@ -0,0 +1,178 @@
+/**
+ * OAuthFlow Tests
+ *
+ * PKCE generation, state management, scope manager.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import Database from 'better-sqlite3';
+import { OAuthFlow, LocalCallbackServer } from './OAuthFlow.js';
+import { TokenStore } from './TokenStore.js';
+import { ScopeManager } from './ScopeManager.js';
+import { GOOGLE_SCOPE_MAP } from './types.js';
+const logger = () => { };
+function createTempDir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'vibe-oauth-test-'));
+}
+describe('OAuthFlow', () => {
+    let tmpDir;
+    let db;
+    let tokenStore;
+    let scopeManager;
+    let oauthFlow;
+    beforeEach(() => {
+        tmpDir = createTempDir();
+        process.env.VIBE_GOOGLE_MASTER_KEY = Buffer.from('a'.repeat(32)).toString('base64');
+        const dbPath = path.join(tmpDir, 'test.db');
+        tokenStore = new TokenStore(logger, dbPath);
+        db = new Database(dbPath);
+        scopeManager = new ScopeManager(db, logger);
+        oauthFlow = new OAuthFlow(db, tokenStore, scopeManager, logger, {
+            clientId: 'test-client-id',
+            clientSecret: 'test-client-secret',
+            callbackPort: 0, // Will not actually listen
+        });
+    });
+    afterEach(() => {
+        db.close();
+        tokenStore.close();
+        delete process.env.VIBE_GOOGLE_MASTER_KEY;
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    // ════════════════════════════════════════════════════════════
+    // Auth URL Generation
+    // ════════════════════════════════════════════════════════════
+    describe('Auth URL Generation', () => {
+        it('should generate auth URL with PKCE parameters', () => {
+            const scopes = [GOOGLE_SCOPE_MAP['gmail.send']];
+            const { url, state } = oauthFlow.generateAuthUrl('user1', scopes);
+            const parsed = new URL(url);
+            expect(parsed.searchParams.get('client_id')).toBe('test-client-id');
+            expect(parsed.searchParams.get('response_type')).toBe('code');
+            expect(parsed.searchParams.get('code_challenge')).toBeTruthy();
+            expect(parsed.searchParams.get('code_challenge_method')).toBe('S256');
+            expect(parsed.searchParams.get('access_type')).toBe('offline');
+            expect(state).toBeTruthy();
+        });
+        it('should include requested scopes', () => {
+            const scopes = [
+                GOOGLE_SCOPE_MAP['gmail.send'],
+                GOOGLE_SCOPE_MAP['drive'],
+            ];
+            const { url } = oauthFlow.generateAuthUrl('user1', scopes);
+            const parsed = new URL(url);
+            const scopeParam = parsed.searchParams.get('scope');
+            expect(scopeParam).toContain('gmail.send');
+            expect(scopeParam).toContain('drive');
+        });
+        it('should generate unique state per request', () => {
+            const { state: state1 } = oauthFlow.generateAuthUrl('user1', []);
+            const { state: state2 } = oauthFlow.generateAuthUrl('user1', []);
+            expect(state1).not.toBe(state2);
+        });
+    });
+    // ════════════════════════════════════════════════════════════
+    // State Management
+    // ════════════════════════════════════════════════════════════
+    describe('State Management', () => {
+        it('should store state in DB on auth URL generation', () => {
+            const { state } = oauthFlow.generateAuthUrl('user1', []);
+            const stateHash = crypto.createHash('sha256').update(state).digest('hex');
+            const row = db.prepare('SELECT * FROM oauth_states WHERE state_hash = ?').get(stateHash);
+            expect(row).toBeTruthy();
+        });
+        it('should mark state as one-time use', () => {
+            const { state } = oauthFlow.generateAuthUrl('user1', []);
+            const stateHash = crypto.createHash('sha256').update(state).digest('hex');
+            const row = db.prepare('SELECT used FROM oauth_states WHERE state_hash = ?').get(stateHash);
+            expect(row.used).toBe(0);
+        });
+    });
+    // ════════════════════════════════════════════════════════════
+    // ScopeManager Integration
+    // ════════════════════════════════════════════════════════════
+    describe('ScopeManager', () => {
+        it('should grant and retrieve scopes', () => {
+            scopeManager.grantScopes('user1', [
+                GOOGLE_SCOPE_MAP['gmail.send'],
+                GOOGLE_SCOPE_MAP['drive'],
+            ]);
+            const granted = scopeManager.getGrantedScopes('user1');
+            expect(granted).toContain(GOOGLE_SCOPE_MAP['gmail.send']);
+            expect(granted).toContain(GOOGLE_SCOPE_MAP['drive']);
+        });
+        it('should check scope by alias', () => {
+            scopeManager.grantScopes('user1', [GOOGLE_SCOPE_MAP['gmail.send']]);
+            expect(scopeManager.hasScope('user1', 'gmail.send')).toBe(true);
+            expect(scopeManager.hasScope('user1', 'drive')).toBe(false);
+        });
+        it('should detect missing scopes', () => {
+            scopeManager.grantScopes('user1', [GOOGLE_SCOPE_MAP['gmail.send']]);
+            const missing = scopeManager.getMissingScopes('user1', ['gmail.send', 'drive']);
+            expect(missing).toHaveLength(1);
+            expect(missing[0]).toBe(GOOGLE_SCOPE_MAP['drive']);
+        });
+        it('should revoke all scopes for user', () => {
+            scopeManager.grantScopes('user1', [GOOGLE_SCOPE_MAP['gmail.send']]);
+            scopeManager.revokeScopes('user1');
+            expect(scopeManager.getGrantedScopes('user1')).toHaveLength(0);
+        });
+        it('should detect denied scopes', () => {
+            const requested = [GOOGLE_SCOPE_MAP['gmail.send'], GOOGLE_SCOPE_MAP['drive']];
+            const granted = [GOOGLE_SCOPE_MAP['gmail.send']];
+            const denied = scopeManager.detectDeniedScopes(requested, granted);
+            expect(denied).toEqual([GOOGLE_SCOPE_MAP['drive']]);
+        });
+        it('should isolate scopes per user', () => {
+            scopeManager.grantScopes('userA', [GOOGLE_SCOPE_MAP['gmail.send']]);
+            scopeManager.grantScopes('userB', [GOOGLE_SCOPE_MAP['drive']]);
+            expect(scopeManager.hasScope('userA', 'gmail.send')).toBe(true);
+            expect(scopeManager.hasScope('userA', 'drive')).toBe(false);
+            expect(scopeManager.hasScope('userB', 'drive')).toBe(true);
+            expect(scopeManager.hasScope('userB', 'gmail.send')).toBe(false);
+        });
+    });
+    // ════════════════════════════════════════════════════════════
+    // Token Refresh Error
+    // ════════════════════════════════════════════════════════════
+    describe('Token Refresh Errors', () => {
+        it('should throw AUTH_REQUIRED when no tokens exist', async () => {
+            await expect(oauthFlow.refreshTokens('nonexistent')).rejects.toThrow(/인증이 필요합니다/);
+        });
+        it('should throw when refresh token is empty', async () => {
+            tokenStore.save('user1', 'access', '', 3600, ['scope1']);
+            await expect(oauthFlow.refreshTokens('user1')).rejects.toThrow(/만료되었습니다/);
+        });
+    });
+    // ════════════════════════════════════════════════════════════
+    // LocalCallbackServer
+    // ════════════════════════════════════════════════════════════
+    describe('LocalCallbackServer', () => {
+        it('should have correct redirect URI', () => {
+            const server = new LocalCallbackServer(51199);
+            expect(server.redirectUri).toBe('http://localhost:51199/oauth-callback');
+            server.close();
+        });
+        it('should timeout after specified duration', async () => {
+            const server = new LocalCallbackServer(51198, 100); // 100ms timeout
+            await expect(server.waitForCallback('test-state')).rejects.toThrow(/타임아웃/);
+        }, 5000);
+    });
+});
+// ════════════════════════════════════════════════════════════
+// PKCE Verification (standalone)
+// ════════════════════════════════════════════════════════════
+describe('PKCE Verification', () => {
+    it('should generate valid S256 challenge from verifier', () => {
+        const verifier = crypto.randomBytes(32).toString('base64url');
+        const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+        expect(challenge).toBeTruthy();
+        expect(challenge).not.toBe(verifier);
+        // S256 challenge should be base64url-encoded SHA-256
+        expect(challenge.length).toBeGreaterThan(20);
+    });
+});
+//# sourceMappingURL=OAuthFlow.test.js.map

package/dist/pc/google/OAuthFlow.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthFlow.test.js","sourceRoot":"","sources":["../../../src/pc/google/OAuthFlow.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,MAAM,GAAiB,GAAG,EAAE,GAAE,CAAC,CAAC;AAEtC,SAAS,aAAa;IACpB,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,EAAqB,CAAC;IAC1B,IAAI,UAAsB,CAAC;IAC3B,IAAI,YAA0B,CAAC;IAC/B,IAAI,SAAoB,CAAC;IAEzB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,aAAa,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1B,YAAY,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE5C,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE;YAC9D,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,oBAAoB;YAClC,YAAY,EAAE,CAAC,EAAE,2BAA2B;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC1C,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAElE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG;gBACb,gBAAgB,CAAC,YAAY,CAAC;gBAC9B,gBAAgB,CAAC,OAAO,CAAC;aAC1B,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,mBAAmB;IACnB,+DAA+D;IAE/D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzF,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAqB,CAAC;YAChH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,2BAA2B;IAC3B,+DAA+D;IAE/D,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE;gBAChC,gBAAgB,CAAC,YAAY,CAAC;gBAC9B,gBAAgB,CAAC,OAAO,CAAC;aAC1B,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;YAChF,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpE,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,SAAS,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,MAAM,OAAO,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpE,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAE/D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAE/D,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACzE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB;YACpE,MAAM,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7E,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+DAA+D;AAC/D,iCAAiC;AACjC,+DAA+D;AAE/D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,qDAAqD;QACrD,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/pc/google/ScopeManager.d.ts

@@ -0,0 +1,28 @@
+/**
+ * ScopeManager — Incremental scope 관리
+ *
+ * Just-in-Time 요청: 필요한 scope만 점진적 추가.
+ * 현재 승인된 scope 조회, 부족 scope 감지.
+ */
+import Database from 'better-sqlite3';
+import type { GoogleLogger, ScopeAlias } from './types.js';
+export declare class ScopeManager {
+    private db;
+    private logger;
+    constructor(db: Database.Database, logger: GoogleLogger);
+    /** 사용자의 승인된 scope 목록 조회 */
+    getGrantedScopes(userId: string): string[];
+    /** scope 승인 기록 */
+    grantScopes(userId: string, scopes: string[]): void;
+    /** scope 삭제 (revoke 시) */
+    revokeScopes(userId: string): void;
+    /** 특정 기능에 필요한 scope가 승인되었는지 확인 */
+    hasScope(userId: string, scopeAlias: ScopeAlias): boolean;
+    /** 필요한 scope 중 미승인 목록 반환 */
+    getMissingScopes(userId: string, required: ScopeAlias[]): string[];
+    /** scope alias → full URL 변환 */
+    resolveScopes(aliases: ScopeAlias[]): string[];
+    /** 부분 승인 감지: 요청한 scope 중 거절된 것 확인 */
+    detectDeniedScopes(requested: string[], granted: string[]): string[];
+}
+//# sourceMappingURL=ScopeManager.d.ts.map

package/dist/pc/google/ScopeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeManager.d.ts","sourceRoot":"","sources":["../../../src/pc/google/ScopeManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG3D,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,MAAM,CAAe;gBAEjB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY;IAKvD,2BAA2B;IAC3B,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAO1C,kBAAkB;IAClB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAenD,0BAA0B;IAC1B,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlC,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO;IASzD,4BAA4B;IAC5B,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE;IAYlE,gCAAgC;IAChC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE;IAU9C,qCAAqC;IACrC,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;CAIrE"}

package/dist/pc/google/ScopeManager.js

@@ -0,0 +1,75 @@
+/**
+ * ScopeManager — Incremental scope 관리
+ *
+ * Just-in-Time 요청: 필요한 scope만 점진적 추가.
+ * 현재 승인된 scope 조회, 부족 scope 감지.
+ */
+import { GOOGLE_SCOPE_MAP, createGoogleError } from './types.js';
+export class ScopeManager {
+    db;
+    logger;
+    constructor(db, logger) {
+        this.db = db;
+        this.logger = logger;
+    }
+    /** 사용자의 승인된 scope 목록 조회 */
+    getGrantedScopes(userId) {
+        const rows = this.db.prepare('SELECT scope FROM user_scopes WHERE user_id = ?').all(userId);
+        return rows.map(r => r.scope);
+    }
+    /** scope 승인 기록 */
+    grantScopes(userId, scopes) {
+        const stmt = this.db.prepare(`
+      INSERT OR REPLACE INTO user_scopes (user_id, scope, granted_at)
+      VALUES (?, ?, ?)
+    `);
+        const now = new Date().toISOString();
+        const tx = this.db.transaction(() => {
+            for (const scope of scopes) {
+                stmt.run(userId, scope, now);
+            }
+        });
+        tx();
+        this.logger('info', `Scopes granted for ${userId}: ${scopes.join(', ')}`);
+    }
+    /** scope 삭제 (revoke 시) */
+    revokeScopes(userId) {
+        this.db.prepare('DELETE FROM user_scopes WHERE user_id = ?').run(userId);
+    }
+    /** 특정 기능에 필요한 scope가 승인되었는지 확인 */
+    hasScope(userId, scopeAlias) {
+        const fullScope = GOOGLE_SCOPE_MAP[scopeAlias];
+        if (!fullScope)
+            return false;
+        const row = this.db.prepare('SELECT 1 FROM user_scopes WHERE user_id = ? AND scope = ?').get(userId, fullScope);
+        return !!row;
+    }
+    /** 필요한 scope 중 미승인 목록 반환 */
+    getMissingScopes(userId, required) {
+        const granted = new Set(this.getGrantedScopes(userId));
+        const missing = [];
+        for (const alias of required) {
+            const fullScope = GOOGLE_SCOPE_MAP[alias];
+            if (fullScope && !granted.has(fullScope)) {
+                missing.push(fullScope);
+            }
+        }
+        return missing;
+    }
+    /** scope alias → full URL 변환 */
+    resolveScopes(aliases) {
+        return aliases.map(alias => {
+            const full = GOOGLE_SCOPE_MAP[alias];
+            if (!full) {
+                throw createGoogleError('UNKNOWN_ERROR', `Unknown scope alias: ${alias}`);
+            }
+            return full;
+        });
+    }
+    /** 부분 승인 감지: 요청한 scope 중 거절된 것 확인 */
+    detectDeniedScopes(requested, granted) {
+        const grantedSet = new Set(granted);
+        return requested.filter(s => !grantedSet.has(s));
+    }
+}
+//# sourceMappingURL=ScopeManager.js.map

package/dist/pc/google/ScopeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopeManager.js","sourceRoot":"","sources":["../../../src/pc/google/ScopeManager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,OAAO,YAAY;IACf,EAAE,CAAoB;IACtB,MAAM,CAAe;IAE7B,YAAY,EAAqB,EAAE,MAAoB;QACrD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,2BAA2B;IAC3B,gBAAgB,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC1B,iDAAiD,CAClD,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;QAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,WAAW,CAAC,MAAc,EAAE,MAAgB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAG5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,EAAE,EAAE,CAAC;QACL,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,0BAA0B;IAC1B,YAAY,CAAC,MAAc;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,kCAAkC;IAClC,QAAQ,CAAC,MAAc,EAAE,UAAsB;QAC7C,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CACzB,2DAA2D,CAC5D,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC,GAAG,CAAC;IACf,CAAC;IAED,4BAA4B;IAC5B,gBAAgB,CAAC,MAAc,EAAE,QAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,OAAqB;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,iBAAiB,CAAC,eAAe,EAAE,wBAAwB,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,kBAAkB,CAAC,SAAmB,EAAE,OAAiB;QACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/pc/google/TokenStore.d.ts

@@ -0,0 +1,49 @@
+/**
+ * TokenStore — SQLite 기반 per-user 토큰 저장소
+ *
+ * - Envelope encryption: KEK(master key) → DEK 암호화, DEK → 토큰 암호화
+ * - Token family rotation: refresh token 갱신 시 family 내 generation 증가
+ * - Reuse detection: 이전 generation token 사용 시 family 전체 폐기
+ * - AsyncMutex: 동시 갱신 방지 (1회만 갱신, 나머지 대기)
+ * - Preemptive refresh: 80% lifetime 시점에 자동 갱신
+ */
+import Database from 'better-sqlite3';
+import type { DecryptedTokens, GoogleLogger } from './types.js';
+export declare class TokenStore {
+    private db;
+    private kek;
+    private logger;
+    private refreshMutexes;
+    private ownsDb;
+    constructor(logger: GoogleLogger, dbOrPath?: Database.Database | string);
+    /** 토큰 저장 (암호화 + family 생성) */
+    save(userId: string, accessToken: string, refreshToken: string, expiresIn: number, scopes: string[]): void;
+    /** 토큰 로드 (복호화) */
+    load(userId: string): DecryptedTokens | null;
+    /** 토큰 삭제 (사용자 전체) */
+    revoke(userId: string): void;
+    /** Refresh token rotation: 새 토큰 저장 + generation 증가 */
+    rotateToken(userId: string, familyId: string, oldGeneration: number, newAccessToken: string, newRefreshToken: string, expiresIn: number, scopes: string[]): void;
+    /** Family 전체 폐기 (compromised) */
+    invalidateFamily(familyId: string): void;
+    /** 80% lifetime 체크 (preemptive refresh 판정) */
+    needsPreemptiveRefresh(tokens: DecryptedTokens): boolean;
+    /** AsyncMutex 래핑 refresh: 동시 요청 시 1회만 갱신 */
+    withRefreshMutex(userId: string, refreshFn: () => Promise<DecryptedTokens>): Promise<DecryptedTokens>;
+    /** 만료 여부 체크 */
+    isExpired(tokens: DecryptedTokens, marginMs?: number): boolean;
+    /** DB 닫기 (외부 주입 DB는 닫지 않음) */
+    close(): void;
+    /** 내부 DB 참조 (ScopeManager 등 공유용) */
+    getDatabase(): Database.Database;
+    private createFamily;
+    private getFamily;
+    private updateFamilyLastUsed;
+    private envelopeEncrypt;
+    private envelopeDecrypt;
+    private loadOrCreateKEK;
+    private hashScopes;
+    private parseScopesJson;
+    private initSchema;
+}
+//# sourceMappingURL=TokenStore.d.ts.map

package/dist/pc/google/TokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenStore.d.ts","sourceRoot":"","sources":["../../../src/pc/google/TokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EACV,eAAe,EAGf,YAAY,EAEb,MAAM,YAAY,CAAC;AASpB,qBAAa,UAAU;IACrB,OAAO,CAAC,EAAE,CAAoB;IAC9B,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,cAAc,CAA+C;IAErE,OAAO,CAAC,MAAM,CAAU;gBAEZ,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,GAAG,MAAM;IA2BvE,8BAA8B;IAC9B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,GACf,IAAI;IAuBP,kBAAkB;IAClB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAmC5C,qBAAqB;IACrB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAM5B,sDAAsD;IACtD,WAAW,CACT,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,GACf,IAAI;IAqCP,iCAAiC;IACjC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAUxC,8CAA8C;IAC9C,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO;IAOxD,4CAA4C;IACtC,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GACxC,OAAO,CAAC,eAAe,CAAC;IAW3B,eAAe;IACf,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,GAAE,MAAe,GAAG,OAAO;IAItE,8BAA8B;IAC9B,KAAK,IAAI,IAAI;IAMb,oCAAoC;IACpC,WAAW,IAAI,QAAQ,CAAC,QAAQ;IAQhC,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,eAAe;IAkBvB,OAAO,CAAC,eAAe;IA4BvB,OAAO,CAAC,eAAe;IAyBvB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,UAAU;CA2CnB"}