@superdurable/connectors-sdk 0.0.0-stage → 0.1.0

package/dist/oauthtoken/index.js

@@ -0,0 +1,236 @@
+import {
+  SecretString
+} from "../chunk-KD5DYYSU.js";
+import {
+  ReauthorizationRequiredError
+} from "../chunk-SOXYPIMO.js";
+
+// src/oauthtoken/index.ts
+import { createPrivateKey, sign } from "crypto";
+var RefreshSkewMs = 3e5;
+var TokenResponse = class {
+  /** Replacement access token. */
+  accessToken;
+  /** Rotated refresh token, empty when the provider retained it. */
+  refreshToken;
+  /** Access lifetime in milliseconds; zero only when explicitly accepted. */
+  expiresInMs;
+  /** Refresh token lifetime in milliseconds; zero when omitted. */
+  refreshTokenExpiresInMs;
+  /** Returned scope string, possibly empty. */
+  scope;
+  /** Returned token type, possibly empty when explicitly accepted. */
+  tokenType;
+  /** Only explicitly retained non-standard response fields. */
+  retainedFields;
+  /** Capture validated provider response fields. */
+  constructor(fields) {
+    this.accessToken = fields.accessToken;
+    this.refreshToken = fields.refreshToken;
+    this.expiresInMs = fields.expiresInMs;
+    this.refreshTokenExpiresInMs = fields.refreshTokenExpiresInMs;
+    this.scope = fields.scope;
+    this.tokenType = fields.tokenType;
+    this.retainedFields = fields.retainedFields;
+  }
+  /** Keep the previous refresh token when no rotated value was returned. */
+  nextRefreshToken(prior) {
+    return this.refreshToken.reveal() ? this.refreshToken : prior;
+  }
+};
+var TokenEndpoint = class {
+  #options;
+  /** Capture endpoint rules without sending a request. */
+  constructor(options) {
+    this.#options = options;
+  }
+  /** Exchange a refresh token, preserving terminal-error classification. */
+  async exchangeRefreshToken(client, refreshToken, signal) {
+    if (!client.id || !refreshToken.reveal()) throw new ReauthorizationRequiredError();
+    const parameters = { grant_type: "refresh_token", refresh_token: refreshToken.reveal() };
+    const basicClient = this.#addClientAuthentication(parameters, client);
+    return this.#exchange(parameters, basicClient, signal);
+  }
+  /** Obtain an access token with the OAuth client-credentials grant. */
+  async exchangeClientCredentials(client, scopes = [], signal) {
+    if (!client.id || !client.secret?.reveal()) throw new ReauthorizationRequiredError();
+    if (client.authenticationMethod === "none") throw new TypeError(`${this.#options.providerName} client credentials grant needs a confidential client`);
+    const parameters = { grant_type: "client_credentials" };
+    if (scopes.length) parameters.scope = scopes.join(" ");
+    const basicClient = this.#addClientAuthentication(parameters, client);
+    return this.#exchange(parameters, basicClient, signal);
+  }
+  /** Exchange a signed JWT bearer assertion without client credentials. */
+  async exchangeJWTBearerAssertion(assertion, signal) {
+    if (!assertion.reveal()) throw new ReauthorizationRequiredError();
+    return this.#exchange({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion: assertion.reveal() }, void 0, signal);
+  }
+  #addClientAuthentication(parameters, client) {
+    switch (client.authenticationMethod) {
+      case "client_secret_post":
+        if (!client.secret?.reveal()) throw new ReauthorizationRequiredError();
+        parameters.client_id = client.id;
+        parameters.client_secret = client.secret.reveal();
+        return void 0;
+      case "client_secret_basic":
+        if (!client.secret?.reveal()) throw new ReauthorizationRequiredError();
+        return client;
+      case "none":
+        parameters.client_id = client.id;
+        return void 0;
+      default:
+        throw new TypeError(`${this.#options.providerName} OAuth client authentication method is not supported`);
+    }
+  }
+  async #exchange(parameters, basicClient, signal) {
+    const options = this.#options;
+    validateEndpointURL(options.url, options.allowsPlainHTTP ?? false, options.providerName);
+    for (const field of options.retainedResponseFields ?? []) {
+      if (standardResponseFields.has(field)) throw new TypeError(`${options.providerName} token endpoint cannot retain the standard ${field} field`);
+    }
+    for (const [parameter, value] of Object.entries(options.additionalRequestParameters ?? {})) {
+      if (grantParameters.has(parameter)) throw new TypeError(`${options.providerName} token endpoint cannot replace the ${parameter} request parameter`);
+      parameters[parameter] = value;
+    }
+    const headers = { Accept: "application/json" };
+    let body;
+    if (options.usesJSONRequestBody) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(parameters);
+    } else {
+      headers["Content-Type"] = "application/x-www-form-urlencoded";
+      body = new URLSearchParams(parameters).toString();
+    }
+    if (basicClient) headers.Authorization = `Basic ${Buffer.from(`${basicClient.id}:${basicClient.secret?.reveal() ?? ""}`).toString("base64")}`;
+    let response;
+    try {
+      response = await (options.fetch ?? fetch)(options.url, { method: "POST", headers, body, redirect: "manual", ...signal ? { signal } : {} });
+    } catch {
+      throw new Error(`${options.providerName} token endpoint is unavailable`);
+    }
+    let contents;
+    try {
+      contents = await readBoundedBody(response, 1 << 20);
+    } catch {
+      throw new Error(`${options.providerName} token response could not be read`);
+    }
+    let decoded;
+    try {
+      const value = JSON.parse(new TextDecoder().decode(contents));
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError();
+      decoded = value;
+    } catch {
+      throw new Error(`${options.providerName} token response is invalid`);
+    }
+    const errorCode = typeof decoded.error === "string" ? decoded.error : "";
+    if (!response.ok || errorCode) {
+      if (response.status < 500 && errorCode && options.terminalErrorCodes?.includes(errorCode)) throw new ReauthorizationRequiredError();
+      throw new Error(`${options.providerName} token endpoint returned HTTP ${response.status}`);
+    }
+    const accessToken = decoded.access_token;
+    const expiresIn = decoded.expires_in;
+    const tokenType = decoded.token_type;
+    const hasAcceptedExpiry = Number.isSafeInteger(expiresIn) && expiresIn > 0 || (expiresIn === void 0 || expiresIn === 0) && options.acceptsMissingExpiresIn === true;
+    const acceptedTypes = options.acceptedTokenTypes?.length ? options.acceptedTokenTypes : ["Bearer"];
+    const hasAcceptedType = typeof tokenType === "string" && acceptedTypes.some((accepted) => accepted.toLowerCase() === tokenType.toLowerCase()) || (tokenType === void 0 || tokenType === "") && options.acceptsMissingTokenType === true;
+    if (typeof accessToken !== "string" || !accessToken || !hasAcceptedExpiry || !hasAcceptedType) throw new Error(`${options.providerName} token response omitted required fields`);
+    const retainedFields = {};
+    for (const field of options.retainedResponseFields ?? []) if (Object.hasOwn(decoded, field)) retainedFields[field] = decoded[field];
+    const refreshToken = typeof decoded.refresh_token === "string" ? decoded.refresh_token : "";
+    const refreshTokenExpiry = typeof decoded.refresh_token_expires_in === "number" && decoded.refresh_token_expires_in > 0 ? decoded.refresh_token_expires_in : 0;
+    return new TokenResponse({ accessToken: new SecretString(accessToken), refreshToken: new SecretString(refreshToken), expiresInMs: (expiresIn ?? 0) * 1e3, refreshTokenExpiresInMs: refreshTokenExpiry * 1e3, scope: typeof decoded.scope === "string" ? decoded.scope : "", tokenType: typeof tokenType === "string" ? tokenType : "", retainedFields });
+  }
+};
+var grantParameters = /* @__PURE__ */ new Set(["grant_type", "refresh_token", "client_id", "client_secret", "assertion", "client_assertion", "client_assertion_type"]);
+var standardResponseFields = /* @__PURE__ */ new Set(["access_token", "refresh_token", "expires_in", "refresh_token_expires_in", "scope", "token_type", "error", "error_description", "error_uri", "id_token"]);
+function validateEndpointURL(value, allowsPlainHTTP, providerName) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new TypeError(`${providerName} token endpoint is invalid`);
+  }
+  if (!parsed.hostname || parsed.protocol !== "https:" && !(allowsPlainHTTP && parsed.protocol === "http:") || parsed.username || parsed.password) throw new TypeError(`${providerName} token endpoint is invalid`);
+}
+async function readBoundedBody(response, maximumBytes) {
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    for (; ; ) {
+      const result = await reader.read();
+      if (result.done) break;
+      length += result.value.byteLength;
+      if (length > maximumBytes) throw new RangeError("token response too large");
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const contents = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    contents.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return contents;
+}
+function proportionalRefreshSkewMs(issuedAt, expiresAt) {
+  return lifetimeShare(RefreshSkewMs, issuedAt, expiresAt);
+}
+function forcedRefreshFloorMs(issuedAt, expiresAt) {
+  return lifetimeShare(6e4, issuedAt, expiresAt);
+}
+function isRefreshRequired(hasAccessToken, expiresAt, now, missingExpiryRule, issuedAt) {
+  if (!hasAccessToken) return true;
+  if (!expiresAt) return missingExpiryRule !== "keep";
+  return expiresAt.getTime() <= now.getTime() + proportionalRefreshSkewMs(issuedAt, expiresAt);
+}
+function isRefreshRequiredWithIssueTime(hasAccessToken, issuedAt, expiresAt, now, missingExpiryRule) {
+  return isRefreshRequired(hasAccessToken, expiresAt, now, missingExpiryRule, issuedAt);
+}
+function hasAllScopes(returnedScope, requiredScopes) {
+  const granted = new Set(returnedScope.split(/[ ,]+/).filter(Boolean));
+  return requiredScopes.every((scope) => granted.has(scope));
+}
+function hasExactScopes(returnedScope, requiredScopes) {
+  const granted = new Set(returnedScope.split(/[ ,]+/).filter(Boolean));
+  return granted.size === new Set(requiredScopes).size && hasAllScopes(returnedScope, requiredScopes);
+}
+function lifetimeShare(maximumMs, issuedAt, expiresAt) {
+  const lifetimeMs = issuedAt && expiresAt ? expiresAt.getTime() - issuedAt.getTime() : 0;
+  return lifetimeMs > 0 ? Math.min(maximumMs, lifetimeMs / 4) : maximumMs;
+}
+function parseRSAPrivateKeyPEM(pemText) {
+  try {
+    const key = createPrivateKey(pemText);
+    if (key.asymmetricKeyType !== "rsa") throw new TypeError();
+    return key;
+  } catch {
+    throw new TypeError("private key is invalid or must use RSA");
+  }
+}
+function signJWTBearerAssertion(assertion, privateKey) {
+  if (!privateKey || privateKey.asymmetricKeyType !== "rsa") throw new TypeError("JWT-bearer assertion private key is missing or invalid");
+  if (!assertion.issuer || !assertion.audience || !Number.isFinite(assertion.issuedAt.getTime()) || !Number.isSafeInteger(assertion.lifetimeMs) || assertion.lifetimeMs <= 0) throw new TypeError("JWT-bearer assertion claims are incomplete");
+  const claims = { aud: assertion.audience, exp: Math.floor((assertion.issuedAt.getTime() + assertion.lifetimeMs) / 1e3), iat: Math.floor(assertion.issuedAt.getTime() / 1e3), iss: assertion.issuer };
+  if (assertion.subject) claims.sub = assertion.subject;
+  if (assertion.scope) claims.scope = assertion.scope;
+  const unsigned = `${Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url")}.${Buffer.from(JSON.stringify(claims)).toString("base64url")}`;
+  const signature = sign("RSA-SHA256", Buffer.from(unsigned), privateKey).toString("base64url");
+  return new SecretString(`${unsigned}.${signature}`);
+}
+export {
+  RefreshSkewMs,
+  TokenEndpoint,
+  TokenResponse,
+  forcedRefreshFloorMs,
+  hasAllScopes,
+  hasExactScopes,
+  isRefreshRequired,
+  isRefreshRequiredWithIssueTime,
+  parseRSAPrivateKeyPEM,
+  proportionalRefreshSkewMs,
+  signJWTBearerAssertion
+};

package/dist/operation-Ca8rfacf.d.ts

@@ -0,0 +1,34 @@
+import { O as OperationRef, f as BranchDefinition, Z as RetryPolicy, C as Call, M as MutationAttempt, Q as QueryAttempt } from './credentials-vrvW0d4j.js';
+
+/** Execute options owned by one operation; durations are milliseconds. */
+interface StepDefaults {
+    /** Zero or absence uses the Dex method timeout. */ executeMethodTimeoutMs?: number;
+    /** Zero or absence uses the Dex heartbeat timeout. */ heartbeatTimeoutMs?: number;
+    /** Absence uses the connector one-hour retry policy. */ executeRetry?: RetryPolicy;
+    /** Absence inherits the Flow durability. */ executeDurability?: 'default' | 'sync' | 'async';
+}
+/** Stable query routes and Execute defaults. */
+interface QueryDefinition {
+    /** Manifest operation identity. */ operation: OperationRef;
+    /** Declared routes, including the standard defect route. */ branches: readonly BranchDefinition[];
+    /** Execute options for the generated Step. */ stepDefaults: StepDefaults;
+}
+/** Stable mutation routes and Execute defaults. */
+type MutationDefinition = QueryDefinition;
+/** Read-only provider operation invoked once per Dex Execute attempt. */
+interface Query<Input, Output> {
+    /** Return an immutable operation definition. */ definition(): QueryDefinition;
+    /** Classify one provider call as a branch or safe retry. */ invoke(call: Call, input: Input): QueryAttempt<Output> | Promise<QueryAttempt<Output>>;
+}
+/** Provider write with a stable deduplication key and classified attempt. */
+interface Mutation<Input, Output> {
+    /** Return an immutable operation definition. */ definition(): MutationDefinition;
+    /** Derive a provider-safe key from the stable call ID and input. */ idempotencyKey(callId: string, input: Input): string;
+    /** Classify one provider call as a branch, safe retry, or uncertainty. */ invoke(call: Call, input: Input): MutationAttempt<Output> | Promise<MutationAttempt<Output>>;
+}
+/** Validate a query definition before any provider call or Step registration. */
+declare function validateQueryDefinition(definition: QueryDefinition): void;
+/** Validate a mutation definition before any provider call or Step registration. */
+declare function validateMutationDefinition(definition: MutationDefinition): void;
+
+export { type Mutation as M, type QueryDefinition as Q, type StepDefaults as S, type MutationDefinition as a, type Query as b, validateQueryDefinition as c, validateMutationDefinition as v };