@tangle-network/agent-integrations 0.53.16 → 0.53.18

package/dist/{chunk-PNHETWE4.js → chunk-ANWNXGVV.js}

@@ -1,7 +1,7 @@
 import {
   TangleIdentityUnreachableError,
   createTangleIdentityClient
-} from "./chunk-PDV6QQTH.js";
+} from "./chunk-JXFPIZ3O.js";
 
 // src/middleware/index.ts
 async function requireTangleAuth(request, opts = {}) {
@@ -126,4 +126,4 @@ export {
   honoTangleAuthMiddleware,
   expressTangleAuthMiddleware
 };
-//# sourceMappingURL=chunk-PNHETWE4.js.map
+//# sourceMappingURL=chunk-ANWNXGVV.js.map

package/dist/{chunk-SDDHYJK6.js → chunk-BXDMQIRE.js}

@@ -5,11 +5,11 @@ import {
 import {
   integrationSpecToConnector,
   listIntegrationSpecs
-} from "./chunk-HXSZKRMO.js";
+} from "./chunk-GDMM5YQE.js";
 import {
   CONNECTOR_ADAPTER_FACTORIES,
   adapters_exports
-} from "./chunk-4CQ7WC6R.js";
+} from "./chunk-35JYHZYE.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -263,12 +263,16 @@ function createConnectorAdapterProvider(options) {
         );
       }
       const scopes = request.requestedScopes && request.requestedScopes.length > 0 ? request.requestedScopes : auth.scopes;
-      const url = new URL(auth.authorizationUrl);
+      const url = new URL(resolveOAuthUrlTemplate(
+        auth.authorizationUrl,
+        request.metadata,
+        request.connectorId
+      ));
       url.searchParams.set("response_type", "code");
       url.searchParams.set("client_id", client.clientId);
       url.searchParams.set("redirect_uri", request.redirectUri);
       if (scopes.length > 0) {
-        url.searchParams.set("scope", scopes.join(" "));
+        url.searchParams.set("scope", scopes.join(auth.scopeSeparator ?? " "));
       }
       const state = request.state ?? randomState();
       url.searchParams.set("state", state);
@@ -332,9 +336,14 @@ function createConnectorAdapterProvider(options) {
         client_secret: client.clientSecret,
         redirect_uri: request.redirectUri
       });
+      const tokenUrl = resolveOAuthUrlTemplate(
+        auth.tokenUrl,
+        request.metadata,
+        request.connectorId
+      );
       let res;
       try {
-        res = await fetchImpl(auth.tokenUrl, {
+        res = await fetchImpl(tokenUrl, {
           method: "POST",
           headers: {
             "content-type": "application/x-www-form-urlencoded",
@@ -551,6 +560,40 @@ function redactSensitiveText(text, secrets) {
     text
   );
 }
+function resolveOAuthUrlTemplate(template, metadata, connectorId) {
+  const placeholders = [...template.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)];
+  let resolved = template;
+  for (const match of placeholders) {
+    const key = match[1];
+    const raw = metadata?.[key];
+    if (typeof raw !== "string" || !isDnsLabel(raw.trim())) {
+      throw new IntegrationError(
+        `OAuth URL for ${connectorId} requires metadata.${key} as a valid tenant label.`,
+        "config_missing"
+      );
+    }
+    resolved = resolved.replaceAll(match[0], raw.trim().toLowerCase());
+  }
+  let url;
+  try {
+    url = new URL(resolved);
+  } catch {
+    throw new IntegrationError(
+      `OAuth URL for ${connectorId} is invalid.`,
+      "config_missing"
+    );
+  }
+  if (url.protocol !== "https:" || url.username || url.password) {
+    throw new IntegrationError(
+      `OAuth URL for ${connectorId} must be HTTPS without embedded credentials.`,
+      "config_missing"
+    );
+  }
+  return url.toString();
+}
+function isDnsLabel(value) {
+  return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(value);
+}
 function captureTokenMetadata(tokenMetadata, json, connectorId) {
   if (!tokenMetadata) return {};
   const captured = {};
@@ -4363,4 +4406,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-SDDHYJK6.js.map
+//# sourceMappingURL=chunk-BXDMQIRE.js.map