@tangle-network/agent-integrations 0.53.50 → 0.53.52

package/dist/{chunk-T3WH6MMA.js → chunk-CT3J7ZB6.js}

@@ -7,17 +7,17 @@ import {
   canonicalIntegrationKind,
   integrationSpecToConnector,
   listIntegrationSpecs
-} from "./chunk-QE4WFYSK.js";
+} from "./chunk-CONRYVPK.js";
 import {
   listBundledConnectorAdapters
-} from "./chunk-EP6EDAPV.js";
+} from "./chunk-E2QYXDJQ.js";
 import {
   CONNECTOR_ADAPTER_FACTORIES,
   createOAuthBasicAuthorizationHeader,
   createOAuthTokenRequestHeaders,
   oauthClientCredentialRedactionValues,
   redactOAuthSensitiveText
-} from "./chunk-2JRYKWYX.js";
+} from "./chunk-QL6CRJ3E.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -252,6 +252,12 @@ function createConnectorAdapterProvider(options) {
           "auth_not_supported"
         );
       }
+      if ((auth.grantType ?? "authorization_code") !== "authorization_code") {
+        throw new IntegrationError(
+          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,
+          "auth_not_supported"
+        );
+      }
       const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
       const tokenClientAuthMethod = resolveTokenClientAuthMethod(
         auth.tokenClientAuthMethod,
@@ -280,7 +286,8 @@ function createConnectorAdapterProvider(options) {
       const url = new URL(resolveOAuthUrlTemplate(
         auth.authorizationUrl,
         request.metadata,
-        request.connectorId
+        request.connectorId,
+        auth.urlTemplateMetadata
       ));
       url.searchParams.set("response_type", "code");
       url.searchParams.set(
@@ -292,7 +299,7 @@ function createConnectorAdapterProvider(options) {
         client.clientId
       );
       url.searchParams.set("redirect_uri", request.redirectUri);
-      if (scopes.length > 0) {
+      if (auth.sendScopeParam !== false && scopes.length > 0) {
         url.searchParams.set("scope", scopes.join(auth.scopeSeparator ?? " "));
       }
       const state = request.state ?? randomState();
@@ -335,6 +342,12 @@ function createConnectorAdapterProvider(options) {
           "auth_not_supported"
         );
       }
+      if ((auth.grantType ?? "authorization_code") !== "authorization_code") {
+        throw new IntegrationError(
+          `Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`,
+          "auth_not_supported"
+        );
+      }
       const tokenClientAuthMethod = resolveTokenClientAuthMethod(
         auth.tokenClientAuthMethod,
         request.connectorId
@@ -419,7 +432,8 @@ function createConnectorAdapterProvider(options) {
       const tokenUrl = resolveOAuthUrlTemplate(
         auth.tokenUrl,
         request.metadata,
-        request.connectorId
+        request.connectorId,
+        auth.urlTemplateMetadata
       );
       let res;
       try {
@@ -695,12 +709,42 @@ function base64Encode(value) {
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa2(binary);
 }
-function resolveOAuthUrlTemplate(template, metadata, connectorId) {
+function resolveOAuthUrlTemplate(template, metadata, connectorId, metadataSpecs) {
   const placeholders = [...template.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)];
   let resolved = template;
   for (const match of placeholders) {
     const key = match[1];
     const raw = metadata?.[key];
+    const metadataSpec = metadataSpecs?.[key];
+    if (metadataSpec?.kind === "base-url") {
+      if (typeof raw !== "string") {
+        throw new IntegrationError(
+          `OAuth URL for ${connectorId} requires metadata.${key} as a provider base URL.`,
+          "config_missing"
+        );
+      }
+      resolved = resolved.replaceAll(
+        match[0],
+        resolveOAuthMetadataBaseUrl(raw, metadataSpec, connectorId, key)
+      );
+      continue;
+    }
+    if (metadataSpec?.kind === "path-segment") {
+      if (!isOAuthPathSegmentPlaceholder(template, match.index ?? -1, match[0])) {
+        throw new IntegrationError(
+          `OAuth URL for ${connectorId} declares metadata.${key} outside a complete path segment.`,
+          "config_missing"
+        );
+      }
+      if (typeof raw !== "string" || !isOAuthPathSegment(raw.trim())) {
+        throw new IntegrationError(
+          `OAuth URL for ${connectorId} requires metadata.${key} as a valid path segment.`,
+          "config_missing"
+        );
+      }
+      resolved = resolved.replaceAll(match[0], encodeURIComponent(raw.trim()));
+      continue;
+    }
     if (typeof raw !== "string" || !isDnsLabel(raw.trim())) {
       throw new IntegrationError(
         `OAuth URL for ${connectorId} requires metadata.${key} as a valid tenant label.`,
@@ -726,6 +770,65 @@ function resolveOAuthUrlTemplate(template, metadata, connectorId) {
   }
   return url.toString();
 }
+function isOAuthPathSegment(value) {
+  return value !== "." && value !== ".." && /^[A-Za-z0-9._~-]{1,128}$/.test(value);
+}
+function isOAuthPathSegmentPlaceholder(template, index, placeholder) {
+  if (index < 0) return false;
+  const schemeIndex = template.indexOf("://");
+  const rootEnd = schemeIndex >= 0 ? schemeIndex + 3 : template.startsWith("{") ? template.indexOf("}") + 1 : 0;
+  const pathStart = template.indexOf("/", rootEnd);
+  const end = index + placeholder.length;
+  const queryStart = template.search(/[?#]/);
+  return pathStart >= 0 && index >= pathStart && (queryStart < 0 || index < queryStart) && template[index - 1] === "/" && (end === template.length || template[end] === "/" || template[end] === "?" || template[end] === "#");
+}
+function resolveOAuthMetadataBaseUrl(value, spec, connectorId, metadataKey) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+  }
+  const exactAllowed = spec.allowedBaseUrls?.some((candidate) => sameOrigin(candidate, url)) ?? false;
+  const suffixAllowed = spec.allowedBaseUrlSuffixes?.some(
+    (suffix) => !url.port && suffix.startsWith(".") && url.hostname.toLowerCase().endsWith(suffix.toLowerCase())
+  ) ?? false;
+  const hasExplicitAllowlist = Boolean(
+    spec.allowedBaseUrls?.length || spec.allowedBaseUrlSuffixes?.length
+  );
+  if (hasExplicitAllowlist && !exactAllowed && !suffixAllowed) {
+    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+  }
+  if (spec.requirePublicHttps && !isPublicDnsHostname(url.hostname)) {
+    throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+  }
+  return url.origin;
+}
+function invalidOAuthMetadataBaseUrl(connectorId, metadataKey) {
+  return new IntegrationError(
+    `OAuth URL for ${connectorId} requires metadata.${metadataKey} as an allowed HTTPS provider root.`,
+    "config_missing"
+  );
+}
+function sameOrigin(candidate, actual) {
+  try {
+    const allowed = new URL(candidate);
+    return allowed.protocol === "https:" && !allowed.username && !allowed.password && allowed.pathname === "/" && !allowed.search && !allowed.hash && allowed.origin === actual.origin;
+  } catch {
+    return false;
+  }
+}
+function isPublicDnsHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa")) {
+    return false;
+  }
+  if (/^[0-9.]+$/.test(normalized) || normalized.includes(":")) return false;
+  return normalized.includes(".") && normalized.split(".").every(isDnsLabel);
+}
 function isDnsLabel(value) {
   return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(value);
 }
@@ -4743,4 +4846,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-T3WH6MMA.js.map
+//# sourceMappingURL=chunk-CT3J7ZB6.js.map