@tetrascience-npm/tetrascience-react-ui 0.7.0 → 1.0.0

package/dist/server/auth/JwtTokenManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"JwtTokenManager.cjs","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n}\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */\n  async getUserToken(cookies: CookieDict): Promise<string | null> {\n    // Prefer ts-auth-token or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed)\n    return this.getUserToken(req.cookies || {});\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","cookies","authToken","req","jwtManager"],"mappings":"uIA6CMA,EAAqB,GAErBC,EAAgB,IAChBC,EAAqC,EAAIF,EAAqBC,EAM7D,MAAME,CAAgB,CACnB,gBACA,YACA,QACA,WACA,wBACA,UAER,YAAYC,EAAgC,GAAI,CAC9C,KAAK,gBAAkBA,EAAO,QAC9B,KAAK,YAAc,QAAQ,IAAI,aAC/B,KAAK,QAAU,QAAQ,IAAI,SAC3B,KAAK,eAAiB,IACtB,KAAK,wBAA0BA,EAAO,yBAA2BF,EACjE,KAAK,UAAY,IACnB,CAMQ,YAAqB,CAC3B,MAAMG,EAAU,KAAK,iBAAmB,QAAQ,IAAI,aACpD,GAAI,CAACA,EACH,MAAM,IAAI,MAAM,+FAA+F,EAEjH,OAAOA,CACT,CAOQ,iBAAiBC,EAAkC,CACzD,GAAI,CACF,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACnB,eAAQ,KAAK,0BAA0B,EAChC,KAIT,MAAMC,EADUD,EAAM,CAAC,EACA,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACrDE,EAAeD,EAAO,OAAOA,EAAO,QAAW,EAAKA,EAAO,OAAS,GAAM,EAAI,GAAG,EAGvF,OAAO,KAAK,MAAM,OAAO,KAAKC,EAAc,QAAQ,EAAE,SAAS,OAAO,CAAC,CACzE,OAASC,EAAO,CACd,eAAQ,KAAK,4BAA6BA,CAAK,EACxC,IACT,CACF,CAGQ,sBAAsBC,EAA8B,CAC1D,GAAI,CAACA,EAAQ,IACX,eAAQ,KAAK,mCAAmC,EACzC,GAGT,MAAMC,EAAeD,EAAQ,IAAMV,EAC7BY,EAAgB,KAAK,IAAA,EAAQ,KAAK,wBACxC,OAAOD,GAAgBC,CACzB,CAGQ,gBAAgBC,EAAiC,CACvD,MAAMC,EAAS,KAAK,WAAW,IAAID,CAAQ,EAC3C,OAAIC,GAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,EAC/CA,EAAO,OAGZA,GAGF,KAAK,WAAW,OAAOD,CAAQ,EAE1B,KACT,CAGA,MAAc,cAAmC,CAC/C,GAAI,KAAK,YAAc,KACrB,OAAO,KAAK,UAGd,GAAI,CAAC,KAAK,aAAe,CAAC,KAAK,QAC7B,MAAM,IAAI,MAAM,0DAA0D,EAI5E,MAAMT,EAAU,KAAK,WAAA,EAErB,GAAI,CACF,MAAMW,EAAS,IAAIC,YAAU,CAC3B,YAAaZ,EACb,YAAa,KAAK,YAClB,QAAS,KAAK,QACd,aAAc,UAAA,CACf,EAED,aAAMW,EAAO,KAAA,EAEb,KAAK,UAAYA,EACV,KAAK,SACd,OAASN,EAAO,CAEd,cAAQ,MAAM,mCAAoCA,CAAK,EACjDA,CACR,CACF,CAGA,MAAc,2BAA2BI,EAA0C,CAEjF,MAAMI,EAAY,MAAM,KAAK,aAAA,EAE7B,GAAI,CAGF,MAAMC,EAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC,EAEnD,GAAIK,GAAUA,EAAO,OAAS,GAAKA,EAAO,CAAC,GAAG,IAAK,CACjD,MAAMC,EAAWD,EAAO,CAAC,EAAE,IAErBR,EAAU,KAAK,iBAAiBS,CAAQ,EAC9C,OAAIT,GACF,KAAK,WAAW,IAAIG,EAAU,CAAE,MAAOM,EAAU,QAAAT,EAAS,EAErDS,CACT,CAEA,QAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB,CACvE,OAASJ,EAAO,CACd,QAAQ,MAAM,8BAA+BA,CAAK,CACpD,CAEA,OAAO,IACT,CAGA,MAAM,mBAAmBI,EAA0C,CACjE,GAAI,CAACA,GAAY,CAAC,KAAK,QACrB,eAAQ,KAAK,qDAAqD,EAC3D,KAGT,MAAMO,EAAkB,KAAK,gBAAgBP,CAAQ,EACrD,OAAIO,GAIG,KAAK,2BAA2BP,CAAQ,CACjD,CAGA,MAAM,aAAaQ,EAA6C,CAE9D,MAAMC,EAAYD,EAAQ,eAAe,GAAK,QAAQ,IAAI,cAC1D,GAAIC,EACF,OAAOA,EAIT,MAAMT,EAAWQ,EAAQ,cAAc,EACvC,GAAIR,GAAY,KAAK,YAAa,CAChC,MAAMM,EAAW,MAAM,KAAK,mBAAmBN,CAAQ,EACvD,GAAIM,EACF,OAAOA,EAET,QAAQ,KAAK,6CAA6C,CAC5D,MAAWN,GACT,QAAQ,MAAM,6BAA6B,EAG7C,eAAQ,KAAK,qCAAqC,EAC3C,IACT,CAiBA,MAAM,2BAA2BU,EAAiD,CAEhF,OAAO,KAAK,aAAaA,EAAI,SAAW,CAAA,CAAE,CAC5C,CAGA,YAAmB,CACjB,KAAK,WAAW,MAAA,CAClB,CACF,CAaO,MAAMC,EAAa,IAAItB"}
+{"version":3,"file":"JwtTokenManager.cjs","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Header dictionary type - matches Express req.headers (keys are lowercased) */\nexport interface HeaderDict {\n  [key: string]: string | string[] | undefined;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n  headers?: HeaderDict;\n}\n\n/** Request header carrying the resolved JWT injected by the data-apps proxy. */\nconst AUTH_TOKEN_HEADER = \"ts-auth-token\";\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /**\n   * Read the ts-auth-token request header, normalizing the array form that\n   * Node/Express may produce for a repeated header.\n   */\n  private getHeaderAuthToken(headers?: HeaderDict): string | null {\n    const raw = headers?.[AUTH_TOKEN_HEADER];\n    const value = Array.isArray(raw) ? raw[0] : raw;\n    return value || null;\n  }\n\n  /**\n   * Get token from a request (proxy-injected header, then cookie, then token ref).\n   *\n   * Precedence (SW-2352):\n   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps\n   *      proxy resolves the token reference server-side and injects the real JWT\n   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.\n   *      Checking the header first is also what keeps SSO users authenticated.\n   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).\n   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes\n   *      dead in prod once the proxy stops forwarding the cookie, retained for\n   *      local dev and defense in depth).\n   */\n  async getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null> {\n    // Prefer the proxy-injected ts-auth-token request header.\n    const headerAuthToken = this.getHeaderAuthToken(headers);\n    if (headerAuthToken) {\n      return headerAuthToken;\n    }\n\n    // Then ts-auth-token cookie or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref (legacy fallback).\n    // TODO(next major): drop the ts-token-ref → connector-KV resolution entirely.\n    // As of SW-2352 the data-apps proxy resolves the reference server-side and\n    // injects the JWT via the ts-auth-token header (preferred above), and no\n    // longer forwards the ts-token-ref cookie to the container — so this path is\n    // dead in production and kept only for local dev / older proxies.\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed).\n    // Headers are checked first (proxy-injected ts-auth-token) — see getUserToken.\n    return this.getUserToken(req.cookies || {}, req.headers);\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["AUTH_TOKEN_HEADER","SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","headers","raw","cookies","headerAuthToken","authToken","req","jwtManager"],"mappings":"uIAsCMA,EAAoB,gBAgBpBC,EAAqB,GAErBC,EAAgB,IAChBC,EAAqC,EAAIF,EAAqBC,EAM7D,MAAME,CAAgB,CACnB,gBACA,YACA,QACA,WACA,wBACA,UAER,YAAYC,EAAgC,GAAI,CAC9C,KAAK,gBAAkBA,EAAO,QAC9B,KAAK,YAAc,QAAQ,IAAI,aAC/B,KAAK,QAAU,QAAQ,IAAI,SAC3B,KAAK,eAAiB,IACtB,KAAK,wBAA0BA,EAAO,yBAA2BF,EACjE,KAAK,UAAY,IACnB,CAMQ,YAAqB,CAC3B,MAAMG,EAAU,KAAK,iBAAmB,QAAQ,IAAI,aACpD,GAAI,CAACA,EACH,MAAM,IAAI,MAAM,+FAA+F,EAEjH,OAAOA,CACT,CAOQ,iBAAiBC,EAAkC,CACzD,GAAI,CACF,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACnB,eAAQ,KAAK,0BAA0B,EAChC,KAIT,MAAMC,EADUD,EAAM,CAAC,EACA,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACrDE,EAAeD,EAAO,OAAOA,EAAO,QAAW,EAAKA,EAAO,OAAS,GAAM,EAAI,GAAG,EAGvF,OAAO,KAAK,MAAM,OAAO,KAAKC,EAAc,QAAQ,EAAE,SAAS,OAAO,CAAC,CACzE,OAASC,EAAO,CACd,eAAQ,KAAK,4BAA6BA,CAAK,EACxC,IACT,CACF,CAGQ,sBAAsBC,EAA8B,CAC1D,GAAI,CAACA,EAAQ,IACX,eAAQ,KAAK,mCAAmC,EACzC,GAGT,MAAMC,EAAeD,EAAQ,IAAMV,EAC7BY,EAAgB,KAAK,IAAA,EAAQ,KAAK,wBACxC,OAAOD,GAAgBC,CACzB,CAGQ,gBAAgBC,EAAiC,CACvD,MAAMC,EAAS,KAAK,WAAW,IAAID,CAAQ,EAC3C,OAAIC,GAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,EAC/CA,EAAO,OAGZA,GAGF,KAAK,WAAW,OAAOD,CAAQ,EAE1B,KACT,CAGA,MAAc,cAAmC,CAC/C,GAAI,KAAK,YAAc,KACrB,OAAO,KAAK,UAGd,GAAI,CAAC,KAAK,aAAe,CAAC,KAAK,QAC7B,MAAM,IAAI,MAAM,0DAA0D,EAI5E,MAAMT,EAAU,KAAK,WAAA,EAErB,GAAI,CACF,MAAMW,EAAS,IAAIC,YAAU,CAC3B,YAAaZ,EACb,YAAa,KAAK,YAClB,QAAS,KAAK,QACd,aAAc,UAAA,CACf,EAED,aAAMW,EAAO,KAAA,EAEb,KAAK,UAAYA,EACV,KAAK,SACd,OAASN,EAAO,CAEd,cAAQ,MAAM,mCAAoCA,CAAK,EACjDA,CACR,CACF,CAGA,MAAc,2BAA2BI,EAA0C,CAEjF,MAAMI,EAAY,MAAM,KAAK,aAAA,EAE7B,GAAI,CAGF,MAAMC,EAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC,EAEnD,GAAIK,GAAUA,EAAO,OAAS,GAAKA,EAAO,CAAC,GAAG,IAAK,CACjD,MAAMC,EAAWD,EAAO,CAAC,EAAE,IAErBR,EAAU,KAAK,iBAAiBS,CAAQ,EAC9C,OAAIT,GACF,KAAK,WAAW,IAAIG,EAAU,CAAE,MAAOM,EAAU,QAAAT,EAAS,EAErDS,CACT,CAEA,QAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB,CACvE,OAASJ,EAAO,CACd,QAAQ,MAAM,8BAA+BA,CAAK,CACpD,CAEA,OAAO,IACT,CAGA,MAAM,mBAAmBI,EAA0C,CACjE,GAAI,CAACA,GAAY,CAAC,KAAK,QACrB,eAAQ,KAAK,qDAAqD,EAC3D,KAGT,MAAMO,EAAkB,KAAK,gBAAgBP,CAAQ,EACrD,OAAIO,GAIG,KAAK,2BAA2BP,CAAQ,CACjD,CAMQ,mBAAmBQ,EAAqC,CAC9D,MAAMC,EAAMD,IAAUvB,CAAiB,EAEvC,OADc,MAAM,QAAQwB,CAAG,EAAIA,EAAI,CAAC,EAAIA,IAC5B,IAClB,CAeA,MAAM,aAAaC,EAAqBF,EAA8C,CAEpF,MAAMG,EAAkB,KAAK,mBAAmBH,CAAO,EACvD,GAAIG,EACF,OAAOA,EAIT,MAAMC,EAAYF,EAAQ,eAAe,GAAK,QAAQ,IAAI,cAC1D,GAAIE,EACF,OAAOA,EAST,MAAMZ,EAAWU,EAAQ,cAAc,EACvC,GAAIV,GAAY,KAAK,YAAa,CAChC,MAAMM,EAAW,MAAM,KAAK,mBAAmBN,CAAQ,EACvD,GAAIM,EACF,OAAOA,EAET,QAAQ,KAAK,6CAA6C,CAC5D,MAAWN,GACT,QAAQ,MAAM,6BAA6B,EAG7C,eAAQ,KAAK,qCAAqC,EAC3C,IACT,CAiBA,MAAM,2BAA2Ba,EAAiD,CAGhF,OAAO,KAAK,aAAaA,EAAI,SAAW,CAAA,EAAIA,EAAI,OAAO,CACzD,CAGA,YAAmB,CACjB,KAAK,WAAW,MAAA,CAClB,CACF,CAaO,MAAMC,EAAa,IAAIzB"}

package/dist/server/auth/JwtTokenManager.d.ts

@@ -0,0 +1,113 @@
+/**
+ * JWT Token Manager for TetraScience Data Apps
+ *
+ * Handles authentication token retrieval from Express request cookies,
+ * supporting both direct JWT tokens (ts-auth-token) and token references
+ * (ts-token-ref) that are resolved via the connector K/V store.
+ *
+ * Note: This manager does not perform cryptographic verification of JWT signatures.
+ * Signature verification is the responsibility of the consuming application or
+ * the upstream authentication layer. The JWT payload is decoded only to read
+ * expiration times for cache invalidation.
+ */
+/** Configuration options for JwtTokenManager */
+export interface JwtTokenManagerConfig {
+    baseUrl?: string;
+    tokenRefreshThresholdMs?: number;
+}
+/** Cookie dictionary type - matches Express req.cookies */
+export interface CookieDict {
+    [key: string]: string;
+}
+/** Header dictionary type - matches Express req.headers (keys are lowercased) */
+export interface HeaderDict {
+    [key: string]: string | string[] | undefined;
+}
+/** Express-like request interface (works with Express, Koa, etc.) */
+export interface ExpressRequestLike {
+    cookies?: CookieDict;
+    headers?: HeaderDict;
+}
+/**
+ * Manages JWT token retrieval from request cookies.
+ * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).
+ */
+export declare class JwtTokenManager {
+    private baseUrlOverride;
+    private connectorId;
+    private orgSlug;
+    private tokenCache;
+    private tokenRefreshThresholdMs;
+    private tdpClient;
+    constructor(config?: JwtTokenManagerConfig);
+    /**
+     * Get the base URL for TDP API calls.
+     * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).
+     */
+    private getBaseUrl;
+    /**
+     * Decode JWT payload without verifying signature.
+     * Used only for reading expiration times for cache invalidation.
+     * Signature verification is NOT performed here.
+     */
+    private decodeJwtPayload;
+    /** Check if payload is expiring within the refresh threshold */
+    private isPayloadExpiringSoon;
+    /** Get valid cached token if not expiring */
+    private getValidUserJwt;
+    /** Initialize or get TDP client */
+    private getTdpClient;
+    /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */
+    private getJwtFromTokenRefInternal;
+    /** Resolve ts-token-ref to full JWT token (with caching) */
+    getJwtFromTokenRef(tokenRef: string): Promise<string | null>;
+    /**
+     * Read the ts-auth-token request header, normalizing the array form that
+     * Node/Express may produce for a repeated header.
+     */
+    private getHeaderAuthToken;
+    /**
+     * Get token from a request (proxy-injected header, then cookie, then token ref).
+     *
+     * Precedence (SW-2352):
+     *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps
+     *      proxy resolves the token reference server-side and injects the real JWT
+     *      here; the `ts-token-ref` cookie is no longer forwarded to the container.
+     *      Checking the header first is also what keeps SSO users authenticated.
+     *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).
+     *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes
+     *      dead in prod once the proxy stops forwarding the cookie, retained for
+     *      local dev and defense in depth).
+     */
+    getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null>;
+    /**
+     * Get user token from an Express request object.
+     * This is the primary method for Express middleware integration.
+     *
+     * @example
+     * ```typescript
+     * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';
+     *
+     * app.use(async (req, res, next) => {
+     *   const token = await jwtManager.getTokenFromExpressRequest(req);
+     *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };
+     *   next();
+     * });
+     * ```
+     */
+    getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null>;
+    /** Clear the token cache */
+    clearCache(): void;
+}
+/**
+ * Global singleton instance.
+ *
+ * Note: This instance is created when the module is imported. Configuration
+ * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)
+ * is read at module load time. Ensure these environment
+ * variables are set before importing this module.
+ *
+ * If you need different configuration at runtime, create a new JwtTokenManager
+ * instance instead of using this singleton.
+ */
+export declare const jwtManager: JwtTokenManager;

package/dist/server/auth/JwtTokenManager.js

@@ -1,6 +1,6 @@
-import { TDPClient as i } from "@tetrascience-npm/ts-connectors-sdk";
-const a = 60, s = 1e3, c = 5 * a * s;
-class l {
+import { TDPClient as a } from "@tetrascience-npm/ts-connectors-sdk";
+const c = "ts-auth-token", l = 60, i = 1e3, h = 5 * l * i;
+class d {
   baseUrlOverride;
   connectorId;
   orgSlug;
@@ -8,7 +8,7 @@ class l {
   tokenRefreshThresholdMs;
   tdpClient;
   constructor(e = {}) {
-    this.baseUrlOverride = e.baseUrl, this.connectorId = process.env.CONNECTOR_ID, this.orgSlug = process.env.ORG_SLUG, this.tokenCache = /* @__PURE__ */ new Map(), this.tokenRefreshThresholdMs = e.tokenRefreshThresholdMs || c, this.tdpClient = null;
+    this.baseUrlOverride = e.baseUrl, this.connectorId = process.env.CONNECTOR_ID, this.orgSlug = process.env.ORG_SLUG, this.tokenCache = /* @__PURE__ */ new Map(), this.tokenRefreshThresholdMs = e.tokenRefreshThresholdMs || h, this.tdpClient = null;
   }
   /**
    * Get the base URL for TDP API calls.
@@ -40,7 +40,7 @@ class l {
   isPayloadExpiringSoon(e) {
     if (!e.exp)
       return console.warn("JWT token has no expiration claim"), !0;
-    const t = e.exp * s, r = Date.now() + this.tokenRefreshThresholdMs;
+    const t = e.exp * i, r = Date.now() + this.tokenRefreshThresholdMs;
     return t <= r;
   }
   /** Get valid cached token if not expiring */
@@ -56,7 +56,7 @@ class l {
       throw new Error("Missing required configuration: CONNECTOR_ID or ORG_SLUG");
     const e = this.getBaseUrl();
     try {
-      const t = new i({
+      const t = new a({
         tdpEndpoint: e,
         connectorId: this.connectorId,
         orgSlug: this.orgSlug,
@@ -89,18 +89,41 @@ class l {
     const t = this.getValidUserJwt(e);
     return t || this.getJwtFromTokenRefInternal(e);
   }
-  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */
-  async getUserToken(e) {
-    const t = e["ts-auth-token"] || process.env.TS_AUTH_TOKEN;
-    if (t)
-      return t;
-    const r = e["ts-token-ref"];
-    if (r && this.connectorId) {
-      const n = await this.getJwtFromTokenRef(r);
-      if (n)
-        return n;
+  /**
+   * Read the ts-auth-token request header, normalizing the array form that
+   * Node/Express may produce for a repeated header.
+   */
+  getHeaderAuthToken(e) {
+    const t = e?.[c];
+    return (Array.isArray(t) ? t[0] : t) || null;
+  }
+  /**
+   * Get token from a request (proxy-injected header, then cookie, then token ref).
+   *
+   * Precedence (SW-2352):
+   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps
+   *      proxy resolves the token reference server-side and injects the real JWT
+   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.
+   *      Checking the header first is also what keeps SSO users authenticated.
+   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).
+   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes
+   *      dead in prod once the proxy stops forwarding the cookie, retained for
+   *      local dev and defense in depth).
+   */
+  async getUserToken(e, t) {
+    const r = this.getHeaderAuthToken(t);
+    if (r)
+      return r;
+    const n = e["ts-auth-token"] || process.env.TS_AUTH_TOKEN;
+    if (n)
+      return n;
+    const o = e["ts-token-ref"];
+    if (o && this.connectorId) {
+      const s = await this.getJwtFromTokenRef(o);
+      if (s)
+        return s;
       console.warn("Failed to resolve ts-token-ref to JWT token");
-    } else r && console.error("Connector ID not configured");
+    } else o && console.error("Connector ID not configured");
     return console.warn("No valid authentication token found"), null;
   }
   /**
@@ -119,16 +142,16 @@ class l {
    * ```
    */
   async getTokenFromExpressRequest(e) {
-    return this.getUserToken(e.cookies || {});
+    return this.getUserToken(e.cookies || {}, e.headers);
   }
   /** Clear the token cache */
   clearCache() {
     this.tokenCache.clear();
   }
 }
-const u = new l();
+const g = new d();
 export {
-  l as JwtTokenManager,
-  u as jwtManager
+  d as JwtTokenManager,
+  g as jwtManager
 };
 //# sourceMappingURL=JwtTokenManager.js.map

package/dist/server/auth/JwtTokenManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtTokenManager.js","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n}\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /** Get token from cookies (ts-auth-token or resolved ts-token-ref) */\n  async getUserToken(cookies: CookieDict): Promise<string | null> {\n    // Prefer ts-auth-token or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed)\n    return this.getUserToken(req.cookies || {});\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","cookies","authToken","req","jwtManager"],"mappings":";AA6CA,MAAMA,IAAqB,IAErBC,IAAgB,KAChBC,IAAqC,IAAIF,IAAqBC;AAM7D,MAAME,EAAgB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAYC,IAAgC,IAAI;AAC9C,SAAK,kBAAkBA,EAAO,SAC9B,KAAK,cAAc,QAAQ,IAAI,cAC/B,KAAK,UAAU,QAAQ,IAAI,UAC3B,KAAK,iCAAiB,IAAA,GACtB,KAAK,0BAA0BA,EAAO,2BAA2BF,GACjE,KAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAqB;AAC3B,UAAMG,IAAU,KAAK,mBAAmB,QAAQ,IAAI;AACpD,QAAI,CAACA;AACH,YAAM,IAAI,MAAM,+FAA+F;AAEjH,WAAOA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiBC,GAAkC;AACzD,QAAI;AACF,YAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,UAAIC,EAAM,WAAW;AACnB,uBAAQ,KAAK,0BAA0B,GAChC;AAIT,YAAMC,IADUD,EAAM,CAAC,EACA,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GACrDE,IAAeD,EAAO,OAAOA,EAAO,UAAW,IAAKA,EAAO,SAAS,KAAM,GAAI,GAAG;AAGvF,aAAO,KAAK,MAAM,OAAO,KAAKC,GAAc,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACzE,SAASC,GAAO;AACd,qBAAQ,KAAK,6BAA6BA,CAAK,GACxC;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,sBAAsBC,GAA8B;AAC1D,QAAI,CAACA,EAAQ;AACX,qBAAQ,KAAK,mCAAmC,GACzC;AAGT,UAAMC,IAAeD,EAAQ,MAAMV,GAC7BY,IAAgB,KAAK,IAAA,IAAQ,KAAK;AACxC,WAAOD,KAAgBC;AAAA,EACzB;AAAA;AAAA,EAGQ,gBAAgBC,GAAiC;AACvD,UAAMC,IAAS,KAAK,WAAW,IAAID,CAAQ;AAC3C,WAAIC,KAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,IAC/CA,EAAO,SAGZA,KAGF,KAAK,WAAW,OAAOD,CAAQ,GAE1B;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,eAAmC;AAC/C,QAAI,KAAK,cAAc;AACrB,aAAO,KAAK;AAGd,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK;AAC7B,YAAM,IAAI,MAAM,0DAA0D;AAI5E,UAAMT,IAAU,KAAK,WAAA;AAErB,QAAI;AACF,YAAMW,IAAS,IAAIC,EAAU;AAAA,QAC3B,aAAaZ;AAAA,QACb,aAAa,KAAK;AAAA,QAClB,SAAS,KAAK;AAAA,QACd,cAAc;AAAA,MAAA,CACf;AAED,mBAAMW,EAAO,KAAA,GAEb,KAAK,YAAYA,GACV,KAAK;AAAA,IACd,SAASN,GAAO;AAEd,oBAAQ,MAAM,oCAAoCA,CAAK,GACjDA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA2BI,GAA0C;AAEjF,UAAMI,IAAY,MAAM,KAAK,aAAA;AAE7B,QAAI;AAGF,YAAMC,IAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC;AAEnD,UAAIK,KAAUA,EAAO,SAAS,KAAKA,EAAO,CAAC,GAAG,KAAK;AACjD,cAAMC,IAAWD,EAAO,CAAC,EAAE,KAErBR,IAAU,KAAK,iBAAiBS,CAAQ;AAC9C,eAAIT,KACF,KAAK,WAAW,IAAIG,GAAU,EAAE,OAAOM,GAAU,SAAAT,GAAS,GAErDS;AAAA,MACT;AAEA,cAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB;AAAA,IACvE,SAASJ,GAAO;AACd,cAAQ,MAAM,+BAA+BA,CAAK;AAAA,IACpD;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmBI,GAA0C;AACjE,QAAI,CAACA,KAAY,CAAC,KAAK;AACrB,qBAAQ,KAAK,qDAAqD,GAC3D;AAGT,UAAMO,IAAkB,KAAK,gBAAgBP,CAAQ;AACrD,WAAIO,KAIG,KAAK,2BAA2BP,CAAQ;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,aAAaQ,GAA6C;AAE9D,UAAMC,IAAYD,EAAQ,eAAe,KAAK,QAAQ,IAAI;AAC1D,QAAIC;AACF,aAAOA;AAIT,UAAMT,IAAWQ,EAAQ,cAAc;AACvC,QAAIR,KAAY,KAAK,aAAa;AAChC,YAAMM,IAAW,MAAM,KAAK,mBAAmBN,CAAQ;AACvD,UAAIM;AACF,eAAOA;AAET,cAAQ,KAAK,6CAA6C;AAAA,IAC5D,OAAWN,KACT,QAAQ,MAAM,6BAA6B;AAG7C,mBAAQ,KAAK,qCAAqC,GAC3C;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,2BAA2BU,GAAiD;AAEhF,WAAO,KAAK,aAAaA,EAAI,WAAW,CAAA,CAAE;AAAA,EAC5C;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,WAAW,MAAA;AAAA,EAClB;AACF;AAaO,MAAMC,IAAa,IAAItB,EAAA;"}
+{"version":3,"file":"JwtTokenManager.js","sources":["../../../src/server/auth/JwtTokenManager.ts"],"sourcesContent":["/**\n * JWT Token Manager for TetraScience Data Apps\n *\n * Handles authentication token retrieval from Express request cookies,\n * supporting both direct JWT tokens (ts-auth-token) and token references\n * (ts-token-ref) that are resolved via the connector K/V store.\n *\n * Note: This manager does not perform cryptographic verification of JWT signatures.\n * Signature verification is the responsibility of the consuming application or\n * the upstream authentication layer. The JWT payload is decoded only to read\n * expiration times for cache invalidation.\n */\n\nimport { TDPClient } from \"@tetrascience-npm/ts-connectors-sdk\";\n\n/** Configuration options for JwtTokenManager */\nexport interface JwtTokenManagerConfig {\n  baseUrl?: string;\n  tokenRefreshThresholdMs?: number;\n}\n\n/** Cookie dictionary type - matches Express req.cookies */\nexport interface CookieDict {\n  [key: string]: string;\n}\n\n/** Header dictionary type - matches Express req.headers (keys are lowercased) */\nexport interface HeaderDict {\n  [key: string]: string | string[] | undefined;\n}\n\n/** Express-like request interface (works with Express, Koa, etc.) */\nexport interface ExpressRequestLike {\n  cookies?: CookieDict;\n  headers?: HeaderDict;\n}\n\n/** Request header carrying the resolved JWT injected by the data-apps proxy. */\nconst AUTH_TOKEN_HEADER = \"ts-auth-token\";\n\n/** JWT payload structure */\ninterface JwtPayload {\n  exp?: number;\n  iat?: number;\n  [key: string]: unknown;\n}\n\n/** Cached token entry storing both raw token and parsed payload */\ninterface CachedTokenEntry {\n  token: string;\n  payload: JwtPayload;\n}\n\n/** Number of seconds in a minute */\nconst SECONDS_PER_MINUTE = 60;\n/** Milliseconds per second */\nconst MS_PER_SECOND = 1000;\nconst DEFAULT_TOKEN_REFRESH_THRESHOLD_MS = 5 * SECONDS_PER_MINUTE * MS_PER_SECOND; // 5 minutes\n\n/**\n * Manages JWT token retrieval from request cookies.\n * Supports both ts-auth-token (direct JWT) and ts-token-ref (resolved via connector store).\n */\nexport class JwtTokenManager {\n  private baseUrlOverride: string | undefined;\n  private connectorId: string | undefined;\n  private orgSlug: string | undefined;\n  private tokenCache: Map<string, CachedTokenEntry>;\n  private tokenRefreshThresholdMs: number;\n  private tdpClient: TDPClient | null;\n\n  constructor(config: JwtTokenManagerConfig = {}) {\n    this.baseUrlOverride = config.baseUrl;\n    this.connectorId = process.env.CONNECTOR_ID;\n    this.orgSlug = process.env.ORG_SLUG;\n    this.tokenCache = new Map();\n    this.tokenRefreshThresholdMs = config.tokenRefreshThresholdMs || DEFAULT_TOKEN_REFRESH_THRESHOLD_MS;\n    this.tdpClient = null;\n  }\n\n  /**\n   * Get the base URL for TDP API calls.\n   * Throws an error if not configured (either via config.baseUrl or TDP_ENDPOINT env var).\n   */\n  private getBaseUrl(): string {\n    const baseUrl = this.baseUrlOverride || process.env.TDP_ENDPOINT;\n    if (!baseUrl) {\n      throw new Error(\"TDP base URL not configured. Set TDP_ENDPOINT environment variable or pass baseUrl in config.\");\n    }\n    return baseUrl;\n  }\n\n  /**\n   * Decode JWT payload without verifying signature.\n   * Used only for reading expiration times for cache invalidation.\n   * Signature verification is NOT performed here.\n   */\n  private decodeJwtPayload(token: string): JwtPayload | null {\n    try {\n      const parts = token.split(\".\");\n      if (parts.length !== 3) {\n        console.warn(\"Invalid JWT token format\");\n        return null;\n      }\n\n      const payload = parts[1];\n      const base64 = payload.replace(/-/g, \"+\").replace(/_/g, \"/\");\n      const paddedBase64 = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n\n      // Use Buffer.from for Node.js compatibility (atob not available in all runtimes)\n      return JSON.parse(Buffer.from(paddedBase64, \"base64\").toString(\"utf-8\"));\n    } catch (error) {\n      console.warn(\"Error decoding JWT token:\", error);\n      return null;\n    }\n  }\n\n  /** Check if payload is expiring within the refresh threshold */\n  private isPayloadExpiringSoon(payload: JwtPayload): boolean {\n    if (!payload.exp) {\n      console.warn(\"JWT token has no expiration claim\");\n      return true;\n    }\n\n    const expiryTimeMs = payload.exp * MS_PER_SECOND;\n    const refreshTimeMs = Date.now() + this.tokenRefreshThresholdMs;\n    return expiryTimeMs <= refreshTimeMs;\n  }\n\n  /** Get valid cached token if not expiring */\n  private getValidUserJwt(tokenRef: string): string | null {\n    const cached = this.tokenCache.get(tokenRef);\n    if (cached && !this.isPayloadExpiringSoon(cached.payload)) {\n      return cached.token;\n    }\n    // Clean up expired entry to prevent unbounded cache growth\n    if (cached) {\n      // TODO: If data apps become high-traffic, consider enhancing with\n      // an LRU cache (e.g., lru-cache package) to purge stale entries automatically\n      this.tokenCache.delete(tokenRef);\n    }\n    return null;\n  }\n\n  /** Initialize or get TDP client */\n  private async getTdpClient(): Promise<TDPClient> {\n    if (this.tdpClient !== null) {\n      return this.tdpClient;\n    }\n\n    if (!this.connectorId || !this.orgSlug) {\n      throw new Error(\"Missing required configuration: CONNECTOR_ID or ORG_SLUG\");\n    }\n\n    // getBaseUrl() throws if TDP_ENDPOINT not configured - let it propagate\n    const baseUrl = this.getBaseUrl();\n\n    try {\n      const client = new TDPClient({\n        tdpEndpoint: baseUrl,\n        connectorId: this.connectorId,\n        orgSlug: this.orgSlug,\n        artifactType: \"data-app\",\n      });\n\n      await client.init();\n      // Only assign after successful initialization to allow retry on failure\n      this.tdpClient = client;\n      return this.tdpClient;\n    } catch (error) {\n      // Log init errors but rethrow so callers know something went wrong\n      console.error(\"Failed to initialize TDP client:\", error);\n      throw error;\n    }\n  }\n\n  /** Retrieve JWT from connector K/V store using getValues (calls getConnectorData internally) */\n  private async getJwtFromTokenRefInternal(tokenRef: string): Promise<string | null> {\n    // getTdpClient() throws on config errors - let those propagate\n    const tdpClient = await this.getTdpClient();\n\n    try {\n      // getValues returns array of values for the given keys\n      // Each value is expected to have a jwt property: { jwt: \"...\" }\n      const values = await tdpClient.getValues([tokenRef]);\n\n      if (values && values.length > 0 && values[0]?.jwt) {\n        const jwtToken = values[0].jwt;\n        // Parse and cache both the raw token and its payload to avoid repeated decoding\n        const payload = this.decodeJwtPayload(jwtToken);\n        if (payload) {\n          this.tokenCache.set(tokenRef, { token: jwtToken, payload });\n        }\n        return jwtToken;\n      }\n\n      console.error(`No JWT found for key '${tokenRef}' in connector store`);\n    } catch (error) {\n      console.error(\"Error retrieving JWT token:\", error);\n    }\n\n    return null;\n  }\n\n  /** Resolve ts-token-ref to full JWT token (with caching) */\n  async getJwtFromTokenRef(tokenRef: string): Promise<string | null> {\n    if (!tokenRef || !this.orgSlug) {\n      console.warn(\"Missing required parameters for JWT token retrieval\");\n      return null;\n    }\n\n    const cachedUserToken = this.getValidUserJwt(tokenRef);\n    if (cachedUserToken) {\n      return cachedUserToken;\n    }\n\n    return this.getJwtFromTokenRefInternal(tokenRef);\n  }\n\n  /**\n   * Read the ts-auth-token request header, normalizing the array form that\n   * Node/Express may produce for a repeated header.\n   */\n  private getHeaderAuthToken(headers?: HeaderDict): string | null {\n    const raw = headers?.[AUTH_TOKEN_HEADER];\n    const value = Array.isArray(raw) ? raw[0] : raw;\n    return value || null;\n  }\n\n  /**\n   * Get token from a request (proxy-injected header, then cookie, then token ref).\n   *\n   * Precedence (SW-2352):\n   *   1. `ts-auth-token` request header — for large-JWT sessions the data-apps\n   *      proxy resolves the token reference server-side and injects the real JWT\n   *      here; the `ts-token-ref` cookie is no longer forwarded to the container.\n   *      Checking the header first is also what keeps SSO users authenticated.\n   *   2. `ts-auth-token` cookie / `TS_AUTH_TOKEN` env var (small-JWT + local dev).\n   *   3. `ts-token-ref` cookie → connector K/V resolution (legacy fallback; goes\n   *      dead in prod once the proxy stops forwarding the cookie, retained for\n   *      local dev and defense in depth).\n   */\n  async getUserToken(cookies: CookieDict, headers?: HeaderDict): Promise<string | null> {\n    // Prefer the proxy-injected ts-auth-token request header.\n    const headerAuthToken = this.getHeaderAuthToken(headers);\n    if (headerAuthToken) {\n      return headerAuthToken;\n    }\n\n    // Then ts-auth-token cookie or TS_AUTH_TOKEN env var (latter is for local dev testing)\n    const authToken = cookies[\"ts-auth-token\"] || process.env.TS_AUTH_TOKEN;\n    if (authToken) {\n      return authToken;\n    }\n\n    // Try to resolve ts-token-ref (legacy fallback).\n    // TODO(next major): drop the ts-token-ref → connector-KV resolution entirely.\n    // As of SW-2352 the data-apps proxy resolves the reference server-side and\n    // injects the JWT via the ts-auth-token header (preferred above), and no\n    // longer forwards the ts-token-ref cookie to the container — so this path is\n    // dead in production and kept only for local dev / older proxies.\n    const tokenRef = cookies[\"ts-token-ref\"];\n    if (tokenRef && this.connectorId) {\n      const jwtToken = await this.getJwtFromTokenRef(tokenRef);\n      if (jwtToken) {\n        return jwtToken;\n      }\n      console.warn(\"Failed to resolve ts-token-ref to JWT token\");\n    } else if (tokenRef) {\n      console.error(\"Connector ID not configured\");\n    }\n\n    console.warn(\"No valid authentication token found\");\n    return null;\n  }\n\n  /**\n   * Get user token from an Express request object.\n   * This is the primary method for Express middleware integration.\n   *\n   * @example\n   * ```typescript\n   * import { jwtManager } from '@tetrascience-npm/tetrascience-react-ui/server';\n   *\n   * app.use(async (req, res, next) => {\n   *   const token = await jwtManager.getTokenFromExpressRequest(req);\n   *   req.tdpAuth = { token, orgSlug: process.env.ORG_SLUG };\n   *   next();\n   * });\n   * ```\n   */\n  async getTokenFromExpressRequest(req: ExpressRequestLike): Promise<string | null> {\n    // Handle missing cookies gracefully (e.g., if cookie-parser middleware not installed).\n    // Headers are checked first (proxy-injected ts-auth-token) — see getUserToken.\n    return this.getUserToken(req.cookies || {}, req.headers);\n  }\n\n  /** Clear the token cache */\n  clearCache(): void {\n    this.tokenCache.clear();\n  }\n}\n\n/**\n * Global singleton instance.\n *\n * Note: This instance is created when the module is imported. Configuration\n * that depends on environment variables (CONNECTOR_ID, ORG_SLUG, TDP_ENDPOINT)\n * is read at module load time. Ensure these environment\n * variables are set before importing this module.\n *\n * If you need different configuration at runtime, create a new JwtTokenManager\n * instance instead of using this singleton.\n */\nexport const jwtManager = new JwtTokenManager();\n"],"names":["AUTH_TOKEN_HEADER","SECONDS_PER_MINUTE","MS_PER_SECOND","DEFAULT_TOKEN_REFRESH_THRESHOLD_MS","JwtTokenManager","config","baseUrl","token","parts","base64","paddedBase64","error","payload","expiryTimeMs","refreshTimeMs","tokenRef","cached","client","TDPClient","tdpClient","values","jwtToken","cachedUserToken","headers","raw","cookies","headerAuthToken","authToken","req","jwtManager"],"mappings":";AAsCA,MAAMA,IAAoB,iBAgBpBC,IAAqB,IAErBC,IAAgB,KAChBC,IAAqC,IAAIF,IAAqBC;AAM7D,MAAME,EAAgB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAYC,IAAgC,IAAI;AAC9C,SAAK,kBAAkBA,EAAO,SAC9B,KAAK,cAAc,QAAQ,IAAI,cAC/B,KAAK,UAAU,QAAQ,IAAI,UAC3B,KAAK,iCAAiB,IAAA,GACtB,KAAK,0BAA0BA,EAAO,2BAA2BF,GACjE,KAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAqB;AAC3B,UAAMG,IAAU,KAAK,mBAAmB,QAAQ,IAAI;AACpD,QAAI,CAACA;AACH,YAAM,IAAI,MAAM,+FAA+F;AAEjH,WAAOA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAiBC,GAAkC;AACzD,QAAI;AACF,YAAMC,IAAQD,EAAM,MAAM,GAAG;AAC7B,UAAIC,EAAM,WAAW;AACnB,uBAAQ,KAAK,0BAA0B,GAChC;AAIT,YAAMC,IADUD,EAAM,CAAC,EACA,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,GACrDE,IAAeD,EAAO,OAAOA,EAAO,UAAW,IAAKA,EAAO,SAAS,KAAM,GAAI,GAAG;AAGvF,aAAO,KAAK,MAAM,OAAO,KAAKC,GAAc,QAAQ,EAAE,SAAS,OAAO,CAAC;AAAA,IACzE,SAASC,GAAO;AACd,qBAAQ,KAAK,6BAA6BA,CAAK,GACxC;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGQ,sBAAsBC,GAA8B;AAC1D,QAAI,CAACA,EAAQ;AACX,qBAAQ,KAAK,mCAAmC,GACzC;AAGT,UAAMC,IAAeD,EAAQ,MAAMV,GAC7BY,IAAgB,KAAK,IAAA,IAAQ,KAAK;AACxC,WAAOD,KAAgBC;AAAA,EACzB;AAAA;AAAA,EAGQ,gBAAgBC,GAAiC;AACvD,UAAMC,IAAS,KAAK,WAAW,IAAID,CAAQ;AAC3C,WAAIC,KAAU,CAAC,KAAK,sBAAsBA,EAAO,OAAO,IAC/CA,EAAO,SAGZA,KAGF,KAAK,WAAW,OAAOD,CAAQ,GAE1B;AAAA,EACT;AAAA;AAAA,EAGA,MAAc,eAAmC;AAC/C,QAAI,KAAK,cAAc;AACrB,aAAO,KAAK;AAGd,QAAI,CAAC,KAAK,eAAe,CAAC,KAAK;AAC7B,YAAM,IAAI,MAAM,0DAA0D;AAI5E,UAAMT,IAAU,KAAK,WAAA;AAErB,QAAI;AACF,YAAMW,IAAS,IAAIC,EAAU;AAAA,QAC3B,aAAaZ;AAAA,QACb,aAAa,KAAK;AAAA,QAClB,SAAS,KAAK;AAAA,QACd,cAAc;AAAA,MAAA,CACf;AAED,mBAAMW,EAAO,KAAA,GAEb,KAAK,YAAYA,GACV,KAAK;AAAA,IACd,SAASN,GAAO;AAEd,oBAAQ,MAAM,oCAAoCA,CAAK,GACjDA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,2BAA2BI,GAA0C;AAEjF,UAAMI,IAAY,MAAM,KAAK,aAAA;AAE7B,QAAI;AAGF,YAAMC,IAAS,MAAMD,EAAU,UAAU,CAACJ,CAAQ,CAAC;AAEnD,UAAIK,KAAUA,EAAO,SAAS,KAAKA,EAAO,CAAC,GAAG,KAAK;AACjD,cAAMC,IAAWD,EAAO,CAAC,EAAE,KAErBR,IAAU,KAAK,iBAAiBS,CAAQ;AAC9C,eAAIT,KACF,KAAK,WAAW,IAAIG,GAAU,EAAE,OAAOM,GAAU,SAAAT,GAAS,GAErDS;AAAA,MACT;AAEA,cAAQ,MAAM,yBAAyBN,CAAQ,sBAAsB;AAAA,IACvE,SAASJ,GAAO;AACd,cAAQ,MAAM,+BAA+BA,CAAK;AAAA,IACpD;AAEA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,mBAAmBI,GAA0C;AACjE,QAAI,CAACA,KAAY,CAAC,KAAK;AACrB,qBAAQ,KAAK,qDAAqD,GAC3D;AAGT,UAAMO,IAAkB,KAAK,gBAAgBP,CAAQ;AACrD,WAAIO,KAIG,KAAK,2BAA2BP,CAAQ;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmBQ,GAAqC;AAC9D,UAAMC,IAAMD,IAAUvB,CAAiB;AAEvC,YADc,MAAM,QAAQwB,CAAG,IAAIA,EAAI,CAAC,IAAIA,MAC5B;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,aAAaC,GAAqBF,GAA8C;AAEpF,UAAMG,IAAkB,KAAK,mBAAmBH,CAAO;AACvD,QAAIG;AACF,aAAOA;AAIT,UAAMC,IAAYF,EAAQ,eAAe,KAAK,QAAQ,IAAI;AAC1D,QAAIE;AACF,aAAOA;AAST,UAAMZ,IAAWU,EAAQ,cAAc;AACvC,QAAIV,KAAY,KAAK,aAAa;AAChC,YAAMM,IAAW,MAAM,KAAK,mBAAmBN,CAAQ;AACvD,UAAIM;AACF,eAAOA;AAET,cAAQ,KAAK,6CAA6C;AAAA,IAC5D,OAAWN,KACT,QAAQ,MAAM,6BAA6B;AAG7C,mBAAQ,KAAK,qCAAqC,GAC3C;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,2BAA2Ba,GAAiD;AAGhF,WAAO,KAAK,aAAaA,EAAI,WAAW,CAAA,GAAIA,EAAI,OAAO;AAAA,EACzD;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,WAAW,MAAA;AAAA,EAClB;AACF;AAaO,MAAMC,IAAa,IAAIzB,EAAA;"}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Authentication utilities for TetraScience data apps
+ */
+export { JwtTokenManager, jwtManager } from './JwtTokenManager';
+export type { JwtTokenManagerConfig, CookieDict, HeaderDict, ExpressRequestLike, } from './JwtTokenManager';

package/dist/server/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * TetraScience Server Utilities
+ *
+ * Backend utilities and helper functions for TetraScience applications.
+ * This module contains server-side code that does not depend on React or browser APIs.
+ */
+export * from './auth';
+export * from './providers';

package/dist/server/providers/AthenaProvider.cjs

@@ -1,2 +1,2 @@
-"use strict";var f=Object.create;var y=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,T=Object.prototype.hasOwnProperty;var x=(e,t,o,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of S(t))!T.call(e,r)&&r!==o&&y(e,r,{get:()=>t[r],enumerable:!(n=g(t,r))||n.enumerable});return e};var C=(e,t,o)=>(o=e!=null?f(k(e)):{},x(t||!e||!e.__esModule?y(o,"default",{value:e,enumerable:!0}):o,e));Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const d=require("./exceptions.cjs"),_=1e3;async function A(){try{return await import("@aws-sdk/client-athena")}catch{throw new d.InvalidProviderConfigurationError("The '@aws-sdk/client-athena' package is required to use the Athena provider. Please install it: npm install @aws-sdk/client-athena")}}const Q=262144;class m{client;sdk;workgroup;database;outputLocation;constructor(t,o,n,r,a){this.client=t,this.sdk=o,this.workgroup=n,this.database=r,this.outputLocation=a}async query(t,o={}){if(t.length>Q)throw new Error("Query length exceeds the maximum allowed limit.");const n=new this.sdk.StartQueryExecutionCommand({QueryString:t,WorkGroup:this.workgroup,QueryExecutionContext:{Database:this.database},ResultConfiguration:this.outputLocation?{OutputLocation:this.outputLocation}:void 0}),a=(await this.client.send(n)).QueryExecutionId;if(!a)throw new d.QueryError("Failed to start query execution");return await this.waitForQueryCompletion(a,t),this.fetchAllResults(a)}async waitForQueryCompletion(t,o){const a=Date.now();for(;Date.now()-a<3e5;){const c=new this.sdk.GetQueryExecutionCommand({QueryExecutionId:t}),s=await this.client.send(c),i=s.QueryExecution?.Status?.State;if(i===this.sdk.QueryExecutionState.SUCCEEDED)return;if(i===this.sdk.QueryExecutionState.FAILED||i===this.sdk.QueryExecutionState.CANCELLED){const u=s.QueryExecution?.Status?.StateChangeReason??"Unknown error";if(u.includes("TABLE_NOT_FOUND")){const l=u.split(":").pop()?.trim()??"";throw new d.MissingTableError("Athena is unable to find the table. If the table is created by a tetraflow, make sure that the tetraflow has run successfully. "+l+".")}throw new d.QueryError(`Query failed: ${o}. Reason: ${u}`)}await new Promise(u=>setTimeout(u,1e3))}throw new d.QueryError(`Query timed out after ${3e5/_} seconds`)}async fetchAllResults(t){const o=[];let n,r=[],a=!0;do{const c=new this.sdk.GetQueryResultsCommand({QueryExecutionId:t,NextToken:n}),s=await this.client.send(c);a&&s.ResultSet?.ResultSetMetadata?.ColumnInfo&&(r=s.ResultSet.ResultSetMetadata.ColumnInfo.map((l,w)=>{const h=l.Name;return h&&h.trim()!==""?h:`column_${w}`}));const i=s.ResultSet?.Rows??[],u=a?i.slice(1):i;for(const l of u){const w={};l.Data?.forEach((h,p)=>{const E=r[p]??`column_${p}`;w[E]=h.VarCharValue??null}),o.push(w)}n=s.NextToken,a=!1}while(n);return o}async close(){this.client.destroy()}}async function R(){const e=await A(),t=process.env.ORG_SLUG??"",o=t.replace(/-/g,"_"),n=process.env.ATHENA_S3_OUTPUT_LOCATION,r=process.env.AWS_REGION,a=`${o}__tss__default`,c=t,s=new e.AthenaClient({region:r});try{return await s.send(new e.GetWorkGroupCommand({WorkGroup:c})),new m(s,e,c,a)}catch{if(!n)throw new Error("ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. Either set this variable or ensure the org-specific workgroup exists.");const i=`s3://${n}/${o}/`;return new m(s,e,"primary",a,i)}}exports.AthenaProvider=m;exports.getTdpAthenaProvider=R;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const d=require("./exceptions.cjs");function f(r){const t=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(r){for(const e in r)if(e!=="default"){const n=Object.getOwnPropertyDescriptor(r,e);Object.defineProperty(t,e,n.get?n:{enumerable:!0,get:()=>r[e]})}}return t.default=r,Object.freeze(t)}const E=1e3;async function g(){try{return await Promise.resolve().then(()=>f(require("@aws-sdk/client-athena")))}catch{throw new d.InvalidProviderConfigurationError("The '@aws-sdk/client-athena' package is required to use the Athena provider. Please install it: npm install @aws-sdk/client-athena")}}const S=262144;class w{client;sdk;workgroup;database;outputLocation;constructor(t,e,n,s,o){this.client=t,this.sdk=e,this.workgroup=n,this.database=s,this.outputLocation=o}async query(t,e={}){if(t.length>S)throw new Error("Query length exceeds the maximum allowed limit.");const n=new this.sdk.StartQueryExecutionCommand({QueryString:t,WorkGroup:this.workgroup,QueryExecutionContext:{Database:this.database},ResultConfiguration:this.outputLocation?{OutputLocation:this.outputLocation}:void 0}),o=(await this.client.send(n)).QueryExecutionId;if(!o)throw new d.QueryError("Failed to start query execution");return await this.waitForQueryCompletion(o,t),this.fetchAllResults(o)}async waitForQueryCompletion(t,e){const o=Date.now();for(;Date.now()-o<3e5;){const c=new this.sdk.GetQueryExecutionCommand({QueryExecutionId:t}),a=await this.client.send(c),i=a.QueryExecution?.Status?.State;if(i===this.sdk.QueryExecutionState.SUCCEEDED)return;if(i===this.sdk.QueryExecutionState.FAILED||i===this.sdk.QueryExecutionState.CANCELLED){const u=a.QueryExecution?.Status?.StateChangeReason??"Unknown error";if(u.includes("TABLE_NOT_FOUND")){const l=u.split(":").pop()?.trim()??"";throw new d.MissingTableError("Athena is unable to find the table. If the table is created by a tetraflow, make sure that the tetraflow has run successfully. "+l+".")}throw new d.QueryError(`Query failed: ${e}. Reason: ${u}`)}await new Promise(u=>setTimeout(u,1e3))}throw new d.QueryError(`Query timed out after ${3e5/E} seconds`)}async fetchAllResults(t){const e=[];let n,s=[],o=!0;do{const c=new this.sdk.GetQueryResultsCommand({QueryExecutionId:t,NextToken:n}),a=await this.client.send(c);o&&a.ResultSet?.ResultSetMetadata?.ColumnInfo&&(s=a.ResultSet.ResultSetMetadata.ColumnInfo.map((l,m)=>{const h=l.Name;return h&&h.trim()!==""?h:`column_${m}`}));const i=a.ResultSet?.Rows??[],u=o?i.slice(1):i;for(const l of u){const m={};l.Data?.forEach((h,p)=>{const y=s[p]??`column_${p}`;m[y]=h.VarCharValue??null}),e.push(m)}n=a.NextToken,o=!1}while(n);return e}async close(){this.client.destroy()}}async function k(){const r=await g(),t=process.env.ORG_SLUG??"",e=t.replace(/-/g,"_"),n=process.env.ATHENA_S3_OUTPUT_LOCATION,s=process.env.AWS_REGION,o=`${e}__tss__default`,c=t,a=new r.AthenaClient({region:s});try{return await a.send(new r.GetWorkGroupCommand({WorkGroup:c})),new w(a,r,c,o)}catch{if(!n)throw new Error("ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. Either set this variable or ensure the org-specific workgroup exists.");const i=`s3://${n}/${e}/`;return new w(a,r,"primary",o,i)}}exports.AthenaProvider=w;exports.getTdpAthenaProvider=k;
 //# sourceMappingURL=AthenaProvider.cjs.map

package/dist/server/providers/AthenaProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaProvider.cjs","sources":["../../../src/server/providers/AthenaProvider.ts"],"sourcesContent":["/**\n * Athena Data Provider\n *\n * TypeScript equivalent of AthenaProvider from\n * ts-lib-ui-kit-streamlit/tetrascience/data_app_providers/provider.py\n *\n * @remarks\n * This provider requires the `@aws-sdk/client-athena` package to be installed.\n * It is an optional peer dependency - install it only if you need Athena support:\n * ```bash\n * npm install @aws-sdk/client-athena\n * # or\n * yarn add @aws-sdk/client-athena\n * ```\n */\n\nimport {\n  QueryError,\n  MissingTableError,\n  InvalidProviderConfigurationError,\n} from \"./exceptions\";\n\n/** Milliseconds per second */\nconst MILLISECONDS_PER_SECOND = 1000;\n\n// Type imports for @aws-sdk/client-athena (these don't require the package at runtime)\ntype AthenaClient = import(\"@aws-sdk/client-athena\").AthenaClient;\ntype AthenaSDK = typeof import(\"@aws-sdk/client-athena\");\n\n/**\n * Dynamically import @aws-sdk/client-athena\n * @throws {InvalidProviderConfigurationError} If @aws-sdk/client-athena is not installed\n */\nasync function getAthenaSDK(): Promise<AthenaSDK> {\n  try {\n    return await import(\"@aws-sdk/client-athena\");\n  } catch {\n    throw new InvalidProviderConfigurationError(\n      \"The '@aws-sdk/client-athena' package is required to use the Athena provider. \" +\n        \"Please install it: npm install @aws-sdk/client-athena\",\n    );\n  }\n}\n\n/** Maximum query length allowed by Athena */\nconst MAX_QUERY_LENGTH = 262144;\n\n/**\n * Athena data provider\n */\nexport class AthenaProvider {\n  private client: AthenaClient;\n  private sdk: AthenaSDK;\n  private workgroup: string;\n  private database: string;\n  private outputLocation?: string;\n\n  /**\n   * Initialize the Athena data provider\n   *\n   * @param client - AWS Athena client\n   * @param sdk - AWS Athena SDK module (for accessing command classes)\n   * @param workgroup - Athena workgroup to use\n   * @param database - Default database/schema\n   * @param outputLocation - Optional S3 output location\n   */\n  constructor(\n    client: AthenaClient,\n    sdk: AthenaSDK,\n    workgroup: string,\n    database: string,\n    outputLocation?: string,\n  ) {\n    this.client = client;\n    this.sdk = sdk;\n    this.workgroup = workgroup;\n    this.database = database;\n    this.outputLocation = outputLocation;\n  }\n\n  /**\n   * Query the Athena database\n   *\n   * @param sqlQuery - SQL query to execute\n   * @param _params - Parameters to pass to the query (currently not used - Athena doesn't support parameterized queries)\n   * @returns Promise resolving to array of row objects\n   *\n   * @remarks\n   * **Security Note:** AWS Athena does not support parameterized queries.\n   * Unlike traditional databases, there is no native way to use bind parameters\n   * with Athena. Callers are responsible for properly sanitizing any user input\n   * before constructing the SQL query string. This is a known limitation of the\n   * Athena service, not a design flaw in this implementation.\n   */\n  async query(\n    sqlQuery: string,\n    _params: Record<string, unknown> = {},\n  ): Promise<Array<Record<string, unknown>>> {\n    if (sqlQuery.length > MAX_QUERY_LENGTH) {\n      throw new Error(\"Query length exceeds the maximum allowed limit.\");\n    }\n\n    // Start query execution\n    // Note: Athena does not support parameterized queries. The sqlQuery is passed\n    // directly to Athena. Callers must sanitize user input before constructing queries.\n    const startCommand = new this.sdk.StartQueryExecutionCommand({\n      QueryString: sqlQuery,\n      WorkGroup: this.workgroup,\n      QueryExecutionContext: {\n        Database: this.database,\n      },\n      ResultConfiguration: this.outputLocation\n        ? { OutputLocation: this.outputLocation }\n        : undefined,\n    });\n\n    const startResponse = await this.client.send(startCommand);\n    const queryExecutionId = startResponse.QueryExecutionId;\n\n    if (!queryExecutionId) {\n      throw new QueryError(\"Failed to start query execution\");\n    }\n\n    // Wait for query to complete\n    await this.waitForQueryCompletion(queryExecutionId, sqlQuery);\n\n    // Fetch results\n    return this.fetchAllResults(queryExecutionId);\n  }\n\n  /**\n   * Wait for query to complete\n   */\n  private async waitForQueryCompletion(\n    queryExecutionId: string,\n    originalQuery: string,\n  ): Promise<void> {\n    const maxWaitTime = 300000; // 5 minutes\n    const pollInterval = 1000; // 1 second\n    const startTime = Date.now();\n\n    while (Date.now() - startTime < maxWaitTime) {\n      const command = new this.sdk.GetQueryExecutionCommand({\n        QueryExecutionId: queryExecutionId,\n      });\n      const response = await this.client.send(command);\n      const state = response.QueryExecution?.Status?.State;\n\n      if (state === this.sdk.QueryExecutionState.SUCCEEDED) {\n        return;\n      }\n\n      if (\n        state === this.sdk.QueryExecutionState.FAILED ||\n        state === this.sdk.QueryExecutionState.CANCELLED\n      ) {\n        const reason =\n          response.QueryExecution?.Status?.StateChangeReason ?? \"Unknown error\";\n\n        if (reason.includes(\"TABLE_NOT_FOUND\")) {\n          const errorTail = reason.split(\":\").pop()?.trim() ?? \"\";\n          throw new MissingTableError(\n            \"Athena is unable to find the table. If the table is created by a \" +\n              \"tetraflow, make sure that the tetraflow has run successfully. \" +\n              errorTail +\n              \".\",\n          );\n        }\n\n        throw new QueryError(\n          `Query failed: ${originalQuery}. Reason: ${reason}`,\n        );\n      }\n\n      await new Promise((resolve) => setTimeout(resolve, pollInterval));\n    }\n\n    throw new QueryError(\n      `Query timed out after ${maxWaitTime / MILLISECONDS_PER_SECOND} seconds`,\n    );\n  }\n\n  /**\n   * Fetch all results from a completed query\n   */\n  private async fetchAllResults(\n    queryExecutionId: string,\n  ): Promise<Array<Record<string, unknown>>> {\n    const results: Array<Record<string, unknown>> = [];\n    let nextToken: string | undefined;\n    let columnNames: string[] = [];\n    let isFirstPage = true;\n\n    do {\n      const command = new this.sdk.GetQueryResultsCommand({\n        QueryExecutionId: queryExecutionId,\n        NextToken: nextToken,\n      });\n\n      const response = await this.client.send(command);\n\n      if (isFirstPage && response.ResultSet?.ResultSetMetadata?.ColumnInfo) {\n        columnNames = response.ResultSet.ResultSetMetadata.ColumnInfo.map(\n          (col, idx) => {\n            // Handle empty or missing column names by using a fallback\n            const name = col.Name;\n            return name && name.trim() !== \"\" ? name : `column_${idx}`;\n          },\n        );\n      }\n\n      const rows = response.ResultSet?.Rows ?? [];\n      // Skip header row on first page\n      const dataRows = isFirstPage ? rows.slice(1) : rows;\n\n      for (const row of dataRows) {\n        const rowData: Record<string, unknown> = {};\n        row.Data?.forEach((cell, index) => {\n          // columnNames already has fallback values, so we can use them directly\n          const columnName = columnNames[index] ?? `column_${index}`;\n          rowData[columnName] = cell.VarCharValue ?? null;\n        });\n        results.push(rowData);\n      }\n\n      nextToken = response.NextToken;\n      isFirstPage = false;\n    } while (nextToken);\n\n    return results;\n  }\n\n  /**\n   * Close the Athena client (no-op for AWS SDK clients)\n   */\n  async close(): Promise<void> {\n    this.client.destroy();\n  }\n}\n\n/**\n * Get the TDP Athena provider\n *\n * Creates an Athena provider using TDP environment configuration\n *\n * @returns Promise resolving to Athena data provider\n * @throws {InvalidProviderConfigurationError} If @aws-sdk/client-athena is not installed\n * @throws {Error} If ATHENA_S3_OUTPUT_LOCATION is not set when using the 'primary' workgroup\n */\nexport async function getTdpAthenaProvider(): Promise<AthenaProvider> {\n  // Dynamically import @aws-sdk/client-athena\n  const athenaSDK = await getAthenaSDK();\n\n  const orgSlug = process.env.ORG_SLUG ?? \"\";\n  const orgSlugDbFriendly = orgSlug.replace(/-/g, \"_\");\n  const athenaQueryBucket = process.env.ATHENA_S3_OUTPUT_LOCATION;\n  const athenaRegion = process.env.AWS_REGION;\n  const athenaSchema = `${orgSlugDbFriendly}__tss__default`;\n  const athenaWorkgroup = orgSlug;\n\n  const client = new athenaSDK.AthenaClient({\n    region: athenaRegion,\n  });\n\n  // Check if the org-specific workgroup exists\n  try {\n    await client.send(\n      new athenaSDK.GetWorkGroupCommand({\n        WorkGroup: athenaWorkgroup,\n      }),\n    );\n\n    // Workgroup exists, use it\n    return new AthenaProvider(client, athenaSDK, athenaWorkgroup, athenaSchema);\n  } catch {\n    // Workgroup doesn't exist or access denied, use 'primary' workgroup\n    // The 'primary' workgroup requires an explicit output location\n    if (!athenaQueryBucket) {\n      throw new Error(\n        \"ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. \" +\n          \"Either set this variable or ensure the org-specific workgroup exists.\",\n      );\n    }\n\n    const athenaOutputLocation = `s3://${athenaQueryBucket}/${orgSlugDbFriendly}/`;\n    return new AthenaProvider(\n      client,\n      athenaSDK,\n      \"primary\",\n      athenaSchema,\n      athenaOutputLocation,\n    );\n  }\n}\n\n"],"names":["MILLISECONDS_PER_SECOND","getAthenaSDK","InvalidProviderConfigurationError","MAX_QUERY_LENGTH","AthenaProvider","client","sdk","workgroup","database","outputLocation","sqlQuery","_params","startCommand","queryExecutionId","QueryError","originalQuery","startTime","command","response","state","reason","errorTail","MissingTableError","resolve","results","nextToken","columnNames","isFirstPage","col","idx","name","rows","dataRows","row","rowData","cell","index","columnName","getTdpAthenaProvider","athenaSDK","orgSlug","orgSlugDbFriendly","athenaQueryBucket","athenaRegion","athenaSchema","athenaWorkgroup","athenaOutputLocation"],"mappings":"+jBAuBMA,EAA0B,IAUhC,eAAeC,GAAmC,CAChD,GAAI,CACF,OAAO,KAAM,QAAO,wBAAwB,CAC9C,MAAQ,CACN,MAAM,IAAIC,EAAAA,kCACR,oIAAA,CAGJ,CACF,CAGA,MAAMC,EAAmB,OAKlB,MAAMC,CAAe,CAClB,OACA,IACA,UACA,SACA,eAWR,YACEC,EACAC,EACAC,EACAC,EACAC,EACA,CACA,KAAK,OAASJ,EACd,KAAK,IAAMC,EACX,KAAK,UAAYC,EACjB,KAAK,SAAWC,EAChB,KAAK,eAAiBC,CACxB,CAgBA,MAAM,MACJC,EACAC,EAAmC,GACM,CACzC,GAAID,EAAS,OAASP,EACpB,MAAM,IAAI,MAAM,iDAAiD,EAMnE,MAAMS,EAAe,IAAI,KAAK,IAAI,2BAA2B,CAC3D,YAAaF,EACb,UAAW,KAAK,UAChB,sBAAuB,CACrB,SAAU,KAAK,QAAA,EAEjB,oBAAqB,KAAK,eACtB,CAAE,eAAgB,KAAK,gBACvB,MAAA,CACL,EAGKG,GADgB,MAAM,KAAK,OAAO,KAAKD,CAAY,GAClB,iBAEvC,GAAI,CAACC,EACH,MAAM,IAAIC,EAAAA,WAAW,iCAAiC,EAIxD,aAAM,KAAK,uBAAuBD,EAAkBH,CAAQ,EAGrD,KAAK,gBAAgBG,CAAgB,CAC9C,CAKA,MAAc,uBACZA,EACAE,EACe,CAGf,MAAMC,EAAY,KAAK,IAAA,EAEvB,KAAO,KAAK,MAAQA,EAAY,KAAa,CAC3C,MAAMC,EAAU,IAAI,KAAK,IAAI,yBAAyB,CACpD,iBAAkBJ,CAAA,CACnB,EACKK,EAAW,MAAM,KAAK,OAAO,KAAKD,CAAO,EACzCE,EAAQD,EAAS,gBAAgB,QAAQ,MAE/C,GAAIC,IAAU,KAAK,IAAI,oBAAoB,UACzC,OAGF,GACEA,IAAU,KAAK,IAAI,oBAAoB,QACvCA,IAAU,KAAK,IAAI,oBAAoB,UACvC,CACA,MAAMC,EACJF,EAAS,gBAAgB,QAAQ,mBAAqB,gBAExD,GAAIE,EAAO,SAAS,iBAAiB,EAAG,CACtC,MAAMC,EAAYD,EAAO,MAAM,GAAG,EAAE,IAAA,GAAO,QAAU,GACrD,MAAM,IAAIE,EAAAA,kBACR,kIAEED,EACA,GAAA,CAEN,CAEA,MAAM,IAAIP,EAAAA,WACR,iBAAiBC,CAAa,aAAaK,CAAM,EAAA,CAErD,CAEA,MAAM,IAAI,QAASG,GAAY,WAAWA,EAAS,GAAY,CAAC,CAClE,CAEA,MAAM,IAAIT,EAAAA,WACR,yBAAyB,IAAcd,CAAuB,UAAA,CAElE,CAKA,MAAc,gBACZa,EACyC,CACzC,MAAMW,EAA0C,CAAA,EAChD,IAAIC,EACAC,EAAwB,CAAA,EACxBC,EAAc,GAElB,EAAG,CACD,MAAMV,EAAU,IAAI,KAAK,IAAI,uBAAuB,CAClD,iBAAkBJ,EAClB,UAAWY,CAAA,CACZ,EAEKP,EAAW,MAAM,KAAK,OAAO,KAAKD,CAAO,EAE3CU,GAAeT,EAAS,WAAW,mBAAmB,aACxDQ,EAAcR,EAAS,UAAU,kBAAkB,WAAW,IAC5D,CAACU,EAAKC,IAAQ,CAEZ,MAAMC,EAAOF,EAAI,KACjB,OAAOE,GAAQA,EAAK,KAAA,IAAW,GAAKA,EAAO,UAAUD,CAAG,EAC1D,CAAA,GAIJ,MAAME,EAAOb,EAAS,WAAW,MAAQ,CAAA,EAEnCc,EAAWL,EAAcI,EAAK,MAAM,CAAC,EAAIA,EAE/C,UAAWE,KAAOD,EAAU,CAC1B,MAAME,EAAmC,CAAA,EACzCD,EAAI,MAAM,QAAQ,CAACE,EAAMC,IAAU,CAEjC,MAAMC,EAAaX,EAAYU,CAAK,GAAK,UAAUA,CAAK,GACxDF,EAAQG,CAAU,EAAIF,EAAK,cAAgB,IAC7C,CAAC,EACDX,EAAQ,KAAKU,CAAO,CACtB,CAEAT,EAAYP,EAAS,UACrBS,EAAc,EAChB,OAASF,GAET,OAAOD,CACT,CAKA,MAAM,OAAuB,CAC3B,KAAK,OAAO,QAAA,CACd,CACF,CAWA,eAAsBc,GAAgD,CAEpE,MAAMC,EAAY,MAAMtC,EAAA,EAElBuC,EAAU,QAAQ,IAAI,UAAY,GAClCC,EAAoBD,EAAQ,QAAQ,KAAM,GAAG,EAC7CE,EAAoB,QAAQ,IAAI,0BAChCC,EAAe,QAAQ,IAAI,WAC3BC,EAAe,GAAGH,CAAiB,iBACnCI,EAAkBL,EAElBnC,EAAS,IAAIkC,EAAU,aAAa,CACxC,OAAQI,CAAA,CACT,EAGD,GAAI,CACF,aAAMtC,EAAO,KACX,IAAIkC,EAAU,oBAAoB,CAChC,UAAWM,CAAA,CACZ,CAAA,EAII,IAAIzC,EAAeC,EAAQkC,EAAWM,EAAiBD,CAAY,CAC5E,MAAQ,CAGN,GAAI,CAACF,EACH,MAAM,IAAI,MACR,sKAAA,EAKJ,MAAMI,EAAuB,QAAQJ,CAAiB,IAAID,CAAiB,IAC3E,OAAO,IAAIrC,EACTC,EACAkC,EACA,UACAK,EACAE,CAAA,CAEJ,CACF"}
+{"version":3,"file":"AthenaProvider.cjs","sources":["../../../src/server/providers/AthenaProvider.ts"],"sourcesContent":["/**\n * Athena Data Provider\n *\n * TypeScript equivalent of AthenaProvider from\n * ts-lib-ui-kit-streamlit/tetrascience/data_app_providers/provider.py\n *\n * @remarks\n * This provider requires the `@aws-sdk/client-athena` package to be installed.\n * It is an optional peer dependency - install it only if you need Athena support:\n * ```bash\n * npm install @aws-sdk/client-athena\n * # or\n * yarn add @aws-sdk/client-athena\n * ```\n */\n\nimport {\n  QueryError,\n  MissingTableError,\n  InvalidProviderConfigurationError,\n} from \"./exceptions\";\n\n/** Milliseconds per second */\nconst MILLISECONDS_PER_SECOND = 1000;\n\n// Type imports for @aws-sdk/client-athena (these don't require the package at runtime)\ntype AthenaClient = import(\"@aws-sdk/client-athena\").AthenaClient;\ntype AthenaSDK = typeof import(\"@aws-sdk/client-athena\");\n\n/**\n * Dynamically import @aws-sdk/client-athena\n * @throws {InvalidProviderConfigurationError} If @aws-sdk/client-athena is not installed\n */\nasync function getAthenaSDK(): Promise<AthenaSDK> {\n  try {\n    return await import(\"@aws-sdk/client-athena\");\n  } catch {\n    throw new InvalidProviderConfigurationError(\n      \"The '@aws-sdk/client-athena' package is required to use the Athena provider. \" +\n        \"Please install it: npm install @aws-sdk/client-athena\",\n    );\n  }\n}\n\n/** Maximum query length allowed by Athena */\nconst MAX_QUERY_LENGTH = 262144;\n\n/**\n * Athena data provider\n */\nexport class AthenaProvider {\n  private client: AthenaClient;\n  private sdk: AthenaSDK;\n  private workgroup: string;\n  private database: string;\n  private outputLocation?: string;\n\n  /**\n   * Initialize the Athena data provider\n   *\n   * @param client - AWS Athena client\n   * @param sdk - AWS Athena SDK module (for accessing command classes)\n   * @param workgroup - Athena workgroup to use\n   * @param database - Default database/schema\n   * @param outputLocation - Optional S3 output location\n   */\n  constructor(\n    client: AthenaClient,\n    sdk: AthenaSDK,\n    workgroup: string,\n    database: string,\n    outputLocation?: string,\n  ) {\n    this.client = client;\n    this.sdk = sdk;\n    this.workgroup = workgroup;\n    this.database = database;\n    this.outputLocation = outputLocation;\n  }\n\n  /**\n   * Query the Athena database\n   *\n   * @param sqlQuery - SQL query to execute\n   * @param _params - Parameters to pass to the query (currently not used - Athena doesn't support parameterized queries)\n   * @returns Promise resolving to array of row objects\n   *\n   * @remarks\n   * **Security Note:** AWS Athena does not support parameterized queries.\n   * Unlike traditional databases, there is no native way to use bind parameters\n   * with Athena. Callers are responsible for properly sanitizing any user input\n   * before constructing the SQL query string. This is a known limitation of the\n   * Athena service, not a design flaw in this implementation.\n   */\n  async query(\n    sqlQuery: string,\n    _params: Record<string, unknown> = {},\n  ): Promise<Array<Record<string, unknown>>> {\n    if (sqlQuery.length > MAX_QUERY_LENGTH) {\n      throw new Error(\"Query length exceeds the maximum allowed limit.\");\n    }\n\n    // Start query execution\n    // Note: Athena does not support parameterized queries. The sqlQuery is passed\n    // directly to Athena. Callers must sanitize user input before constructing queries.\n    const startCommand = new this.sdk.StartQueryExecutionCommand({\n      QueryString: sqlQuery,\n      WorkGroup: this.workgroup,\n      QueryExecutionContext: {\n        Database: this.database,\n      },\n      ResultConfiguration: this.outputLocation\n        ? { OutputLocation: this.outputLocation }\n        : undefined,\n    });\n\n    const startResponse = await this.client.send(startCommand);\n    const queryExecutionId = startResponse.QueryExecutionId;\n\n    if (!queryExecutionId) {\n      throw new QueryError(\"Failed to start query execution\");\n    }\n\n    // Wait for query to complete\n    await this.waitForQueryCompletion(queryExecutionId, sqlQuery);\n\n    // Fetch results\n    return this.fetchAllResults(queryExecutionId);\n  }\n\n  /**\n   * Wait for query to complete\n   */\n  private async waitForQueryCompletion(\n    queryExecutionId: string,\n    originalQuery: string,\n  ): Promise<void> {\n    const maxWaitTime = 300000; // 5 minutes\n    const pollInterval = 1000; // 1 second\n    const startTime = Date.now();\n\n    while (Date.now() - startTime < maxWaitTime) {\n      const command = new this.sdk.GetQueryExecutionCommand({\n        QueryExecutionId: queryExecutionId,\n      });\n      const response = await this.client.send(command);\n      const state = response.QueryExecution?.Status?.State;\n\n      if (state === this.sdk.QueryExecutionState.SUCCEEDED) {\n        return;\n      }\n\n      if (\n        state === this.sdk.QueryExecutionState.FAILED ||\n        state === this.sdk.QueryExecutionState.CANCELLED\n      ) {\n        const reason =\n          response.QueryExecution?.Status?.StateChangeReason ?? \"Unknown error\";\n\n        if (reason.includes(\"TABLE_NOT_FOUND\")) {\n          const errorTail = reason.split(\":\").pop()?.trim() ?? \"\";\n          throw new MissingTableError(\n            \"Athena is unable to find the table. If the table is created by a \" +\n              \"tetraflow, make sure that the tetraflow has run successfully. \" +\n              errorTail +\n              \".\",\n          );\n        }\n\n        throw new QueryError(\n          `Query failed: ${originalQuery}. Reason: ${reason}`,\n        );\n      }\n\n      await new Promise((resolve) => setTimeout(resolve, pollInterval));\n    }\n\n    throw new QueryError(\n      `Query timed out after ${maxWaitTime / MILLISECONDS_PER_SECOND} seconds`,\n    );\n  }\n\n  /**\n   * Fetch all results from a completed query\n   */\n  private async fetchAllResults(\n    queryExecutionId: string,\n  ): Promise<Array<Record<string, unknown>>> {\n    const results: Array<Record<string, unknown>> = [];\n    let nextToken: string | undefined;\n    let columnNames: string[] = [];\n    let isFirstPage = true;\n\n    do {\n      const command = new this.sdk.GetQueryResultsCommand({\n        QueryExecutionId: queryExecutionId,\n        NextToken: nextToken,\n      });\n\n      const response = await this.client.send(command);\n\n      if (isFirstPage && response.ResultSet?.ResultSetMetadata?.ColumnInfo) {\n        columnNames = response.ResultSet.ResultSetMetadata.ColumnInfo.map(\n          (col, idx) => {\n            // Handle empty or missing column names by using a fallback\n            const name = col.Name;\n            return name && name.trim() !== \"\" ? name : `column_${idx}`;\n          },\n        );\n      }\n\n      const rows = response.ResultSet?.Rows ?? [];\n      // Skip header row on first page\n      const dataRows = isFirstPage ? rows.slice(1) : rows;\n\n      for (const row of dataRows) {\n        const rowData: Record<string, unknown> = {};\n        row.Data?.forEach((cell, index) => {\n          // columnNames already has fallback values, so we can use them directly\n          const columnName = columnNames[index] ?? `column_${index}`;\n          rowData[columnName] = cell.VarCharValue ?? null;\n        });\n        results.push(rowData);\n      }\n\n      nextToken = response.NextToken;\n      isFirstPage = false;\n    } while (nextToken);\n\n    return results;\n  }\n\n  /**\n   * Close the Athena client (no-op for AWS SDK clients)\n   */\n  async close(): Promise<void> {\n    this.client.destroy();\n  }\n}\n\n/**\n * Get the TDP Athena provider\n *\n * Creates an Athena provider using TDP environment configuration\n *\n * @returns Promise resolving to Athena data provider\n * @throws {InvalidProviderConfigurationError} If @aws-sdk/client-athena is not installed\n * @throws {Error} If ATHENA_S3_OUTPUT_LOCATION is not set when using the 'primary' workgroup\n */\nexport async function getTdpAthenaProvider(): Promise<AthenaProvider> {\n  // Dynamically import @aws-sdk/client-athena\n  const athenaSDK = await getAthenaSDK();\n\n  const orgSlug = process.env.ORG_SLUG ?? \"\";\n  const orgSlugDbFriendly = orgSlug.replace(/-/g, \"_\");\n  const athenaQueryBucket = process.env.ATHENA_S3_OUTPUT_LOCATION;\n  const athenaRegion = process.env.AWS_REGION;\n  const athenaSchema = `${orgSlugDbFriendly}__tss__default`;\n  const athenaWorkgroup = orgSlug;\n\n  const client = new athenaSDK.AthenaClient({\n    region: athenaRegion,\n  });\n\n  // Check if the org-specific workgroup exists\n  try {\n    await client.send(\n      new athenaSDK.GetWorkGroupCommand({\n        WorkGroup: athenaWorkgroup,\n      }),\n    );\n\n    // Workgroup exists, use it\n    return new AthenaProvider(client, athenaSDK, athenaWorkgroup, athenaSchema);\n  } catch {\n    // Workgroup doesn't exist or access denied, use 'primary' workgroup\n    // The 'primary' workgroup requires an explicit output location\n    if (!athenaQueryBucket) {\n      throw new Error(\n        \"ATHENA_S3_OUTPUT_LOCATION environment variable is required when using the 'primary' workgroup. \" +\n          \"Either set this variable or ensure the org-specific workgroup exists.\",\n      );\n    }\n\n    const athenaOutputLocation = `s3://${athenaQueryBucket}/${orgSlugDbFriendly}/`;\n    return new AthenaProvider(\n      client,\n      athenaSDK,\n      \"primary\",\n      athenaSchema,\n      athenaOutputLocation,\n    );\n  }\n}\n\n"],"names":["MILLISECONDS_PER_SECOND","getAthenaSDK","_interopNamespaceDefault","InvalidProviderConfigurationError","MAX_QUERY_LENGTH","AthenaProvider","client","sdk","workgroup","database","outputLocation","sqlQuery","_params","startCommand","queryExecutionId","QueryError","originalQuery","startTime","command","response","state","reason","errorTail","MissingTableError","resolve","results","nextToken","columnNames","isFirstPage","col","idx","name","rows","dataRows","row","rowData","cell","index","columnName","getTdpAthenaProvider","athenaSDK","orgSlug","orgSlugDbFriendly","athenaQueryBucket","athenaRegion","athenaSchema","athenaWorkgroup","athenaOutputLocation"],"mappings":"iYAuBA,MAAMA,EAA0B,IAUhC,eAAeC,GAAmC,CAChD,GAAI,CACF,OAAO,MAAM,QAAA,QAAA,EAAA,KAAA,IAAAC,EAAA,QAAO,wBAAwB,CAAA,CAAA,CAC9C,MAAQ,CACN,MAAM,IAAIC,EAAAA,kCACR,oIAAA,CAGJ,CACF,CAGA,MAAMC,EAAmB,OAKlB,MAAMC,CAAe,CAClB,OACA,IACA,UACA,SACA,eAWR,YACEC,EACAC,EACAC,EACAC,EACAC,EACA,CACA,KAAK,OAASJ,EACd,KAAK,IAAMC,EACX,KAAK,UAAYC,EACjB,KAAK,SAAWC,EAChB,KAAK,eAAiBC,CACxB,CAgBA,MAAM,MACJC,EACAC,EAAmC,GACM,CACzC,GAAID,EAAS,OAASP,EACpB,MAAM,IAAI,MAAM,iDAAiD,EAMnE,MAAMS,EAAe,IAAI,KAAK,IAAI,2BAA2B,CAC3D,YAAaF,EACb,UAAW,KAAK,UAChB,sBAAuB,CACrB,SAAU,KAAK,QAAA,EAEjB,oBAAqB,KAAK,eACtB,CAAE,eAAgB,KAAK,gBACvB,MAAA,CACL,EAGKG,GADgB,MAAM,KAAK,OAAO,KAAKD,CAAY,GAClB,iBAEvC,GAAI,CAACC,EACH,MAAM,IAAIC,EAAAA,WAAW,iCAAiC,EAIxD,aAAM,KAAK,uBAAuBD,EAAkBH,CAAQ,EAGrD,KAAK,gBAAgBG,CAAgB,CAC9C,CAKA,MAAc,uBACZA,EACAE,EACe,CAGf,MAAMC,EAAY,KAAK,IAAA,EAEvB,KAAO,KAAK,MAAQA,EAAY,KAAa,CAC3C,MAAMC,EAAU,IAAI,KAAK,IAAI,yBAAyB,CACpD,iBAAkBJ,CAAA,CACnB,EACKK,EAAW,MAAM,KAAK,OAAO,KAAKD,CAAO,EACzCE,EAAQD,EAAS,gBAAgB,QAAQ,MAE/C,GAAIC,IAAU,KAAK,IAAI,oBAAoB,UACzC,OAGF,GACEA,IAAU,KAAK,IAAI,oBAAoB,QACvCA,IAAU,KAAK,IAAI,oBAAoB,UACvC,CACA,MAAMC,EACJF,EAAS,gBAAgB,QAAQ,mBAAqB,gBAExD,GAAIE,EAAO,SAAS,iBAAiB,EAAG,CACtC,MAAMC,EAAYD,EAAO,MAAM,GAAG,EAAE,IAAA,GAAO,QAAU,GACrD,MAAM,IAAIE,EAAAA,kBACR,kIAEED,EACA,GAAA,CAEN,CAEA,MAAM,IAAIP,EAAAA,WACR,iBAAiBC,CAAa,aAAaK,CAAM,EAAA,CAErD,CAEA,MAAM,IAAI,QAASG,GAAY,WAAWA,EAAS,GAAY,CAAC,CAClE,CAEA,MAAM,IAAIT,EAAAA,WACR,yBAAyB,IAAcf,CAAuB,UAAA,CAElE,CAKA,MAAc,gBACZc,EACyC,CACzC,MAAMW,EAA0C,CAAA,EAChD,IAAIC,EACAC,EAAwB,CAAA,EACxBC,EAAc,GAElB,EAAG,CACD,MAAMV,EAAU,IAAI,KAAK,IAAI,uBAAuB,CAClD,iBAAkBJ,EAClB,UAAWY,CAAA,CACZ,EAEKP,EAAW,MAAM,KAAK,OAAO,KAAKD,CAAO,EAE3CU,GAAeT,EAAS,WAAW,mBAAmB,aACxDQ,EAAcR,EAAS,UAAU,kBAAkB,WAAW,IAC5D,CAACU,EAAKC,IAAQ,CAEZ,MAAMC,EAAOF,EAAI,KACjB,OAAOE,GAAQA,EAAK,KAAA,IAAW,GAAKA,EAAO,UAAUD,CAAG,EAC1D,CAAA,GAIJ,MAAME,EAAOb,EAAS,WAAW,MAAQ,CAAA,EAEnCc,EAAWL,EAAcI,EAAK,MAAM,CAAC,EAAIA,EAE/C,UAAWE,KAAOD,EAAU,CAC1B,MAAME,EAAmC,CAAA,EACzCD,EAAI,MAAM,QAAQ,CAACE,EAAMC,IAAU,CAEjC,MAAMC,EAAaX,EAAYU,CAAK,GAAK,UAAUA,CAAK,GACxDF,EAAQG,CAAU,EAAIF,EAAK,cAAgB,IAC7C,CAAC,EACDX,EAAQ,KAAKU,CAAO,CACtB,CAEAT,EAAYP,EAAS,UACrBS,EAAc,EAChB,OAASF,GAET,OAAOD,CACT,CAKA,MAAM,OAAuB,CAC3B,KAAK,OAAO,QAAA,CACd,CACF,CAWA,eAAsBc,GAAgD,CAEpE,MAAMC,EAAY,MAAMvC,EAAA,EAElBwC,EAAU,QAAQ,IAAI,UAAY,GAClCC,EAAoBD,EAAQ,QAAQ,KAAM,GAAG,EAC7CE,EAAoB,QAAQ,IAAI,0BAChCC,EAAe,QAAQ,IAAI,WAC3BC,EAAe,GAAGH,CAAiB,iBACnCI,EAAkBL,EAElBnC,EAAS,IAAIkC,EAAU,aAAa,CACxC,OAAQI,CAAA,CACT,EAGD,GAAI,CACF,aAAMtC,EAAO,KACX,IAAIkC,EAAU,oBAAoB,CAChC,UAAWM,CAAA,CACZ,CAAA,EAII,IAAIzC,EAAeC,EAAQkC,EAAWM,EAAiBD,CAAY,CAC5E,MAAQ,CAGN,GAAI,CAACF,EACH,MAAM,IAAI,MACR,sKAAA,EAKJ,MAAMI,EAAuB,QAAQJ,CAAiB,IAAID,CAAiB,IAC3E,OAAO,IAAIrC,EACTC,EACAkC,EACA,UACAK,EACAE,CAAA,CAEJ,CACF"}

package/dist/server/providers/AthenaProvider.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Athena Data Provider
+ *
+ * TypeScript equivalent of AthenaProvider from
+ * ts-lib-ui-kit-streamlit/tetrascience/data_app_providers/provider.py
+ *
+ * @remarks
+ * This provider requires the `@aws-sdk/client-athena` package to be installed.
+ * It is an optional peer dependency - install it only if you need Athena support:
+ * ```bash
+ * npm install @aws-sdk/client-athena
+ * # or
+ * yarn add @aws-sdk/client-athena
+ * ```
+ */
+type AthenaClient = import('@aws-sdk/client-athena').AthenaClient;
+type AthenaSDK = typeof import("@aws-sdk/client-athena");
+/**
+ * Athena data provider
+ */
+export declare class AthenaProvider {
+    private client;
+    private sdk;
+    private workgroup;
+    private database;
+    private outputLocation?;
+    /**
+     * Initialize the Athena data provider
+     *
+     * @param client - AWS Athena client
+     * @param sdk - AWS Athena SDK module (for accessing command classes)
+     * @param workgroup - Athena workgroup to use
+     * @param database - Default database/schema
+     * @param outputLocation - Optional S3 output location
+     */
+    constructor(client: AthenaClient, sdk: AthenaSDK, workgroup: string, database: string, outputLocation?: string);
+    /**
+     * Query the Athena database
+     *
+     * @param sqlQuery - SQL query to execute
+     * @param _params - Parameters to pass to the query (currently not used - Athena doesn't support parameterized queries)
+     * @returns Promise resolving to array of row objects
+     *
+     * @remarks
+     * **Security Note:** AWS Athena does not support parameterized queries.
+     * Unlike traditional databases, there is no native way to use bind parameters
+     * with Athena. Callers are responsible for properly sanitizing any user input
+     * before constructing the SQL query string. This is a known limitation of the
+     * Athena service, not a design flaw in this implementation.
+     */
+    query(sqlQuery: string, _params?: Record<string, unknown>): Promise<Array<Record<string, unknown>>>;
+    /**
+     * Wait for query to complete
+     */
+    private waitForQueryCompletion;
+    /**
+     * Fetch all results from a completed query
+     */
+    private fetchAllResults;
+    /**
+     * Close the Athena client (no-op for AWS SDK clients)
+     */
+    close(): Promise<void>;
+}
+/**
+ * Get the TDP Athena provider
+ *
+ * Creates an Athena provider using TDP environment configuration
+ *
+ * @returns Promise resolving to Athena data provider
+ * @throws {InvalidProviderConfigurationError} If @aws-sdk/client-athena is not installed
+ * @throws {Error} If ATHENA_S3_OUTPUT_LOCATION is not set when using the 'primary' workgroup
+ */
+export declare function getTdpAthenaProvider(): Promise<AthenaProvider>;
+export {};

package/dist/server/providers/DatabricksProvider.cjs

@@ -1,2 +1,2 @@
-"use strict";var f=Object.create;var o=Object.defineProperty;var v=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var S=Object.getPrototypeOf,_=Object.prototype.hasOwnProperty;var g=(t,e,s,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of w(e))!_.call(t,i)&&i!==s&&o(t,i,{get:()=>e[i],enumerable:!(a=v(e,i))||a.enumerable});return t};var m=(t,e,s)=>(s=t!=null?f(S(t)):{},g(e||!t||!t.__esModule?o(s,"default",{value:t,enumerable:!0}):s,t));Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const c=require("./exceptions.cjs");async function y(){try{return await import("@databricks/sql")}catch{throw new c.InvalidProviderConfigurationError("The '@databricks/sql' package is required to use the Databricks provider. Please install it: npm install @databricks/sql")}}class l{client;session;constructor(e,s){this.client=e,this.session=s}async query(e,s={}){const a=await this.session.executeStatement(e);try{return await a.fetchAll()}finally{await a.close()}}async close(){await this.session.close(),await this.client.close()}}function k(){return`${(process.env.ORG_SLUG??"").replace(/-/g,"_")}__tss__default`}async function D(t){const{DBSQLClient:e}=await y(),s=["server_hostname","http_path","client_id","client_secret","catalog"];for(const n of s)if(!t.fields[n])throw new c.InvalidProviderConfigurationError(`Missing field '${n}' in the provider '${t.name}' to connect to Databricks.`);const a=t.fields.server_hostname,i=t.fields.http_path,d=t.fields.client_id,u=t.fields.client_secret,h=t.fields.catalog,p=t.fields.schema??k(),r=new e;await r.connect({host:a,path:i,authType:"databricks-oauth",oauthClientId:d,oauthClientSecret:u});const b=await r.openSession({initialCatalog:h,initialSchema:p});return new l(r,b)}exports.DatabricksProvider=l;exports.buildDatabricksProvider=D;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./exceptions.cjs");function p(t){const e=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(t){for(const s in t)if(s!=="default"){const i=Object.getOwnPropertyDescriptor(t,s);Object.defineProperty(e,s,i.get?i:{enumerable:!0,get:()=>t[s]})}}return e.default=t,Object.freeze(e)}async function b(){try{return await Promise.resolve().then(()=>p(require("@databricks/sql")))}catch{throw new o.InvalidProviderConfigurationError("The '@databricks/sql' package is required to use the Databricks provider. Please install it: npm install @databricks/sql")}}class c{client;session;constructor(e,s){this.client=e,this.session=s}async query(e,s={}){const i=await this.session.executeStatement(e);try{return await i.fetchAll()}finally{await i.close()}}async close(){await this.session.close(),await this.client.close()}}function g(){return`${(process.env.ORG_SLUG??"").replace(/-/g,"_")}__tss__default`}async function v(t){const{DBSQLClient:e}=await b(),s=["server_hostname","http_path","client_id","client_secret","catalog"];for(const n of s)if(!t.fields[n])throw new o.InvalidProviderConfigurationError(`Missing field '${n}' in the provider '${t.name}' to connect to Databricks.`);const i=t.fields.server_hostname,a=t.fields.http_path,l=t.fields.client_id,u=t.fields.client_secret,d=t.fields.catalog,h=t.fields.schema??g(),r=new e;await r.connect({host:i,path:a,authType:"databricks-oauth",oauthClientId:l,oauthClientSecret:u});const f=await r.openSession({initialCatalog:d,initialSchema:h});return new c(r,f)}exports.DatabricksProvider=c;exports.buildDatabricksProvider=v;
 //# sourceMappingURL=DatabricksProvider.cjs.map

package/dist/server/providers/DatabricksProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DatabricksProvider.cjs","sources":["../../../src/server/providers/DatabricksProvider.ts"],"sourcesContent":["/**\n * Databricks Data Provider\n *\n * TypeScript equivalent of DatabricksProvider from\n * ts-lib-ui-kit-streamlit/tetrascience/data_app_providers/provider.py\n *\n * @remarks\n * This provider requires the `@databricks/sql` package to be installed.\n * It is an optional peer dependency - install it only if you need Databricks support:\n * ```bash\n * npm install @databricks/sql\n * # or\n * yarn add @databricks/sql\n * ```\n */\n\nimport { InvalidProviderConfigurationError } from \"./exceptions\";\n\nimport type { ProviderConfiguration } from \"./types\";\n\n// Type imports for @databricks/sql (these don't require the package at runtime)\ntype DBSQLClient = import(\"@databricks/sql\").DBSQLClient;\ntype IDBSQLSession = import(\"@databricks/sql/dist/contracts/IDBSQLSession\").default;\n\n/**\n * Dynamically import @databricks/sql\n * @throws {InvalidProviderConfigurationError} If @databricks/sql is not installed\n */\nasync function getDatabricksSQL(): Promise<typeof import(\"@databricks/sql\")> {\n  try {\n    return await import(\"@databricks/sql\");\n  } catch {\n    throw new InvalidProviderConfigurationError(\n      \"The '@databricks/sql' package is required to use the Databricks provider. \" +\n        \"Please install it: npm install @databricks/sql\",\n    );\n  }\n}\n\n/**\n * Databricks data provider\n */\nexport class DatabricksProvider {\n  private client: DBSQLClient;\n  private session: IDBSQLSession;\n\n  /**\n   * Initialize the Databricks data provider\n   *\n   * @param client - Databricks SQL client\n   * @param session - Databricks SQL session\n   */\n  constructor(client: DBSQLClient, session: IDBSQLSession) {\n    this.client = client;\n    this.session = session;\n  }\n\n  /**\n   * Query the Databricks database\n   *\n   * @param sqlQuery - SQL query to execute\n   * @param _params - Parameters to pass to the query (currently not used)\n   * @returns Promise resolving to array of row objects\n   */\n  async query(\n    sqlQuery: string,\n    _params: Record<string, unknown> = {},\n  ): Promise<Array<Record<string, unknown>>> {\n    const operation = await this.session.executeStatement(sqlQuery);\n    try {\n      const result = await operation.fetchAll();\n      return result as Array<Record<string, unknown>>;\n    } finally {\n      // Always close the operation to avoid leaking server-side resources\n      await operation.close();\n    }\n  }\n\n  /**\n   * Close the Databricks connection\n   */\n  async close(): Promise<void> {\n    await this.session.close();\n    await this.client.close();\n  }\n}\n\n/**\n * Get the default Athena schema from environment\n */\nfunction getDefaultSchema(): string {\n  const orgSlug = process.env.ORG_SLUG ?? \"\";\n  const orgSlugDbFriendly = orgSlug.replace(/-/g, \"_\");\n  return `${orgSlugDbFriendly}__tss__default`;\n}\n\n/**\n * Build a Databricks data provider from the configuration\n *\n * @param config - Provider configuration\n * @returns Promise resolving to Databricks data provider\n * @throws {InvalidProviderConfigurationError} If @databricks/sql is not installed or config is invalid\n */\nexport async function buildDatabricksProvider(\n  config: ProviderConfiguration,\n): Promise<DatabricksProvider> {\n  // Dynamically import @databricks/sql\n  const { DBSQLClient } = await getDatabricksSQL();\n\n  const requiredFields = [\n    \"server_hostname\",\n    \"http_path\",\n    \"client_id\",\n    \"client_secret\",\n    \"catalog\",\n  ] as const;\n\n  for (const field of requiredFields) {\n    if (!config.fields[field]) {\n      throw new InvalidProviderConfigurationError(\n        `Missing field '${field}' in the provider '${config.name}' to connect to Databricks.`,\n      );\n    }\n  }\n\n  const serverHostname = config.fields[\"server_hostname\"]!;\n  const httpPath = config.fields[\"http_path\"]!;\n  const clientId = config.fields[\"client_id\"]!;\n  const clientSecret = config.fields[\"client_secret\"]!;\n  const catalog = config.fields[\"catalog\"]!;\n  const schema = config.fields[\"schema\"] ?? getDefaultSchema();\n\n  const client = new DBSQLClient();\n\n  await client.connect({\n    host: serverHostname,\n    path: httpPath,\n    authType: \"databricks-oauth\",\n    oauthClientId: clientId,\n    oauthClientSecret: clientSecret,\n  });\n\n  const session = await client.openSession({\n    initialCatalog: catalog,\n    initialSchema: schema,\n  });\n\n  return new DatabricksProvider(client, session);\n}\n\n"],"names":["getDatabricksSQL","InvalidProviderConfigurationError","DatabricksProvider","client","session","sqlQuery","_params","operation","getDefaultSchema","buildDatabricksProvider","config","DBSQLClient","requiredFields","field","serverHostname","httpPath","clientId","clientSecret","catalog","schema"],"mappings":"+jBA4BA,eAAeA,GAA8D,CAC3E,GAAI,CACF,OAAO,KAAM,QAAO,iBAAiB,CACvC,MAAQ,CACN,MAAM,IAAIC,EAAAA,kCACR,0HAAA,CAGJ,CACF,CAKO,MAAMC,CAAmB,CACtB,OACA,QAQR,YAAYC,EAAqBC,EAAwB,CACvD,KAAK,OAASD,EACd,KAAK,QAAUC,CACjB,CASA,MAAM,MACJC,EACAC,EAAmC,GACM,CACzC,MAAMC,EAAY,MAAM,KAAK,QAAQ,iBAAiBF,CAAQ,EAC9D,GAAI,CAEF,OADe,MAAME,EAAU,SAAA,CAEjC,QAAA,CAEE,MAAMA,EAAU,MAAA,CAClB,CACF,CAKA,MAAM,OAAuB,CAC3B,MAAM,KAAK,QAAQ,MAAA,EACnB,MAAM,KAAK,OAAO,MAAA,CACpB,CACF,CAKA,SAASC,GAA2B,CAGlC,MAAO,IAFS,QAAQ,IAAI,UAAY,IACN,QAAQ,KAAM,GAAG,CACxB,gBAC7B,CASA,eAAsBC,EACpBC,EAC6B,CAE7B,KAAM,CAAE,YAAAC,GAAgB,MAAMX,EAAA,EAExBY,EAAiB,CACrB,kBACA,YACA,YACA,gBACA,SAAA,EAGF,UAAWC,KAASD,EAClB,GAAI,CAACF,EAAO,OAAOG,CAAK,EACtB,MAAM,IAAIZ,EAAAA,kCACR,kBAAkBY,CAAK,sBAAsBH,EAAO,IAAI,6BAAA,EAK9D,MAAMI,EAAiBJ,EAAO,OAAO,gBAC/BK,EAAWL,EAAO,OAAO,UACzBM,EAAWN,EAAO,OAAO,UACzBO,EAAeP,EAAO,OAAO,cAC7BQ,EAAUR,EAAO,OAAO,QACxBS,EAAST,EAAO,OAAO,QAAaF,EAAA,EAEpCL,EAAS,IAAIQ,EAEnB,MAAMR,EAAO,QAAQ,CACnB,KAAMW,EACN,KAAMC,EACN,SAAU,mBACV,cAAeC,EACf,kBAAmBC,CAAA,CACpB,EAED,MAAMb,EAAU,MAAMD,EAAO,YAAY,CACvC,eAAgBe,EAChB,cAAeC,CAAA,CAChB,EAED,OAAO,IAAIjB,EAAmBC,EAAQC,CAAO,CAC/C"}
+{"version":3,"file":"DatabricksProvider.cjs","sources":["../../../src/server/providers/DatabricksProvider.ts"],"sourcesContent":["/**\n * Databricks Data Provider\n *\n * TypeScript equivalent of DatabricksProvider from\n * ts-lib-ui-kit-streamlit/tetrascience/data_app_providers/provider.py\n *\n * @remarks\n * This provider requires the `@databricks/sql` package to be installed.\n * It is an optional peer dependency - install it only if you need Databricks support:\n * ```bash\n * npm install @databricks/sql\n * # or\n * yarn add @databricks/sql\n * ```\n */\n\nimport { InvalidProviderConfigurationError } from \"./exceptions\";\n\nimport type { ProviderConfiguration } from \"./types\";\n\n// Type imports for @databricks/sql (these don't require the package at runtime)\ntype DBSQLClient = import(\"@databricks/sql\").DBSQLClient;\ntype IDBSQLSession = import(\"@databricks/sql/dist/contracts/IDBSQLSession\").default;\n\n/**\n * Dynamically import @databricks/sql\n * @throws {InvalidProviderConfigurationError} If @databricks/sql is not installed\n */\nasync function getDatabricksSQL(): Promise<typeof import(\"@databricks/sql\")> {\n  try {\n    return await import(\"@databricks/sql\");\n  } catch {\n    throw new InvalidProviderConfigurationError(\n      \"The '@databricks/sql' package is required to use the Databricks provider. \" +\n        \"Please install it: npm install @databricks/sql\",\n    );\n  }\n}\n\n/**\n * Databricks data provider\n */\nexport class DatabricksProvider {\n  private client: DBSQLClient;\n  private session: IDBSQLSession;\n\n  /**\n   * Initialize the Databricks data provider\n   *\n   * @param client - Databricks SQL client\n   * @param session - Databricks SQL session\n   */\n  constructor(client: DBSQLClient, session: IDBSQLSession) {\n    this.client = client;\n    this.session = session;\n  }\n\n  /**\n   * Query the Databricks database\n   *\n   * @param sqlQuery - SQL query to execute\n   * @param _params - Parameters to pass to the query (currently not used)\n   * @returns Promise resolving to array of row objects\n   */\n  async query(\n    sqlQuery: string,\n    _params: Record<string, unknown> = {},\n  ): Promise<Array<Record<string, unknown>>> {\n    const operation = await this.session.executeStatement(sqlQuery);\n    try {\n      const result = await operation.fetchAll();\n      return result as Array<Record<string, unknown>>;\n    } finally {\n      // Always close the operation to avoid leaking server-side resources\n      await operation.close();\n    }\n  }\n\n  /**\n   * Close the Databricks connection\n   */\n  async close(): Promise<void> {\n    await this.session.close();\n    await this.client.close();\n  }\n}\n\n/**\n * Get the default Athena schema from environment\n */\nfunction getDefaultSchema(): string {\n  const orgSlug = process.env.ORG_SLUG ?? \"\";\n  const orgSlugDbFriendly = orgSlug.replace(/-/g, \"_\");\n  return `${orgSlugDbFriendly}__tss__default`;\n}\n\n/**\n * Build a Databricks data provider from the configuration\n *\n * @param config - Provider configuration\n * @returns Promise resolving to Databricks data provider\n * @throws {InvalidProviderConfigurationError} If @databricks/sql is not installed or config is invalid\n */\nexport async function buildDatabricksProvider(\n  config: ProviderConfiguration,\n): Promise<DatabricksProvider> {\n  // Dynamically import @databricks/sql\n  const { DBSQLClient } = await getDatabricksSQL();\n\n  const requiredFields = [\n    \"server_hostname\",\n    \"http_path\",\n    \"client_id\",\n    \"client_secret\",\n    \"catalog\",\n  ] as const;\n\n  for (const field of requiredFields) {\n    if (!config.fields[field]) {\n      throw new InvalidProviderConfigurationError(\n        `Missing field '${field}' in the provider '${config.name}' to connect to Databricks.`,\n      );\n    }\n  }\n\n  const serverHostname = config.fields[\"server_hostname\"]!;\n  const httpPath = config.fields[\"http_path\"]!;\n  const clientId = config.fields[\"client_id\"]!;\n  const clientSecret = config.fields[\"client_secret\"]!;\n  const catalog = config.fields[\"catalog\"]!;\n  const schema = config.fields[\"schema\"] ?? getDefaultSchema();\n\n  const client = new DBSQLClient();\n\n  await client.connect({\n    host: serverHostname,\n    path: httpPath,\n    authType: \"databricks-oauth\",\n    oauthClientId: clientId,\n    oauthClientSecret: clientSecret,\n  });\n\n  const session = await client.openSession({\n    initialCatalog: catalog,\n    initialSchema: schema,\n  });\n\n  return new DatabricksProvider(client, session);\n}\n\n"],"names":["getDatabricksSQL","_interopNamespaceDefault","InvalidProviderConfigurationError","DatabricksProvider","client","session","sqlQuery","_params","operation","getDefaultSchema","buildDatabricksProvider","config","DBSQLClient","requiredFields","field","serverHostname","httpPath","clientId","clientSecret","catalog","schema"],"mappings":"iYA4BA,eAAeA,GAA8D,CAC3E,GAAI,CACF,OAAO,MAAM,QAAA,QAAA,EAAA,KAAA,IAAAC,EAAA,QAAO,iBAAiB,CAAA,CAAA,CACvC,MAAQ,CACN,MAAM,IAAIC,EAAAA,kCACR,0HAAA,CAGJ,CACF,CAKO,MAAMC,CAAmB,CACtB,OACA,QAQR,YAAYC,EAAqBC,EAAwB,CACvD,KAAK,OAASD,EACd,KAAK,QAAUC,CACjB,CASA,MAAM,MACJC,EACAC,EAAmC,GACM,CACzC,MAAMC,EAAY,MAAM,KAAK,QAAQ,iBAAiBF,CAAQ,EAC9D,GAAI,CAEF,OADe,MAAME,EAAU,SAAA,CAEjC,QAAA,CAEE,MAAMA,EAAU,MAAA,CAClB,CACF,CAKA,MAAM,OAAuB,CAC3B,MAAM,KAAK,QAAQ,MAAA,EACnB,MAAM,KAAK,OAAO,MAAA,CACpB,CACF,CAKA,SAASC,GAA2B,CAGlC,MAAO,IAFS,QAAQ,IAAI,UAAY,IACN,QAAQ,KAAM,GAAG,CACxB,gBAC7B,CASA,eAAsBC,EACpBC,EAC6B,CAE7B,KAAM,CAAE,YAAAC,GAAgB,MAAMZ,EAAA,EAExBa,EAAiB,CACrB,kBACA,YACA,YACA,gBACA,SAAA,EAGF,UAAWC,KAASD,EAClB,GAAI,CAACF,EAAO,OAAOG,CAAK,EACtB,MAAM,IAAIZ,EAAAA,kCACR,kBAAkBY,CAAK,sBAAsBH,EAAO,IAAI,6BAAA,EAK9D,MAAMI,EAAiBJ,EAAO,OAAO,gBAC/BK,EAAWL,EAAO,OAAO,UACzBM,EAAWN,EAAO,OAAO,UACzBO,EAAeP,EAAO,OAAO,cAC7BQ,EAAUR,EAAO,OAAO,QACxBS,EAAST,EAAO,OAAO,QAAaF,EAAA,EAEpCL,EAAS,IAAIQ,EAEnB,MAAMR,EAAO,QAAQ,CACnB,KAAMW,EACN,KAAMC,EACN,SAAU,mBACV,cAAeC,EACf,kBAAmBC,CAAA,CACpB,EAED,MAAMb,EAAU,MAAMD,EAAO,YAAY,CACvC,eAAgBe,EAChB,cAAeC,CAAA,CAChB,EAED,OAAO,IAAIjB,EAAmBC,EAAQC,CAAO,CAC/C"}