@tigeropenapi/tigeropen 0.5.4 → 0.5.7

package/dist/esm/auth/oauth2/loopback-receiver.js

@@ -0,0 +1,178 @@
+/**
+ * Single-use OAuth 2.0 loopback redirect receiver (RFC 8252).
+ *
+ * The receiver binds only to `127.0.0.1` to prevent authorization code exposure on the
+ * local network. Dynamic registration uses a system-assigned port as permitted by
+ * RFC 8252 §7.3; manual registration requires a port matching its redirect URI. The IP
+ * literal avoids the name-resolution risks described by RFC 8252 §8.3.
+ */
+import * as http from 'http';
+import { OAuth2Category, OAuth2Error } from './errors.js';
+export const CALLBACK_PATH = '/callback';
+/** Inline SVG avoids external resources and font-dependent glyph rendering. */
+function icon(color, path) {
+    return `<svg width='64' height='64' viewBox='0 0 64 64' aria-hidden='true'>`
+        + `<circle cx='32' cy='32' r='29' fill='none' stroke='${color}' stroke-width='4'/>`
+        + `<path d='${path}' fill='none' stroke='${color}' stroke-width='5'`
+        + ` stroke-linecap='round' stroke-linejoin='round'/></svg>`;
+}
+/** Green tick. */
+const ICON_SUCCESS = icon('#22c55e', 'M19 33l9.5 9.5L45 22');
+/** Grey dash for the normal `access_denied` outcome. */
+const ICON_CANCELLED = icon('#9ca3af', 'M20 32h24');
+/** Red cross, for outcomes that really are failures. */
+const ICON_FAILED = icon('#ef4444', 'M22 22l20 20M42 22L22 42');
+/** English callback text, kept consistent with the Java and Python SDKs. */
+const TEXT = {
+    title: 'Tiger OpenAPI',
+    success: ['Authorization successful', 'You can close this page and return to the application.'],
+    cancelled: ['Authorization cancelled', 'You declined this authorization. You can close this page.'],
+    failed: ['Authorization failed', 'Please return to the application and try again.'],
+};
+/** Classify `access_denied` as cancellation and other errors as failures. */
+function outcomeOf(params) {
+    if ('code' in params)
+        return 'success';
+    if (params['error'] === 'access_denied')
+        return 'cancelled';
+    return 'failed';
+}
+/**
+ * Render a redacted callback outcome page.
+ *
+ * Callback parameters, including authorization codes and errors, are omitted because
+ * browser history, screenshots, and extensions may expose page content. Full parameters
+ * remain available to internal callback processing.
+ */
+function renderPage(params) {
+    const outcome = outcomeOf(params);
+    const svg = { success: ICON_SUCCESS, cancelled: ICON_CANCELLED, failed: ICON_FAILED }[outcome];
+    const [heading, detail] = TEXT[outcome];
+    return `<!DOCTYPE html><html><head><meta charset='utf-8'>`
+        + `<meta name='viewport' content='width=device-width,initial-scale=1'>`
+        + `<title>${TEXT['title']}</title></head>`
+        + `<body style="margin:0;min-height:100vh;display:flex;align-items:center;`
+        + `justify-content:center;`
+        + `font-family:-apple-system,BlinkMacSystemFont,'PingFang SC','Microsoft YaHei',`
+        + `sans-serif;background:#fafafa;color:#1f2328">`
+        + `<main style='text-align:center;padding:48px 24px;max-width:420px'>`
+        + `${svg}`
+        + `<h2 style='margin:24px 0 8px;font-size:20px;font-weight:600'>${heading}</h2>`
+        + `<p style='margin:0;font-size:14px;line-height:1.6;color:#6b7280'>${detail}</p>`
+        + `</main></body></html>`;
+}
+/** Single-shot local callback server. */
+export class LoopbackReceiver {
+    constructor(server) {
+        this.port = 0;
+        this.params = {};
+        this.fired = false;
+        this.waiters = [];
+        this.server = server;
+    }
+    /**
+     * Bind the receiver. It must be listening before the authorization request is issued.
+     *
+     * @param port port to bind; 0 lets the system assign a free one
+     */
+    static async start(port = 0) {
+        const server = http.createServer();
+        const receiver = new LoopbackReceiver(server);
+        server.on('request', (req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== CALLBACK_PATH) {
+                res.writeHead(404, { 'Content-Length': '0' });
+                res.end();
+                return;
+            }
+            const snapshot = receiver.record(url.searchParams);
+            const body = Buffer.from(renderPage(snapshot), 'utf-8');
+            res.writeHead(200, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Content-Length': String(body.length),
+            });
+            res.end(body);
+            receiver.release(snapshot);
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (e) => {
+                // A fixed port can conflict with another listener; system-assigned ports do not.
+                const hint = port === 0 ? '' : ` (port ${port} is in use; free it or set another callbackPort`
+                    + ' matching the redirect_uri registered for your client)';
+                reject(new OAuth2Error(OAuth2Category.CallbackFailed, `cannot bind loopback callback server on 127.0.0.1:${port}${hint}`, e));
+            };
+            server.once('error', onError);
+            server.listen(port, '127.0.0.1', () => {
+                server.removeListener('error', onError);
+                const address = server.address();
+                receiver.port = typeof address === 'object' && address ? address.port : port;
+                resolve();
+            });
+        });
+        return receiver;
+    }
+    get redirectUri() {
+        return `http://127.0.0.1:${this.port}${CALLBACK_PATH}`;
+    }
+    get boundPort() {
+        return this.port;
+    }
+    /**
+     * Wait for the browser callback.
+     *
+     * @returns the query parameters carried by the callback
+     * @throws OAuth2Error on timeout
+     */
+    waitForCallback(timeoutSeconds) {
+        if (this.fired) {
+            return Promise.resolve({ ...this.params });
+        }
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.waiters = this.waiters.filter((w) => w !== onParams);
+                reject(new OAuth2Error(OAuth2Category.CallbackFailed, 'waiting for authorization callback timed out'));
+            }, timeoutSeconds * 1000);
+            const onParams = (params) => {
+                clearTimeout(timer);
+                resolve(params);
+            };
+            this.waiters.push(onParams);
+        });
+    }
+    close() {
+        try {
+            // The browser keeps its connection alive after the redirect, and close() alone
+            // waits for it. That would hold the port -- which matters for the fixed port a
+            // manually registered client has to reuse on the next authorization.
+            this.server.closeAllConnections?.();
+        }
+        catch {
+            // Older runtimes have no such method; the idle timeout releases the port instead.
+        }
+        try {
+            this.server.close();
+        }
+        catch {
+            // Already closed; nothing to release.
+        }
+    }
+    /** Record the callback params (first one wins) and return a snapshot of them. */
+    record(search) {
+        if (!this.fired) {
+            for (const [key, value] of search.entries()) {
+                this.params[key] = value;
+            }
+        }
+        return { ...this.params };
+    }
+    release(snapshot) {
+        if (this.fired)
+            return;
+        this.fired = true;
+        const waiters = this.waiters;
+        this.waiters = [];
+        for (const waiter of waiters) {
+            waiter(snapshot);
+        }
+    }
+}

package/dist/esm/auth/oauth2/metadata.js

@@ -0,0 +1,30 @@
+/**
+ * Authorization server metadata (RFC 8414).
+ *
+ * Endpoints always come from metadata, never hardcoded, so switching environments only
+ * means changing the issuer.
+ */
+export class OAuth2Metadata {
+    constructor(init = {}) {
+        this.issuer = init.issuer;
+        this.authorizationEndpoint = init.authorizationEndpoint;
+        this.tokenEndpoint = init.tokenEndpoint;
+        this.registrationEndpoint = init.registrationEndpoint;
+        this.deviceAuthorizationEndpoint = init.deviceAuthorizationEndpoint;
+        this.revocationEndpoint = init.revocationEndpoint;
+        this.scopesSupported = init.scopesSupported ?? [];
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2Metadata({
+            issuer: data.issuer,
+            authorizationEndpoint: data.authorization_endpoint,
+            tokenEndpoint: data.token_endpoint,
+            registrationEndpoint: data.registration_endpoint,
+            deviceAuthorizationEndpoint: data.device_authorization_endpoint,
+            revocationEndpoint: data.revocation_endpoint,
+            scopesSupported: data.scopes_supported ?? [],
+        });
+    }
+}

package/dist/esm/auth/oauth2/oauth2-authentication.js

@@ -0,0 +1,70 @@
+/** Request authentication backed by an OAuth 2.0 session manager. */
+import { AuthenticationAttempt, AuthenticationType, RetryDecision, } from '../authentication.js';
+import { OAuth2Error } from './errors.js';
+export const BEARER_PREFIX = 'Bearer ';
+const UNAUTHORIZED_STATUS = 401;
+/** Authenticate with an OAuth2 access token. */
+export class OAuth2Authentication {
+    constructor(sessionManager) {
+        if (!sessionManager) {
+            throw new Error('OAuth2SessionManager is required');
+        }
+        this.sessions = sessionManager;
+    }
+    get authType() {
+        return AuthenticationType.OAuth2;
+    }
+    get sessionManager() {
+        return this.sessions;
+    }
+    /**
+     * Attach a Bearer token to the request context.
+     *
+     * Near-expiry refreshes use the session manager's single-flight synchronization.
+     * Missing authorization rejects with `ReauthorizationRequired` without starting an
+     * implicit browser flow.
+     */
+    async apply(context) {
+        const accessToken = await this.sessions.getAccessToken();
+        context.authorizationHeader = BEARER_PREFIX + accessToken;
+        return new AuthenticationAttempt(AuthenticationType.OAuth2, accessToken);
+    }
+    /**
+     * Process HTTP 401 responses.
+     *
+     * HTTP 403 indicates insufficient permission and cannot be resolved by refreshing a
+     * token with the same scope. Server errors and timeouts are not credential failures.
+     */
+    async onUnauthorized(attempt, statusCode) {
+        if (statusCode !== UNAUTHORIZED_STATUS) {
+            return RetryDecision.noRetry();
+        }
+        const credential = attempt?.credential;
+        try {
+            // Reuse a token already rotated elsewhere without another token request.
+            const refreshed = await this.sessions.refreshAfterUnauthorized(credential);
+            if (!refreshed || !refreshed.accessToken) {
+                return RetryDecision.noRetry();
+            }
+            if (credential !== undefined && refreshed.accessToken === credential) {
+                // Credential unchanged, so a retry would get the same 401.
+                return RetryDecision.noRetry();
+            }
+            return RetryDecision.retry(BEARER_PREFIX + refreshed.accessToken);
+        }
+        catch (e) {
+            if (!(e instanceof OAuth2Error)) {
+                // Not an OAuth2Error, so most likely a defect in the refresh path.
+                console.warn('[TigerOpen] oauth2 refresh after 401 error', e);
+            }
+            return RetryDecision.noRetry();
+        }
+    }
+    /**
+     * The session is owned by the application and may still be in use, so it is not
+     * closed here.
+     */
+    close() {
+        // Nothing to release.
+    }
+}