@tigeropenapi/tigeropen 0.5.5 → 0.5.7

package/dist/cjs/auth/oauth2/metadata.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Authorization server metadata (RFC 8414).
+ *
+ * Endpoints always come from metadata, never hardcoded, so switching environments only
+ * means changing the issuer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Metadata = void 0;
+class OAuth2Metadata {
+    constructor(init = {}) {
+        this.issuer = init.issuer;
+        this.authorizationEndpoint = init.authorizationEndpoint;
+        this.tokenEndpoint = init.tokenEndpoint;
+        this.registrationEndpoint = init.registrationEndpoint;
+        this.deviceAuthorizationEndpoint = init.deviceAuthorizationEndpoint;
+        this.revocationEndpoint = init.revocationEndpoint;
+        this.scopesSupported = init.scopesSupported ?? [];
+    }
+    static fromJSON(data) {
+        if (!data)
+            return null;
+        return new OAuth2Metadata({
+            issuer: data.issuer,
+            authorizationEndpoint: data.authorization_endpoint,
+            tokenEndpoint: data.token_endpoint,
+            registrationEndpoint: data.registration_endpoint,
+            deviceAuthorizationEndpoint: data.device_authorization_endpoint,
+            revocationEndpoint: data.revocation_endpoint,
+            scopesSupported: data.scopes_supported ?? [],
+        });
+    }
+}
+exports.OAuth2Metadata = OAuth2Metadata;

package/dist/cjs/auth/oauth2/oauth2-authentication.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Authentication = exports.BEARER_PREFIX = void 0;
+/** Request authentication backed by an OAuth 2.0 session manager. */
+const authentication_1 = require("../authentication");
+const errors_1 = require("./errors");
+exports.BEARER_PREFIX = 'Bearer ';
+const UNAUTHORIZED_STATUS = 401;
+/** Authenticate with an OAuth2 access token. */
+class OAuth2Authentication {
+    constructor(sessionManager) {
+        if (!sessionManager) {
+            throw new Error('OAuth2SessionManager is required');
+        }
+        this.sessions = sessionManager;
+    }
+    get authType() {
+        return authentication_1.AuthenticationType.OAuth2;
+    }
+    get sessionManager() {
+        return this.sessions;
+    }
+    /**
+     * Attach a Bearer token to the request context.
+     *
+     * Near-expiry refreshes use the session manager's single-flight synchronization.
+     * Missing authorization rejects with `ReauthorizationRequired` without starting an
+     * implicit browser flow.
+     */
+    async apply(context) {
+        const accessToken = await this.sessions.getAccessToken();
+        context.authorizationHeader = exports.BEARER_PREFIX + accessToken;
+        return new authentication_1.AuthenticationAttempt(authentication_1.AuthenticationType.OAuth2, accessToken);
+    }
+    /**
+     * Process HTTP 401 responses.
+     *
+     * HTTP 403 indicates insufficient permission and cannot be resolved by refreshing a
+     * token with the same scope. Server errors and timeouts are not credential failures.
+     */
+    async onUnauthorized(attempt, statusCode) {
+        if (statusCode !== UNAUTHORIZED_STATUS) {
+            return authentication_1.RetryDecision.noRetry();
+        }
+        const credential = attempt?.credential;
+        try {
+            // Reuse a token already rotated elsewhere without another token request.
+            const refreshed = await this.sessions.refreshAfterUnauthorized(credential);
+            if (!refreshed || !refreshed.accessToken) {
+                return authentication_1.RetryDecision.noRetry();
+            }
+            if (credential !== undefined && refreshed.accessToken === credential) {
+                // Credential unchanged, so a retry would get the same 401.
+                return authentication_1.RetryDecision.noRetry();
+            }
+            return authentication_1.RetryDecision.retry(exports.BEARER_PREFIX + refreshed.accessToken);
+        }
+        catch (e) {
+            if (!(e instanceof errors_1.OAuth2Error)) {
+                // Not an OAuth2Error, so most likely a defect in the refresh path.
+                console.warn('[TigerOpen] oauth2 refresh after 401 error', e);
+            }
+            return authentication_1.RetryDecision.noRetry();
+        }
+    }
+    /**
+     * The session is owned by the application and may still be in use, so it is not
+     * closed here.
+     */
+    close() {
+        // Nothing to release.
+    }
+}
+exports.OAuth2Authentication = OAuth2Authentication;