@uniformdev/mesh-sdk 20.72.3-alpha.2 → 20.72.3-alpha.5

package/dist/server/index.mjs

@@ -0,0 +1,354 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
+// src/server/clients/DelegationTokenClient.ts
+import { ApiClient } from "@uniformdev/context/api";
+var DelegationTokenError = class extends Error {
+  constructor(status, kind, publicMessage) {
+    super(publicMessage);
+    this.name = "DelegationTokenError";
+    this.status = status;
+    this.kind = kind;
+  }
+};
+var PUBLIC_MESSAGES = {
+  bad_request: "Token exchange request was rejected as invalid",
+  unauthenticated: "Token exchange authentication failed",
+  forbidden: "Token exchange forbidden by server",
+  not_found: "Token exchange target was not found",
+  rate_limited: "Token exchange rate limit exceeded",
+  server_error: "Token exchange server error",
+  unknown: "Token exchange failed"
+};
+function classifyDelegationTokenStatus(status) {
+  if (status === 400) {
+    return "bad_request";
+  }
+  if (status === 401) {
+    return "unauthenticated";
+  }
+  if (status === 403) {
+    return "forbidden";
+  }
+  if (status === 404) {
+    return "not_found";
+  }
+  if (status === 429) {
+    return "rate_limited";
+  }
+  if (status >= 500) {
+    return "server_error";
+  }
+  return "unknown";
+}
+function buildDelegationTokenError(status) {
+  const kind = classifyDelegationTokenStatus(status);
+  return new DelegationTokenError(status, kind, PUBLIC_MESSAGES[kind]);
+}
+var _integrationId, _integrationSecret, _explicitFetch, _DelegationTokenClient_instances, post_fn;
+var DelegationTokenClient = class extends ApiClient {
+  constructor(options) {
+    super({ apiHost: options.apiHost, apiKey: "avoid_constructor_check", fetch: options.fetch });
+    __privateAdd(this, _DelegationTokenClient_instances);
+    __privateAdd(this, _integrationId);
+    __privateAdd(this, _integrationSecret);
+    // Preserve the caller-supplied fetch so #post can fall back to the global fetch at
+    // call time when none was provided. ApiClient captures the global at construction,
+    // which breaks test-time global stubbing (vi.stubGlobal).
+    __privateAdd(this, _explicitFetch);
+    __privateSet(this, _integrationId, options.integrationId);
+    __privateSet(this, _integrationSecret, options.integrationSecret);
+    __privateSet(this, _explicitFetch, options.fetch);
+  }
+  /**
+   * Exchanges a short-lived session token for a delegation token and refresh token.
+   * The session token is obtained by the integration's frontend via `sdk.getSessionToken()`.
+   *
+   * @deprecated This beta identity delegation API may change with breaking changes.
+   */
+  async exchangeSessionToken(sessionToken) {
+    return __privateMethod(this, _DelegationTokenClient_instances, post_fn).call(this, {
+      grantType: "delegation_token",
+      sessionToken,
+      integrationId: __privateGet(this, _integrationId),
+      integrationSecret: __privateGet(this, _integrationSecret)
+    });
+  }
+  /**
+   * Exchanges a refresh token for a new delegation token and a new refresh token.
+   *
+   * Replay posture: refresh tokens are bearer credentials that are valid until
+   * their server-side expiry. They are NOT single-use — a captured refresh token can be
+   * replayed by an attacker that also has the integration secret until it expires.
+   * Single-use enforcement (refresh-token storage, family/jti tracking, replay revocation)
+   * is tracked in `UNI-9279`.
+   *
+   * @deprecated This beta identity delegation API may change with breaking changes.
+   */
+  async refreshDelegationToken(refreshToken) {
+    return __privateMethod(this, _DelegationTokenClient_instances, post_fn).call(this, {
+      grantType: "refresh_token",
+      refreshToken,
+      integrationId: __privateGet(this, _integrationId),
+      integrationSecret: __privateGet(this, _integrationSecret)
+    });
+  }
+};
+_integrationId = new WeakMap();
+_integrationSecret = new WeakMap();
+_explicitFetch = new WeakMap();
+_DelegationTokenClient_instances = new WeakSet();
+post_fn = async function(body) {
+  var _a;
+  const url = this.createUrl("/api/v1/token");
+  const fetchFn = (_a = __privateGet(this, _explicitFetch)) != null ? _a : fetch;
+  const response = await this.options.limitPolicy(
+    () => fetchFn(url.toString(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    })
+  );
+  if (!response.ok) {
+    await response.text().catch(() => "");
+    throw buildDelegationTokenError(response.status);
+  }
+  return await response.json();
+};
+
+// src/server/cookies/cookieConstants.ts
+var DELEGATION_COOKIE_NAME = "__Host-uniform_mesh_delegation";
+var SESSION_TTL_SECONDS = 8 * 60 * 60;
+
+// src/server/cookies/parseCookies.ts
+import { parse } from "cookie";
+function parseCookies(cookieHeader) {
+  if (cookieHeader === void 0 || cookieHeader.length === 0) {
+    return {};
+  }
+  const parsed = parse(cookieHeader);
+  const result = {};
+  for (const key of Object.keys(parsed)) {
+    const value = parsed[key];
+    if (typeof value === "string") {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+// src/server/cookies/serializeSessionCookie.ts
+import { serialize } from "cookie";
+var DEFAULT_PATH = "/";
+function serializeSessionCookie(name, value, opts) {
+  var _a, _b, _c;
+  const path = (_a = opts == null ? void 0 : opts.path) != null ? _a : DEFAULT_PATH;
+  if (name.startsWith("__Host-") && path !== "/") {
+    throw new Error("Cookies with the __Host- prefix require Path=/");
+  }
+  const maxAge = (_b = opts == null ? void 0 : opts.maxAge) != null ? _b : SESSION_TTL_SECONDS;
+  const partitioned = (_c = opts == null ? void 0 : opts.partitioned) != null ? _c : true;
+  return serialize(name, value, {
+    httpOnly: true,
+    secure: true,
+    sameSite: "none",
+    path,
+    maxAge,
+    partitioned
+  });
+}
+
+// src/delegation/csrfConstants.ts
+var CSRF_HEADER_VALUE = "1";
+
+// src/server/util/parseOrigin.ts
+function parseOrigin(referer) {
+  if (referer === void 0 || referer.length === 0) {
+    return void 0;
+  }
+  try {
+    const url = new URL(referer);
+    if (url.origin === "null") {
+      return void 0;
+    }
+    return url.origin;
+  } catch (e) {
+    return void 0;
+  }
+}
+
+// src/server/csrf/verifyCsrf.ts
+function verifyCsrf(input, config) {
+  var _a, _b, _c, _d;
+  const headerValue = (_a = config.headerValue) != null ? _a : CSRF_HEADER_VALUE;
+  const requireSecFetchSite = (_b = config.requireSecFetchSite) != null ? _b : false;
+  const skipOriginValidation = (_c = config.skipOriginValidation) != null ? _c : false;
+  const normalizedOrigins = config.allowedOrigins.map((o) => o.replace(/\/+$/, ""));
+  const refererOrigin = parseOrigin(input.referer);
+  const effectiveOrigin = (_d = input.origin) != null ? _d : refererOrigin;
+  const provedSameOrigin = input.secFetchSite === "same-origin";
+  if (!skipOriginValidation) {
+    if (effectiveOrigin === void 0 && !provedSameOrigin) {
+      return { ok: false, reason: "origin_missing" };
+    }
+    if (effectiveOrigin !== void 0 && !normalizedOrigins.includes(effectiveOrigin)) {
+      return { ok: false, reason: "origin_mismatch" };
+    }
+  }
+  if (input.customHeader !== headerValue) {
+    return { ok: false, reason: "header_missing" };
+  }
+  if (requireSecFetchSite && input.secFetchSite !== "same-origin") {
+    return { ok: false, reason: "sec_fetch_site_mismatch" };
+  }
+  return { ok: true };
+}
+
+// src/server/session/needsRefresh.ts
+var DEFAULT_BUFFER_MS = 6e4;
+function needsRefresh(session, bufferMs) {
+  const buffer = bufferMs != null ? bufferMs : DEFAULT_BUFFER_MS;
+  return session.expiresAt - Date.now() < buffer;
+}
+
+// src/server/session/sealDelegationSession.ts
+import { EncryptJWT } from "jose";
+
+// src/server/util/deriveKey.ts
+var MESH_SESSION_SECRET_MIN_BYTES = 32;
+var HKDF_INFO = new TextEncoder().encode("mesh-delegation-session-v1");
+async function deriveKey(secret) {
+  const ikm = new TextEncoder().encode(secret);
+  if (ikm.byteLength < MESH_SESSION_SECRET_MIN_BYTES) {
+    throw new Error(
+      `MESH_SESSION_SECRET must be at least ${MESH_SESSION_SECRET_MIN_BYTES} UTF-8 bytes (got ${ikm.byteLength}).`
+    );
+  }
+  const baseKey = await crypto.subtle.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: HKDF_INFO
+    },
+    baseKey,
+    256
+  );
+  return new Uint8Array(bits);
+}
+
+// src/server/session/sealDelegationSession.ts
+async function sealDelegationSession(session, secret) {
+  const key = await deriveKey(secret);
+  return new EncryptJWT(session).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${SESSION_TTL_SECONDS}s`).encrypt(key);
+}
+
+// src/server/session/unsealDelegationSession.ts
+import { jwtDecrypt } from "jose";
+async function unsealDelegationSession(jwe, secret) {
+  try {
+    const key = await deriveKey(secret);
+    const { payload } = await jwtDecrypt(jwe, key);
+    const { accessToken, refreshToken, expiresAt } = payload;
+    if (typeof accessToken !== "string" || typeof expiresAt !== "number") {
+      console.error("Invalid delegation session payload", {
+        hasAccessToken: typeof accessToken === "string" && accessToken.length > 0,
+        accessTokenType: typeof accessToken,
+        hasRefreshToken: typeof refreshToken === "string" && refreshToken.length > 0,
+        refreshTokenType: typeof refreshToken,
+        expiresAtType: typeof expiresAt
+      });
+      return null;
+    }
+    return {
+      accessToken,
+      refreshToken: typeof refreshToken === "string" ? refreshToken : void 0,
+      expiresAt
+    };
+  } catch (e) {
+    console.error("Error decrypting delegation session cookie");
+    return null;
+  }
+}
+
+// src/server/verify/constants.ts
+var DEFAULT_UNIFORM_ORIGIN = "https://uniform.app";
+var uniformDelegationIssuer = "uniform:delegation";
+var uniformApiAudience = "uniform:api";
+function getJwksUrl(origin = DEFAULT_UNIFORM_ORIGIN) {
+  const normalizedOrigin = origin.replace(/\/$/, "");
+  return `${normalizedOrigin}/delegation/.well-known/jwks.json`;
+}
+
+// src/server/verify/verifyDelegationAccessToken.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+var DEFAULT_CLOCK_TOLERANCE_SECONDS = 2;
+var jwksByUrl = /* @__PURE__ */ new Map();
+function getRemoteJwkSet(jwksUrl) {
+  const key = String(jwksUrl);
+  let jwks = jwksByUrl.get(key);
+  if (!jwks) {
+    jwks = createRemoteJWKSet(new URL(key));
+    jwksByUrl.set(key, jwks);
+  }
+  return jwks;
+}
+async function verifyDelegationAccessToken(token, options = {}) {
+  var _a, _b;
+  const jwksUrl = (_a = options.jwksUrl) != null ? _a : getJwksUrl();
+  const jwks = getRemoteJwkSet(jwksUrl);
+  const clockTolerance = (_b = options.clockToleranceSeconds) != null ? _b : DEFAULT_CLOCK_TOLERANCE_SECONDS;
+  const { payload } = await jwtVerify(token, jwks, {
+    issuer: uniformDelegationIssuer,
+    audience: uniformApiAudience,
+    clockTolerance
+  });
+  const { sub, teamId, act, iat, exp } = payload;
+  if (typeof sub !== "string" || !sub) {
+    throw new Error("Missing required delegation token claim: sub");
+  }
+  if (typeof teamId !== "string" || !teamId) {
+    throw new Error("Missing required delegation token claim: teamId");
+  }
+  const actRecord = act;
+  const actSub = actRecord == null ? void 0 : actRecord.sub;
+  const actIntegrationType = actRecord == null ? void 0 : actRecord.integration_type;
+  if (!actRecord || typeof actSub !== "string" || !actSub || typeof actIntegrationType !== "string" || !actIntegrationType) {
+    throw new Error("Missing required delegation token claim: act");
+  }
+  if (typeof iat !== "number" || typeof exp !== "number") {
+    throw new Error("Missing required delegation token claim: iat/exp");
+  }
+  return {
+    sub,
+    teamId,
+    act: { sub: actSub, integration_type: actIntegrationType },
+    iat,
+    exp
+  };
+}
+export {
+  DELEGATION_COOKIE_NAME,
+  DelegationTokenClient,
+  DelegationTokenError,
+  SESSION_TTL_SECONDS,
+  buildDelegationTokenError,
+  classifyDelegationTokenStatus,
+  getJwksUrl,
+  needsRefresh,
+  parseCookies,
+  sealDelegationSession,
+  serializeSessionCookie,
+  uniformApiAudience,
+  uniformDelegationIssuer,
+  unsealDelegationSession,
+  verifyCsrf,
+  verifyDelegationAccessToken
+};

package/package.json

@@ -1,17 +1,35 @@
 {
   "name": "@uniformdev/mesh-sdk",
-  "version": "20.72.3-alpha.2+36e92d30ab",
+  "version": "20.72.3-alpha.5+87cd60cb2e",
   "description": "Uniform Mesh Framework SDK",
   "license": "SEE LICENSE IN LICENSE.txt",
+  "engines": {
+    "node": ">=18"
+  },
   "main": "./dist/index.js",
   "module": "./dist/index.esm.js",
   "exports": {
-    "import": {
-      "types": "./dist/index.d.mts",
-      "node": "./dist/index.mjs",
-      "default": "./dist/index.esm.js"
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "node": "./dist/index.mjs",
+        "default": "./dist/index.esm.js"
+      },
+      "require": "./dist/index.js"
     },
-    "require": "./dist/index.js"
+    "./server": {
+      "import": {
+        "types": "./dist/server/index.d.mts",
+        "default": "./dist/server/index.mjs"
+      }
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "server": [
+        "./dist/server/index.d.mts"
+      ]
+    }
   },
   "types": "./dist/index.d.ts",
   "sideEffects": false,
@@ -22,6 +40,7 @@
     "dev": "pnpm update-openapi && pnpm build:setversion && tsup --watch",
     "clean": "rimraf dist",
     "format": "prettier --write \"src/**/*.{js,ts,tsx}\"",
+    "test": "vitest run",
     "update-openapi": "tsx ./scripts/update-openapi.cts",
     "apidocs-extract": "api-extractor run --local"
   },
@@ -32,16 +51,19 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniformdev/assets": "20.72.3-alpha.2+36e92d30ab",
-    "@uniformdev/canvas": "20.72.3-alpha.2+36e92d30ab",
-    "@uniformdev/context": "20.72.3-alpha.2+36e92d30ab",
-    "@uniformdev/project-map": "20.72.3-alpha.2+36e92d30ab",
+    "@uniformdev/assets": "20.72.3-alpha.5+87cd60cb2e",
+    "@uniformdev/canvas": "20.72.3-alpha.5+87cd60cb2e",
+    "@uniformdev/context": "20.72.3-alpha.5+87cd60cb2e",
+    "@uniformdev/project-map": "20.72.3-alpha.5+87cd60cb2e",
+    "cookie": "^1.1.1",
     "imagesloaded": "^5.0.0",
+    "jose": "^6.2.2",
     "mitt": "^3.0.1"
   },
   "devDependencies": {
     "@types/imagesloaded": "^4.1.2",
-    "openai": "6.44.0"
+    "openai": "6.44.0",
+    "tsup": "8.5.1"
   },
-  "gitHead": "36e92d30ab1b97fc68cf16fc22c6f7865ac8ba97"
+  "gitHead": "87cd60cb2eae75aac26c8c51566e66281c3921f9"
 }