@unito/integration-cli 0.63.2 → 0.63.3

package/dist/src/services/oauth2.js

@@ -110,6 +110,8 @@ class OAuth2Service {
             }
         }
         const templateVariables = { ...(this.credentialPayload ?? {}), ...authorizationResponseVariables };
+        templateVariables.clientId ??= this.clientId;
+        templateVariables.clientSecret ??= this.clientSecret;
         const tokenRequestPayload = {
             ...Object.fromEntries(Object.entries(this.tokenRequestParameters?.body ?? {}).map(([key, value]) => [
                 key,
@@ -235,11 +237,23 @@ class OAuth2Service {
             bodyData.client_assertion_type = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
             bodyData.redirect_uri = `${IntegrationsPlatformClient.Servers[this.environment]}/credentials/new/oauth2/callback-cli`;
         }
+        const templateVariables = structuredClone(this.credentialPayload ?? {});
+        templateVariables.clientId ??= this.clientId;
+        templateVariables.clientSecret ??= this.clientSecret;
+        const tokenRequestHeaders = {
+            'Content-Type': this.requestContentType,
+            ...(this.refreshRequestParameters?.header ?? {}),
+        };
+        for (const [headerKey, headerValue] of Object.entries(this.tokenRequestParameters?.header ?? {})) {
+            tokenRequestHeaders[headerKey] = (0, template_1.expandTemplate)(String(headerValue), templateVariables, {
+                urlEncodeVariables: false,
+            });
+        }
         try {
             const tokenResponse = await fetch(this.tokenUrl, {
                 headers: {
                     'Content-Type': this.requestContentType,
-                    ...(this.refreshRequestParameters?.header ?? {}),
+                    ...(tokenRequestHeaders ?? {}),
                 },
                 body: this.encodeBody(bodyData, this.requestContentType),
                 method: 'POST',

package/dist/test/services/oauth2.test.js

@@ -142,7 +142,121 @@ describe('OAuth2Helper', () => {
                 sinon_1.default.assert.calledOnce(res.send);
                 sinon_1.default.assert.calledWith(res.send, oauth2Namespace.HTML_ERROR_MSG());
             });
-            it('handles form-urlencoded error responses', async () => {
+            describe('template variables for clientId and clientSecret', () => {
+                const setupHelperWithStubs = (authorizationInfo, credentialPayload) => {
+                    oauth2Helper = new oauth2_1.default(authorizationInfo, globalConfiguration_1.Environment.Production, credentialPayload);
+                    sinon_1.default.stub(oauth2Helper, 'startServer').resolves('http://localhost:5050');
+                    sinon_1.default.stub(oauth2Helper, 'stopServer');
+                };
+                afterEach(() => {
+                    sinon_1.default.restore();
+                });
+                const performCallback = async () => {
+                    const req = { query: { code: 'test-code' } };
+                    const res = { send: sinon_1.default.stub(), setHeader: sinon_1.default.stub() };
+                    await oauth2Helper['handleCallback'](req, res);
+                    return { req, res };
+                };
+                it('expands clientId and clientSecret in headers', async () => {
+                    // What matters: Template variables {+clientId} and {+clientSecret} in headers
+                    // should be replaced with actual service-level client credentials
+                    setupHelperWithStubs({
+                        clientId: 'my-client-id',
+                        clientSecret: 'my-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        tokenRequestParameters: {
+                            header: { 'X-Client-ID': '{+clientId}', 'X-Client-Secret': '{+clientSecret}' },
+                        },
+                    });
+                    await performCallback();
+                    // What matters: The fetch call should have expanded the template variables in headers
+                    sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token', {
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'X-Client-ID': 'my-client-id', // Template {+clientId} expanded
+                            'X-Client-Secret': 'my-client-secret', // Template {+clientSecret} expanded
+                        },
+                        body: sinon_1.default.match.string,
+                        method: 'POST',
+                    });
+                });
+                it('expands clientId and clientSecret in body', async () => {
+                    // What matters: Template variables in request body should be expanded
+                    // while preserving other static parameters
+                    setupHelperWithStubs({
+                        clientId: 'my-client-id',
+                        clientSecret: 'my-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        tokenRequestParameters: {
+                            body: {
+                                custom_client_id: '{+clientId}',
+                                custom_client_secret: '{+clientSecret}',
+                                additional_param: 'static_value',
+                            },
+                        },
+                    });
+                    await performCallback();
+                    const requestBody = fetchStub.getCall(0).args[1].body;
+                    const bodyParams = new URLSearchParams(requestBody);
+                    // What matters: Template variables in body are expanded to actual values
+                    strict_1.default.equal(bodyParams.get('custom_client_id'), 'my-client-id');
+                    strict_1.default.equal(bodyParams.get('custom_client_secret'), 'my-client-secret');
+                    // What matters: Static parameters are preserved unchanged
+                    strict_1.default.equal(bodyParams.get('additional_param'), 'static_value');
+                });
+                it('expands clientId and clientSecret in URL', async () => {
+                    // What matters: Template variables in token URL should be expanded
+                    // and properly URL-encoded as query parameters
+                    setupHelperWithStubs({
+                        clientId: 'my-client-id',
+                        clientSecret: 'my-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token?client_id={+clientId}&secret={+clientSecret}',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                    });
+                    await performCallback();
+                    // What matters: The URL template variables are expanded in the fetch call
+                    sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token?client_id=my-client-id&secret=my-client-secret', sinon_1.default.match.object);
+                });
+                it('allows credential payload to override service values', async () => {
+                    // What matters: Credential payload values should take precedence over
+                    // service-level clientId/clientSecret when expanding templates
+                    setupHelperWithStubs({
+                        clientId: 'default-client-id', // Service-level values
+                        clientSecret: 'default-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        tokenRequestParameters: {
+                            header: { 'X-Client-ID': '{+clientId}', 'X-Client-Secret': '{+clientSecret}' },
+                        },
+                    }, { clientId: 'override-client-id', clientSecret: 'override-client-secret' });
+                    await performCallback();
+                    // What matters: Template expansion uses the credential payload override values
+                    sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token', {
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'X-Client-ID': 'override-client-id', // Uses credential payload value
+                            'X-Client-Secret': 'override-client-secret', // Uses credential payload value
+                        },
+                        body: sinon_1.default.match.string,
+                        method: 'POST',
+                    });
+                });
+            });
+            it('form-urlencoded error responses', async () => {
                 const code = 'test-code';
                 const req = { query: { code } };
                 const res = { send: sinon_1.default.stub(), setHeader: sinon_1.default.stub(), headersSent: false };
@@ -187,9 +301,9 @@ describe('OAuth2Helper', () => {
             });
         });
         describe('updateToken', () => {
-            it('retrieves the access token when a refresh token is available', async () => {
+            const setupSuccessfulRefreshResponse = () => {
                 const refreshToken = 'test-refresh-token';
-                const accessToken = 'test-access-token';
+                const accessToken = 'new-access-token';
                 const fetchResponse = { access_token: accessToken, refresh_token: refreshToken };
                 fetchStub.resolves({
                     status: 200,
@@ -197,9 +311,103 @@ describe('OAuth2Helper', () => {
                     text: sinon_1.default.stub().resolves(''),
                     headers: new Headers({ 'content-type': 'application/json' }),
                 });
+                return { refreshToken, accessToken };
+            };
+            it('retrieves the access token when a refresh token is available', async () => {
+                const { refreshToken, accessToken } = setupSuccessfulRefreshResponse();
                 const result = await oauth2Helper.updateToken(refreshToken);
                 strict_1.default.deepEqual(result, { accessToken, refreshToken });
                 sinon_1.default.assert.calledOnce(fetchStub);
+                // Assert that the refresh token is actually sent in the request body
+                const fetchCall = fetchStub.getCall(0);
+                const requestBody = fetchCall.args[1].body;
+                const bodyParams = new URLSearchParams(requestBody);
+                strict_1.default.equal(bodyParams.get('refresh_token'), refreshToken);
+                strict_1.default.equal(bodyParams.get('grant_type'), 'refresh_token');
+            });
+            describe('template variables for clientId and clientSecret', () => {
+                const createHelperWithTemplateHeaders = (clientId, clientSecret, credentialPayload) => {
+                    return new oauth2_1.default({
+                        clientId,
+                        clientSecret,
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        tokenRequestParameters: {
+                            header: { 'X-Client-ID': '{+clientId}', 'X-Client-Secret': '{+clientSecret}' },
+                        },
+                    }, globalConfiguration_1.Environment.Production, credentialPayload);
+                };
+                it('expands template variables in headers', async () => {
+                    // What matters: Template variables in tokenRequestParameters headers
+                    // should be expanded during token refresh operations
+                    oauth2Helper = createHelperWithTemplateHeaders('refresh-client-id', 'refresh-client-secret');
+                    const { refreshToken } = setupSuccessfulRefreshResponse();
+                    await oauth2Helper.updateToken(refreshToken);
+                    // What matters: Fetch call for refresh token includes expanded template variables
+                    sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token', {
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'X-Client-ID': 'refresh-client-id', // Template expanded
+                            'X-Client-Secret': 'refresh-client-secret', // Template expanded
+                        },
+                        body: sinon_1.default.match.string,
+                        method: 'POST',
+                    });
+                });
+                it('allows credential payload override', async () => {
+                    // What matters: During token refresh, credential payload values should
+                    // override service-level values for template expansion
+                    oauth2Helper = createHelperWithTemplateHeaders('default-id', 'default-secret', {
+                        clientId: 'override-refresh-client-id', // Override values
+                        clientSecret: 'override-refresh-client-secret',
+                    });
+                    const { refreshToken } = setupSuccessfulRefreshResponse();
+                    await oauth2Helper.updateToken(refreshToken);
+                    // What matters: Template expansion uses credential payload override values for refresh
+                    sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token', {
+                        headers: {
+                            'Content-Type': 'application/x-www-form-urlencoded',
+                            'X-Client-ID': 'override-refresh-client-id', // Uses override value
+                            'X-Client-Secret': 'override-refresh-client-secret', // Uses override value
+                        },
+                        body: sinon_1.default.match.string,
+                        method: 'POST',
+                    });
+                });
+            });
+            it('includes refreshRequestParameters headers in token request', async () => {
+                oauth2Helper = new oauth2_1.default({
+                    clientId: 'test-client-id',
+                    clientSecret: 'test-client-secret',
+                    authorizationUrl: 'https://provider.com/oauth/authorize',
+                    scopes: [{ name: 'scope1' }],
+                    tokenUrl: 'https://provider.com/oauth/token',
+                    grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                    requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                    tokenRequestParameters: {
+                        header: { 'X-Token-Header': 'token-value' },
+                    },
+                    refreshRequestParameters: {
+                        header: { 'X-Refresh-Header': 'refresh-value', 'X-Special-Auth': 'special-token' },
+                    },
+                }, globalConfiguration_1.Environment.Production);
+                const { refreshToken } = setupSuccessfulRefreshResponse();
+                await oauth2Helper.updateToken(refreshToken);
+                // What matters: Both tokenRequestParameters and refreshRequestParameters headers
+                // should be present in the token refresh request
+                sinon_1.default.assert.calledWith(fetchStub, 'https://provider.com/oauth/token', {
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        'X-Token-Header': 'token-value', // From tokenRequestParameters.header
+                        'X-Refresh-Header': 'refresh-value', // From refreshRequestParameters.header
+                        'X-Special-Auth': 'special-token', // From refreshRequestParameters.header
+                    },
+                    body: sinon_1.default.match.string,
+                    method: 'POST',
+                });
             });
             it('throws an error when failing to refresh the access token', async () => {
                 const refreshToken = 'test-refresh-token';

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.63.2",
+  "version": "0.63.3",
   "commands": {
     "activity": {
       "id": "activity",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unito/integration-cli",
-  "version": "0.63.2",
+  "version": "0.63.3",
   "description": "Integration CLI",
   "bin": {
     "integration-cli": "./bin/run"