@unito/integration-cli 1.1.0 → 1.2.1

package/dist/boilerplate/package-lock.json

@@ -1731,9 +1731,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
+      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3205,9 +3205,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.0.tgz",
+      "integrity": "sha512-PuseHIvAnz3bjrM2rGJtSgo1zjgxapTLZ7x2pjhzWwlp4SJQgK3f3iZIQwkpEnBaKz6seKBADpM4B4ySkuYypg==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",

package/dist/boilerplate/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "compile": "tsc --project tsconfig.build.json",
     "compile:watch": "tsc -w",
-    "dev": "tsx watch src/index.ts",
+    "dev": "NODE_ENV=development tsx watch src/index.ts",
     "test": "NODE_ENV=test tsx --test --test-name-pattern=${ONLY:-.*} $(find test -type f -name '*.test.ts')",
     "lint": "eslint --config eslint.config.mjs --fix src test && prettier --write src test",
     "ci:test": "npm run test"

package/dist/schemas/authorization.json

@@ -202,6 +202,12 @@
         },
         "responseContentType": {
           "$ref": "#/$defs/authorizationResponseContentType"
+        },
+        "pkceCodeChallengeMethod": {
+          "type": "string",
+          "description": "The PKCE code challenge method (RFC 7636). When set, the OAuth2 flow will use Proof Key for Code Exchange.",
+          "enum": ["S256", "plain"],
+          "tsEnumNames": ["S256", "PLAIN"]
         }
       }
     }

package/dist/src/commands/oauth2.js

@@ -30,7 +30,6 @@ class Oauth2 extends core_1.Command {
             description: 'the environment of the platform',
             options: Object.values(globalConfiguration_1.Environment),
             default: globalConfiguration_1.Environment.Production,
-            hidden: true,
         })(),
         reauth: core_1.Flags.boolean({
             description: `triggers a new oauth2 flow to overwrite the test account's current credentials`,

package/dist/src/commands/publish.js

@@ -28,9 +28,8 @@ class Publish extends baseCommand_1.BaseCommand {
             default: GlobalConfiguration.Environment.Production,
         })(),
         'registry-only': core_1.Flags.boolean({
-            description: '(advanced) only update the registry',
+            description: 'only update the registry without publishing code',
             default: false,
-            hidden: true,
             exclusive: ['preview', 'live-preview'],
         }),
         preview: core_1.Flags.boolean({

package/dist/src/commands/upgrade.js

@@ -53,7 +53,8 @@ class Upgrade extends baseCommand_1.BaseCommand {
         //
         core_1.ux.action.start(`${latestVersion ? 'Validating' : 'Upgrading'} the package`, undefined, { stdout: true });
         // To make sure we have a clean version of the CLI, with updated packages, we force the re-installation.
-        child_process_1.default.execSync(`npm install --force ${npmOptions} ${packageName}`, {
+        // --min-release-age=0 bypasses the npm release age safeguard for this internal trusted package.
+        child_process_1.default.execSync(`npm install --force --min-release-age=0 ${npmOptions} ${packageName}`, {
             ...execOptions,
             stdio: ['ignore', 'ignore', 'inherit'],
         });

package/dist/src/configurationTypes.d.ts

@@ -168,6 +168,7 @@ export interface Oauth2 {
     refreshRequestParameters?: AuthorizationRequestParameters;
     requestContentType?: RequestContentType;
     responseContentType?: RequestContentType;
+    pkceCodeChallengeMethod?: PkceCodeChallengeMethod;
 }
 /**
  * The extra information used to communicate with the provider
@@ -209,6 +210,13 @@ export declare enum RequestContentType {
     URL_ENCODED = "application/x-www-form-urlencoded",
     JSON = "application/json"
 }
+/**
+ * The PKCE code challenge method (RFC 7636). When set, the OAuth2 flow will use Proof Key for Code Exchange.
+ */
+export declare enum PkceCodeChallengeMethod {
+    S256 = "S256",
+    PLAIN = "plain"
+}
 export declare enum Type {
     BOOLEAN = "boolean",
     NUMBER = "number",

package/dist/src/configurationTypes.js

@@ -6,7 +6,7 @@
  * and run json-schema-to-typescript to regenerate this file.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Format = exports.Type = exports.RequestContentType = exports.GrantType = exports.Method = void 0;
+exports.Format = exports.Type = exports.PkceCodeChallengeMethod = exports.RequestContentType = exports.GrantType = exports.Method = void 0;
 /**
  * The method of authorization
  */
@@ -33,6 +33,14 @@ var RequestContentType;
     RequestContentType["URL_ENCODED"] = "application/x-www-form-urlencoded";
     RequestContentType["JSON"] = "application/json";
 })(RequestContentType || (exports.RequestContentType = RequestContentType = {}));
+/**
+ * The PKCE code challenge method (RFC 7636). When set, the OAuth2 flow will use Proof Key for Code Exchange.
+ */
+var PkceCodeChallengeMethod;
+(function (PkceCodeChallengeMethod) {
+    PkceCodeChallengeMethod["S256"] = "S256";
+    PkceCodeChallengeMethod["PLAIN"] = "plain";
+})(PkceCodeChallengeMethod || (exports.PkceCodeChallengeMethod = PkceCodeChallengeMethod = {}));
 var Type;
 (function (Type) {
     Type["BOOLEAN"] = "boolean";

package/dist/src/services/oauth2.d.ts

@@ -41,6 +41,8 @@ declare class OAuth2Service {
     private refreshRequestParameters;
     private credentialPayload;
     private legacyRedirectUrl;
+    private pkceCodeChallengeMethod;
+    private codeVerifier;
     /**
      * Constructs an instance of OAuthHelper.
      * @param clientId The client ID for your OAuth application.

package/dist/src/services/oauth2.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HTML_SUCCESS_MSG = exports.HTML_ERROR_MSG = exports.open = void 0;
 const tslib_1 = require("tslib");
+const node_crypto_1 = tslib_1.__importDefault(require("node:crypto"));
 const express_1 = tslib_1.__importDefault(require("express"));
 const cors_1 = tslib_1.__importDefault(require("cors"));
 const openUrl = tslib_1.__importStar(require("openurl"));
@@ -33,6 +34,8 @@ class OAuth2Service {
     refreshRequestParameters;
     credentialPayload;
     legacyRedirectUrl;
+    pkceCodeChallengeMethod;
+    codeVerifier;
     /**
      * Constructs an instance of OAuthHelper.
      * @param clientId The client ID for your OAuth application.
@@ -42,7 +45,7 @@ class OAuth2Service {
      * @param providerTokenUrl The URL for the token endpoint of the provider.
      */
     constructor(authorizationInfo, environment = globalConfiguration_1.Environment.Production, credentialPayload) {
-        const { clientId, clientSecret, authorizationUrl, scopes, tokenUrl, grantType, requestContentType, refreshRequestParameters, tokenRequestParameters, legacyRedirectUrl, } = authorizationInfo;
+        const { clientId, clientSecret, authorizationUrl, scopes, tokenUrl, grantType, requestContentType, refreshRequestParameters, tokenRequestParameters, legacyRedirectUrl, pkceCodeChallengeMethod, } = authorizationInfo;
         this.clientId = clientId;
         this.clientSecret = clientSecret;
         this.providerAuthorizationUrl = authorizationUrl;
@@ -53,6 +56,7 @@ class OAuth2Service {
         this.tokenRequestParameters = tokenRequestParameters;
         this.refreshRequestParameters = refreshRequestParameters;
         this.legacyRedirectUrl = legacyRedirectUrl;
+        this.pkceCodeChallengeMethod = pkceCodeChallengeMethod;
         this.environment = environment;
         this.credentialPayload = credentialPayload;
         if (!Object.values(configurationTypes_1.RequestContentType).includes(this.requestContentType)) {
@@ -94,6 +98,14 @@ class OAuth2Service {
         authorizationParams.set('state', state);
         authorizationParams.set('response_type', 'code');
         authorizationParams.set('redirect_uri', this.redirectUri);
+        if (this.grantType === configurationTypes_1.GrantType.AUTHORIZATION_CODE && this.pkceCodeChallengeMethod) {
+            this.codeVerifier = node_crypto_1.default.randomBytes(32).toString('base64url');
+            const codeChallenge = this.pkceCodeChallengeMethod === 'S256'
+                ? node_crypto_1.default.createHash('sha256').update(this.codeVerifier).digest('base64url')
+                : this.codeVerifier;
+            authorizationParams.set('code_challenge', codeChallenge);
+            authorizationParams.set('code_challenge_method', this.pkceCodeChallengeMethod);
+        }
         const delimiter = this.providerAuthorizationUrl.includes('?') ? '&' : '?';
         const authorizationUrlTemplate = `${this.providerAuthorizationUrl}${delimiter}${authorizationParams.toString()}`;
         const authorizationUrl = (0, template_1.expandTemplate)(authorizationUrlTemplate, {
@@ -139,6 +151,7 @@ class OAuth2Service {
             redirect_uri: this.redirectUri,
             ...(this.clientId && { client_id: this.clientId }),
             ...(this.clientSecret && { client_secret: this.clientSecret }),
+            ...(this.grantType === configurationTypes_1.GrantType.AUTHORIZATION_CODE && this.codeVerifier && { code_verifier: this.codeVerifier }),
         };
         if (this.grantType === configurationTypes_1.GrantType.JWT_BEARER && this.clientSecret) {
             tokenRequestPayload.client_assertion = this.clientSecret;

package/dist/test/services/oauth2.test.js

@@ -73,6 +73,57 @@ describe('OAuth2Helper', () => {
                 sinon_1.default.assert.calledOnce(openSpy);
                 sinon_1.default.assert.calledWith(openSpy, 'https://pro-fooValue-der.com/oauth/authorize?query1=barValue&client_id=your-client-id&scope=scope1+scope2&state=eyJjbGlDYWxsYmFja1VybCI6Ii9vYXV0aDIvY2FsbGJhY2sifQ%3D%3D&response_type=code&redirect_uri=https%3A%2F%2Fintegrations-platform.unito.io%2Fcredentials%2Fnew%2Foauth2%2Fcallback');
             });
+            describe('with pkceCodeChallengeMethod', () => {
+                it('adds code_challenge and code_challenge_method to authorization URL for S256', async () => {
+                    const authorizationInfo = {
+                        clientId: 'your-client-id',
+                        clientSecret: 'your-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        pkceCodeChallengeMethod: configurationTypes_1.PkceCodeChallengeMethod.S256,
+                    };
+                    const pkceHelper = new oauth2_1.default(authorizationInfo, globalConfiguration_1.Environment.Production);
+                    sinon_1.default.stub(pkceHelper, 'startServer').resolves('http://localhost:5050');
+                    sinon_1.default.stub(pkceHelper, 'stopServer');
+                    await pkceHelper.authorize();
+                    sinon_1.default.assert.calledOnce(openSpy);
+                    const url = new URL(openSpy.getCall(0).args[0]);
+                    strict_1.default.equal(url.searchParams.get('code_challenge_method'), 'S256');
+                    strict_1.default.ok(url.searchParams.get('code_challenge'), 'code_challenge should be present');
+                    strict_1.default.ok(url.searchParams.get('code_challenge').length > 0, 'code_challenge should not be empty');
+                });
+                it('uses verifier directly as challenge for plain method', async () => {
+                    const authorizationInfo = {
+                        clientId: 'your-client-id',
+                        clientSecret: 'your-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        pkceCodeChallengeMethod: configurationTypes_1.PkceCodeChallengeMethod.PLAIN,
+                    };
+                    const pkceHelper = new oauth2_1.default(authorizationInfo, globalConfiguration_1.Environment.Production);
+                    sinon_1.default.stub(pkceHelper, 'startServer').resolves('http://localhost:5050');
+                    sinon_1.default.stub(pkceHelper, 'stopServer');
+                    await pkceHelper.authorize();
+                    sinon_1.default.assert.calledOnce(openSpy);
+                    const url = new URL(openSpy.getCall(0).args[0]);
+                    strict_1.default.equal(url.searchParams.get('code_challenge_method'), 'plain');
+                    // For plain method, the code_verifier stored on the instance should equal the code_challenge
+                    strict_1.default.equal(url.searchParams.get('code_challenge'), pkceHelper['codeVerifier']);
+                });
+                it('does not add PKCE params when codeChallengeMethod is not set', async () => {
+                    await oauth2Helper.authorize();
+                    sinon_1.default.assert.calledOnce(openSpy);
+                    const url = new URL(openSpy.getCall(0).args[0]);
+                    strict_1.default.equal(url.searchParams.get('code_challenge'), null);
+                    strict_1.default.equal(url.searchParams.get('code_challenge_method'), null);
+                });
+            });
             describe('with legacyRedirectUrl', () => {
                 it('uses legacyRedirectUrl as redirect_uri and adds redirectToIPS to state', async () => {
                     oauth2Helper['legacyRedirectUrl'] = 'http://localhost:3000/api/auth/notion/callback';
@@ -318,6 +369,43 @@ describe('OAuth2Helper', () => {
                 sinon_1.default.assert.calledOnce(res.send);
                 sinon_1.default.assert.calledWith(res.send, oauth2Namespace.HTML_ERROR_MSG('Bad request'));
             });
+            describe('with PKCE', () => {
+                it('includes code_verifier in token request body when codeChallengeMethod is set', async () => {
+                    const authorizationInfo = {
+                        clientId: 'your-client-id',
+                        clientSecret: 'your-client-secret',
+                        authorizationUrl: 'https://provider.com/oauth/authorize',
+                        scopes: [{ name: 'scope1' }],
+                        tokenUrl: 'https://provider.com/oauth/token',
+                        grantType: configurationTypes_1.GrantType.AUTHORIZATION_CODE,
+                        requestContentType: configurationTypes_1.RequestContentType.URL_ENCODED,
+                        pkceCodeChallengeMethod: configurationTypes_1.PkceCodeChallengeMethod.S256,
+                    };
+                    const pkceHelper = new oauth2_1.default(authorizationInfo, globalConfiguration_1.Environment.Production);
+                    sinon_1.default.stub(pkceHelper, 'startServer').resolves('http://localhost:5050');
+                    sinon_1.default.stub(pkceHelper, 'stopServer');
+                    // authorize() generates the code_verifier
+                    await pkceHelper.authorize();
+                    const storedVerifier = pkceHelper['codeVerifier'];
+                    strict_1.default.ok(storedVerifier, 'codeVerifier should be set after authorize()');
+                    const code = 'test-code';
+                    const req = { query: { code } };
+                    const res = { send: sinon_1.default.stub(), setHeader: sinon_1.default.stub() };
+                    await pkceHelper['handleCallback'](req, res);
+                    sinon_1.default.assert.calledOnce(fetchStub);
+                    const body = new URLSearchParams(fetchStub.getCall(0).args[1].body);
+                    strict_1.default.equal(body.get('code_verifier'), storedVerifier);
+                });
+                it('does not include code_verifier when codeChallengeMethod is not set', async () => {
+                    const code = 'test-code';
+                    const req = { query: { code } };
+                    const res = { send: sinon_1.default.stub(), setHeader: sinon_1.default.stub() };
+                    await oauth2Helper['handleCallback'](req, res);
+                    sinon_1.default.assert.calledOnce(fetchStub);
+                    const body = new URLSearchParams(fetchStub.getCall(0).args[1].body);
+                    strict_1.default.equal(body.get('code_verifier'), null);
+                });
+            });
             describe('with legacyRedirectUrl', () => {
                 it('uses legacyRedirectUrl as redirect_uri in token request', async () => {
                     oauth2Helper['legacyRedirectUrl'] = 'http://localhost:3000/api/auth/notion/callback';

package/oclif.manifest.json

@@ -562,7 +562,6 @@
         },
         "environment": {
           "description": "the environment of the platform",
-          "hidden": true,
           "name": "environment",
           "default": "production",
           "hasDynamicHelp": false,
@@ -635,12 +634,11 @@
           "type": "option"
         },
         "registry-only": {
-          "description": "(advanced) only update the registry",
+          "description": "only update the registry without publishing code",
           "exclusive": [
             "preview",
             "live-preview"
           ],
-          "hidden": true,
           "name": "registry-only",
           "allowNo": false,
           "type": "boolean"
@@ -1007,5 +1005,5 @@
       ]
     }
   },
-  "version": "1.1.0"
+  "version": "1.2.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unito/integration-cli",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Integration CLI",
   "bin": {
     "integration-cli": "./bin/run"