@versori/run 0.2.28 → 0.3.0-beta.2

package/esm/src/dsl/http/versori/roundtripper.js

@@ -1,967 +0,0 @@
-import { Code, ConnectError } from '@connectrpc/connect';
-import { ConsoleLogger } from '../../../observability/mod.js';
-import { VersoriConfigReader } from './configloader.js';
-import { envVarCredsBaseURL, envVarEnvId, envVarOrgId, envVarPlatformApiBaseURL, } from './constants.js';
-import { VersoriCredentialClient } from './credential/mod.js';
-import { isValidURL } from './helpers.js';
-import { PlatformAPIClient } from './platformapi.js';
-import { URLSearchParams } from 'node:url';
-import { createHmac } from 'node:crypto';
-import { LRUCache } from 'lru-cache';
-import { timestampMs } from '@bufbuild/protobuf/wkt';
-import OAuth from 'oauth-1.0a'; // Importing the OAuth class as default export
-/**
- * VersoriRoundTripper is an implementation of the RoundTripperFactory interface for Versori connections.
- * This is the intended implementation for when projects/services are hosted on Versori infrastructure.
- *
- * @example
- * ```typescript
- * const factory = new VersoriCredentialsFactory(connectAPIClient, tokenClient);
- * const customFetch = await factory.create('connectionName');
- * const response = await customFetch('https://api.example.com/data');
- * ```
- */
-export class VersoriCredentialsFactory {
-    constructor(credsClient, credsBaseURL, platformAPIClient, logger, tracer, cfgReader) {
-        Object.defineProperty(this, "tokenClient", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "credsBaseURL", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "platformAPIClient", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cfgReader", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "log", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "tracer", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "oauth2Cache", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "defaultDynamic", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: (msg, values) => {
-                return (_, input, init) => {
-                    this.log.error(msg, values);
-                    return globalThis.fetch(input, init);
-                };
-            }
-        });
-        this.tokenClient = credsClient;
-        this.credsBaseURL = credsBaseURL;
-        this.platformAPIClient = platformAPIClient;
-        this.cfgReader = cfgReader;
-        this.log = logger;
-        this.tracer = tracer;
-        this.oauth2Cache = new LRUCache({
-            max: 1000,
-            ttl: 2000 * 60 * 5,
-        });
-        // lost 15 minutes because of this one
-        this.traceFetch = this.traceFetch.bind(this);
-        this.credentials = this.credentials.bind(this);
-    }
-    static fromEnv(logger, tracer) {
-        const credsBaseURL = Deno.env.get(envVarCredsBaseURL);
-        const platformApiBaseURL = Deno.env.get(envVarPlatformApiBaseURL);
-        const orgId = Deno.env.get(envVarOrgId);
-        const envId = Deno.env.get(envVarEnvId);
-        const cfgReader = VersoriConfigReader.fromEnv(logger);
-        if (!orgId || !envId || !platformApiBaseURL || !credsBaseURL) {
-            const missingVars = [];
-            if (!orgId)
-                missingVars.push(envVarOrgId);
-            if (!envId)
-                missingVars.push(envVarEnvId);
-            if (!platformApiBaseURL)
-                missingVars.push(envVarPlatformApiBaseURL);
-            if (!credsBaseURL)
-                missingVars.push(envVarCredsBaseURL);
-            throw new Error(`Missing environment variables: ${missingVars.join(', ')}`);
-        }
-        const log = logger || new ConsoleLogger('debug');
-        const pAPIClient = new PlatformAPIClient(platformApiBaseURL, orgId, envId, log);
-        const tokenClient = new VersoriCredentialClient(credsBaseURL);
-        return new VersoriCredentialsFactory(tokenClient, credsBaseURL, pAPIClient, log, tracer, cfgReader);
-    }
-    // takes the info and modifies the url using changeBaseUrl if necessary
-    // if a full valid URL is passed as a string, it will be returned as is
-    // if a valid URL object is passed, it will be returned as is
-    changeRequestInit(info, conn) {
-        if (typeof info === 'string') {
-            if (isValidURL(info)) {
-                return info;
-            }
-            return this.changeBaseUrl(info, conn);
-        }
-        else if (info instanceof URL) {
-            return info;
-        }
-        else if (info instanceof Request) {
-            const url = this.changeBaseUrl(info.url, conn);
-            return new Request(url, info);
-        }
-        return info;
-    }
-    changeBaseUrl(pathname, conn) {
-        const connBaseURL = conn.baseUrl;
-        // if the connection has no baseUrl set, but the pathname is a valid URL, return it as is
-        if (!connBaseURL && isValidURL(pathname)) {
-            this.log.debug('Using given URL as is', { url: pathname });
-            return pathname;
-        }
-        const connBaseURLObj = new URL(connBaseURL);
-        let _pathname = pathname;
-        if (isValidURL(pathname)) {
-            const pathnameObj = new URL(pathname);
-            _pathname = pathnameObj.pathname;
-        }
-        const newURL = new URL(_pathname, connBaseURLObj.origin);
-        this.log.debug('Using baseURL from connection', { url: newURL.toString() });
-        return newURL.toString();
-    }
-    async create(connName) {
-        const cnxId = this.cfgReader.getConnectionID(connName);
-        if (!cnxId) {
-            return Promise.resolve(undefined);
-        }
-        const conn = await this.platformAPIClient.getStaticConnection(cnxId);
-        let _fetch = this.traceFetch;
-        if (!conn) {
-            this.log.error('Connection not found - using default fetch', { 'connectionName': connName, 'connectionID': cnxId });
-            return _fetch;
-        }
-        for (const cred of conn?.credentials ?? []) {
-            switch (cred.authSchemeConfig.type) {
-                case 'api-key': {
-                    const apiTokenResponse = await this.getToken(cred.credential.id);
-                    if (!apiTokenResponse?.token?.accessToken || !cred.authSchemeConfig.apiKey) {
-                        this.log.error('API Key credential is missing token or configuration', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.apiKeyFetcherStatic(apiTokenResponse.token.accessToken, cred.authSchemeConfig.apiKey, _fetch);
-                    break;
-                }
-                case 'basic-auth': {
-                    const basicTokenResponse = await this.getToken(cred.credential.id);
-                    if (!basicTokenResponse?.token?.accessToken) {
-                        this.log.error('Basic Auth credential is missing token', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.basicAuthFetcherStatic(basicTokenResponse.token.accessToken, _fetch);
-                    break;
-                }
-                case 'jwt-bearer': {
-                    const bearerTokenResponse = await this.getToken(cred.credential.id);
-                    if (!bearerTokenResponse?.token?.accessToken) {
-                        this.log.error('Bearer Token credential is missing token', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.bearerTokenFetcherStatic(bearerTokenResponse.token.accessToken, _fetch);
-                    break;
-                }
-                case 'oauth2': {
-                    if (!cred.credential?.id) {
-                        this.log.error('OAuth2 credential is missing credential ID', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.oauth2FetcherStatic(cred.credential.id, _fetch);
-                    break;
-                }
-                case 'oauth1': {
-                    const oauth1Metadata = await this.getOAuth1Metadata(cred.credential.id);
-                    if (!oauth1Metadata?.authorizationMetadata) {
-                        this.log.error('OAuth1 credential is missing metadata', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.oauth1FetcherStatic(oauth1Metadata, _fetch);
-                    break;
-                }
-                case 'certificate': {
-                    const mtlsData = await this.getRaw(cred.credential.id);
-                    if (!mtlsData?.credential?.data['cert'] || !mtlsData?.credential?.data['key']) {
-                        this.log.error('mTLS credential is missing cert or key data', {
-                            connectionName: connName,
-                            credentialId: cred.credential.id,
-                        });
-                        continue;
-                    }
-                    _fetch = this.mtlsFetcherStatic({
-                        cert: mtlsData.credential.data['cert'],
-                        key: mtlsData.credential.data['key'],
-                        ca: mtlsData.credential.data['ca'],
-                    }, _fetch);
-                    break;
-                }
-            }
-        }
-        const _fn = async (input, init) => {
-            const _input = this.changeRequestInit(input, conn);
-            return _fetch(_input, init);
-        };
-        return _fn;
-    }
-    apiKeyFetcherStatic(token, asc, fn) {
-        const _fn = async (input, init) => {
-            if (!token) {
-                throw new Error('Token not found');
-            }
-            if (!asc) {
-                throw new Error('API Key configuration not found');
-            }
-            if (!init) {
-                init = {};
-            }
-            switch (asc.in) {
-                case 'header':
-                    if (!init.headers) {
-                        init.headers = new Headers();
-                    }
-                    if (init.headers instanceof Headers) {
-                        init.headers.set(asc.name, token);
-                    }
-                    else if (init.headers instanceof Array) {
-                        init.headers.push([asc.name, token]);
-                    }
-                    else {
-                        init.headers = {
-                            ...init.headers,
-                            [asc.name]: token,
-                        };
-                    }
-                    break;
-                case 'query':
-                    if (typeof input === 'string') {
-                        const _input = new URL(input);
-                        _input.searchParams.append(asc.name, token);
-                        input = _input.toString();
-                    }
-                    else if (input instanceof Request) {
-                        const _input = new URL(input.url);
-                        _input.searchParams.append(asc.name, token);
-                        input = new Request(_input.toString(), init);
-                    }
-                    else if (input instanceof URL) {
-                        input.searchParams.append(asc.name, token);
-                    }
-                    break;
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    basicAuthFetcherStatic(token, fn) {
-        const _fn = async (input, init) => {
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `Basic ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `Basic ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `Basic ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    bearerTokenFetcherStatic(token, fn) {
-        const _fn = async (input, init) => {
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `Bearer ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `Bearer ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `Bearer ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    // getOauth2Token fetches an OAuth2 token, stores the result in a cache, and returns the token.
-    // If forceRefresh is true, it will bypass the cache and fetch a new token then update the cache.
-    async getOAuth2Token(credId, forceRefresh = false) {
-        if (!forceRefresh && this.oauth2Cache.has(credId)) {
-            // we do cache.has so it will be there, hence the ! operator
-            const cached = this.oauth2Cache.get(credId);
-            // check the expiry: if the oauth2 token has an expiry and it is going to expire
-            // after the next 10 minutes, then simply return. Otherswise set forceRefresh to true,
-            // get a new token and update the cache
-            if (cached.expiry) {
-                if (this.checkExpiry(cached.expiry)) {
-                    return Promise.resolve(cached);
-                }
-                else {
-                    forceRefresh = true;
-                }
-            }
-        }
-        let tokenResponse = await this.getToken(credId, forceRefresh);
-        // we need to check the expiry of this new token in case it is going to expire soon.
-        if (tokenResponse?.token?.expiry && !this.checkExpiry(tokenResponse.token.expiry)) {
-            tokenResponse = await this.getToken(credId, true);
-        }
-        const newOauthTokenData = {
-            token: tokenResponse.token?.accessToken || '',
-            tokenType: tokenResponse.token?.tokenType,
-            expiry: tokenResponse.token?.expiry,
-        };
-        this.oauth2Cache.set(credId, newOauthTokenData);
-        return Promise.resolve(newOauthTokenData);
-    }
-    // Check if the given timestamp is expiring in the next 10 minutes.
-    // Returns true if not expiring, false otherwise
-    checkExpiry(ts) {
-        return timestampMs(ts) > (Date.now() + 10 * 60 * 1000);
-    }
-    oauth2FetcherStatic(credId, fn) {
-        const refreshFn = async (input, init, forceRefresh = false) => {
-            const tokenResponse = await this.getOAuth2Token(credId, forceRefresh);
-            const token = tokenResponse.token;
-            const _tokenType = () => {
-                const _tt = tokenResponse.tokenType?.toLowerCase();
-                switch (_tt) {
-                    case 'bearer':
-                        return 'Bearer';
-                    case 'mac':
-                        return 'MAC';
-                    case 'basic':
-                        return 'Basic';
-                    default:
-                        return 'Bearer';
-                }
-            };
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `${_tokenType()} ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `${_tokenType()} ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `${_tokenType()} ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        const _fn = async (input, init) => {
-            const resp = await refreshFn(input, init);
-            if (resp.status === 401 || resp.status === 403) {
-                this.log.debug('Received unauthorized response, attempting to refresh token', {
-                    url: input,
-                    status: resp.status,
-                });
-                return refreshFn(input, init, true);
-            }
-            return resp;
-        };
-        return _fn;
-    }
-    oauth1FetcherStatic(metadata, fn) {
-        const _fn = async (input, init) => {
-            const authParams = new URLSearchParams(metadata.authorizationMetadata?.authorizationParams);
-            if (!metadata.authorizationMetadata) {
-                throw new Error('OAuth1 metadata not found');
-            }
-            const oauth = new OAuth({
-                consumer: {
-                    key: metadata.authorizationMetadata.consumerKey,
-                    secret: metadata.authorizationMetadata.consumerSecret,
-                },
-                signature_method: 'HMAC-SHA256',
-                hash_function: (baseString, key) => createHmac('sha256', key).update(baseString).digest('base64'),
-                realm: authParams.get('realm') || undefined,
-            });
-            let url;
-            if (input instanceof Request) {
-                url = input.url;
-            }
-            else if (input instanceof URL) {
-                url = input.toString();
-            }
-            else if (typeof input === 'string') {
-                url = input;
-            }
-            else {
-                throw new Error('Invalid input type for OAuth1 fetcher');
-            }
-            const header = oauth.toHeader(oauth.authorize({
-                url: url,
-                method: init?.method || 'GET',
-            }, {
-                key: metadata.authorizationMetadata?.oauthToken,
-                secret: metadata.authorizationMetadata?.oauthTokenSecret,
-            }));
-            const authHeader = header.Authorization;
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', authHeader);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', authHeader]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: authHeader,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    mtlsFetcherStatic(mtlsdata, fn) {
-        const _fn = async (input, init) => {
-            const cert = new TextDecoder().decode(mtlsdata.cert);
-            const key = new TextDecoder().decode(mtlsdata.key);
-            const caCerts = new TextDecoder().decode(mtlsdata.ca ?? new Uint8Array());
-            const httpClient = Deno.createHttpClient({
-                cert,
-                key,
-                caCerts: caCerts ? [caCerts] : [],
-            });
-            return fn(input, {
-                ...init,
-                client: httpClient,
-            });
-        };
-        return _fn;
-    }
-    createDynamic(templateName) {
-        const template = this.cfgReader.getTemplateID(templateName);
-        if (!template) {
-            return Promise.resolve(undefined);
-        }
-        const _fn = async (activation, input, init) => {
-            const conn = await this.platformAPIClient.getActivationConnection(template, activation.id);
-            if (!conn) {
-                return this.defaultDynamic('Connection not found for user, using default fetch', {
-                    templateName: templateName,
-                    userId: activation.user.id,
-                    activationId: activation.id,
-                })(activation, input, init);
-            }
-            const _input = this.changeRequestInit(input, conn);
-            let _fetch = this.traceFetch;
-            conn.credentials.forEach((cred) => {
-                switch (cred.authSchemeConfig.type) {
-                    case 'api-key':
-                        _fetch = this.apiKeyFetcher(cred, _fetch);
-                        break;
-                    case 'basic-auth':
-                        _fetch = this.basicAuthFetcher(cred, _fetch);
-                        break;
-                    case 'jwt-bearer':
-                        _fetch = this.bearerTokenFetcher(cred, _fetch);
-                        break;
-                    case 'oauth2':
-                        _fetch = this.oauth2Fetcher(cred, _fetch);
-                        break;
-                    case 'certificate':
-                        _fetch = this.mtlsFetcher(cred, _fetch);
-                        break;
-                    default:
-                        break;
-                }
-            });
-            return _fetch(_input, init);
-        };
-        return Promise.resolve(_fn);
-    }
-    traceFetch(input, init) {
-        return this.tracer.startActiveSpan('fetch', async (span) => {
-            const response = await globalThis.fetch(input, init);
-            let url = new URL('http://localhost');
-            try {
-                url = new URL(input.toString());
-            }
-            catch (error) {
-                this.log.error('Error parsing URL when tracing request', { error });
-            }
-            const method = input instanceof Request ? input.method : 'GET';
-            span.setAttributes({
-                // Error attributes
-                'error.type': response.status >= 400 ? 'HTTP_ERROR' : undefined,
-                // HTTP request attributes
-                'http.request.method': method,
-                'http.response.status_code': response.status,
-                // Server attributes
-                'server.address': url.hostname,
-                'server.port': url.port || (url.protocol === 'https:' ? '443' : '80'),
-                // URL attributes
-                'url.full': url.toString(),
-                'url.path': url.pathname,
-                'url.query': url.search,
-                'url.scheme': url.protocol.replace(':', ''),
-            });
-            span.end();
-            return response;
-        });
-    }
-    credentials() {
-        return {
-            getRaw: this.getRawByName.bind(this),
-            getAccessToken: this.getTokenByName.bind(this),
-            getOAuth1Metadata: this.getOAuth1Metadata.bind(this),
-        };
-    }
-    baseUrlFetcher(templateName) {
-        let isDynamic = false;
-        let cnxId = this.cfgReader.getConnectionID(templateName);
-        if (!cnxId) {
-            this.log.debug('Connection not found in config, could be a dynamic connection', {
-                connectionName: templateName,
-            });
-            isDynamic = true;
-            cnxId = this.cfgReader.getTemplateID(templateName);
-        }
-        return async (activationId) => {
-            if (!activationId) {
-                throw new Error(`Activation ID is required for base URL fetching for connection ${templateName}`);
-            }
-            if (isDynamic) {
-                const dynamicConn = await this.platformAPIClient.getActivationConnection(cnxId, activationId);
-                if (!dynamicConn) {
-                    throw new Error(`Dynamic connection ${templateName} not found for activation ${activationId}`);
-                }
-                return dynamicConn.baseUrl;
-            }
-            const staticConn = await this.platformAPIClient.getStaticConnection(cnxId);
-            if (!staticConn) {
-                throw new Error(`Static connection ${templateName} not found`);
-            }
-            return staticConn.baseUrl;
-        };
-    }
-    async getTokenByName(name, forceRefresh = false, activationId) {
-        const credId = await this.getCredentialIDFromName(name, activationId);
-        const token = await this.getToken(credId, forceRefresh);
-        if (!token?.token) {
-            throw new Error(`Token not found for connection ${name} with credential ID ${credId}`);
-        }
-        return {
-            accessToken: token.token.accessToken,
-            tokenType: token.token.tokenType,
-            expiry: token.token.expiry
-                ? new Date(Number(token.token.expiry.seconds) * 1000)
-                : undefined,
-        };
-    }
-    async getRawByName(name, activationId) {
-        const credId = await this.getCredentialIDFromName(name, activationId);
-        const raw = await this.getRaw(credId);
-        if (!raw) {
-            throw new Error(`Raw data not found for connection ${name} with credential ID ${credId}`);
-        }
-        const buffer = raw?.credential?.data['raw'] ?? undefined;
-        if (!buffer) {
-            throw new Error(`Credential ${raw?.credential?.id} is missing raw data, please contact your administrator`);
-        }
-        return Promise.resolve(buffer);
-    }
-    async getCredentialIDFromName(name, activationId) {
-        // fin connection config from versori file
-        const conn = this.cfgReader.getCnxMapping(name);
-        if (!conn) {
-            return '';
-        }
-        // if connection is dynamic try and load the activation
-        if (conn.dynamic) {
-            if (!activationId) {
-                throw new Error(`Connection ${name} is dynamic, but no activation ID was found on the context`);
-            }
-            if (!conn.templateId) {
-                throw new Error(`Connection ${name} is dynamic, but no template ID was found on the config`);
-            }
-            const dynamicConn = await this.platformAPIClient.getActivationConnection(conn.templateId, activationId);
-            if (!dynamicConn) {
-                throw new Error(`Connection ${name} not found`);
-            }
-            return dynamicConn.credentials[0].credential.id;
-        }
-        // connection is not dynamic try and load static connection
-        if (!conn.connId) {
-            throw new Error(`Connection ${name} is static, but no connection ID was found on the config`);
-        }
-        const staticConn = await this.platformAPIClient.getStaticConnection(conn.connId);
-        if (!conn) {
-            throw new Error(`Connection ${name} not found`);
-        }
-        if (!staticConn?.credentials[0]?.credential?.id) {
-            throw new Error(`Connection ${name}/${conn.connId} has no credentials defined on it`);
-        }
-        return staticConn.credentials[0].credential.id;
-    }
-    apiKeyFetcher(cred, fn) {
-        const _fn = async (input, init) => {
-            const tokenResponse = await this.getToken(cred.credential.id);
-            const token = tokenResponse.token?.accessToken;
-            const asc = cred.authSchemeConfig.apiKey;
-            if (!token) {
-                throw new Error('Token not found');
-            }
-            if (!asc) {
-                throw new Error('API Key configuration not found');
-            }
-            if (!init) {
-                init = {};
-            }
-            switch (asc.in) {
-                case 'header':
-                    if (!init.headers) {
-                        init.headers = new Headers();
-                    }
-                    if (init.headers instanceof Headers) {
-                        init.headers.set(asc.name, token);
-                    }
-                    else if (init.headers instanceof Array) {
-                        init.headers.push([asc.name, token]);
-                    }
-                    else {
-                        init.headers = {
-                            ...init.headers,
-                            [asc.name]: token,
-                        };
-                    }
-                    break;
-                case 'query':
-                    if (typeof input === 'string') {
-                        input += `?${asc.name}=${token}`;
-                    }
-                    else if (input instanceof Request) {
-                        input = new Request(input.url + `?${asc.name}=${token}`, init);
-                    }
-                    else if (input instanceof URL) {
-                        input.searchParams.append(asc.name, token);
-                    }
-                    break;
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    basicAuthFetcher(cred, fn) {
-        const _fn = async (input, init) => {
-            const tokenResponse = await this.getToken(cred.credential.id);
-            const token = tokenResponse.token?.accessToken;
-            if (!token) {
-                throw new Error('Token not found');
-            }
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `Basic ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `Basic ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `Basic ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    // TODO: need to make the prefix and header name configurable from authschemeconfig
-    bearerTokenFetcher(cred, fn) {
-        const _fn = async (input, init) => {
-            const tokenResponse = await this.getToken(cred.credential.id);
-            const token = tokenResponse.token?.accessToken;
-            if (!token) {
-                throw new Error('Token not found');
-            }
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `Bearer ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `Bearer ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `Bearer ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    oauth2Fetcher(cred, fn) {
-        const refreshFn = async (input, init, forceRefresh = false) => {
-            const tokenResponse = await this.getToken(cred.credential.id, forceRefresh);
-            const token = tokenResponse.token?.accessToken;
-            const tokenType = tokenResponse.token?.tokenType;
-            if (!token) {
-                throw new Error('Token not found');
-            }
-            const _tokenType = () => {
-                const _tt = tokenType?.toLowerCase();
-                switch (_tt) {
-                    case 'bearer':
-                        return 'Bearer';
-                    case 'mac':
-                        return 'MAC';
-                    case 'basic':
-                        return 'Basic';
-                    default:
-                        return 'Bearer';
-                }
-            };
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', `${_tokenType()} ${token}`);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', `${_tokenType()} ${token}`]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: `${_tokenType()} ${token}`,
-                };
-            }
-            return fn(input, init);
-        };
-        const _fn = async (input, init) => {
-            const resp = await refreshFn(input, init);
-            if (resp.status === 401) {
-                this.log.debug('Received 401 Unauthorized response, attempting refresh', {
-                    url: input,
-                    status: resp.status,
-                });
-                // TODO: attempt refresh until precondition failed??
-                return refreshFn(input, init, true);
-            }
-            return Promise.resolve(resp);
-        };
-        return _fn;
-    }
-    oauth1Fetcher(cred, fn) {
-        const _fn = async (input, init) => {
-            const metadata = await this.getOAuth1Metadata(cred.credential.id);
-            const authParams = new URLSearchParams(metadata.authorizationMetadata?.authorizationParams);
-            if (!metadata.authorizationMetadata) {
-                throw new Error('OAuth1 metadata not found');
-            }
-            const oauth = new OAuth({
-                consumer: {
-                    key: metadata.authorizationMetadata.consumerKey,
-                    secret: metadata.authorizationMetadata.consumerSecret,
-                },
-                signature_method: 'HMAC-SHA256',
-                hash_function: (baseString, key) => createHmac('sha256', key).update(baseString).digest('base64'),
-                realm: authParams.get('realm') || undefined,
-            });
-            let url;
-            if (input instanceof Request) {
-                url = input.url;
-            }
-            else if (input instanceof URL) {
-                url = input.toString();
-            }
-            else if (typeof input === 'string') {
-                url = input;
-            }
-            else {
-                throw new Error('Invalid input type for OAuth1 fetcher');
-            }
-            const header = oauth.toHeader(oauth.authorize({
-                url: url,
-                method: init?.method || 'GET',
-            }, {
-                key: metadata.authorizationMetadata?.oauthToken,
-                secret: metadata.authorizationMetadata?.oauthTokenSecret,
-            }));
-            const authHeader = header.Authorization;
-            if (!init) {
-                init = {};
-            }
-            if (!init.headers) {
-                init.headers = new Headers();
-            }
-            if (init.headers instanceof Headers) {
-                init.headers.set('Authorization', authHeader);
-            }
-            else if (init.headers instanceof Array) {
-                init.headers.push(['Authorization', authHeader]);
-            }
-            else {
-                init.headers = {
-                    ...init.headers,
-                    ['Authorization']: authHeader,
-                };
-            }
-            return fn(input, init);
-        };
-        return _fn;
-    }
-    mtlsFetcher(cred, fn) {
-        const _fn = async (input, init) => {
-            const raw = await this.getRaw(cred.credential.id);
-            if (!raw?.credential?.data) {
-                throw new Error(`Cannot fetch MTLS credentials for connection ${cred.credential.name}, no data found`);
-            }
-            const cert = new TextDecoder().decode(raw.credential.data['certificate']);
-            const key = new TextDecoder().decode(raw.credential.data['key']);
-            const caCerts = new TextDecoder().decode(raw.credential.data['ca'] || '');
-            const httpClient = Deno.createHttpClient({
-                cert,
-                key,
-                caCerts: caCerts ? [caCerts] : [],
-            });
-            return fn(input, {
-                ...init,
-                client: httpClient,
-            });
-        };
-        return _fn;
-    }
-    async getToken(id, forceRefresh = false) {
-        try {
-            return await this.tokenClient.getToken(id, forceRefresh);
-        }
-        catch (error) {
-            this.log.error('unable to get token credential', { error });
-            if (error instanceof ConnectError) {
-                if (error.rawMessage.includes('connection error received: not a result of an error') &&
-                    error.code === Code.Internal) {
-                    this.log.info('Connection error received, attempting to reconnect');
-                    this.tokenClient = new VersoriCredentialClient(this.credsBaseURL);
-                    return await this.tokenClient.getToken(id);
-                }
-                throw error;
-            }
-            throw error;
-        }
-    }
-    async getRaw(id) {
-        try {
-            return await this.tokenClient.getRaw(id);
-        }
-        catch (error) {
-            this.log.error('unable to get raw credential', { error });
-            if (error instanceof ConnectError) {
-                if (error.rawMessage.includes('connection error received: not a result of an error') &&
-                    error.code === Code.Internal) {
-                    this.log.info('Connection error received, attempting to reconnect');
-                    this.tokenClient = new VersoriCredentialClient(this.credsBaseURL);
-                    return await this.tokenClient.getRaw(id);
-                }
-                throw error;
-            }
-            throw error;
-        }
-    }
-    async getOAuth1Metadata(id) {
-        try {
-            return await this.tokenClient.getOAuth1Metadata(id);
-        }
-        catch (error) {
-            this.log.error('unable to get OAuth1 metadata', { error });
-            if (error instanceof ConnectError) {
-                if (error.rawMessage.includes('connection error received: not a result of an error') &&
-                    error.code === Code.Internal) {
-                    this.log.info('Connection error received, attempting to reconnect');
-                    this.tokenClient = new VersoriCredentialClient(this.credsBaseURL);
-                    return await this.tokenClient.getOAuth1Metadata(id);
-                }
-                throw error;
-            }
-            throw error;
-        }
-    }
-}