@voyant-travel/apps 0.2.0 → 0.4.0

package/dist/contracts.js

@@ -221,3 +221,53 @@ export const appWebhookReplaySchema = z
     signingSecret: z.string().min(32),
 })
     .strict();
+export const appOAuthAuthorizeQuerySchema = z
+    .object({
+    response_type: z.literal("code"),
+    client_id: z.string().trim().min(1),
+    release_id: z.string().trim().min(1),
+    redirect_uri: z.string().url(),
+    state: z.string().trim().min(1),
+    code_challenge: z.string().trim().min(1),
+    code_challenge_method: z.literal("S256"),
+    actor_id: z.string().trim().min(1),
+    operator_scopes: z.string().trim().default(""),
+    optional_scopes: z.string().trim().default(""),
+})
+    .strict();
+export const appOAuthTokenSchema = z
+    .discriminatedUnion("grant_type", [
+    z.object({
+        grant_type: z.literal("authorization_code"),
+        code: z.string().trim().min(1),
+        redirect_uri: z.string().url(),
+        code_verifier: z.string().trim().min(43).max(128),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("refresh_token"),
+        refresh_token: z.string().trim().min(1),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+    z.object({
+        grant_type: z.literal("urn:voyant:params:oauth:grant-type:actor-token-exchange"),
+        installation_id: z.string().trim().min(1),
+        viewer_id: z.string().trim().min(1),
+        viewer_scopes: z.array(scopeSchema).default([]),
+        contextual_scopes: z.array(scopeSchema).optional(),
+        client_id: z.string().trim().min(1),
+        client_secret: z.string().trim().optional(),
+    }),
+])
+    .transform((input) => ({
+    ...input,
+    client_secret: input.client_secret?.trim() || undefined,
+}));
+export const appCredentialRevocationSchema = z
+    .object({
+    installationId: z.string().trim().min(1),
+    actorId: z.string().trim().min(1),
+})
+    .strict();

package/dist/index.d.ts

@@ -1,9 +1,16 @@
+export * from "./access-boundary.js";
+export * from "./app-api-contracts.js";
+export * from "./app-api-routes.js";
+export * from "./app-api-service.js";
 export * from "./compiler.js";
+export * from "./consent.js";
 export * from "./contracts.js";
 export * from "./ingestion.js";
 export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";
-export { appAccessCredentialStatusEnum, appAccessCredentials, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
 export { createAppsService } from "./service.js";
 export type { AppWebhookDeliveryOptions } from "./webhook-delivery.js";
 export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/index.js

@@ -1,8 +1,15 @@
+export * from "./access-boundary.js";
+export * from "./app-api-contracts.js";
+export * from "./app-api-routes.js";
+export * from "./app-api-service.js";
 export * from "./compiler.js";
+export * from "./consent.js";
 export * from "./contracts.js";
 export * from "./ingestion.js";
 export * from "./installation-service.js";
+export * from "./oauth-crypto.js";
+export * from "./oauth-service.js";
 export { createAppsAdminRoutes } from "./routes.js";
-export { appAccessCredentialStatusEnum, appAccessCredentials, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
+export { appAccessCredentialStatusEnum, appAccessCredentials, appAccessTokenModeEnum, appAuditEventKindEnum, appAuditEvents, appCredentialKindEnum, appCredentials, appDistributionEnum, appExtensionInstallations, appGrantStatusEnum, appGrants, appInstallationRegistrationStatusEnum, appInstallationSettings, appInstallationStatusEnum, appInstallations, appInstallationUpdatePolicyEnum, appLifecycleStateEnum, appOAuthAuthorizationCodes, appOAuthRefreshTokens, appRedirectUris, appReleaseArtifactStateEnum, appReleaseArtifacts, appReleaseLocalizations, appReleaseStateEnum, appReleases, appSecretReferences, apps, appWebhookSubscriptionStatusEnum, appWebhookSubscriptions, } from "./schema.js";
 export { createAppsService } from "./service.js";
 export { createAppWebhookDeliveryStore, createAppWebhookEventQueue, enqueueAppWebhookEvent, listAppWebhookHealth, replayAppWebhookDelivery, } from "./webhook-delivery.js";

package/dist/installation-reconciliation.d.ts

@@ -14,5 +14,5 @@ export declare function deactivateRuntimeState(db: PostgresJsDatabase, installat
 export declare function deactivateResolvedRegistrations(db: PostgresJsDatabase, installation: AppInstallation): Promise<void>;
 export declare function markAppDefinitionsInactive(db: PostgresJsDatabase, installation: AppInstallation, actorId: string): Promise<void>;
 export declare function countInstallationRows(db: PostgresJsDatabase, table: typeof appGrants | typeof appAccessCredentials | typeof appExtensionInstallations | typeof appWebhookSubscriptions, installationId: string): Promise<number>;
-export declare function audit(db: PostgresJsDatabase, installation: AppInstallation, actorId: string, kind: "lifecycle" | "grant" | "credential" | "reconciliation" | "purge", action: string, details: Record<string, unknown>): Promise<void>;
+export declare function audit(db: PostgresJsDatabase, installation: AppInstallation, actorId: string, kind: "lifecycle" | "grant" | "consent" | "credential" | "token" | "reconciliation" | "purge", action: string, details: Record<string, unknown>): Promise<void>;
 export {};

package/dist/installation-reconciliation.js

@@ -1,7 +1,7 @@
 import { createAppCustomFieldDefinitionOwner, customFieldDefinitions, } from "@voyant-travel/custom-fields";
 import { ApiHttpError } from "@voyant-travel/hono";
 import { and, eq, sql } from "drizzle-orm";
-import { appAccessCredentials, appAuditEvents, appExtensionInstallations, appGrants, appWebhookSubscriptions, } from "./schema.js";
+import { appAccessCredentials, appAuditEvents, appExtensionInstallations, appGrants, appOAuthRefreshTokens, appWebhookSubscriptions, } from "./schema.js";
 export async function reconcileRelease(db, installation, release, actorId, action, options) {
     const normalized = parseNormalizedRelease(release.normalizedRecord);
     await reconcileCustomFields(db, installation, release, normalized, actorId, options);
@@ -78,6 +78,10 @@ export async function deactivateRuntimeState(db, installation) {
         .update(appAccessCredentials)
         .set({ status: "inactive", deactivatedAt: now })
         .where(eq(appAccessCredentials.installationId, installation.id));
+    await db
+        .update(appOAuthRefreshTokens)
+        .set({ status: "revoked", revokedAt: now })
+        .where(eq(appOAuthRefreshTokens.installationId, installation.id));
     await deactivateResolvedRegistrations(db, installation);
 }
 export async function deactivateResolvedRegistrations(db, installation) {

package/dist/installation-service.d.ts

@@ -58,6 +58,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -76,15 +77,16 @@ export declare function createAppInstallationService(options?: AppInstallationSe
         outcome: "unchanged";
     } | {
         installation: {
-            status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             id: string;
             createdAt: Date;
             updatedAt: Date;
             appId: string;
             releaseId: string;
             deploymentId: string;
+            status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -98,7 +100,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             uninstalledAt: Date | null;
             purgedAt: Date | null;
         };
-        outcome: "created" | "reinstalled";
+        outcome: "reinstalled" | "created";
     }>;
     upgrade: (db: PostgresJsDatabase, input: UpgradeAppInput) => Promise<{
         installation: {
@@ -109,6 +111,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -135,6 +138,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -162,6 +166,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -187,6 +192,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -213,6 +219,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -238,6 +245,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -264,6 +272,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -289,6 +298,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;
@@ -315,6 +325,7 @@ export declare function createAppInstallationService(options?: AppInstallationSe
             status: "active" | "pending" | "authorizing" | "paused" | "degraded" | "revoked" | "uninstalled";
             namespace: string;
             installedBy: string;
+            credentialGeneration: number;
             updatePolicy: "manual" | "compatible" | "patch" | "pinned";
             lastCompatibleReleaseCheckAt: Date | null;
             pendingReleaseId: string | null;

package/dist/installation-service.js

@@ -1,5 +1,5 @@
 import { ApiHttpError } from "@voyant-travel/hono";
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { audit, countInstallationRows, deactivateResolvedRegistrations, deactivateRuntimeState, markAppDefinitionsInactive, newlyRequiredScopes, reconcileGrants, reconcileRelease, rotateCredential, } from "./installation-reconciliation.js";
 import { canInstallOver, invalidTransition, planLifecycleTransition } from "./installation-state.js";
 import { appAccessCredentials, appExtensionInstallations, appGrants, appInstallations, appReleases, apps, appWebhookSubscriptions, } from "./schema.js";
@@ -295,14 +295,29 @@ function lifecyclePatch(to, now) {
     const base = { status: to, updatedAt: now };
     if (to === "active")
         return { ...base, activatedAt: now };
-    if (to === "paused")
-        return { ...base, pausedAt: now };
+    if (to === "paused") {
+        return {
+            ...base,
+            pausedAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
     if (to === "degraded")
         return { ...base, degradedAt: now };
-    if (to === "revoked")
-        return { ...base, revokedAt: now };
-    if (to === "uninstalled")
-        return { ...base, uninstalledAt: now };
+    if (to === "revoked") {
+        return {
+            ...base,
+            revokedAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
+    if (to === "uninstalled") {
+        return {
+            ...base,
+            uninstalledAt: now,
+            credentialGeneration: sql `${appInstallations.credentialGeneration} + 1`,
+        };
+    }
     return base;
 }
 function writeFailed() {

package/dist/oauth-crypto.d.ts

@@ -0,0 +1,8 @@
+export declare const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export declare const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export declare const APP_AUTH_CODE_PREFIX = "vappc_";
+export declare function randomToken(prefix: string, bytes?: number): string;
+export declare function sha256Hex(value: string): string;
+export declare function sha256Base64Url(value: string): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+export declare function verifyPkceS256(verifier: string, challenge: string): boolean;

package/dist/oauth-crypto.js

@@ -0,0 +1,23 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export const APP_ACCESS_TOKEN_PREFIX = "vapp_";
+export const APP_REFRESH_TOKEN_PREFIX = "vappr_";
+export const APP_AUTH_CODE_PREFIX = "vappc_";
+export function randomToken(prefix, bytes = 32) {
+    return `${prefix}${randomBytes(bytes).toString("base64url")}`;
+}
+export function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function sha256Base64Url(value) {
+    return createHash("sha256").update(value).digest("base64url");
+}
+export function constantTimeEqual(left, right) {
+    const leftHash = Buffer.from(sha256Hex(left), "hex");
+    const rightHash = Buffer.from(sha256Hex(right), "hex");
+    return timingSafeEqual(leftHash, rightHash);
+}
+export function verifyPkceS256(verifier, challenge) {
+    if (!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))
+        return false;
+    return constantTimeEqual(sha256Base64Url(verifier), challenge);
+}

package/dist/oauth-crypto.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/oauth-crypto.test.js

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { sha256Base64Url, verifyPkceS256 } from "./oauth-crypto.js";
+describe("app OAuth PKCE", () => {
+    it("accepts only S256 challenges derived from the verifier", () => {
+        const verifier = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ_0123456789-1234567890";
+        const challenge = sha256Base64Url(verifier);
+        expect(verifyPkceS256(verifier, challenge)).toBe(true);
+        expect(verifyPkceS256(`${verifier}x`, challenge)).toBe(false);
+        expect(verifyPkceS256("too-short", challenge)).toBe(false);
+    });
+});

package/dist/oauth-service.d.ts

@@ -0,0 +1,66 @@
+import type { VoyantAuthContext } from "@voyant-travel/core";
+import type { AccessCatalog } from "@voyant-travel/types/api-keys";
+import type { PostgresJsDatabase } from "drizzle-orm/postgres-js";
+export interface AppOAuthServiceOptions {
+    accessCatalog: AccessCatalog;
+    deploymentId: string;
+    now?: () => Date;
+}
+export interface AuthorizeAppInput {
+    appId: string;
+    releaseId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+    actorId: string;
+    operatorGrantedScopes: readonly string[];
+    grantedOptionalScopes?: readonly string[];
+}
+export interface TokenCodeInput {
+    grantType: "authorization_code";
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+    clientId: string;
+    clientSecret?: string;
+}
+export interface RefreshTokenInput {
+    grantType: "refresh_token";
+    refreshToken: string;
+    clientId: string;
+    clientSecret?: string;
+}
+export interface TokenExchangeInput {
+    grantType: "urn:voyant:params:oauth:grant-type:actor-token-exchange";
+    installationId: string;
+    viewerId: string;
+    viewerScopes: readonly string[];
+    contextualScopes?: readonly string[];
+    clientId: string;
+    clientSecret?: string;
+}
+export type AppTokenInput = TokenCodeInput | RefreshTokenInput | TokenExchangeInput;
+export declare function createAppOAuthService(options: AppOAuthServiceOptions): {
+    authorize: (db: PostgresJsDatabase, input: AuthorizeAppInput) => Promise<{
+        code: string;
+        state: string;
+        redirectUri: string;
+        expiresAt: Date;
+    }>;
+    token: (db: PostgresJsDatabase, input: AppTokenInput) => Promise<{
+        refreshToken?: string | undefined;
+        accessToken: string;
+        tokenType: "Bearer";
+        expiresIn: number;
+        scope: string;
+        tokenMode: "offline" | "online";
+    }>;
+    resolveAccessToken: (db: PostgresJsDatabase, rawToken: string) => Promise<VoyantAuthContext | null>;
+    revokeInstallationCredentials: (db: PostgresJsDatabase, installationId: string, actorId: string) => Promise<{
+        installationId: string;
+        generation: number;
+    }>;
+};
+export declare function intersectAppTokenScopes(...sets: readonly (readonly string[])[]): string[];
+export declare function readStoredScopes(metadata: Record<string, unknown>): string[] | null;