@vymalo/opencode-oauth2 0.14.1 → 0.15.0

package/dist/oauth/device-code.js

@@ -1,247 +0,0 @@
-import { toTokenSet } from "./client.js";
-import { readResponseBodyPreview as readResponsePreviewShared, scrubSecrets } from "./http-utils.js";
-import { generatePkcePair } from "./pkce.js";
-const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-const DEFAULT_POLL_INTERVAL_SECONDS = 5;
-const SLOW_DOWN_INCREMENT_SECONDS = 5;
-const ERROR_BODY_PREVIEW_CHARS = 500;
-// Cap on the polling interval itself, not on the number of retries. We never
-// hard-stop on transient transport errors — a VPN flap or DNS hiccup mid-flow
-// should not abort an in-progress device-code session. The `expires_in`
-// deadline bounds the overall wait. The cap keeps the interval from growing
-// without bound while we wait for transient conditions to clear.
-const MAX_POLL_INTERVAL_SECONDS = 60;
-function defaultSleep(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
-async function readResponseBodyPreview(response) {
-	return readResponsePreviewShared(response, ERROR_BODY_PREVIEW_CHARS);
-}
-function parseDeviceAuthorizationResponse(payload) {
-	if (!payload || typeof payload !== "object") {
-		throw new Error("device authorization response is not a JSON object");
-	}
-	const record = payload;
-	const deviceCode = record.device_code;
-	const userCode = record.user_code;
-	const verificationUri = record.verification_uri;
-	const expiresIn = record.expires_in;
-	if (typeof deviceCode !== "string" || deviceCode.length === 0) {
-		throw new Error("device authorization response is missing device_code");
-	}
-	if (typeof userCode !== "string" || userCode.length === 0) {
-		throw new Error("device authorization response is missing user_code");
-	}
-	if (typeof verificationUri !== "string" || verificationUri.length === 0) {
-		throw new Error("device authorization response is missing verification_uri");
-	}
-	if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
-		throw new Error("device authorization response is missing a valid expires_in");
-	}
-	const verificationUriComplete = typeof record.verification_uri_complete === "string" && record.verification_uri_complete.length > 0 ? record.verification_uri_complete : undefined;
-	const interval = typeof record.interval === "number" && Number.isFinite(record.interval) && record.interval > 0 ? Math.ceil(record.interval) : undefined;
-	return {
-		device_code: deviceCode,
-		user_code: userCode,
-		verification_uri: verificationUri,
-		verification_uri_complete: verificationUriComplete,
-		expires_in: expiresIn,
-		interval
-	};
-}
-export async function acquireTokenViaDeviceCode(options) {
-	const fetchImpl = options.fetchImpl ?? fetch;
-	const sleep = options.sleep ?? defaultSleep;
-	const now = options.now ?? Date.now;
-	const { logger, serverId } = options;
-	// PKCE for the device flow (RFC 8628 + RFC 7636). Keycloak enforces this when
-	// the client's "Proof Key for Code Exchange Code Challenge Method" is set, and
-	// rejects the device-authorization request with
-	// `invalid_request: Missing parameter: code_challenge_method` otherwise. On by
-	// default — providers that don't require PKCE ignore it — and opt-out via the
-	// `pkce` server option for non-compliant IdPs. Mirrors the authorization_code
-	// flow.
-	const usePkce = options.pkce !== false;
-	const pkce = usePkce ? generatePkcePair() : undefined;
-	// Step 1: request a device code.
-	const deviceAuthBody = new URLSearchParams({
-		client_id: options.clientId,
-		scope: options.scopes.join(" ")
-	});
-	if (pkce) {
-		deviceAuthBody.set("code_challenge", pkce.challenge);
-		deviceAuthBody.set("code_challenge_method", "S256");
-	}
-	if (options.clientSecret) {
-		deviceAuthBody.set("client_secret", options.clientSecret);
-	}
-	const deviceAuthController = new AbortController();
-	const deviceAuthTimeout = setTimeout(() => deviceAuthController.abort(), options.timeoutMs);
-	let deviceAuthResponse;
-	try {
-		deviceAuthResponse = await fetchImpl(options.deviceAuthorizationEndpoint, {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded",
-				Accept: "application/json"
-			},
-			body: deviceAuthBody,
-			signal: deviceAuthController.signal
-		});
-	} finally {
-		clearTimeout(deviceAuthTimeout);
-	}
-	if (!deviceAuthResponse.ok) {
-		const preview = await readResponseBodyPreview(deviceAuthResponse);
-		// Log the body separately at error-level so the logger's redaction filter
-		// can scrub matching keys (e.g. a verbose provider echoing `client_secret`
-		// back in the response). Never embed the body in error.message — callers
-		// log error.message verbatim, bypassing the redaction filter.
-		logger.error("oauth_device_authorization_failed", {
-			serverId,
-			status: deviceAuthResponse.status,
-			bodyPreview: preview ? scrubSecrets(preview) : undefined
-		});
-		throw new Error(`device authorization request failed (${deviceAuthResponse.status})`);
-	}
-	const deviceAuthPayload = await deviceAuthResponse.json();
-	const deviceAuth = parseDeviceAuthorizationResponse(deviceAuthPayload);
-	const verificationUri = deviceAuth.verification_uri_complete ?? deviceAuth.verification_uri;
-	// user_code is an ephemeral, single-use code with no value outside the active
-	// flow — that is the spec's intent (RFC 8628). Log it so operators can see the
-	// active code and forward it to the user if needed.
-	logger.info("oauth_device_code_issued", {
-		verificationUri,
-		userCode: deviceAuth.user_code,
-		expiresIn: deviceAuth.expires_in,
-		serverId
-	});
-	// Also surface to stderr so terminal users can see the code regardless of log
-	// routing. Mirrors the browser-fallback pattern in client.ts.
-	process.stderr.write(`\n[opencode-oauth2] device-code login for ${serverId}:\n  visit: ${verificationUri}\n  code:  ${deviceAuth.user_code}\n  (expires in ${deviceAuth.expires_in}s)\n\n`);
-	// Step 2: poll the token endpoint.
-	let intervalSeconds = deviceAuth.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
-	const deadlineMs = now() + deviceAuth.expires_in * 1e3;
-	let consecutiveTransientFailures = 0;
-	while (true) {
-		const remainingMs = deadlineMs - now();
-		if (remainingMs <= 0) {
-			throw new Error("device code expired before authorization completed");
-		}
-		await sleep(Math.min(intervalSeconds * 1e3, remainingMs));
-		const pollBody = new URLSearchParams({
-			grant_type: DEVICE_CODE_GRANT_TYPE,
-			device_code: deviceAuth.device_code,
-			client_id: options.clientId
-		});
-		if (pkce) {
-			pollBody.set("code_verifier", pkce.verifier);
-		}
-		if (options.clientSecret) {
-			pollBody.set("client_secret", options.clientSecret);
-		}
-		const pollController = new AbortController();
-		const pollTimeout = setTimeout(() => pollController.abort(), options.timeoutMs);
-		let pollResponse;
-		try {
-			pollResponse = await fetchImpl(options.tokenEndpoint, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/x-www-form-urlencoded",
-					Accept: "application/json"
-				},
-				body: pollBody,
-				signal: pollController.signal
-			});
-			// Reset the failure counter on any HTTP response — even a non-2xx one
-			// is a sign the network round-trip is working; only thrown exceptions
-			// (network errors, timeouts) count as transient failures.
-			consecutiveTransientFailures = 0;
-		} catch (error) {
-			// TypeError from fetch typically means a programming/configuration
-			// error (malformed URL, unsupported scheme) that won't resolve on
-			// retry. Fail fast on those instead of burning the expires_in window.
-			// Everything else (AbortError from timeout, network errors, DNS
-			// failures) is treated as transient and triggers backoff per
-			// RFC 8628 §3.5.
-			if (error instanceof TypeError) {
-				logger.error("oauth_device_code_poll_failed", {
-					serverId,
-					error: error.message
-				});
-				throw error;
-			}
-			consecutiveTransientFailures++;
-			// Exponential backoff (capped) on transient transport errors. We do
-			// NOT hard-stop: VPN flaps, transient DNS/TLS outages, and similar
-			// short-lived disruptions are normal during a multi-minute device-code
-			// window. The `expires_in` deadline at the top of the loop is the
-			// sole termination condition.
-			intervalSeconds = Math.min(intervalSeconds + SLOW_DOWN_INCREMENT_SECONDS, MAX_POLL_INTERVAL_SECONDS);
-			logger.warn("oauth_device_code_poll_transient_error", {
-				serverId,
-				error: error instanceof Error ? error.message : String(error),
-				consecutiveFailures: consecutiveTransientFailures,
-				nextIntervalSeconds: intervalSeconds
-			});
-			continue;
-		} finally {
-			clearTimeout(pollTimeout);
-		}
-		if (pollResponse.ok) {
-			const payload = await pollResponse.json();
-			const token = toTokenSet(payload, { requireRefreshToken: true });
-			logger.info("oauth_device_code_success", {
-				serverId,
-				hasRefreshToken: true
-			});
-			return token;
-		}
-		if (pollResponse.status >= 400 && pollResponse.status < 500) {
-			let errorPayload = {};
-			const text = await readResponseBodyPreview(pollResponse);
-			try {
-				if (text.length > 0) {
-					errorPayload = JSON.parse(text);
-				}
-			} catch {}
-			const errorCode = errorPayload.error;
-			if (errorCode === "authorization_pending") {
-				continue;
-			}
-			if (errorCode === "slow_down") {
-				intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
-				continue;
-			}
-			if (errorCode === "expired_token") {
-				throw new Error("device code expired before user completed authorization");
-			}
-			if (errorCode === "access_denied") {
-				throw new Error("device code authorization denied by user");
-			}
-			logger.error("oauth_device_code_poll_failed", {
-				serverId,
-				status: pollResponse.status,
-				errorCode: errorCode || undefined,
-				// Body preview goes here, not into the thrown error.message — callers
-				// log error.message verbatim and would bypass the logger's redaction.
-				// scrubSecrets masks token-shaped substrings the field-name-based
-				// logger redaction would otherwise miss.
-				bodyPreview: text ? scrubSecrets(text) : undefined
-			});
-			throw new Error(`device code token poll failed (${pollResponse.status})${errorCode ? `: ${errorCode}` : ""}`);
-		}
-		// 5xx — surface to caller; do not retry indefinitely on server errors.
-		const preview = await readResponseBodyPreview(pollResponse);
-		logger.error("oauth_device_code_poll_failed", {
-			serverId,
-			status: pollResponse.status,
-			bodyPreview: preview ? scrubSecrets(preview) : undefined
-		});
-		throw new Error(`device code token poll failed (${pollResponse.status})`);
-	}
-}
-
-//# sourceMappingURL=device-code.js.map

package/dist/oauth/device-code.js.map

@@ -1 +0,0 @@
-{"mappings":"AAEA,SAAS,kBAAkB;AAC3B,SACE,2BAA2B,2BAC3B,oBACK;AACP,SAAS,wBAAwB;AAEjC,MAAM,yBAAyB;AAC/B,MAAM,gCAAgC;AACtC,MAAM,8BAA8B;AACpC,MAAM,2BAA2B;;;;;;AAMjC,MAAM,4BAA4B;AA0ClC,SAAS,aAAa,IAA2B;CAC/C,OAAO,IAAI,SAAS,YAAY;EAC9B,WAAW,SAAS,EAAE;CACxB,CAAC;AACH;AAEA,eAAe,wBAAwB,UAAqC;CAC1E,OAAO,0BAA0B,UAAU,wBAAwB;AACrE;AAEA,SAAS,iCAAiC,SAA+C;CACvF,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;EAC3C,MAAM,IAAI,MAAM,oDAAoD;CACtE;CAEA,MAAM,SAAS;CACf,MAAM,aAAa,OAAO;CAC1B,MAAM,WAAW,OAAO;CACxB,MAAM,kBAAkB,OAAO;CAC/B,MAAM,YAAY,OAAO;CAEzB,IAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;EAC7D,MAAM,IAAI,MAAM,sDAAsD;CACxE;CACA,IAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;EACzD,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,IAAI,OAAO,oBAAoB,YAAY,gBAAgB,WAAW,GAAG;EACvE,MAAM,IAAI,MAAM,2DAA2D;CAC7E;CACA,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,GAAG;EAClF,MAAM,IAAI,MAAM,6DAA6D;CAC/E;CAEA,MAAM,0BACJ,OAAO,OAAO,8BAA8B,YAC5C,OAAO,0BAA0B,SAAS,IACtC,OAAO,4BACP;CAEN,MAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,OAAO,QAAQ,KAAK,OAAO,WAAW,IACzF,KAAK,KAAK,OAAO,QAAQ,IACzB;CAEN,OAAO;EACL,aAAa;EACb,WAAW;EACX,kBAAkB;EAClB,2BAA2B;EAC3B,YAAY;EACZ;CACF;AACF;AAEA,OAAO,eAAe,0BACpB,SACmB;CACnB,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,EAAE,QAAQ,aAAa;;;;;;;;CAS7B,MAAM,UAAU,QAAQ,SAAS;CACjC,MAAM,OAAO,UAAU,iBAAiB,IAAI;;CAG5C,MAAM,iBAAiB,IAAI,gBAAgB;EACzC,WAAW,QAAQ;EACnB,OAAO,QAAQ,OAAO,KAAK,GAAG;CAChC,CAAC;CAED,IAAI,MAAM;EACR,eAAe,IAAI,kBAAkB,KAAK,SAAS;EACnD,eAAe,IAAI,yBAAyB,MAAM;CACpD;CAEA,IAAI,QAAQ,cAAc;EACxB,eAAe,IAAI,iBAAiB,QAAQ,YAAY;CAC1D;CAEA,MAAM,uBAAuB,IAAI,gBAAgB;CACjD,MAAM,oBAAoB,iBAAiB,qBAAqB,MAAM,GAAG,QAAQ,SAAS;CAE1F,IAAI;CACJ,IAAI;EACF,qBAAqB,MAAM,UAAU,QAAQ,6BAA6B;GACxE,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM;GACN,QAAQ,qBAAqB;EAC/B,CAAC;CACH,UAAU;EACR,aAAa,iBAAiB;CAChC;CAEA,IAAI,CAAC,mBAAmB,IAAI;EAC1B,MAAM,UAAU,MAAM,wBAAwB,kBAAkB;;;;;EAKhE,OAAO,MAAM,qCAAqC;GAChD;GACA,QAAQ,mBAAmB;GAC3B,aAAa,UAAU,aAAa,OAAO,IAAI;EACjD,CAAC;EACD,MAAM,IAAI,MAAM,wCAAwC,mBAAmB,OAAO,EAAE;CACtF;CAEA,MAAM,oBAAqB,MAAM,mBAAmB,KAAK;CACzD,MAAM,aAAa,iCAAiC,iBAAiB;CAErE,MAAM,kBAAkB,WAAW,6BAA6B,WAAW;;;;CAK3E,OAAO,KAAK,4BAA4B;EACtC;EACA,UAAU,WAAW;EACrB,WAAW,WAAW;EACtB;CACF,CAAC;;;CAID,QAAQ,OAAO,MACb,6CAA6C,SAAS,cAAc,gBAAgB,aAAa,WAAW,UAAU,kBAAkB,WAAW,WAAW,OAChK;;CAGA,IAAI,kBAAkB,WAAW,YAAY;CAC7C,MAAM,aAAa,IAAI,IAAI,WAAW,aAAa;CACnD,IAAI,+BAA+B;CAEnC,OAAO,MAAM;EACX,MAAM,cAAc,aAAa,IAAI;EACrC,IAAI,eAAe,GAAG;GACpB,MAAM,IAAI,MAAM,oDAAoD;EACtE;EAEA,MAAM,MAAM,KAAK,IAAI,kBAAkB,KAAM,WAAW,CAAC;EAEzD,MAAM,WAAW,IAAI,gBAAgB;GACnC,YAAY;GACZ,aAAa,WAAW;GACxB,WAAW,QAAQ;EACrB,CAAC;EAED,IAAI,MAAM;GACR,SAAS,IAAI,iBAAiB,KAAK,QAAQ;EAC7C;EAEA,IAAI,QAAQ,cAAc;GACxB,SAAS,IAAI,iBAAiB,QAAQ,YAAY;EACpD;EAEA,MAAM,iBAAiB,IAAI,gBAAgB;EAC3C,MAAM,cAAc,iBAAiB,eAAe,MAAM,GAAG,QAAQ,SAAS;EAE9E,IAAI;EACJ,IAAI;GACF,eAAe,MAAM,UAAU,QAAQ,eAAe;IACpD,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;IACV;IACA,MAAM;IACN,QAAQ,eAAe;GACzB,CAAC;;;;GAID,+BAA+B;EACjC,SAAS,OAAO;;;;;;;GAOd,IAAI,iBAAiB,WAAW;IAC9B,OAAO,MAAM,iCAAiC;KAC5C;KACA,OAAO,MAAM;IACf,CAAC;IACD,MAAM;GACR;GACA;;;;;;GAMA,kBAAkB,KAAK,IACrB,kBAAkB,6BAClB,yBACF;GACA,OAAO,KAAK,0CAA0C;IACpD;IACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,qBAAqB;IACrB,qBAAqB;GACvB,CAAC;GACD;EACF,UAAU;GACR,aAAa,WAAW;EAC1B;EAEA,IAAI,aAAa,IAAI;GACnB,MAAM,UAAW,MAAM,aAAa,KAAK;GACzC,MAAM,QAAQ,WAAW,SAAS,EAAE,qBAAqB,KAAK,CAAC;GAE/D,OAAO,KAAK,6BAA6B;IACvC;IACA,iBAAiB;GACnB,CAAC;GAED,OAAO;EACT;EAEA,IAAI,aAAa,UAAU,OAAO,aAAa,SAAS,KAAK;GAC3D,IAAI,eAAkC,CAAC;GACvC,MAAM,OAAO,MAAM,wBAAwB,YAAY;GACvD,IAAI;IACF,IAAI,KAAK,SAAS,GAAG;KACnB,eAAe,KAAK,MAAM,IAAI;IAChC;GACF,QAAQ,CAER;GAEA,MAAM,YAAY,aAAa;GAE/B,IAAI,cAAc,yBAAyB;IACzC;GACF;GAEA,IAAI,cAAc,aAAa;IAC7B,mBAAmB;IACnB;GACF;GAEA,IAAI,cAAc,iBAAiB;IACjC,MAAM,IAAI,MAAM,yDAAyD;GAC3E;GAEA,IAAI,cAAc,iBAAiB;IACjC,MAAM,IAAI,MAAM,0CAA0C;GAC5D;GAEA,OAAO,MAAM,iCAAiC;IAC5C;IACA,QAAQ,aAAa;IACrB,WAAW,aAAa;;;;;IAKxB,aAAa,OAAO,aAAa,IAAI,IAAI;GAC3C,CAAC;GACD,MAAM,IAAI,MACR,kCAAkC,aAAa,OAAO,GAAG,YAAY,KAAK,cAAc,IAC1F;EACF;;EAGA,MAAM,UAAU,MAAM,wBAAwB,YAAY;EAC1D,OAAO,MAAM,iCAAiC;GAC5C;GACA,QAAQ,aAAa;GACrB,aAAa,UAAU,aAAa,OAAO,IAAI;EACjD,CAAC;EACD,MAAM,IAAI,MAAM,kCAAkC,aAAa,OAAO,EAAE;CAC1E;AACF","names":[],"sources":["../../src/oauth/device-code.ts"],"version":3,"file":"device-code.js","sourceRoot":""}

package/dist/oauth/discovery.d.ts

@@ -1,8 +0,0 @@
-export interface OidcMetadata {
-	issuer: string;
-	authorization_endpoint?: string;
-	token_endpoint: string;
-	device_authorization_endpoint?: string;
-	jwks_uri?: string;
-}
-export declare function discoverOidcMetadata(issuer: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<OidcMetadata>;

package/dist/oauth/discovery.js

@@ -1,38 +0,0 @@
-function buildWellKnownUrl(issuer) {
-	const normalizedIssuer = issuer.endsWith("/") ? issuer : `${issuer}/`;
-	const url = new URL(".well-known/openid-configuration", normalizedIssuer);
-	return url.toString();
-}
-export async function discoverOidcMetadata(issuer, fetchImpl = fetch, timeoutMs = 15e3) {
-	const url = buildWellKnownUrl(issuer);
-	const controller = new AbortController();
-	const timeout = setTimeout(() => controller.abort(), timeoutMs);
-	try {
-		const response = await fetchImpl(url, {
-			method: "GET",
-			headers: { Accept: "application/json" },
-			signal: controller.signal
-		});
-		if (!response.ok) {
-			throw new Error(`OIDC discovery failed (${response.status})`);
-		}
-		const metadata = await response.json();
-		// Only the token_endpoint is universally required — every grant we support
-		// needs it. authorization_endpoint and device_authorization_endpoint are
-		// grant-specific; callers validate per their chosen flow.
-		if (!metadata.token_endpoint) {
-			throw new Error("OIDC metadata is missing token_endpoint");
-		}
-		return {
-			issuer: metadata.issuer ?? issuer,
-			authorization_endpoint: metadata.authorization_endpoint,
-			token_endpoint: metadata.token_endpoint,
-			device_authorization_endpoint: metadata.device_authorization_endpoint,
-			jwks_uri: metadata.jwks_uri
-		};
-	} finally {
-		clearTimeout(timeout);
-	}
-}
-
-//# sourceMappingURL=discovery.js.map

package/dist/oauth/discovery.js.map

@@ -1 +0,0 @@
-{"mappings":"AAYA,SAAS,kBAAkB,QAAwB;CACjD,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;CACnE,MAAM,MAAM,IAAI,IAAI,oCAAoC,gBAAgB;CACxE,OAAO,IAAI,SAAS;AACtB;AAEA,OAAO,eAAe,qBACpB,QACA,YAA0B,OAC1B,YAAY,MACW;CACvB,MAAM,MAAM,kBAAkB,MAAM;CACpC,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,SAAS;CAE9D,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,KAAK;GACpC,QAAQ;GACR,SAAS,EAAE,QAAQ,mBAAmB;GACtC,QAAQ,WAAW;EACrB,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,IAAI,MAAM,0BAA0B,SAAS,OAAO,EAAE;EAC9D;EAEA,MAAM,WAAY,MAAM,SAAS,KAAK;;;;EAItC,IAAI,CAAC,SAAS,gBAAgB;GAC5B,MAAM,IAAI,MAAM,yCAAyC;EAC3D;EAEA,OAAO;GACL,QAAQ,SAAS,UAAU;GAC3B,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,+BAA+B,SAAS;GACxC,UAAU,SAAS;EACrB;CACF,UAAU;EACR,aAAa,OAAO;CACtB;AACF","names":[],"sources":["../../src/oauth/discovery.ts"],"version":3,"file":"discovery.js","sourceRoot":""}

package/dist/oauth/http-utils.d.ts

@@ -1,33 +0,0 @@
-/**
-* Strip credentials (`user:pass@`) and the query string from a URL before
-* including it in user-facing error messages or thrown exceptions. The query
-* string can contain access tokens, session ids, or other secrets supplied by
-* caller-controlled config — `baseURL` and `issuer` are not validated as
-* credential-free.
-*/
-export declare function redactUrl(rawUrl: string): string;
-/**
-* Read at most `maxChars` characters from a `Response`'s body without
-* buffering the rest. Cancels the underlying stream once the cap is reached so
-* the network isn't drained on a huge error page.
-*
-* Returns an empty string if the body is unreadable or empty.
-*/
-export declare function readResponseBodyPreview(response: Response, maxChars?: number): Promise<string>;
-/**
-* Mask token/credential substrings inside an arbitrary text body before it
-* lands in a structured log entry. Field-name-based redaction in upstream
-* loggers only matches whole field NAMES — it does not scrub secrets embedded
-* in arbitrary string VALUES (like an IdP error body that echoes back the
-* client_secret it received).
-*
-* Catches:
-*   - JSON: `"access_token": "..."` and the other SECRET_FIELD_NAMES
-*   - form bodies: `client_secret=...`
-*   - Bearer/Basic auth headers
-*   - bare JWT-shaped strings
-*
-* Anything not matching stays intact, so error messages keep their diagnostic
-* value (status code, error kind, descriptions, etc.).
-*/
-export declare function scrubSecrets(text: string): string;

package/dist/oauth/http-utils.js

@@ -1,118 +0,0 @@
-/**
-* Strip credentials (`user:pass@`) and the query string from a URL before
-* including it in user-facing error messages or thrown exceptions. The query
-* string can contain access tokens, session ids, or other secrets supplied by
-* caller-controlled config — `baseURL` and `issuer` are not validated as
-* credential-free.
-*/
-export function redactUrl(rawUrl) {
-	try {
-		const url = new URL(rawUrl);
-		url.username = "";
-		url.password = "";
-		url.search = "";
-		url.hash = "";
-		return url.toString();
-	} catch {
-		// Not a parseable URL — strip anything that looks like a query and any
-		// userinfo separator, then return.
-		return rawUrl.replace(/\/\/[^/@]*@/, "//").replace(/\?.*$/, "").replace(/#.*$/, "");
-	}
-}
-/**
-* Read at most `maxChars` characters from a `Response`'s body without
-* buffering the rest. Cancels the underlying stream once the cap is reached so
-* the network isn't drained on a huge error page.
-*
-* Returns an empty string if the body is unreadable or empty.
-*/
-export async function readResponseBodyPreview(response, maxChars = 500) {
-	if (!response.body) {
-		// Some runtimes attach the body lazily; fall back to text() but still cap.
-		try {
-			const text = await response.text();
-			return text.slice(0, maxChars);
-		} catch {
-			return "";
-		}
-	}
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder("utf-8", { fatal: false });
-	let collected = "";
-	try {
-		while (collected.length < maxChars) {
-			const { done, value } = await reader.read();
-			if (done) {
-				break;
-			}
-			if (!value) {
-				continue;
-			}
-			collected += decoder.decode(value, { stream: true });
-			if (collected.length >= maxChars) {
-				collected = collected.slice(0, maxChars);
-				break;
-			}
-		}
-	} catch {} finally {
-		try {
-			await reader.cancel();
-		} catch {}
-	}
-	return collected;
-}
-// Names of token/credential fields commonly echoed back by misbehaving IdPs in
-// error responses. Used both for JSON-style ("name":"value") and form-style
-// (name=value&...) substitution.
-const SECRET_FIELD_NAMES = [
-	"access_token",
-	"refresh_token",
-	"id_token",
-	"client_secret",
-	"client_assertion",
-	"code",
-	"device_code",
-	"password",
-	"assertion",
-	"subject_token",
-	"actor_token"
-];
-const REDACTED = "[redacted]";
-// Pre-built patterns so we don't re-compile on every call.
-const SECRET_JSON_PATTERN = new RegExp(
-	// "name"  :  "value"      (also handles escaped quotes inside value)
-	`("(?:${SECRET_FIELD_NAMES.join("|")})"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`,
-	"gi"
-);
-const SECRET_FORM_PATTERN = new RegExp(
-	// name=value (terminated by & or end-of-string)
-	`(\\b(?:${SECRET_FIELD_NAMES.join("|")}))=([^&\\s]+)`,
-	"gi"
-);
-// Bearer / Basic prefixes in headers/messages, plus bare JWT-shaped strings.
-const BEARER_PATTERN = /\b(Bearer|Basic)\s+([A-Za-z0-9._\-+/=]+)/g;
-const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
-/**
-* Mask token/credential substrings inside an arbitrary text body before it
-* lands in a structured log entry. Field-name-based redaction in upstream
-* loggers only matches whole field NAMES — it does not scrub secrets embedded
-* in arbitrary string VALUES (like an IdP error body that echoes back the
-* client_secret it received).
-*
-* Catches:
-*   - JSON: `"access_token": "..."` and the other SECRET_FIELD_NAMES
-*   - form bodies: `client_secret=...`
-*   - Bearer/Basic auth headers
-*   - bare JWT-shaped strings
-*
-* Anything not matching stays intact, so error messages keep their diagnostic
-* value (status code, error kind, descriptions, etc.).
-*/
-export function scrubSecrets(text) {
-	if (!text) {
-		return text;
-	}
-	return text.replace(SECRET_JSON_PATTERN, `$1"${REDACTED}"`).replace(SECRET_FORM_PATTERN, `$1=${REDACTED}`).replace(BEARER_PATTERN, `$1 ${REDACTED}`).replace(JWT_PATTERN, REDACTED);
-}
-
-//# sourceMappingURL=http-utils.js.map

package/dist/oauth/http-utils.js.map

@@ -1 +0,0 @@
-{"mappings":";;;;;;;AAOA,OAAO,SAAS,UAAU,QAAwB;CAChD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,IAAI,WAAW;EACf,IAAI,WAAW;EACf,IAAI,SAAS;EACb,IAAI,OAAO;EACX,OAAO,IAAI,SAAS;CACtB,QAAQ;;;EAGN,OAAO,OACJ,QAAQ,eAAe,IAAI,CAAC,CAC5B,QAAQ,SAAS,EAAE,CAAC,CACpB,QAAQ,QAAQ,EAAE;CACvB;AACF;;;;;;;;AASA,OAAO,eAAe,wBAAwB,UAAoB,WAAW,KAAsB;CACjG,IAAI,CAAC,SAAS,MAAM;;EAElB,IAAI;GACF,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,KAAK,MAAM,GAAG,QAAQ;EAC/B,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC;CACzD,IAAI,YAAY;CAEhB,IAAI;EACF,OAAO,UAAU,SAAS,UAAU;GAClC,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;IACR;GACF;GACA,IAAI,CAAC,OAAO;IACV;GACF;GACA,aAAa,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;GACnD,IAAI,UAAU,UAAU,UAAU;IAChC,YAAY,UAAU,MAAM,GAAG,QAAQ;IACvC;GACF;EACF;CACF,QAAQ,CAER,UAAU;EACR,IAAI;GACF,MAAM,OAAO,OAAO;EACtB,QAAQ,CAER;CACF;CAEA,OAAO;AACT;;;;AAKA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,WAAW;;AAGjB,MAAM,sBAAsB,IAAI;;CAE9B,QAAQ,mBAAmB,KAAK,GAAG,EAAE;CACrC;AACF;AACA,MAAM,sBAAsB,IAAI;;CAE9B,UAAU,mBAAmB,KAAK,GAAG,EAAE;CACvC;AACF;;AAEA,MAAM,iBAAiB;AACvB,MAAM,cAAc;;;;;;;;;;;;;;;;;AAkBpB,OAAO,SAAS,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM;EACT,OAAO;CACT;CACA,OAAO,KACJ,QAAQ,qBAAqB,MAAM,SAAS,EAAE,CAAC,CAC/C,QAAQ,qBAAqB,MAAM,UAAU,CAAC,CAC9C,QAAQ,gBAAgB,MAAM,UAAU,CAAC,CACzC,QAAQ,aAAa,QAAQ;AAClC","names":[],"sources":["../../src/oauth/http-utils.ts"],"version":3,"file":"http-utils.js","sourceRoot":""}

package/dist/oauth/local-callback.d.ts

@@ -1,10 +0,0 @@
-export interface OAuthCallbackResult {
-	code: string;
-	state: string;
-}
-export interface LocalCallbackServer {
-	redirectUri: string;
-	waitForCode: (timeoutMs?: number) => Promise<OAuthCallbackResult>;
-	close: () => Promise<void>;
-}
-export declare function startLocalCallbackServer(callbackPath?: string, port?: number): Promise<LocalCallbackServer>;

package/dist/oauth/local-callback.js

@@ -1,84 +0,0 @@
-import { createServer } from "node:http";
-function writeHtml(response, statusCode, body) {
-	response.statusCode = statusCode;
-	response.setHeader("Content-Type", "text/html; charset=utf-8");
-	response.end(body);
-}
-function parseCallback(request) {
-	if (!request.url) {
-		return undefined;
-	}
-	const url = new URL(request.url, "http://127.0.0.1");
-	const code = url.searchParams.get("code");
-	const state = url.searchParams.get("state");
-	if (!code || !state) {
-		return undefined;
-	}
-	return {
-		code,
-		state
-	};
-}
-export async function startLocalCallbackServer(callbackPath = "/oauth2/callback", port) {
-	let resolver;
-	let rejecter;
-	const promise = new Promise((resolve, reject) => {
-		resolver = resolve;
-		rejecter = reject;
-	});
-	const server = createServer((request, response) => {
-		const requestUrl = request.url ?? "";
-		const parsed = new URL(requestUrl, "http://127.0.0.1");
-		if (parsed.pathname !== callbackPath) {
-			writeHtml(response, 404, "<h1>Not Found</h1>");
-			return;
-		}
-		const payload = parseCallback(request);
-		if (!payload) {
-			writeHtml(response, 400, "<h1>Invalid OAuth callback</h1>");
-			rejecter?.(new Error("invalid oauth callback payload"));
-			return;
-		}
-		writeHtml(response, 200, "<h1>Login complete</h1><p>You can close this tab.</p>");
-		resolver?.(payload);
-	});
-	const listenPort = typeof port === "number" && port >= 0 ? port : 0;
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(listenPort, "127.0.0.1", () => resolve());
-	});
-	const address = server.address();
-	if (!address || typeof address === "string") {
-		throw new Error("failed to allocate local callback port");
-	}
-	return {
-		redirectUri: `http://127.0.0.1:${address.port}${callbackPath}`,
-		waitForCode(timeoutMs = 12e4) {
-			return new Promise((resolve, reject) => {
-				const timeout = setTimeout(() => {
-					reject(new Error("timed out waiting for OAuth callback"));
-				}, timeoutMs);
-				promise.then((value) => {
-					clearTimeout(timeout);
-					resolve(value);
-				}).catch((error) => {
-					clearTimeout(timeout);
-					reject(error);
-				});
-			});
-		},
-		close() {
-			return new Promise((resolve, reject) => {
-				server.close((error) => {
-					if (error) {
-						reject(error);
-						return;
-					}
-					resolve();
-				});
-			});
-		}
-	};
-}
-
-//# sourceMappingURL=local-callback.js.map

package/dist/oauth/local-callback.js.map

@@ -1 +0,0 @@
-{"mappings":"AAAA,SAAS,oBAA+D;AAaxE,SAAS,UAAU,UAA0B,YAAoB,MAAoB;CACnF,SAAS,aAAa;CACtB,SAAS,UAAU,gBAAgB,0BAA0B;CAC7D,SAAS,IAAI,IAAI;AACnB;AAEA,SAAS,cAAc,SAA2D;CAChF,IAAI,CAAC,QAAQ,KAAK;EAChB,OAAO;CACT;CAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,KAAK,kBAAkB;CACnD,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;CACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;CAE1C,IAAI,CAAC,QAAQ,CAAC,OAAO;EACnB,OAAO;CACT;CAEA,OAAO;EAAE;EAAM;CAAM;AACvB;AAEA,OAAO,eAAe,yBACpB,eAAe,oBACf,MAC8B;CAC9B,IAAI;CACJ,IAAI;CAEJ,MAAM,UAAU,IAAI,SAA8B,SAAS,WAAW;EACpE,WAAW;EACX,WAAW;CACb,CAAC;CAED,MAAM,SAAS,cAAc,SAAS,aAAa;EACjD,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,SAAS,IAAI,IAAI,YAAY,kBAAkB;EAErD,IAAI,OAAO,aAAa,cAAc;GACpC,UAAU,UAAU,KAAK,oBAAoB;GAC7C;EACF;EAEA,MAAM,UAAU,cAAc,OAAO;EACrC,IAAI,CAAC,SAAS;GACZ,UAAU,UAAU,KAAK,iCAAiC;GAC1D,WAAW,IAAI,MAAM,gCAAgC,CAAC;GACtD;EACF;EAEA,UAAU,UAAU,KAAK,uDAAuD;EAChF,WAAW,OAAO;CACpB,CAAC;CAED,MAAM,aAAa,OAAO,SAAS,YAAY,QAAQ,IAAI,OAAO;CAClE,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,YAAY,mBAAmB,QAAQ,CAAC;CACxD,CAAC;CAED,MAAM,UAAU,OAAO,QAAQ;CAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;EAC3C,MAAM,IAAI,MAAM,wCAAwC;CAC1D;CAEA,OAAO;EACL,aAAa,oBAAoB,QAAQ,OAAO;EAChD,YAAY,YAAY,MAAS;GAC/B,OAAO,IAAI,SAA8B,SAAS,WAAW;IAC3D,MAAM,UAAU,iBAAiB;KAC/B,OAAO,IAAI,MAAM,sCAAsC,CAAC;IAC1D,GAAG,SAAS;IAEZ,QACG,MAAM,UAAU;KACf,aAAa,OAAO;KACpB,QAAQ,KAAK;IACf,CAAC,CAAC,CACD,OAAO,UAAU;KAChB,aAAa,OAAO;KACpB,OAAO,KAAK;IACd,CAAC;GACL,CAAC;EACH;EACA,QAAQ;GACN,OAAO,IAAI,SAAe,SAAS,WAAW;IAC5C,OAAO,OAAO,UAAU;KACtB,IAAI,OAAO;MACT,OAAO,KAAK;MACZ;KACF;KACA,QAAQ;IACV,CAAC;GACH,CAAC;EACH;CACF;AACF","names":[],"sources":["../../src/oauth/local-callback.ts"],"version":3,"file":"local-callback.js","sourceRoot":""}

package/dist/oauth/pkce.d.ts

@@ -1,5 +0,0 @@
-export declare function generatePkcePair(): {
-	verifier: string;
-	challenge: string;
-};
-export declare function generateStateToken(): string;

package/dist/oauth/pkce.js

@@ -1,17 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-function toBase64Url(buffer) {
-	return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-export function generatePkcePair() {
-	const verifier = toBase64Url(randomBytes(32));
-	const challenge = toBase64Url(createHash("sha256").update(verifier).digest());
-	return {
-		verifier,
-		challenge
-	};
-}
-export function generateStateToken() {
-	return toBase64Url(randomBytes(24));
-}
-
-//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -1 +0,0 @@
-{"mappings":"AAAA,SAAS,YAAY,mBAAmB;AAExC,SAAS,YAAY,QAAwB;CAC3C,OAAO,OAAO,SAAS,QAAQ,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,QAAQ,EAAE;AAC7F;AAEA,OAAO,SAAS,mBAA4D;CAC1E,MAAM,WAAW,YAAY,YAAY,EAAE,CAAC;CAC5C,MAAM,YAAY,YAAY,WAAW,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,CAAC;CAE5E,OAAO;EAAE;EAAU;CAAU;AAC/B;AAEA,OAAO,SAAS,qBAA6B;CAC3C,OAAO,YAAY,YAAY,EAAE,CAAC;AACpC","names":[],"sources":["../../src/oauth/pkce.ts"],"version":3,"file":"pkce.js","sourceRoot":""}

package/dist/oauth/subject-token.d.ts

@@ -1,20 +0,0 @@
-import { type SubjectTokenSource } from "../config.js";
-export interface ResolveSubjectTokenOptions {
-	fetchImpl?: typeof fetch;
-	timeoutMs?: number;
-	/**
-	* Override process.env. Lets tests inject GHA-style env vars without
-	* mutating the real environment.
-	*/
-	env?: Record<string, string | undefined>;
-}
-/**
-* Read the platform-supplied JWT that the plugin will present as the subject
-* token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
-*
-* Each source resolves fresh on every call — we never cache the JWT itself,
-* only the OIDC access token it gets exchanged for. K8s projected SA tokens
-* rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
-* re-fetch on demand.
-*/
-export declare function resolveSubjectToken(source: SubjectTokenSource, options?: ResolveSubjectTokenOptions): Promise<string>;