npm - @wildo-ai/external-connectors-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/external-connectors-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (89) hide show

package/dist/esm/protocols/oauth2-provider-assurance.schemas.js ADDED Viewed

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+/** Provider enrollment requirements are not evidence about this authentication transaction. */
+export var ProviderAssuranceEvidenceKind;
+(function (ProviderAssuranceEvidenceKind) {
+    ProviderAssuranceEvidenceKind["SESSION_AMR"] = "session_amr";
+    ProviderAssuranceEvidenceKind["ACCOUNT_ENROLLMENT"] = "account_enrollment";
+    ProviderAssuranceEvidenceKind["UNDOCUMENTED"] = "undocumented";
+})(ProviderAssuranceEvidenceKind || (ProviderAssuranceEvidenceKind = {}));
+/** A researched provider contract. Documentation is evidence of meaning, not proof of a login. */
+export const ProviderAuthenticationAssuranceSchema = z.object({
+    product: z.string().min(1),
+    protocol: z.string().min(1),
+    tokenVersion: z.string().min(1),
+    evidenceKind: z.enum(ProviderAssuranceEvidenceKind),
+    /** ID-token claim matching the identifier returned by the provider profile endpoint. */
+    subjectClaim: z.string().min(1).optional(),
+    /** Values in a verified ID token's amr array that establish generic MFA only. */
+    mfaValues: z.array(z.string().min(1)).default([]),
+    prerequisites: z.array(z.string().min(1)),
+    limitations: z.array(z.string().min(1)),
+    requestParameters: z.record(z.string(), z.string()).default({}),
+    documentationUrls: z.array(z.url()).min(1),
+    verifiedOn: z.iso.date(),
+});
+//# sourceMappingURL=oauth2-provider-assurance.schemas.js.map

package/dist/esm/protocols/oauth2-provider-assurance.schemas.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"oauth2-provider-assurance.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/oauth2-provider-assurance.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,4DAA2B,CAAA;IAC3B,0EAAyC,CAAA;IACzC,8DAA6B,CAAA;AAC/B,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IACnD,wFAAwF;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Provider enrollment requirements are not evidence about this authentication transaction. */\nexport enum ProviderAssuranceEvidenceKind {\n SESSION_AMR = 'session_amr',\n ACCOUNT_ENROLLMENT = 'account_enrollment',\n UNDOCUMENTED = 'undocumented',\n}\n\n/** A researched provider contract. Documentation is evidence of meaning, not proof of a login. */\nexport const ProviderAuthenticationAssuranceSchema = z.object({\n product: z.string().min(1),\n protocol: z.string().min(1),\n tokenVersion: z.string().min(1),\n evidenceKind: z.enum(ProviderAssuranceEvidenceKind),\n /** ID-token claim matching the identifier returned by the provider profile endpoint. */\n subjectClaim: z.string().min(1).optional(),\n /** Values in a verified ID token's amr array that establish generic MFA only. */\n mfaValues: z.array(z.string().min(1)).default([]),\n prerequisites: z.array(z.string().min(1)),\n limitations: z.array(z.string().min(1)),\n requestParameters: z.record(z.string(), z.string()).default({}),\n documentationUrls: z.array(z.url()).min(1),\n verifiedOn: z.iso.date(),\n});\nexport type ProviderAuthenticationAssurance = z.infer<typeof ProviderAuthenticationAssuranceSchema>;\n\n"]}

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.d.ts CHANGED Viewed

@@ -8,7 +8,6 @@
  * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication
  */
 import { z } from 'zod';
-import { ExternalProvider_ExchangeProtocol_Kind } from '../core/commons.external-connectors-models.schemas';
 export { OAuth2_GrantType, OAuth2_ResponseType, OAuth2_PKCE_Method, OAuth2_TokenEndpoint_AuthMethod, OAuth2_Prompt, OAuth2_AccessType, OAuth2_Purpose, OAuth2_TokenFormat, OAuth2_TokenLocation, } from '../core/oauth2.enums';
 import { OAuth2_GrantType, OAuth2_ResponseType, OAuth2_PKCE_Method, OAuth2_TokenEndpoint_AuthMethod, OAuth2_Prompt, OAuth2_AccessType, OAuth2_Purpose, OAuth2_TokenFormat, OAuth2_TokenLocation } from '../core/oauth2.enums';
 /**
@@ -210,123 +209,6 @@ export declare const OAuth2_ProviderDefinitionSchema: z.ZodObject<{
     extensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export type OAuth2_ProviderDefinition = z.infer<typeof OAuth2_ProviderDefinitionSchema>;
-/**
- * OAuth2 Provider Profile - UI and identification information
- * Used when OAuth2 is exposed as an SSO protocol
- *
- * Note: Uses OAuth2_ProviderDefinitionSchema.pick() to avoid duplication
- * of common fields (displayName, iconUrl, enabled, purpose)
- */
-export declare const OAuth2Provider_ProfileSchema: z.ZodObject<{
-    endpoints: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof import("..").APPLICATION_ENVIRONMENT>, z.ZodString>>;
-    availableAuthMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof import("..").ExternalProvider_Auth_Kind>>>;
-    authProfiles: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.API_KEY>;
-        locationField: z.ZodDefault<z.ZodString>;
-        prefix: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.HMAC_SIGNATURE>;
-        locationField: z.ZodDefault<z.ZodString>;
-        algorithm: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_HMAC_Signature_Algorithm>>;
-        signaturePayload: z.ZodOptional<z.ZodEnum<{
-            custom: "custom";
-            body: "body";
-            timestamp: "timestamp";
-        }>>;
-        timestampHeader: z.ZodOptional<z.ZodString>;
-        nonceHeader: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.BEARER>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        prefix: z.ZodDefault<z.ZodString>;
-        format: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_Bearer_Format>>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.OPENID_CONNECT>;
-        discoveryUrl: z.ZodOptional<z.ZodURL>;
-        issuer: z.ZodOptional<z.ZodString>;
-        audience: z.ZodOptional<z.ZodString>;
-        validationMode: z.ZodOptional<z.ZodEnum<{
-            jwks: "jwks";
-            introspection: "introspection";
-            local: "local";
-        }>>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.OAUTH2>;
-        oauth2ProviderRef: z.ZodOptional<z.ZodString>;
-        authUrl: z.ZodOptional<z.ZodURL>;
-        tokenUrl: z.ZodOptional<z.ZodURL>;
-        refreshUrl: z.ZodOptional<z.ZodURL>;
-        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        grantType: z.ZodOptional<z.ZodEnum<typeof OAuth2_GrantType>>;
-        tokenEndpointAuthMethod: z.ZodOptional<z.ZodEnum<typeof OAuth2_TokenEndpoint_AuthMethod>>;
-        pkce: z.ZodOptional<z.ZodBoolean>;
-        pkceMethod: z.ZodOptional<z.ZodEnum<typeof OAuth2_PKCE_Method>>;
-        prompt: z.ZodOptional<z.ZodEnum<typeof OAuth2_Prompt>>;
-        accessType: z.ZodOptional<z.ZodEnum<typeof OAuth2_AccessType>>;
-        extraAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        extraTokenParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        tokenFormat: z.ZodDefault<z.ZodEnum<{
-            custom: "custom";
-            bearer: "bearer";
-            token: "token";
-            oauth: "oauth";
-        }>>;
-        customTokenPrefix: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.BASIC>;
-        usernameRef: z.ZodOptional<z.ZodString>;
-        passwordRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.NONE>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.FRONTEND_SECRET>;
-        frontendOnly: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip>, z.ZodObject<{
-        ref: z.ZodOptional<z.ZodString>;
-        isDefault: z.ZodDefault<z.ZodBoolean>;
-        location: z.ZodDefault<z.ZodEnum<typeof import("..").ExternalProvider_Auth_ApiKey_Location>>;
-        locationField: z.ZodDefault<z.ZodString>;
-        kind: z.ZodLiteral<import("..").ExternalProvider_Auth_Kind.MUTUAL_TLS>;
-        certificateRef: z.ZodOptional<z.ZodString>;
-        privateKeyRef: z.ZodOptional<z.ZodString>;
-        caRef: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>], "kind">>>;
-    providerName: z.ZodString;
-    displayName: z.ZodString;
-    iconUrl: z.ZodOptional<z.ZodURL>;
-    buttonColor: z.ZodOptional<z.ZodString>;
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    purpose: z.ZodDefault<z.ZodEnum<typeof OAuth2_Purpose>>;
-}, z.core.$strip>;
 /**
  * OAuth2 Credential - Active tokens for a provider connection
  * This is what gets stored after successful OAuth2 authentication
@@ -469,38 +351,8 @@ export declare const OAuth2Provider_ConfigurationSchema: z.ZodObject<{
  * Currently empty, reserved for future use
  */
 export declare const OAuth2Provider_OperationSchema: z.ZodObject<{}, z.core.$strip>;
-/**
- * OAuth2 Provider Status - Connection status
- */
-export declare const OAuth2Provider_StatusSchema: z.ZodObject<{
-    status: z.ZodEnum<typeof import("..").ExternalProvider_Status>;
-    lastCheckedAt: z.ZodString;
-    errorReason: z.ZodOptional<z.ZodString>;
-    protocolKind: z.ZodLiteral<ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2>;
-    credential: z.ZodOptional<z.ZodObject<{
-        providerId: z.ZodString;
-        accessToken: z.ZodString;
-        tokenType: z.ZodDefault<z.ZodString>;
-        expiresAt: z.ZodOptional<z.ZodNumber>;
-        refreshToken: z.ZodOptional<z.ZodString>;
-        refreshTokenExpiresAt: z.ZodOptional<z.ZodNumber>;
-        idToken: z.ZodOptional<z.ZodString>;
-        scope: z.ZodOptional<z.ZodString>;
-        claimedAt: z.ZodNumber;
-        data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, z.core.$strip>>;
-    isTokenValid: z.ZodOptional<z.ZodBoolean>;
-    needsRefresh: z.ZodOptional<z.ZodBoolean>;
-    lastRefreshAt: z.ZodOptional<z.ZodNumber>;
-    grantedScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    missingScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-export type OAuth2Provider_Profile = z.infer<typeof OAuth2Provider_ProfileSchema>;
 export type OAuth2Provider_Configuration = z.infer<typeof OAuth2Provider_ConfigurationSchema>;
 export type OAuth2Provider_Operation = z.infer<typeof OAuth2Provider_OperationSchema>;
-export type OAuth2Provider_Status = z.infer<typeof OAuth2Provider_StatusSchema>;
-export type ExternalProvider_OAuth2_Config = OAuth2Provider_Configuration;
 /**
  * OAuth2 API Auth Link
  *

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AACxB~~,OAAO,~~EAEL,sCAAsC,EAGvC,MAAM,oDAAoD,CAAC;AAG5D,OAAO,~~EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAMH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;iBA8D5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAM5F;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAqCjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAqBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAevC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqF1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;~~AAcxF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBvC,CAAC;AAOH~~;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAiClC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gCAAe,CAAC;~~AAE3D;;GAEG;AACH~~,~~eAAO,~~MAAM,~~2BAA2B;;;;;;;;;;;;;;;;;;;;;;;iBAoBtC,CAAC;AAMH,~~MAAM,~~MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,~~4BAA4B,~~CAAC,CAAC;AAClF,MAAM,MAAM,4BAA4B,~~GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;~~AACtF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGhF,MAAM,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAM1E~~;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}
1	+ {"version":3,"file":"oauth2.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAMH;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;iBA8D5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAM5F;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAqCjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAqBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;iBAevC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E;;;GAGG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqF1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAmBxF;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAiClC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+B7C,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,gCAAe,CAAC;AAM3D,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAMtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;iBAqBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.js CHANGED Viewed

@@ -8,7 +8,7 @@
  * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication
  */
 import { z } from 'zod';
-import { ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Profile_BaseSchema, ExternalProvider_ExchangeProtocol_Status_BaseSchema } from '../core/commons.external-connectors-models.schemas.js';
+import { ExternalProvider_ExchangeProtocol_Configuration_BaseSchema } from '../core/commons.external-connectors-models.schemas.js';
 // Re-export OAuth2 enums from the shared enums file (avoids circular dependency)
 export { OAuth2_GrantType, OAuth2_ResponseType, OAuth2_PKCE_Method, OAuth2_TokenEndpoint_AuthMethod, OAuth2_Prompt, OAuth2_AccessType, OAuth2_Purpose, OAuth2_TokenFormat, OAuth2_TokenLocation, } from '../core/oauth2.enums.js';
 import { OAuth2_GrantType, OAuth2_ResponseType, OAuth2_PKCE_Method, OAuth2_TokenEndpoint_AuthMethod, OAuth2_Prompt, OAuth2_AccessType, OAuth2_Purpose, OAuth2_TokenFormat, OAuth2_TokenLocation, } from '../core/oauth2.enums.js';
@@ -258,27 +258,6 @@ export const OAuth2_ProviderDefinitionSchema = z.object({
 // =============================================================================
 // SSO OAUTH2 PROTOCOL - For User Authentication
 // =============================================================================
-/**
- * OAuth2 Provider Profile - UI and identification information
- * Used when OAuth2 is exposed as an SSO protocol
- *
- * Note: Uses OAuth2_ProviderDefinitionSchema.pick() to avoid duplication
- * of common fields (displayName, iconUrl, enabled, purpose)
- */
-export const OAuth2Provider_ProfileSchema = ExternalProvider_ExchangeProtocol_Profile_BaseSchema.extend({
-    /** Provider name (unique identifier) - string reference (e.g., "google", "openai") */
-    providerName: z.string().min(1, { message: 'Provider name is required' }),
-    /** Display name for UI - picked from OAuth2_ProviderDefinitionSchema */
-    displayName: OAuth2_ProviderDefinitionSchema.shape.displayName,
-    /** Icon URL for the provider - picked from OAuth2_ProviderDefinitionSchema */
-    iconUrl: OAuth2_ProviderDefinitionSchema.shape.iconUrl,
-    /** Button color for OAuth login buttons (SSO-specific) */
-    buttonColor: z.string().optional(),
-    /** Is this provider enabled? - picked from OAuth2_ProviderDefinitionSchema */
-    enabled: OAuth2_ProviderDefinitionSchema.shape.enabled,
-    /** Provider purpose (SSO, API, or both) - with SSO default for this context */
-    purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.USER_SSO),
-});
 // =============================================================================
 // RUNTIME CREDENTIAL - Active OAuth2 credentials
 // =============================================================================
@@ -345,24 +324,6 @@ export const OAuth2Provider_ConfigurationSchema = ExternalProvider_ExchangeProto
  * Currently empty, reserved for future use
  */
 export const OAuth2Provider_OperationSchema = z.object({});
-/**
- * OAuth2 Provider Status - Connection status
- */
-export const OAuth2Provider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({
-    protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2),
-    /** Current credential (if connected) */
-    credential: OAuth2_CredentialSchema.optional(),
-    /** Is the token valid/not expired? */
-    isTokenValid: z.boolean().optional(),
-    /** Does the token need refresh? */
-    needsRefresh: z.boolean().optional(),
-    /** Last token refresh time */
-    lastRefreshAt: z.number().optional(),
-    /** Granted scopes (may differ from requested) */
-    grantedScopes: z.array(z.string()).optional(),
-    /** Missing required scopes */
-    missingScopes: z.array(z.string()).optional(),
-});
 // =============================================================================
 // OAUTH2 API AUTHENTICATION LINK (Consolidated)
 // =============================================================================

package/dist/esm/protocols/oauth2.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"oauth2.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0DAA0D,EAC1D,sCAAsC,EACtC,oDAAoD,EACpD,mDAAmD,EACpD,MAAM,oDAAoD,CAAC;AAE5D,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6BAA6B;IAC7B,gEAAgE;IAChE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,iEAAiE;IACjE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C,qCAAqC;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEzC,yBAAyB;IACzB,8BAA8B;IAC9B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C,kDAAkD;IAClD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,2CAA2C;IAC3C,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,8CAA8C;IAC9C,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElD,4BAA4B;IAC5B,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAE1D,kCAAkC;IAClC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,iEAAiE;IACjE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,iCAAiC;IACjC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAExC,yBAAyB;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,4BAA4B;IAC5B,yDAAyD;IACzD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,6BAA6B;IAC7B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,2CAA2C;IAC3C,wDAAwD;IACxD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IAEzB,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IAEjB,6BAA6B;IAC7B,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE9B,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEpC,+CAA+C;IAC/C,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE1C,mCAAmC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE/B,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,4BAA4B;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,kDAAkD;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAEjB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,2BAA2B;IAC3B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAE3D,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEvC,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+CAA+C;IAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAErD,gDAAgD;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEtD,0CAA0C;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjD,gDAAgD;IAChD,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAE3E,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhE,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mBAAmB;IACnB,iCAAiC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,wBAAwB;IACxB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,kBAAkB;IAClB,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAElE,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,oBAAoB;IACpB,qCAAqC;IACrC,SAAS,EAAE,sBAAsB;IAEjC,uBAAuB;IACvB,4DAA4D;IAC5D,YAAY,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAE1D,iBAAiB;IACjB,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAE/C,8BAA8B;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAEhD,sCAAsC;IACtC,2BAA2B;IAC3B,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAEzF,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;IAE3E,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAExC,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAExE,gCAAgC;IAChC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE;KACf,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEd,4DAA4D;IAC5D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE5D,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7D,0CAA0C;IAC1C,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;IAEb,uCAAuC;IACvC,iDAAiD;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAGH,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,GAAG;AACH,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AAEF,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,oDAAoD,CAAC,MAAM,CAAC;IACtG,sFAAsF;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAEzE,wEAAwE;IACxE,WAAW,EAAE,+BAA+B,CAAC,KAAK,CAAC,WAAW;IAE9D,8EAA8E;IAC9E,OAAO,EAAE,+BAA+B,CAAC,KAAK,CAAC,OAAO;IAEtD,0DAA0D;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,8EAA8E;IAC9E,OAAO,EAAE,+BAA+B,CAAC,KAAK,CAAC,OAAO;IAEtD,+EAA+E;IAC/E,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;CACjE,CAAC,CAAC;AAGH,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IAEtB,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvC,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAElD,oDAAoD;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IAClH,oCAAoC;IACpC,uEAAuE;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAE5D,mDAAmD;IACnD,iCAAiC;IACjC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEzC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvC,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,qEAAqE;QACrE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAE9C,uEAAuE;QACvE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEtD,qCAAqC;QACrC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEpD,sDAAsD;QACtD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC,CAAC,OAAO,CAAC;QACT,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,EAAE;QACzB,mBAAmB,EAAE,EAAE;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,mDAAmD,CAAC,MAAM,CAAC;IACpG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IAE1E,wCAAwC;IACxC,UAAU,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE9C,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,8BAA8B;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,8BAA8B;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAcH,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,kDAAkD;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAE1E,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC;IAEhF,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["/*\n OAuth2 Protocol Schemas for External Connectors\n * \n * This module integrates the comprehensive OAuth2 definitions with the\n * external connectors protocol engine. It provides:\n * \n * 1. SSO_OAuth2 Protocol - For user authentication (OpenID Connect)\n * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication\n /\n\nimport { z } from 'zod';\nimport { \n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, \n ExternalProvider_ExchangeProtocol_Kind, \n ExternalProvider_ExchangeProtocol_Profile_BaseSchema, \n ExternalProvider_ExchangeProtocol_Status_BaseSchema \n} from '../core/commons.external-connectors-models.schemas';\n\n// Re-export OAuth2 enums from the shared enums file (avoids circular dependency)\nexport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\nimport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\n\n/\n OAuth2 and OpenID Connect Protocol Definitions\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n * - RFC 7662: OAuth 2.0 Token Introspection\n * - RFC 7009: OAuth 2.0 Token Revocation\n * \n * This module provides standardized OAuth2 definitions that unify:\n * 1. API Authentication (for REST/GraphQL/Webhook calls)\n * 2. User SSO Authentication (OpenID Connect overlay)\n * 3. Service-to-Service (S2S) authentication\n /\n\n// =============================================================================\n// CAPABILITY FLAGS - Provider Features and Limitations\n// =============================================================================\n\n/\n OAuth2 Provider Capabilities - what the provider supports\n * These flags help determine what flows and features are available\n /\nexport const OAuth2_ProviderCapabilitiesSchema = z.object({\n // ─── Grant Type Support ───\n /* Supports authorization_code grant (user-interactive flow) /\n supportsAuthorizationCode: z.boolean().optional(),\n \n /* Supports client_credentials grant (S2S/machine-to-machine) /\n supportsClientCredentials: z.boolean().optional(),\n \n /* Supports device_code grant (input-constrained devices) /\n supportsDeviceCode: z.boolean().optional(),\n \n /* Supports JWT bearer assertions /\n supportsJwtBearer: z.boolean().optional(),\n \n // ─── Token Features ───\n /* Supports refresh tokens /\n supportsRefreshToken: z.boolean().optional(),\n \n /* Provider rotates refresh tokens on each use /\n rotatesRefreshToken: z.boolean().optional(),\n \n /* Supports token revocation (RFC 7009) /\n supportsTokenRevocation: z.boolean().optional(),\n \n /* Supports token introspection (RFC 7662) /\n supportsTokenIntrospection: z.boolean().optional(),\n \n // ─── Security Features ───\n /* Supports PKCE (RFC 7636) - required for public clients /\n supportsPKCE: z.boolean().optional(),\n \n /* PKCE is required (not optional) /\n requiresPKCE: z.boolean().optional(),\n \n /* Preferred PKCE method /\n preferredPKCEMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n // ─── OpenID Connect Features ───\n /* Supports OpenID Connect /\n supportsOIDC: z.boolean().optional(),\n \n /* Supports OIDC Discovery (.well-known/openid-configuration) /\n supportsOIDCDiscovery: z.boolean().optional(),\n \n /* Supports userinfo endpoint /\n supportsUserInfo: z.boolean().optional(),\n \n /* Supports ID tokens /\n supportsIdToken: z.boolean().optional(),\n \n // ─── Advanced Features ───\n /* Supports incremental authorization (adding scopes) /\n supportsIncrementalAuth: z.boolean().optional(),\n \n /* Supports scope reduction on token refresh /\n supportsScopeReduction: z.boolean().optional(),\n \n /* Supports custom domains/environments /\n supportsCustomDomains: z.boolean().optional(),\n \n /* Supports multi-tenancy /\n supportsMultiTenancy: z.boolean().optional(),\n});\nexport type OAuth2_ProviderCapabilities = z.infer<typeof OAuth2_ProviderCapabilitiesSchema>;\n\n// =============================================================================\n// ENDPOINTS - OAuth2 Server Endpoints\n// =============================================================================\n\n/\n OAuth2 Endpoints Configuration\n * Standard endpoints as defined in RFC 6749 and OIDC Discovery\n /\nexport const OAuth2_EndpointsSchema = z.object({\n // ─── Core OAuth2 Endpoints (RFC 6749) ───\n /* Authorization endpoint - where user grants access /\n authorizationUrl: z.url(),\n \n /* Token endpoint - where tokens are exchanged /\n tokenUrl: z.url(),\n \n // ─── Optional Endpoints ───\n /* Refresh URL - often same as tokenUrl, but some providers differ /\n refreshUrl: z.url().optional(),\n \n /* Revocation endpoint (RFC 7009) /\n revocationUrl: z.url().optional(),\n \n /* Introspection endpoint (RFC 7662) /\n introspectionUrl: z.url().optional(),\n \n /* Device authorization endpoint (RFC 8628) /\n deviceAuthorizationUrl: z.url().optional(),\n \n // ─── OpenID Connect Endpoints ───\n /* UserInfo endpoint - for fetching user profile /\n userInfoUrl: z.url().optional(),\n \n /* JWKS endpoint - for verifying tokens /\n jwksUrl: z.url().optional(),\n \n /* OIDC Discovery endpoint /\n discoveryUrl: z.url().optional(),\n \n /* End session / logout endpoint /\n endSessionUrl: z.url().optional(),\n \n // ─── Provider-Specific ───\n /* Custom API base URL (for making authenticated API calls) /\n apiBaseUrl: z.url().optional(),\n});\nexport type OAuth2_Endpoints = z.infer<typeof OAuth2_EndpointsSchema>;\n\n// =============================================================================\n// SCOPE DEFINITIONS - Granular Permissions\n// =============================================================================\n\n/\n OAuth2 Scope Definition - describes what a scope grants\n /\nexport const OAuth2_ScopeDefinitionSchema = z.object({\n /* The scope string as used in OAuth2 requests /\n scope: z.string(),\n \n /* Human-readable description /\n description: z.string().optional(),\n \n /* Is this scope required or optional? /\n required: z.boolean().optional(),\n \n /* Category for grouping scopes (e.g., 'read', 'write', 'admin') /\n category: z.string().optional(),\n \n /* Is this an OIDC standard scope? /\n isOIDC: z.boolean().optional(),\n \n /* Does this scope grant offline access (refresh tokens)? /\n grantsOfflineAccess: z.boolean().optional(),\n \n /* Related resources or APIs this scope provides access to /\n resources: z.array(z.string()).optional(),\n});\nexport type OAuth2_ScopeDefinition = z.infer<typeof OAuth2_ScopeDefinitionSchema>;\n\n/\n Scope Collection - organized scopes for a provider\n /\nexport const OAuth2_ScopeCollectionSchema = z.object({\n /* All available scopes /\n available: z.array(OAuth2_ScopeDefinitionSchema).optional(),\n \n /* Default scopes for user SSO authentication /\n defaultForSSO: z.array(z.string()).optional(),\n \n /* Default scopes for API access /\n defaultForAPI: z.array(z.string()).optional(),\n \n /* Minimum required scopes /\n minimum: z.array(z.string()).optional(),\n \n /* Scope that grants offline/refresh access (e.g., 'offline_access') /\n offlineAccessScope: z.string().optional(),\n});\nexport type OAuth2_ScopeCollection = z.infer<typeof OAuth2_ScopeCollectionSchema>;\n\n// =============================================================================\n// TOKEN CONFIGURATION - Token handling specifics\n// =============================================================================\n\n/\n Token Configuration - how tokens behave\n /\nexport const OAuth2_TokenConfigSchema = z.object({\n /* Token type (usually 'Bearer') /\n tokenType: z.string().optional(),\n \n /* Default access token lifetime in seconds /\n accessTokenLifetime: z.number().positive().optional(),\n \n /* Default refresh token lifetime in seconds /\n refreshTokenLifetime: z.number().positive().optional(),\n \n /* ID token lifetime in seconds (OIDC) /\n idTokenLifetime: z.number().positive().optional(),\n \n /* How to authenticate at the token endpoint /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* Additional headers required for token requests /\n tokenRequestHeaders: z.record(z.string(), z.string()).optional(),\n \n /* How early (in seconds) to refresh tokens before expiry /\n refreshBufferSeconds: z.number().nonnegative().optional(),\n});\nexport type OAuth2_TokenConfig = z.infer<typeof OAuth2_TokenConfigSchema>;\n\n// =============================================================================\n// MAIN OAUTH2 PROVIDER DEFINITION\n// =============================================================================\n\n/\n Complete OAuth2 Provider Definition\n * This is the main schema that captures all OAuth2 configuration for a provider\n /\nexport const OAuth2_ProviderDefinitionSchema = z.object({\n // ─── Identity ───\n /* Unique provider identifier /\n providerId: z.string().min(1),\n \n /* Display name for UI /\n displayName: z.string().min(1),\n \n /* Provider icon URL /\n iconUrl: z.url().optional(),\n \n /* Primary brand color (hex) /\n brandColor: z.string().optional(),\n \n // ─── Purpose ───\n /* What this OAuth2 config is used for /\n purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.API_ACCESS),\n \n /* Is this provider enabled? /\n enabled: z.boolean().default(true),\n \n // ─── Endpoints ───\n /* OAuth2 endpoints configuration /\n endpoints: OAuth2_EndpointsSchema,\n \n // ─── Capabilities ───\n /* What the provider supports (all fields have defaults) /\n capabilities: OAuth2_ProviderCapabilitiesSchema.optional(),\n \n // ─── Scopes ───\n /* Scope definitions and defaults (all fields have defaults) /\n scopes: OAuth2_ScopeCollectionSchema.optional(),\n \n // ─── Token Configuration ───\n /* Token handling configuration (all fields have defaults) /\n tokenConfig: OAuth2_TokenConfigSchema.optional(),\n \n // ─── Authorization Configuration ───\n /* Preferred grant type /\n preferredGrantType: z.enum(OAuth2_GrantType).default(OAuth2_GrantType.AUTHORIZATION_CODE),\n \n /* Response type for authorization requests /\n responseType: z.enum(OAuth2_ResponseType).default(OAuth2_ResponseType.CODE),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).default(OAuth2_AccessType.OFFLINE),\n \n // ─── Dynamic Configuration ───\n /* \n * Template variables that can be substituted in URLs\n * e.g., { location: 'us' } for 'https://accounts.{location}.zoho.com'\n /\n templateVariables: z.record(z.string(), z.object({\n displayName: z.string(),\n description: z.string().optional(),\n required: z.boolean().optional(),\n defaultValue: z.string().optional(),\n options: z.array(z.object({\n value: z.string(),\n label: z.string(),\n })).optional(),\n })).optional(),\n \n /* Extra parameters to include in authorization requests /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra parameters to include in token requests /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── User Profile Mapping (OIDC/SSO) ───\n /* Mapping for extracting user info from profile response /\n userProfileMapping: z.object({\n id: z.string().default('sub'),\n email: z.string().default('email'),\n name: z.string().default('name'),\n image: z.string().default('picture'),\n emailVerified: z.string().default('email_verified'),\n }).optional(),\n \n // ─── Provider-Specific Extensions ───\n /* Provider-specific configuration extensions /\n extensions: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_ProviderDefinition = z.infer<typeof OAuth2_ProviderDefinitionSchema>;\n\n// =============================================================================\n// NOTE: OAuth2 configurations are defined per-provider in external-connectors\n// =============================================================================\n// \n// Each provider folder (e.g., google/, microsoft/) contains its own OAuth2\n// protocol definition. Use provider string identifiers to reference providers.\n//\n\n// =============================================================================\n// SSO OAUTH2 PROTOCOL - For User Authentication\n// =============================================================================\n\n/\n OAuth2 Provider Profile - UI and identification information\n * Used when OAuth2 is exposed as an SSO protocol\n * \n * Note: Uses OAuth2_ProviderDefinitionSchema.pick() to avoid duplication\n * of common fields (displayName, iconUrl, enabled, purpose)\n /\nexport const OAuth2Provider_ProfileSchema = ExternalProvider_ExchangeProtocol_Profile_BaseSchema.extend({\n /* Provider name (unique identifier) - string reference (e.g., \"google\", \"openai\") /\n providerName: z.string().min(1, { message: 'Provider name is required' }),\n \n /* Display name for UI - picked from OAuth2_ProviderDefinitionSchema /\n displayName: OAuth2_ProviderDefinitionSchema.shape.displayName,\n \n /* Icon URL for the provider - picked from OAuth2_ProviderDefinitionSchema /\n iconUrl: OAuth2_ProviderDefinitionSchema.shape.iconUrl,\n \n /* Button color for OAuth login buttons (SSO-specific) /\n buttonColor: z.string().optional(),\n \n /* Is this provider enabled? - picked from OAuth2_ProviderDefinitionSchema /\n enabled: OAuth2_ProviderDefinitionSchema.shape.enabled,\n \n /* Provider purpose (SSO, API, or both) - with SSO default for this context /\n purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.USER_SSO),\n});\n\n\n// =============================================================================\n// RUNTIME CREDENTIAL - Active OAuth2 credentials\n// =============================================================================\n\n/\n OAuth2 Credential - Active tokens for a provider connection\n * This is what gets stored after successful OAuth2 authentication\n /\nexport const OAuth2_CredentialSchema = z.object({\n /* Provider this credential is for /\n providerId: z.string(),\n \n /* Access token /\n accessToken: z.string(),\n \n /* Token type (usually 'Bearer') /\n tokenType: z.string().default('Bearer'),\n \n /* When the access token expires (Unix timestamp) /\n expiresAt: z.number().optional(),\n \n /* Refresh token (if available) /\n refreshToken: z.string().optional(),\n \n /* When the refresh token expires (Unix timestamp) /\n refreshTokenExpiresAt: z.number().optional(),\n \n /* ID token (OIDC) /\n idToken: z.string().optional(),\n \n /* Granted scopes (may differ from requested) /\n scope: z.string().optional(),\n \n /* When this credential was obtained /\n claimedAt: z.number(),\n \n /* Additional data from the token response /\n data: z.record(z.string(), z.unknown()).optional(),\n \n /* Provider-specific properties used during auth /\n props: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_Credential = z.infer<typeof OAuth2_CredentialSchema>;\n\n\n\n/\n OAuth2 Provider Configuration - Runtime configuration\n * Contains the OAuth2 endpoints and configuration\n /\nexport const OAuth2Provider_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n // ─── OAuth2 Core Configuration ───\n /* Complete OAuth2 provider definition (new comprehensive approach) /\n oauth2Definition: OAuth2_ProviderDefinitionSchema.optional(),\n \n // ─── Legacy fields for backward compatibility ───\n /* Authorization endpoint URL /\n authorizationEndpoint: z.url().optional(),\n \n /* Requested scopes /\n scopes: z.array(z.string()).default([]),\n\n // ─── Integration Access (for providers that offer multiple APIs) ───\n integrationAccess: z.object({\n /* Enable third-party integrations through this OAuth2 connection /\n enableIntegrations: z.boolean().default(false),\n \n /* Available integrations (e.g., ['drive', 'calendar', 'contacts']) /\n availableIntegrations: z.array(z.string()).default([]),\n \n /* Default integrations to enable /\n defaultIntegrations: z.array(z.string()).default([]),\n \n /* User must grant permission for each integration /\n requiresPermission: z.boolean().default(true),\n }).default({\n enableIntegrations: false,\n availableIntegrations: [],\n defaultIntegrations: [],\n requiresPermission: true,\n }),\n});\n\n/\n OAuth2 Provider Operation - Operations that require OAuth2\n * Currently empty, reserved for future use\n /\nexport const OAuth2Provider_OperationSchema = z.object({});\n\n/\n OAuth2 Provider Status - Connection status\n /\nexport const OAuth2Provider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({\n protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2),\n \n /* Current credential (if connected) /\n credential: OAuth2_CredentialSchema.optional(),\n \n /* Is the token valid/not expired? /\n isTokenValid: z.boolean().optional(),\n \n /* Does the token need refresh? /\n needsRefresh: z.boolean().optional(),\n \n /* Last token refresh time /\n lastRefreshAt: z.number().optional(),\n \n /* Granted scopes (may differ from requested) /\n grantedScopes: z.array(z.string()).optional(),\n \n /* Missing required scopes /\n missingScopes: z.array(z.string()).optional(),\n});\n\n// =============================================================================\n// INFERRED TYPES\n// =============================================================================\n\nexport type OAuth2Provider_Profile = z.infer<typeof OAuth2Provider_ProfileSchema>;\nexport type OAuth2Provider_Configuration = z.infer<typeof OAuth2Provider_ConfigurationSchema>;\nexport type OAuth2Provider_Operation = z.infer<typeof OAuth2Provider_OperationSchema>;\nexport type OAuth2Provider_Status = z.infer<typeof OAuth2Provider_StatusSchema>;\n\n// Alias for backward compatibility\nexport type ExternalProvider_OAuth2_Config = OAuth2Provider_Configuration;\n\n// =============================================================================\n// OAUTH2 API AUTHENTICATION LINK (Consolidated)\n// =============================================================================\n\n/\n OAuth2 API Auth Link\n * \n * Unified schema for linking OAuth2 credentials to REST API / Hook authentication.\n * This prevents duplication between auth profile and OAuth2 config.\n * \n * When a REST API uses OAuth2 for authentication:\n * 1. Define the OAuth2 provider once (endpoints, scopes, capabilities)\n * 2. Link it to the API auth profile using this schema\n * 3. The system will automatically:\n * - Manage token refresh\n * - Format Authorization headers\n * - Track required scopes per operation\n /\nexport const OAuth2_APIAuthLinkSchema = z.object({\n /* Reference to the OAuth2 provider definition /\n oauth2ProviderRef: z.string().min(1),\n \n /* Which scopes are needed for this API access /\n requiredScopes: z.array(z.string()).default([]),\n \n /* How to format the token for API calls /\n tokenFormat: z.enum(OAuth2_TokenFormat).default(OAuth2_TokenFormat.BEARER),\n \n /* Where to send the access token /\n tokenLocation: z.enum(OAuth2_TokenLocation).default(OAuth2_TokenLocation.HEADER),\n \n /* Custom header name (when tokenFormat is 'custom_header') /\n customHeaderName: z.string().optional(),\n \n /* Query parameter name (when tokenLocation is 'query') /\n queryParamName: z.string().optional(),\n \n /* Prefix for the token value (optional override) /\n tokenPrefix: z.string().optional(),\n});\nexport type OAuth2_APIAuthLink = z.infer<typeof OAuth2_APIAuthLinkSchema>;\n\n// Note: OAuth2_APIAuthLinkSchema is now defined in the consolidated section above\n\n// =============================================================================\n// HELPER TYPES\n// =============================================================================\n\n/\n OAuth2 Authorization Request - parameters for the authorization URL\n /\nexport interface OAuth2_AuthorizationRequest {\n clientId: string;\n redirectUri: string;\n scope: string[];\n state: string;\n responseType?: OAuth2_ResponseType;\n codeChallenge?: string;\n codeChallengeMethod?: OAuth2_PKCE_Method;\n prompt?: OAuth2_Prompt;\n accessType?: OAuth2_AccessType;\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Request - parameters for the token endpoint\n /\nexport interface OAuth2_TokenRequest {\n grantType: OAuth2_GrantType;\n clientId: string;\n clientSecret?: string;\n code?: string;\n redirectUri?: string;\n codeVerifier?: string;\n refreshToken?: string;\n scope?: string[];\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Response - response from the token endpoint\n */\nexport interface OAuth2_TokenResponse {\n accessToken: string;\n tokenType: string;\n expiresIn?: number;\n refreshToken?: string;\n scope?: string;\n idToken?: string;\n data?: Record<string, unknown>;\n}\n\n"]}
1	+ {"version":3,"file":"oauth2.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/oauth2.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0DAA0D,EAE3D,MAAM,oDAAoD,CAAC;AAE5D,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,+BAA+B,EAC/B,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B;;;;;;;;;;;;;;GAcG;AAEH,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6BAA6B;IAC7B,gEAAgE;IAChE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,iEAAiE;IACjE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjD,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C,qCAAqC;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEzC,yBAAyB;IACzB,8BAA8B;IAC9B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C,kDAAkD;IAClD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,2CAA2C;IAC3C,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,8CAA8C;IAC9C,0BAA0B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAElD,4BAA4B;IAC5B,6DAA6D;IAC7D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,sCAAsC;IACtC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,4BAA4B;IAC5B,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAE1D,kCAAkC;IAClC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEpC,iEAAiE;IACjE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,iCAAiC;IACjC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAExC,yBAAyB;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEvC,4BAA4B;IAC5B,yDAAyD;IACzD,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/C,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,6BAA6B;IAC7B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,2CAA2C;IAC3C,wDAAwD;IACxD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IAEzB,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;IAEjB,6BAA6B;IAC7B,sEAAsE;IACtE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE9B,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,wCAAwC;IACxC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEpC,+CAA+C;IAC/C,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE1C,mCAAmC;IACnC,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE/B,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,8BAA8B;IAC9B,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEhC,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEjC,4BAA4B;IAC5B,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,kDAAkD;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IAEjB,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhC,oEAAoE;IACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE9B,6DAA6D;IAC7D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE3C,8DAA8D;IAC9D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,2BAA2B;IAC3B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAE3D,iDAAiD;IACjD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,oCAAoC;IACpC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,8BAA8B;IAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEvC,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+CAA+C;IAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAErD,gDAAgD;IAChD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEtD,0CAA0C;IAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEjD,gDAAgD;IAChD,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;IAE3E,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhE,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mBAAmB;IACnB,iCAAiC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,wBAAwB;IACxB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,kBAAkB;IAClB,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAElE,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,oBAAoB;IACpB,qCAAqC;IACrC,SAAS,EAAE,sBAAsB;IAEjC,uBAAuB;IACvB,4DAA4D;IAC5D,YAAY,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IAE1D,iBAAiB;IACjB,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAE/C,8BAA8B;IAC9B,8DAA8D;IAC9D,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAEhD,sCAAsC;IACtC,2BAA2B;IAC3B,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC;IAEzF,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;IAE3E,sBAAsB;IACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAExC,mCAAmC;IACnC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;IAExE,gCAAgC;IAChC;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB,CAAC,CAAC,CAAC,QAAQ,EAAE;KACf,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEd,4DAA4D;IAC5D,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE5D,oDAAoD;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7D,0CAA0C;IAC1C,6DAA6D;IAC7D,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACpD,CAAC,CAAC,QAAQ,EAAE;IAEb,uCAAuC;IACvC,iDAAiD;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAGH,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,GAAG;AACH,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AAEF,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAGhF,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sCAAsC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IAEtB,mBAAmB;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEvC,qDAAqD;IACrD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,mCAAmC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,sDAAsD;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5C,sBAAsB;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,wCAAwC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,8CAA8C;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAElD,oDAAoD;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAKH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IAClH,oCAAoC;IACpC,uEAAuE;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAE5D,mDAAmD;IACnD,iCAAiC;IACjC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEzC,uBAAuB;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEvC,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1B,qEAAqE;QACrE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAE9C,uEAAuE;QACvE,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEtD,qCAAqC;QACrC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAEpD,sDAAsD;QACtD,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9C,CAAC,CAAC,OAAO,CAAC;QACT,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,EAAE;QACzB,mBAAmB,EAAE,EAAE;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAS3D,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,kDAAkD;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,kDAAkD;IAClD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAE1E,qCAAqC;IACrC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC;IAEhF,+DAA+D;IAC/D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,2DAA2D;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qDAAqD;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC","sourcesContent":["/*\n OAuth2 Protocol Schemas for External Connectors\n * \n * This module integrates the comprehensive OAuth2 definitions with the\n * external connectors protocol engine. It provides:\n * \n * 1. SSO_OAuth2 Protocol - For user authentication (OpenID Connect)\n * 2. OAuth2 API Auth Profile - For linking OAuth2 to REST API authentication\n /\n\nimport { z } from 'zod';\nimport { \n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema, \n ExternalProvider_ExchangeProtocol_Kind \n} from '../core/commons.external-connectors-models.schemas';\n\n// Re-export OAuth2 enums from the shared enums file (avoids circular dependency)\nexport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\nimport {\n OAuth2_GrantType,\n OAuth2_ResponseType,\n OAuth2_PKCE_Method,\n OAuth2_TokenEndpoint_AuthMethod,\n OAuth2_Prompt,\n OAuth2_AccessType,\n OAuth2_Purpose,\n OAuth2_TokenFormat,\n OAuth2_TokenLocation,\n} from '../core/oauth2.enums';\n\n\n/\n OAuth2 and OpenID Connect Protocol Definitions\n * \n * Based on:\n * - RFC 6749: The OAuth 2.0 Authorization Framework\n * - RFC 7636: Proof Key for Code Exchange (PKCE)\n * - OpenID Connect Core 1.0\n * - RFC 7662: OAuth 2.0 Token Introspection\n * - RFC 7009: OAuth 2.0 Token Revocation\n * \n * This module provides standardized OAuth2 definitions that unify:\n * 1. API Authentication (for REST/GraphQL/Webhook calls)\n * 2. User SSO Authentication (OpenID Connect overlay)\n * 3. Service-to-Service (S2S) authentication\n /\n\n// =============================================================================\n// CAPABILITY FLAGS - Provider Features and Limitations\n// =============================================================================\n\n/\n OAuth2 Provider Capabilities - what the provider supports\n * These flags help determine what flows and features are available\n /\nexport const OAuth2_ProviderCapabilitiesSchema = z.object({\n // ─── Grant Type Support ───\n /* Supports authorization_code grant (user-interactive flow) /\n supportsAuthorizationCode: z.boolean().optional(),\n \n /* Supports client_credentials grant (S2S/machine-to-machine) /\n supportsClientCredentials: z.boolean().optional(),\n \n /* Supports device_code grant (input-constrained devices) /\n supportsDeviceCode: z.boolean().optional(),\n \n /* Supports JWT bearer assertions /\n supportsJwtBearer: z.boolean().optional(),\n \n // ─── Token Features ───\n /* Supports refresh tokens /\n supportsRefreshToken: z.boolean().optional(),\n \n /* Provider rotates refresh tokens on each use /\n rotatesRefreshToken: z.boolean().optional(),\n \n /* Supports token revocation (RFC 7009) /\n supportsTokenRevocation: z.boolean().optional(),\n \n /* Supports token introspection (RFC 7662) /\n supportsTokenIntrospection: z.boolean().optional(),\n \n // ─── Security Features ───\n /* Supports PKCE (RFC 7636) - required for public clients /\n supportsPKCE: z.boolean().optional(),\n \n /* PKCE is required (not optional) /\n requiresPKCE: z.boolean().optional(),\n \n /* Preferred PKCE method /\n preferredPKCEMethod: z.enum(OAuth2_PKCE_Method).optional(),\n \n // ─── OpenID Connect Features ───\n /* Supports OpenID Connect /\n supportsOIDC: z.boolean().optional(),\n \n /* Supports OIDC Discovery (.well-known/openid-configuration) /\n supportsOIDCDiscovery: z.boolean().optional(),\n \n /* Supports userinfo endpoint /\n supportsUserInfo: z.boolean().optional(),\n \n /* Supports ID tokens /\n supportsIdToken: z.boolean().optional(),\n \n // ─── Advanced Features ───\n /* Supports incremental authorization (adding scopes) /\n supportsIncrementalAuth: z.boolean().optional(),\n \n /* Supports scope reduction on token refresh /\n supportsScopeReduction: z.boolean().optional(),\n \n /* Supports custom domains/environments /\n supportsCustomDomains: z.boolean().optional(),\n \n /* Supports multi-tenancy /\n supportsMultiTenancy: z.boolean().optional(),\n});\nexport type OAuth2_ProviderCapabilities = z.infer<typeof OAuth2_ProviderCapabilitiesSchema>;\n\n// =============================================================================\n// ENDPOINTS - OAuth2 Server Endpoints\n// =============================================================================\n\n/\n OAuth2 Endpoints Configuration\n * Standard endpoints as defined in RFC 6749 and OIDC Discovery\n /\nexport const OAuth2_EndpointsSchema = z.object({\n // ─── Core OAuth2 Endpoints (RFC 6749) ───\n /* Authorization endpoint - where user grants access /\n authorizationUrl: z.url(),\n \n /* Token endpoint - where tokens are exchanged /\n tokenUrl: z.url(),\n \n // ─── Optional Endpoints ───\n /* Refresh URL - often same as tokenUrl, but some providers differ /\n refreshUrl: z.url().optional(),\n \n /* Revocation endpoint (RFC 7009) /\n revocationUrl: z.url().optional(),\n \n /* Introspection endpoint (RFC 7662) /\n introspectionUrl: z.url().optional(),\n \n /* Device authorization endpoint (RFC 8628) /\n deviceAuthorizationUrl: z.url().optional(),\n \n // ─── OpenID Connect Endpoints ───\n /* UserInfo endpoint - for fetching user profile /\n userInfoUrl: z.url().optional(),\n \n /* JWKS endpoint - for verifying tokens /\n jwksUrl: z.url().optional(),\n \n /* OIDC Discovery endpoint /\n discoveryUrl: z.url().optional(),\n \n /* End session / logout endpoint /\n endSessionUrl: z.url().optional(),\n \n // ─── Provider-Specific ───\n /* Custom API base URL (for making authenticated API calls) /\n apiBaseUrl: z.url().optional(),\n});\nexport type OAuth2_Endpoints = z.infer<typeof OAuth2_EndpointsSchema>;\n\n// =============================================================================\n// SCOPE DEFINITIONS - Granular Permissions\n// =============================================================================\n\n/\n OAuth2 Scope Definition - describes what a scope grants\n /\nexport const OAuth2_ScopeDefinitionSchema = z.object({\n /* The scope string as used in OAuth2 requests /\n scope: z.string(),\n \n /* Human-readable description /\n description: z.string().optional(),\n \n /* Is this scope required or optional? /\n required: z.boolean().optional(),\n \n /* Category for grouping scopes (e.g., 'read', 'write', 'admin') /\n category: z.string().optional(),\n \n /* Is this an OIDC standard scope? /\n isOIDC: z.boolean().optional(),\n \n /* Does this scope grant offline access (refresh tokens)? /\n grantsOfflineAccess: z.boolean().optional(),\n \n /* Related resources or APIs this scope provides access to /\n resources: z.array(z.string()).optional(),\n});\nexport type OAuth2_ScopeDefinition = z.infer<typeof OAuth2_ScopeDefinitionSchema>;\n\n/\n Scope Collection - organized scopes for a provider\n /\nexport const OAuth2_ScopeCollectionSchema = z.object({\n /* All available scopes /\n available: z.array(OAuth2_ScopeDefinitionSchema).optional(),\n \n /* Default scopes for user SSO authentication /\n defaultForSSO: z.array(z.string()).optional(),\n \n /* Default scopes for API access /\n defaultForAPI: z.array(z.string()).optional(),\n \n /* Minimum required scopes /\n minimum: z.array(z.string()).optional(),\n \n /* Scope that grants offline/refresh access (e.g., 'offline_access') /\n offlineAccessScope: z.string().optional(),\n});\nexport type OAuth2_ScopeCollection = z.infer<typeof OAuth2_ScopeCollectionSchema>;\n\n// =============================================================================\n// TOKEN CONFIGURATION - Token handling specifics\n// =============================================================================\n\n/\n Token Configuration - how tokens behave\n /\nexport const OAuth2_TokenConfigSchema = z.object({\n /* Token type (usually 'Bearer') /\n tokenType: z.string().optional(),\n \n /* Default access token lifetime in seconds /\n accessTokenLifetime: z.number().positive().optional(),\n \n /* Default refresh token lifetime in seconds /\n refreshTokenLifetime: z.number().positive().optional(),\n \n /* ID token lifetime in seconds (OIDC) /\n idTokenLifetime: z.number().positive().optional(),\n \n /* How to authenticate at the token endpoint /\n tokenEndpointAuthMethod: z.enum(OAuth2_TokenEndpoint_AuthMethod).optional(),\n \n /* Additional headers required for token requests /\n tokenRequestHeaders: z.record(z.string(), z.string()).optional(),\n \n /* How early (in seconds) to refresh tokens before expiry /\n refreshBufferSeconds: z.number().nonnegative().optional(),\n});\nexport type OAuth2_TokenConfig = z.infer<typeof OAuth2_TokenConfigSchema>;\n\n// =============================================================================\n// MAIN OAUTH2 PROVIDER DEFINITION\n// =============================================================================\n\n/\n Complete OAuth2 Provider Definition\n * This is the main schema that captures all OAuth2 configuration for a provider\n /\nexport const OAuth2_ProviderDefinitionSchema = z.object({\n // ─── Identity ───\n /* Unique provider identifier /\n providerId: z.string().min(1),\n \n /* Display name for UI /\n displayName: z.string().min(1),\n \n /* Provider icon URL /\n iconUrl: z.url().optional(),\n \n /* Primary brand color (hex) /\n brandColor: z.string().optional(),\n \n // ─── Purpose ───\n /* What this OAuth2 config is used for /\n purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.API_ACCESS),\n \n /* Is this provider enabled? /\n enabled: z.boolean().default(true),\n \n // ─── Endpoints ───\n /* OAuth2 endpoints configuration /\n endpoints: OAuth2_EndpointsSchema,\n \n // ─── Capabilities ───\n /* What the provider supports (all fields have defaults) /\n capabilities: OAuth2_ProviderCapabilitiesSchema.optional(),\n \n // ─── Scopes ───\n /* Scope definitions and defaults (all fields have defaults) /\n scopes: OAuth2_ScopeCollectionSchema.optional(),\n \n // ─── Token Configuration ───\n /* Token handling configuration (all fields have defaults) /\n tokenConfig: OAuth2_TokenConfigSchema.optional(),\n \n // ─── Authorization Configuration ───\n /* Preferred grant type /\n preferredGrantType: z.enum(OAuth2_GrantType).default(OAuth2_GrantType.AUTHORIZATION_CODE),\n \n /* Response type for authorization requests /\n responseType: z.enum(OAuth2_ResponseType).default(OAuth2_ResponseType.CODE),\n \n /* Prompt behavior /\n prompt: z.enum(OAuth2_Prompt).optional(),\n \n /* Access type (online/offline) /\n accessType: z.enum(OAuth2_AccessType).default(OAuth2_AccessType.OFFLINE),\n \n // ─── Dynamic Configuration ───\n /* \n * Template variables that can be substituted in URLs\n * e.g., { location: 'us' } for 'https://accounts.{location}.zoho.com'\n /\n templateVariables: z.record(z.string(), z.object({\n displayName: z.string(),\n description: z.string().optional(),\n required: z.boolean().optional(),\n defaultValue: z.string().optional(),\n options: z.array(z.object({\n value: z.string(),\n label: z.string(),\n })).optional(),\n })).optional(),\n \n /* Extra parameters to include in authorization requests /\n extraAuthParams: z.record(z.string(), z.string()).optional(),\n \n /* Extra parameters to include in token requests /\n extraTokenParams: z.record(z.string(), z.string()).optional(),\n \n // ─── User Profile Mapping (OIDC/SSO) ───\n /* Mapping for extracting user info from profile response /\n userProfileMapping: z.object({\n id: z.string().default('sub'),\n email: z.string().default('email'),\n name: z.string().default('name'),\n image: z.string().default('picture'),\n emailVerified: z.string().default('email_verified'),\n }).optional(),\n \n // ─── Provider-Specific Extensions ───\n /* Provider-specific configuration extensions /\n extensions: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_ProviderDefinition = z.infer<typeof OAuth2_ProviderDefinitionSchema>;\n\n// =============================================================================\n// NOTE: OAuth2 configurations are defined per-provider in external-connectors\n// =============================================================================\n// \n// Each provider folder (e.g., google/, microsoft/) contains its own OAuth2\n// protocol definition. Use provider string identifiers to reference providers.\n//\n\n// =============================================================================\n// SSO OAUTH2 PROTOCOL - For User Authentication\n// =============================================================================\n\n\n// =============================================================================\n// RUNTIME CREDENTIAL - Active OAuth2 credentials\n// =============================================================================\n\n/\n OAuth2 Credential - Active tokens for a provider connection\n * This is what gets stored after successful OAuth2 authentication\n /\nexport const OAuth2_CredentialSchema = z.object({\n /* Provider this credential is for /\n providerId: z.string(),\n \n /* Access token /\n accessToken: z.string(),\n \n /* Token type (usually 'Bearer') /\n tokenType: z.string().default('Bearer'),\n \n /* When the access token expires (Unix timestamp) /\n expiresAt: z.number().optional(),\n \n /* Refresh token (if available) /\n refreshToken: z.string().optional(),\n \n /* When the refresh token expires (Unix timestamp) /\n refreshTokenExpiresAt: z.number().optional(),\n \n /* ID token (OIDC) /\n idToken: z.string().optional(),\n \n /* Granted scopes (may differ from requested) /\n scope: z.string().optional(),\n \n /* When this credential was obtained /\n claimedAt: z.number(),\n \n /* Additional data from the token response /\n data: z.record(z.string(), z.unknown()).optional(),\n \n /* Provider-specific properties used during auth /\n props: z.record(z.string(), z.unknown()).optional(),\n});\nexport type OAuth2_Credential = z.infer<typeof OAuth2_CredentialSchema>;\n\n\n\n/\n OAuth2 Provider Configuration - Runtime configuration\n * Contains the OAuth2 endpoints and configuration\n /\nexport const OAuth2Provider_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n // ─── OAuth2 Core Configuration ───\n /* Complete OAuth2 provider definition (new comprehensive approach) /\n oauth2Definition: OAuth2_ProviderDefinitionSchema.optional(),\n \n // ─── Legacy fields for backward compatibility ───\n /* Authorization endpoint URL /\n authorizationEndpoint: z.url().optional(),\n \n /* Requested scopes /\n scopes: z.array(z.string()).default([]),\n\n // ─── Integration Access (for providers that offer multiple APIs) ───\n integrationAccess: z.object({\n /* Enable third-party integrations through this OAuth2 connection /\n enableIntegrations: z.boolean().default(false),\n \n /* Available integrations (e.g., ['drive', 'calendar', 'contacts']) /\n availableIntegrations: z.array(z.string()).default([]),\n \n /* Default integrations to enable /\n defaultIntegrations: z.array(z.string()).default([]),\n \n /* User must grant permission for each integration /\n requiresPermission: z.boolean().default(true),\n }).default({\n enableIntegrations: false,\n availableIntegrations: [],\n defaultIntegrations: [],\n requiresPermission: true,\n }),\n});\n\n/\n OAuth2 Provider Operation - Operations that require OAuth2\n * Currently empty, reserved for future use\n /\nexport const OAuth2Provider_OperationSchema = z.object({});\n\n// =============================================================================\n// INFERRED TYPES\n// =============================================================================\n\nexport type OAuth2Provider_Configuration = z.infer<typeof OAuth2Provider_ConfigurationSchema>;\nexport type OAuth2Provider_Operation = z.infer<typeof OAuth2Provider_OperationSchema>;\n\n// =============================================================================\n// OAUTH2 API AUTHENTICATION LINK (Consolidated)\n// =============================================================================\n\n/\n OAuth2 API Auth Link\n * \n * Unified schema for linking OAuth2 credentials to REST API / Hook authentication.\n * This prevents duplication between auth profile and OAuth2 config.\n * \n * When a REST API uses OAuth2 for authentication:\n * 1. Define the OAuth2 provider once (endpoints, scopes, capabilities)\n * 2. Link it to the API auth profile using this schema\n * 3. The system will automatically:\n * - Manage token refresh\n * - Format Authorization headers\n * - Track required scopes per operation\n /\nexport const OAuth2_APIAuthLinkSchema = z.object({\n /* Reference to the OAuth2 provider definition /\n oauth2ProviderRef: z.string().min(1),\n \n /* Which scopes are needed for this API access /\n requiredScopes: z.array(z.string()).default([]),\n \n /* How to format the token for API calls /\n tokenFormat: z.enum(OAuth2_TokenFormat).default(OAuth2_TokenFormat.BEARER),\n \n /* Where to send the access token /\n tokenLocation: z.enum(OAuth2_TokenLocation).default(OAuth2_TokenLocation.HEADER),\n \n /* Custom header name (when tokenFormat is 'custom_header') /\n customHeaderName: z.string().optional(),\n \n /* Query parameter name (when tokenLocation is 'query') /\n queryParamName: z.string().optional(),\n \n /* Prefix for the token value (optional override) /\n tokenPrefix: z.string().optional(),\n});\nexport type OAuth2_APIAuthLink = z.infer<typeof OAuth2_APIAuthLinkSchema>;\n\n// Note: OAuth2_APIAuthLinkSchema is now defined in the consolidated section above\n\n// =============================================================================\n// HELPER TYPES\n// =============================================================================\n\n/\n OAuth2 Authorization Request - parameters for the authorization URL\n /\nexport interface OAuth2_AuthorizationRequest {\n clientId: string;\n redirectUri: string;\n scope: string[];\n state: string;\n responseType?: OAuth2_ResponseType;\n codeChallenge?: string;\n codeChallengeMethod?: OAuth2_PKCE_Method;\n prompt?: OAuth2_Prompt;\n accessType?: OAuth2_AccessType;\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Request - parameters for the token endpoint\n /\nexport interface OAuth2_TokenRequest {\n grantType: OAuth2_GrantType;\n clientId: string;\n clientSecret?: string;\n code?: string;\n redirectUri?: string;\n codeVerifier?: string;\n refreshToken?: string;\n scope?: string[];\n extraParams?: Record<string, string>;\n}\n\n/\n OAuth2 Token Response - response from the token endpoint\n */\nexport interface OAuth2_TokenResponse {\n accessToken: string;\n tokenType: string;\n expiresIn?: number;\n refreshToken?: string;\n scope?: string;\n idToken?: string;\n data?: Record<string, unknown>;\n}\n\n"]}