@zackbart/connecta 0.38.0 → 0.40.0

package/dist/auth/downstream-oauth/sdk-hooks.js

@@ -0,0 +1,242 @@
+import { authCall, authFlow, authInvoke, authMethod, authValue } from "../native.js";
+import { discoveryIssuer } from "../oauth-grant.js";
+import { aborted } from "./refresh-coordinator.js";
+import { fingerprint } from "./grant-store.js";
+import { oauthStateDigest, randomState } from "./consent.js";
+/** KvOAuthProvider's SDK hooks; `authMethods` installs them. */
+export const sdkHookMethods = {
+    clientInformation: function (ctx) {
+        return authFlow(function* () {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const { body } = (yield authInvoke(this, "activeGrant", []));
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const client = this.clientOptions?.client;
+            if (!body.client && !this.allowAuthorization)
+                throw this.authorizationRefused();
+            if (client) {
+                if ((ctx && ctx.issuer !== client.issuer) || body.issuer !== client.issuer)
+                    throw this.flowSuperseded();
+                if (body.client &&
+                    (body.client.value.client_id !== client.clientId || body.client.binding !== this.clientBinding))
+                    throw this.flowSuperseded();
+                return {
+                    client_id: client.clientId,
+                    issuer: client.issuer,
+                    token_endpoint_auth_method: this.clientMetadata.token_endpoint_auth_method,
+                    ...(client.clientSecret !== undefined ? { client_secret: client.clientSecret } : {}),
+                };
+            }
+            if (!body.client || (ctx && body.issuer !== ctx.issuer))
+                return undefined;
+            this.seen.client = fingerprint(body.client.value);
+            return ctx ? { ...body.client.value, issuer: ctx.issuer } : body.client.value;
+        }.bind(this));
+    },
+    saveClientInformation: function (info, ctx) {
+        return authFlow(function* () {
+            try {
+                const { body } = (yield authInvoke(this, "boundGrant", []));
+                const registrationPath = this.clientOptions?.client
+                    ? "static"
+                    : body.client?.value.client_id === info.client_id && body.client.registrationPath
+                        ? body.client.registrationPath
+                        : this.clientMetadataUrl &&
+                            body.discovery?.authorizationServerMetadata?.client_id_metadata_document_supported === true
+                            ? "cimd"
+                            : "dcr";
+                (yield authInvoke(this, "writeCredential", [
+                    "client",
+                    {
+                        value: this.clientOptions?.client ? { client_id: this.clientOptions.client.clientId } : info,
+                        registrationPath,
+                        ...(this.clientBinding !== undefined ? { binding: this.clientBinding } : {}),
+                    },
+                    ctx?.issuer,
+                ]));
+            }
+            catch (error) {
+                if (!this.signal?.aborted)
+                    throw error;
+            }
+        }.bind(this));
+    },
+    registrationPath: function () {
+        return authFlow(function* () {
+            const { body } = (yield authInvoke(this, "boundGrant", []));
+            return body.client?.registrationPath;
+        }.bind(this));
+    },
+    validatedIssuerOrigin: function () {
+        return authFlow(function* () {
+            const { body } = (yield authInvoke(this, "boundGrant", []));
+            const state = body.discovery;
+            if (!state ||
+                state.authorizationServerMetadata?.issuer !== state.authorizationServerUrl ||
+                body.issuer !== state.authorizationServerUrl)
+                return undefined;
+            this.assertCredentialFree(state, body);
+            return new URL(state.authorizationServerUrl).origin;
+        }.bind(this));
+    },
+    discoveryState: function () {
+        return authFlow(function* () {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const { body } = (yield authInvoke(this, "activeGrant", []));
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            let state = body.discovery;
+            if (state?.resourceMetadataUrl && this.clientOptions?.resourceOrigin) {
+                let sameOrigin = false;
+                try {
+                    sameOrigin = new URL(state.resourceMetadataUrl).origin === this.clientOptions.resourceOrigin;
+                }
+                catch {
+                    // A malformed legacy URL is no more usable than a foreign one.
+                }
+                if (!sameOrigin) {
+                    // Never hand the SDK a legacy foreign URL or its resource
+                    // document. Keep the issuer binding for callbacks, but force
+                    // same-origin resource discovery on every SDK path. This read
+                    // does not mutate the stored grant.
+                    state = { ...state };
+                    delete state.resourceMetadataUrl;
+                    delete state.resourceMetadata;
+                }
+            }
+            this.assertCredentialFree(state, body);
+            // Bind consent to durable discovery until the SDK saves a new
+            // state. A same-origin metadata 404 can leave the cache unchanged.
+            this.consentDiscovery = body.discovery;
+            return state;
+        }.bind(this));
+    },
+    saveDiscoveryState: function (state) {
+        return authFlow(function* () {
+            this.assertCredentialFree(state, (yield authInvoke(this, "boundGrant", [])).body);
+            const issuer = discoveryIssuer(state);
+            if (this.clientOptions?.client && issuer !== this.clientOptions.client.issuer)
+                throw this.flowSuperseded();
+            if (!this.allowAuthorization && !(yield authInvoke(this, "boundGrant", [])).body.client)
+                throw this.authorizationRefused();
+            this.consentDiscovery = state;
+            (yield authInvoke(this, "updateGrant", [
+                (grant) => {
+                    const body = grant.body.issuer !== issuer ? (issuer !== undefined ? { issuer } : {}) : { ...grant.body };
+                    this.assertCredentialFree(state, grant.body);
+                    body.discovery = state;
+                    return this.withIssuer(grant, body);
+                },
+            ]));
+        }.bind(this));
+    },
+    tokens: function (ctx) {
+        return authFlow(function* () {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const grant = (yield authInvoke(this, "activeGrant", []));
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const { tokens } = grant.body;
+            if (!tokens || (ctx && grant.body.issuer !== ctx.issuer))
+                return undefined;
+            this.seen.tokens = fingerprint(tokens);
+            if (!ctx)
+                return tokens;
+            this.refreshBasis = { accessToken: tokens.access_token, epoch: grant.epoch, issuer: ctx.issuer };
+            return { ...tokens, issuer: ctx.issuer };
+        }.bind(this));
+    },
+    saveTokens: function (tokens, ctx) {
+        return authFlow(function* () {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            if (this.refreshFailure?.kind === "dead")
+                throw this.authorizationRefused();
+            // The coordinator stored this refresh already, or handed on another's.
+            if (this.storedRefresh !== undefined && tokens.access_token === this.storedRefresh)
+                return;
+            const refreshConsent = this.exchangeConsent &&
+                tokens.refresh_token !== undefined &&
+                this.exchangeConsent.digest ===
+                    (yield authInvoke(this, "wait", [
+                        authMethod(() => {
+                            return authCall(oauthStateDigest, [tokens.refresh_token]);
+                        }),
+                    ]))
+                ? this.exchangeConsent
+                : undefined;
+            (yield authInvoke(this, "writeCredential", ["tokens", tokens, ctx?.issuer, refreshConsent]));
+            this.refreshFailure = undefined;
+        }.bind(this));
+    },
+    state: function () {
+        return authValue(() => {
+            if (!this.allowAuthorization)
+                throw this.authorizationRefused();
+            const state = randomState();
+            this.consent = { state };
+            return state;
+        });
+    },
+    saveCodeVerifier: function (verifier) {
+        return authValue(() => {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            if (!this.allowAuthorization)
+                throw this.authorizationRefused();
+            this.consent = { ...this.consent, verifier };
+        });
+    },
+    codeVerifier: function () {
+        return authValue(() => {
+            const verifier = this.callback?.flow.verifier ?? this.consent.verifier;
+            if (verifier === undefined) {
+                throw new Error(`No PKCE code verifier for "${this.connectorId}"`);
+            }
+            return verifier;
+        });
+    },
+    invalidateCredentials: function (scope) {
+        return authFlow(function* () {
+            if (this.signal?.aborted)
+                throw aborted(this.signal);
+            const fields = {
+                all: ["client", "tokens", "discovery"],
+                client: ["client"],
+                tokens: ["tokens"],
+                discovery: ["discovery"],
+                verifier: [],
+            }[scope];
+            if (fields.length > 0) {
+                (yield authInvoke(this, "updateGrant", [
+                    (grant) => {
+                        const body = { ...grant.body };
+                        let changed = false;
+                        for (const field of fields) {
+                            const current = field === "client" ? body.client?.value : body[field];
+                            if (current === undefined)
+                                continue;
+                            if (field !== "discovery" && fingerprint(current) !== this.seen[field])
+                                continue;
+                            delete body[field];
+                            if (field === "tokens")
+                                delete body.expiresAt;
+                            changed = true;
+                        }
+                        return changed ? { ...grant, body } : undefined;
+                    },
+                    { quiet: true },
+                ]));
+            }
+            // The SDK invalidates after a refused refresh and then starts over, which
+            // on `invalid_client` means registering a new client. A passive request
+            // must not begin authorization, so it ends here, as auth_required.
+            if (!this.allowAuthorization && this.refreshFailure?.kind === "dead") {
+                throw this.authorizationRefused();
+            }
+        }.bind(this));
+    },
+};