dineway 0.1.8 → 0.1.11

package/dist/astro/routes/api/oauth/token.mjs

@@ -0,0 +1,138 @@
+import { r as handleError, t as apiError } from "../../../../error-DEGjx2Xw.mjs";
+import "../../../../api-tokens-DzloJxuh.mjs";
+import "../../../../oauth-clients-CvWatf5p.mjs";
+import "../../../../oauth-user-lookup-B4OcmsLV.mjs";
+import { r as handleAuthorizationCodeExchange } from "../../../../oauth-authorization-C1qiw4hd.mjs";
+import { i as handleTokenRefresh, r as handleDeviceTokenExchange } from "../../../../device-flow-7AhWNwCK.mjs";
+import { z } from "zod";
+
+//#region src/astro/routes/api/oauth/token.ts
+const prerender = false;
+const OAUTH_TOKEN_HEADERS = {
+	"Content-Type": "application/json",
+	"Cache-Control": "no-store",
+	Pragma: "no-cache",
+	"Access-Control-Allow-Origin": "*"
+};
+const OAUTH_PREFLIGHT_HEADERS = {
+	"Access-Control-Allow-Origin": "*",
+	"Access-Control-Allow-Methods": "POST, OPTIONS",
+	"Access-Control-Allow-Headers": "Content-Type",
+	"Access-Control-Max-Age": "86400"
+};
+/**
+* Parse the request body from either form-encoded or JSON.
+* OAuth 2.1 mandates form-encoded, but we accept both.
+*/
+async function parseTokenBody(request) {
+	if ((request.headers.get("content-type") ?? "").includes("application/x-www-form-urlencoded")) {
+		const text = await request.text();
+		const params = new URLSearchParams(text);
+		const result = {};
+		for (const [key, value] of params) result[key] = value;
+		return result;
+	}
+	try {
+		const json = Object(await request.json());
+		const result = {};
+		for (const [key, value] of Object.entries(json)) if (typeof value === "string") result[key] = value;
+		else if (typeof value === "number") result[key] = String(value);
+		return result;
+	} catch {
+		return {};
+	}
+}
+const authCodeSchema = z.object({
+	grant_type: z.literal("authorization_code"),
+	code: z.string().min(1),
+	redirect_uri: z.string().min(1),
+	client_id: z.string().min(1),
+	code_verifier: z.string().min(43).max(128),
+	resource: z.string().optional()
+});
+const deviceCodeSchema = z.object({
+	grant_type: z.literal("urn:ietf:params:oauth:grant-type:device_code"),
+	device_code: z.string().min(1)
+});
+const refreshSchema = z.object({
+	grant_type: z.literal("refresh_token"),
+	refresh_token: z.string().min(1)
+});
+const OPTIONS = () => {
+	return new Response(null, {
+		status: 204,
+		headers: OAUTH_PREFLIGHT_HEADERS
+	});
+};
+const POST = async ({ request, locals }) => {
+	const { dineway } = locals;
+	if (!dineway?.db) return apiError("NOT_CONFIGURED", "Dineway is not initialized", 500);
+	try {
+		const body = await parseTokenBody(request);
+		const grantType = body.grant_type;
+		if (!grantType) return oauthError("invalid_request", "grant_type is required", 400);
+		switch (grantType) {
+			case "authorization_code": {
+				const parsed = authCodeSchema.safeParse(body);
+				if (!parsed.success) return oauthError("invalid_request", formatZodError(parsed.error), 400);
+				const result = await handleAuthorizationCodeExchange(dineway.db, parsed.data);
+				if (!result.success) {
+					const err = result.error ?? {
+						code: "unknown",
+						message: "Unknown error"
+					};
+					return oauthError(err.code, err.message, 400);
+				}
+				return oauthSuccess(result.data);
+			}
+			case "urn:ietf:params:oauth:grant-type:device_code": {
+				const parsed = deviceCodeSchema.safeParse(body);
+				if (!parsed.success) return oauthError("invalid_request", formatZodError(parsed.error), 400);
+				const result = await handleDeviceTokenExchange(dineway.db, parsed.data);
+				if (!result.success) {
+					const err = result.error ?? {
+						code: "unknown",
+						message: "Unknown error"
+					};
+					if (result.deviceFlowError) return oauthError(result.deviceFlowError, err.message, 400);
+					return oauthError(err.code, err.message, 400);
+				}
+				return oauthSuccess(result.data);
+			}
+			case "refresh_token": {
+				const parsed = refreshSchema.safeParse(body);
+				if (!parsed.success) return oauthError("invalid_request", formatZodError(parsed.error), 400);
+				const result = await handleTokenRefresh(dineway.db, parsed.data);
+				if (!result.success) {
+					const err = result.error ?? {
+						code: "unknown",
+						message: "Unknown error"
+					};
+					return oauthError(err.code, err.message, 400);
+				}
+				return oauthSuccess(result.data);
+			}
+			default: return oauthError("unsupported_grant_type", `Unsupported grant_type: ${grantType}`, 400);
+		}
+	} catch (error) {
+		return handleError(error, "Failed to process token request", "TOKEN_ERROR");
+	}
+};
+function oauthSuccess(data) {
+	return Response.json(data, { headers: OAUTH_TOKEN_HEADERS });
+}
+function oauthError(error, description, status) {
+	return Response.json({
+		error,
+		error_description: description
+	}, {
+		status,
+		headers: OAUTH_TOKEN_HEADERS
+	});
+}
+function formatZodError(error) {
+	return error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+}
+
+//#endregion
+export { OPTIONS, POST, prerender };

package/dist/astro/routes/api/openapi.json.d.mts

@@ -0,0 +1,7 @@
+import { APIRoute } from "astro";
+
+//#region src/astro/routes/api/openapi.json.d.ts
+declare const prerender = false;
+declare const GET: APIRoute;
+//#endregion
+export { GET, prerender };