gtypee 1.0.2

package/dist/src/googleauth/oauth-flow.js

@@ -0,0 +1,262 @@
+import { randomBytes } from "node:crypto";
+import http from "node:http";
+import net from "node:net";
+import { google } from "googleapis";
+import { readClientCredentialsFor } from "../config/credentials.js";
+const ERR_INVALID_REDIRECT_URL = "invalid redirect URL";
+const ERR_MISSING_CODE = "missing code";
+const ERR_MISSING_SCOPES = "missing scopes";
+const ERR_NO_CODE_IN_URL = "no code found in URL";
+const ERR_MISSING_REDIRECT_URI = "missing redirect uri; provide auth-url";
+const ERR_MISSING_STATE = "missing state in redirect URL";
+const ERR_NO_REFRESH_TOKEN = "no refresh token received; try again with --force-consent";
+export const ERR_INTERACTIVE_FLOW_REQUIRED = "interactive browser auth is not available in this build; use --manual or --remote";
+async function randomManualRedirectUri() {
+    const server = net.createServer();
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.removeListener("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    await new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+    if (address === null || typeof address === "string") {
+        throw new Error("listen for manual redirect port: invalid address");
+    }
+    return `http://127.0.0.1:${address.port}/oauth2/callback`;
+}
+function parseRedirectUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl.trim());
+    }
+    catch (error) {
+        throw new Error(`parse redirect url: ${String(error)}`);
+    }
+    if (parsed.protocol === "" || parsed.host === "") {
+        throw new Error(`parse redirect url: ${ERR_INVALID_REDIRECT_URL}`);
+    }
+    const code = parsed.searchParams.get("code") ?? "";
+    if (code === "") {
+        throw new Error(ERR_NO_CODE_IN_URL);
+    }
+    const state = parsed.searchParams.get("state") ?? "";
+    return {
+        code,
+        state,
+        redirectUri: `${parsed.protocol}//${parsed.host}${parsed.pathname || "/"}`,
+    };
+}
+async function defaultExchangeCode(request) {
+    const oauth = new google.auth.OAuth2(request.clientId, request.clientSecret, request.redirectUri);
+    const response = await oauth.getToken({
+        code: request.code,
+        redirect_uri: request.redirectUri,
+    });
+    const refreshToken = response.tokens.refresh_token;
+    if (typeof refreshToken === "string" && refreshToken.trim() !== "") {
+        return { refreshToken };
+    }
+    return {};
+}
+export function validateAuthorizeOptions(opts) {
+    if ((opts.authUrl ?? "").trim() !== "" && (opts.authCode ?? "").trim() !== "") {
+        throw new Error("cannot combine auth-url with auth-code");
+    }
+    if ((opts.requireState ?? false) && (opts.authCode ?? "").trim() !== "") {
+        throw new Error("auth-code is not valid when state is required; provide auth-url");
+    }
+    if (opts.scopes.length === 0) {
+        throw new Error(ERR_MISSING_SCOPES);
+    }
+}
+export function authUrlParams(forceConsent) {
+    const out = {
+        access_type: "offline",
+        include_granted_scopes: "true",
+    };
+    if (forceConsent) {
+        out.prompt = "consent";
+    }
+    return out;
+}
+export function randomState() {
+    return randomBytes(32).toString("base64url");
+}
+export async function manualAuthURL(opts, deps = {}) {
+    validateAuthorizeOptions(opts);
+    const readCreds = deps.readClientCredentialsFor ?? readClientCredentialsFor;
+    const makeState = deps.randomState ?? randomState;
+    const makeRedirectUri = deps.randomRedirectUri ?? randomManualRedirectUri;
+    const client = (opts.client ?? "").trim();
+    const creds = await readCreds(client);
+    const state = makeState();
+    const redirectUri = await makeRedirectUri();
+    const oauth = new google.auth.OAuth2(creds.clientId, creds.clientSecret, redirectUri);
+    const generateOptions = {
+        access_type: "offline",
+        include_granted_scopes: true,
+        response_type: "code",
+        scope: opts.scopes,
+        state,
+    };
+    if (opts.forceConsent ?? false) {
+        generateOptions.prompt = "consent";
+    }
+    const url = oauth.generateAuthUrl(generateOptions);
+    return {
+        url,
+        stateReused: false,
+    };
+}
+export async function authorize(opts, deps = {}) {
+    validateAuthorizeOptions(opts);
+    const readCreds = deps.readClientCredentialsFor ?? readClientCredentialsFor;
+    const exchangeCode = deps.exchangeCode ?? defaultExchangeCode;
+    const authUrlInput = (opts.authUrl ?? "").trim();
+    const authCodeInput = (opts.authCode ?? "").trim();
+    if (authUrlInput === "" && authCodeInput === "") {
+        throw new Error(ERR_INTERACTIVE_FLOW_REQUIRED);
+    }
+    const client = (opts.client ?? "").trim();
+    const creds = await readCreds(client);
+    let code = authCodeInput;
+    let state = "";
+    let redirectUri = "";
+    if (authUrlInput !== "") {
+        const parsed = parseRedirectUrl(authUrlInput);
+        code = parsed.code;
+        state = parsed.state;
+        redirectUri = parsed.redirectUri;
+    }
+    if ((opts.requireState ?? false) && state === "") {
+        throw new Error(ERR_MISSING_STATE);
+    }
+    if (code === "") {
+        throw new Error(ERR_MISSING_CODE);
+    }
+    if (redirectUri === "") {
+        throw new Error(ERR_MISSING_REDIRECT_URI);
+    }
+    const request = {
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        scopes: opts.scopes,
+        code,
+        redirectUri,
+        forceConsent: opts.forceConsent ?? false,
+    };
+    if (state !== "") {
+        request.state = state;
+    }
+    const token = await exchangeCode(request);
+    const refreshToken = token.refreshToken?.trim() ?? "";
+    if (refreshToken === "") {
+        throw new Error(ERR_NO_REFRESH_TOKEN);
+    }
+    return refreshToken;
+}
+export async function authorizeWithLocalServer(opts, deps = {}) {
+    if (opts.scopes.length === 0) {
+        throw new Error(ERR_MISSING_SCOPES);
+    }
+    const readCreds = deps.readClientCredentialsFor ?? readClientCredentialsFor;
+    const exchangeCode = deps.exchangeCode ?? defaultExchangeCode;
+    const client = (opts.client ?? "").trim();
+    const creds = await readCreds(client);
+    const timeoutMs = opts.timeoutMs ?? 120_000;
+    const state = randomState();
+    // Start a local HTTP server on a random port to receive the OAuth callback.
+    const server = http.createServer();
+    const port = await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.removeListener("error", reject);
+            const addr = server.address();
+            if (addr === null || typeof addr === "string") {
+                reject(new Error("failed to bind local server"));
+                return;
+            }
+            resolve(addr.port);
+        });
+    });
+    const redirectUri = `http://127.0.0.1:${port}/oauth2/callback`;
+    const oauth = new google.auth.OAuth2(creds.clientId, creds.clientSecret, redirectUri);
+    const generateOptions = {
+        access_type: "offline",
+        include_granted_scopes: true,
+        response_type: "code",
+        scope: opts.scopes,
+        state,
+    };
+    if (opts.forceConsent ?? false) {
+        generateOptions.prompt = "consent";
+    }
+    const authUrl = oauth.generateAuthUrl(generateOptions);
+    // Notify the caller of the auth URL so it can be displayed before we block.
+    opts.onAuthUrl?.(authUrl);
+    // Wait for the OAuth callback or timeout.
+    const callbackCode = await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            server.close();
+            reject(new Error("timed out waiting for OAuth callback"));
+        }, timeoutMs);
+        server.on("request", (req, res) => {
+            const reqUrl = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+            if (reqUrl.pathname !== "/oauth2/callback") {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            const callbackState = reqUrl.searchParams.get("state") ?? "";
+            if (callbackState !== state) {
+                clearTimeout(timer);
+                res.writeHead(400, { "Content-Type": "text/plain" });
+                res.end("OAuth state mismatch");
+                server.close();
+                reject(new Error("OAuth state mismatch"));
+                return;
+            }
+            const code = reqUrl.searchParams.get("code") ?? "";
+            if (code === "") {
+                clearTimeout(timer);
+                res.writeHead(400, { "Content-Type": "text/plain" });
+                res.end("No authorization code in callback");
+                server.close();
+                reject(new Error("no authorization code in callback"));
+                return;
+            }
+            clearTimeout(timer);
+            res.writeHead(200, { "Content-Type": "text/plain" });
+            res.end("Authorization received. You can close this tab.");
+            server.close();
+            resolve(code);
+        });
+    });
+    const request = {
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        scopes: opts.scopes,
+        code: callbackCode,
+        redirectUri,
+        forceConsent: opts.forceConsent ?? false,
+        state,
+    };
+    const token = await exchangeCode(request);
+    const refreshToken = token.refreshToken?.trim() ?? "";
+    if (refreshToken === "") {
+        throw new Error(ERR_NO_REFRESH_TOKEN);
+    }
+    return { refreshToken, authUrl };
+}
+//# sourceMappingURL=oauth-flow.js.map

package/dist/src/googleauth/oauth-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.js","sourceRoot":"","sources":["../../../src/googleauth/oauth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,wBAAwB,EAA0B,MAAM,0BAA0B,CAAC;AAmD5F,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AACxD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAClD,MAAM,wBAAwB,GAAG,wCAAwC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAC1D,MAAM,oBAAoB,GAAG,2DAA2D,CAAC;AACzF,MAAM,CAAC,MAAM,6BAA6B,GAAG,mFAAmF,CAAC;AAEjI,KAAK,UAAU,uBAAuB;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;IAClC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,oBAAoB,OAAO,CAAC,IAAI,kBAAkB,CAAC;AAC5D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uBAAuB,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO;QACL,IAAI;QACJ,KAAK;QACL,WAAW,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAA4B;IAC7D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAClG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,YAAqB;IACjD,MAAM,GAAG,GAA2B;QAClC,WAAW,EAAE,SAAS;QACtB,sBAAsB,EAAE,MAAM;KAC/B,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAsB,EAAE,OAA0B,EAAE;IACtF,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,IAAI,wBAAwB,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC;IAClD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,IAAI,uBAAuB,CAAC;IAC1E,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG;QACtB,WAAW,EAAE,SAAS;QACtB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,KAAK;KAQN,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QAC/B,eAAe,CAAC,MAAM,GAAG,SAAS,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;IAEnD,OAAO;QACL,GAAG;QACH,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB,EAAE,OAAsB,EAAE;IAC9E,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,IAAI,wBAAwB,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAE9D,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,YAAY,KAAK,EAAE,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,IAAI,GAAG,aAAa,CAAC;IACzB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACnB,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACrB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAwB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI;QACJ,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;KACzC,CAAC;IACF,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC,EACrC,OAAqC,EAAE;IAEvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,IAAI,wBAAwB,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAE5B,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,oBAAoB,IAAI,kBAAkB,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEtF,MAAM,eAAe,GAOjB;QACF,WAAW,EAAE,SAAS;QACtB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,KAAK;KACN,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;QAC/B,eAAe,CAAC,MAAM,GAAG,SAAS,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IAE1B,0CAA0C;IAC1C,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC5D,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAyB,EAAE,GAAwB,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEnE,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;gBAC7C,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAwB;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,YAAY;QAClB,WAAW;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,KAAK;QACxC,KAAK;KACN,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/googleauth/service.d.ts

@@ -0,0 +1,28 @@
+export type Service = "gmail" | "calendar" | "chat" | "classroom" | "drive" | "docs" | "slides" | "contacts" | "tasks" | "people" | "sheets" | "forms" | "appscript" | "groups" | "workspace" | "keep";
+export declare enum DriveScopeMode {
+    Full = "full",
+    Readonly = "readonly",
+    File = "file"
+}
+export type ScopeOptions = {
+    readonly?: boolean;
+    driveScope?: DriveScopeMode;
+};
+export declare function allServices(): Service[];
+export declare function parseService(raw: string): Service;
+export declare function userServices(): Service[];
+export declare function scopes(service: Service): string[];
+export declare function scopesForServices(services: Service[]): string[];
+export declare function scopesForManage(services: Service[]): string[];
+export declare function scopesForManageWithOptions(services: Service[], opts: ScopeOptions): string[];
+export type ServiceInfo = {
+    service: Service;
+    user: boolean;
+    scopes: string[];
+    apis: string[];
+    note?: string;
+};
+export declare function servicesInfo(): ServiceInfo[];
+export declare function servicesMarkdown(infos: ServiceInfo[]): string;
+export declare function userServiceCSV(): string;
+//# sourceMappingURL=service.d.ts.map

package/dist/src/googleauth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/googleauth/service.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GACf,OAAO,GACP,UAAU,GACV,MAAM,GACN,WAAW,GACX,OAAO,GACP,MAAM,GACN,QAAQ,GACR,UAAU,GACV,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,WAAW,GACX,QAAQ,GACR,WAAW,GACX,MAAM,CAAC;AAMX,oBAAY,cAAc;IACxB,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,IAAI,SAAS;CACd;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B,CAAC;AAgKF,wBAAgB,WAAW,IAAI,OAAO,EAAE,CAEvC;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMjD;AAED,wBAAgB,YAAY,IAAI,OAAO,EAAE,CAExC;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAMjD;AAkHD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAQ/D;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAE7D;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CAQ5F;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAc5C;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAkB7D;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC"}

package/dist/src/googleauth/service.js

@@ -0,0 +1,345 @@
+const SCOPE_OPENID = "openid";
+const SCOPE_EMAIL = "email";
+const SCOPE_USERINFO_EMAIL = "https://www.googleapis.com/auth/userinfo.email";
+export var DriveScopeMode;
+(function (DriveScopeMode) {
+    DriveScopeMode["Full"] = "full";
+    DriveScopeMode["Readonly"] = "readonly";
+    DriveScopeMode["File"] = "file";
+})(DriveScopeMode || (DriveScopeMode = {}));
+const serviceOrder = [
+    "gmail",
+    "calendar",
+    "chat",
+    "classroom",
+    "drive",
+    "docs",
+    "slides",
+    "contacts",
+    "tasks",
+    "sheets",
+    "people",
+    "forms",
+    "appscript",
+    "groups",
+    "keep",
+];
+const serviceInfoByService = {
+    gmail: {
+        scopes: [
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.settings.basic",
+            "https://www.googleapis.com/auth/gmail.settings.sharing",
+        ],
+        user: true,
+        apis: ["Gmail API"],
+    },
+    calendar: {
+        scopes: ["https://www.googleapis.com/auth/calendar"],
+        user: true,
+        apis: ["Calendar API"],
+    },
+    chat: {
+        scopes: [
+            "https://www.googleapis.com/auth/chat.spaces",
+            "https://www.googleapis.com/auth/chat.messages",
+            "https://www.googleapis.com/auth/chat.memberships",
+            "https://www.googleapis.com/auth/chat.users.readstate.readonly",
+        ],
+        user: true,
+        apis: ["Chat API"],
+    },
+    classroom: {
+        scopes: [
+            "https://www.googleapis.com/auth/classroom.courses",
+            "https://www.googleapis.com/auth/classroom.rosters",
+            "https://www.googleapis.com/auth/classroom.coursework.students",
+            "https://www.googleapis.com/auth/classroom.coursework.me",
+            "https://www.googleapis.com/auth/classroom.courseworkmaterials",
+            "https://www.googleapis.com/auth/classroom.announcements",
+            "https://www.googleapis.com/auth/classroom.topics",
+            "https://www.googleapis.com/auth/classroom.guardianlinks.students",
+            "https://www.googleapis.com/auth/classroom.profile.emails",
+            "https://www.googleapis.com/auth/classroom.profile.photos",
+        ],
+        user: true,
+        apis: ["Classroom API"],
+    },
+    drive: {
+        scopes: ["https://www.googleapis.com/auth/drive"],
+        user: true,
+        apis: ["Drive API"],
+    },
+    docs: {
+        scopes: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/documents"],
+        user: true,
+        apis: ["Docs API", "Drive API"],
+        note: "Export/copy/create via Drive",
+    },
+    slides: {
+        scopes: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/presentations"],
+        user: true,
+        apis: ["Slides API", "Drive API"],
+        note: "Create/edit presentations",
+    },
+    contacts: {
+        scopes: [
+            "https://www.googleapis.com/auth/contacts",
+            "https://www.googleapis.com/auth/contacts.other.readonly",
+            "https://www.googleapis.com/auth/directory.readonly",
+        ],
+        user: true,
+        apis: ["People API"],
+        note: "Contacts + other contacts + directory",
+    },
+    tasks: {
+        scopes: ["https://www.googleapis.com/auth/tasks"],
+        user: true,
+        apis: ["Tasks API"],
+    },
+    people: {
+        scopes: ["profile"],
+        user: true,
+        apis: ["People API"],
+        note: "OIDC profile scope",
+    },
+    sheets: {
+        scopes: ["https://www.googleapis.com/auth/drive", "https://www.googleapis.com/auth/spreadsheets"],
+        user: true,
+        apis: ["Sheets API", "Drive API"],
+        note: "Export via Drive",
+    },
+    forms: {
+        scopes: [
+            "https://www.googleapis.com/auth/forms.body",
+            "https://www.googleapis.com/auth/forms.responses.readonly",
+        ],
+        user: true,
+        apis: ["Forms API"],
+    },
+    appscript: {
+        scopes: [
+            "https://www.googleapis.com/auth/drive",
+            "https://www.googleapis.com/auth/script.projects",
+            "https://www.googleapis.com/auth/script.deployments",
+            "https://www.googleapis.com/auth/script.processes",
+        ],
+        user: true,
+        apis: ["Apps Script API", "Drive API"],
+        note: "List scripts via Drive",
+    },
+    groups: {
+        scopes: ["https://www.googleapis.com/auth/admin.directory.group"],
+        user: false,
+        apis: ["Admin SDK Directory API"],
+        note: "Workspace only; requires Admin SDK directory_v1",
+    },
+    workspace: {
+        scopes: [
+            "https://www.googleapis.com/auth/admin.directory.user",
+            "https://www.googleapis.com/auth/admin.directory.user.security",
+            "https://www.googleapis.com/auth/admin.directory.orgunit",
+            "https://www.googleapis.com/auth/admin.directory.group",
+            "https://www.googleapis.com/auth/admin.directory.group.member",
+            "https://www.googleapis.com/auth/admin.directory.device.chromeos",
+            "https://www.googleapis.com/auth/admin.directory.device.mobile",
+            "https://www.googleapis.com/auth/admin.reports.audit.readonly",
+        ],
+        user: false,
+        apis: ["Admin SDK Directory API", "Admin SDK Reports API"],
+        note: "Workspace admin: users, org units, groups, devices, reports",
+    },
+    keep: {
+        scopes: ["https://www.googleapis.com/auth/keep.readonly"],
+        user: false,
+        apis: ["Keep API"],
+        note: "Workspace only; service account (domain-wide delegation)",
+    },
+};
+export function allServices() {
+    return [...serviceOrder];
+}
+export function parseService(raw) {
+    const parsed = raw.trim().toLowerCase();
+    if (parsed in serviceInfoByService) {
+        return parsed;
+    }
+    throw new Error(`unknown service ${raw} (expected ${serviceNames(allServices(), "|")})`);
+}
+export function userServices() {
+    return serviceOrder.filter((service) => serviceInfoByService[service].user);
+}
+export function scopes(service) {
+    const info = serviceInfoByService[service];
+    if (!info) {
+        throw new Error(`unknown service: ${service}`);
+    }
+    return [...info.scopes];
+}
+function driveScopeValue(opts) {
+    if (opts.readonly) {
+        return "https://www.googleapis.com/auth/drive.readonly";
+    }
+    switch (opts.driveScope ?? DriveScopeMode.Full) {
+        case DriveScopeMode.File:
+            return "https://www.googleapis.com/auth/drive.file";
+        case DriveScopeMode.Readonly:
+            return "https://www.googleapis.com/auth/drive.readonly";
+        case DriveScopeMode.Full:
+            return "https://www.googleapis.com/auth/drive";
+        default:
+            throw new Error(`invalid drive scope ${String(opts.driveScope)} (expected full|readonly|file)`);
+    }
+}
+function scopesForServiceWithOptions(service, opts) {
+    const readonly = opts.readonly ?? false;
+    switch (service) {
+        case "gmail":
+            return readonly ? ["https://www.googleapis.com/auth/gmail.readonly"] : scopes(service);
+        case "calendar":
+            return readonly ? ["https://www.googleapis.com/auth/calendar.readonly"] : scopes(service);
+        case "chat":
+            return readonly
+                ? [
+                    "https://www.googleapis.com/auth/chat.spaces.readonly",
+                    "https://www.googleapis.com/auth/chat.messages.readonly",
+                    "https://www.googleapis.com/auth/chat.memberships.readonly",
+                    "https://www.googleapis.com/auth/chat.users.readstate.readonly",
+                ]
+                : scopes(service);
+        case "classroom":
+            return readonly
+                ? [
+                    "https://www.googleapis.com/auth/classroom.courses.readonly",
+                    "https://www.googleapis.com/auth/classroom.rosters.readonly",
+                    "https://www.googleapis.com/auth/classroom.coursework.students.readonly",
+                    "https://www.googleapis.com/auth/classroom.coursework.me.readonly",
+                    "https://www.googleapis.com/auth/classroom.courseworkmaterials.readonly",
+                    "https://www.googleapis.com/auth/classroom.announcements.readonly",
+                    "https://www.googleapis.com/auth/classroom.topics.readonly",
+                    "https://www.googleapis.com/auth/classroom.guardianlinks.students.readonly",
+                    "https://www.googleapis.com/auth/classroom.profile.emails",
+                    "https://www.googleapis.com/auth/classroom.profile.photos",
+                ]
+                : scopes(service);
+        case "drive":
+            return [driveScopeValue(opts)];
+        case "docs":
+            return [
+                driveScopeValue(opts),
+                readonly
+                    ? "https://www.googleapis.com/auth/documents.readonly"
+                    : "https://www.googleapis.com/auth/documents",
+            ];
+        case "slides":
+            return [
+                driveScopeValue(opts),
+                readonly
+                    ? "https://www.googleapis.com/auth/presentations.readonly"
+                    : "https://www.googleapis.com/auth/presentations",
+            ];
+        case "contacts":
+            return [
+                readonly ? "https://www.googleapis.com/auth/contacts.readonly" : "https://www.googleapis.com/auth/contacts",
+                "https://www.googleapis.com/auth/contacts.other.readonly",
+                "https://www.googleapis.com/auth/directory.readonly",
+            ];
+        case "tasks":
+            return readonly ? ["https://www.googleapis.com/auth/tasks.readonly"] : scopes(service);
+        case "people":
+            return scopes(service);
+        case "sheets":
+            return [
+                driveScopeValue(opts),
+                readonly
+                    ? "https://www.googleapis.com/auth/spreadsheets.readonly"
+                    : "https://www.googleapis.com/auth/spreadsheets",
+            ];
+        case "forms":
+            return [
+                readonly
+                    ? "https://www.googleapis.com/auth/forms.body.readonly"
+                    : "https://www.googleapis.com/auth/forms.body",
+                "https://www.googleapis.com/auth/forms.responses.readonly",
+            ];
+        case "appscript":
+            return readonly
+                ? [
+                    "https://www.googleapis.com/auth/script.projects.readonly",
+                    "https://www.googleapis.com/auth/script.deployments.readonly",
+                ]
+                : scopes(service);
+        case "groups":
+        case "keep":
+            return scopes(service);
+        default:
+            throw new Error(`unknown service: ${service}`);
+    }
+}
+function mergeScopes(baseScopes, extras) {
+    const set = new Set();
+    for (const scope of [...baseScopes, ...extras]) {
+        if (scope.trim() !== "") {
+            set.add(scope);
+        }
+    }
+    return [...set].sort();
+}
+export function scopesForServices(services) {
+    const set = new Set();
+    for (const service of services) {
+        for (const scope of scopes(service)) {
+            set.add(scope);
+        }
+    }
+    return [...set].sort();
+}
+export function scopesForManage(services) {
+    return mergeScopes(scopesForServices(services), [SCOPE_OPENID, SCOPE_EMAIL, SCOPE_USERINFO_EMAIL]);
+}
+export function scopesForManageWithOptions(services, opts) {
+    const set = new Set();
+    for (const service of services) {
+        for (const scope of scopesForServiceWithOptions(service, opts)) {
+            set.add(scope);
+        }
+    }
+    return mergeScopes([...set], [SCOPE_OPENID, SCOPE_EMAIL, SCOPE_USERINFO_EMAIL]);
+}
+export function servicesInfo() {
+    return serviceOrder.map((service) => {
+        const info = serviceInfoByService[service];
+        const out = {
+            service,
+            user: info.user,
+            scopes: [...info.scopes],
+            apis: [...info.apis],
+        };
+        if (info.note !== undefined) {
+            out.note = info.note;
+        }
+        return out;
+    });
+}
+export function servicesMarkdown(infos) {
+    if (infos.length === 0) {
+        return "";
+    }
+    const lines = [
+        "| Service | User | APIs | Scopes | Notes |",
+        "| --- | --- | --- | --- | --- |",
+    ];
+    for (const info of infos) {
+        lines.push(`| ${info.service} | ${info.user ? "yes" : "no"} | ${info.apis.join(", ")} | ${info.scopes
+            .map((scope) => `\`${scope}\``)
+            .join("<br>")} | ${info.note ?? ""} |`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function userServiceCSV() {
+    return serviceNames(userServices(), ",");
+}
+function serviceNames(services, sep) {
+    return services.join(sep);
+}
+//# sourceMappingURL=service.js.map