m365connector 0.3.6 → 0.3.7

package/src/token-providers.js

@@ -0,0 +1,739 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const SUBSTRATE_AUDIENCE = "https://substrate.office.com";
+const GRAPH_AUDIENCE = "https://graph.microsoft.com";
+const GRAPH_AUDIENCES = new Set([
+  GRAPH_AUDIENCE,
+  "00000003-0000-0000-c000-000000000000"
+]);
+
+const SUBSTRATE_ALIASES = new Map([
+  ["https://substrate.office.com/search", SUBSTRATE_AUDIENCE],
+  ["https://outlook.office365.com/search", SUBSTRATE_AUDIENCE],
+  ["https://outlook.office365.com", SUBSTRATE_AUDIENCE]
+]);
+
+const M365_SEARCH_URL = "https://m365.cloud.microsoft/search?q=m365connector-token-refresh";
+const GRAPH_EXPLORER_PRIMARY_URL = "https://developer.microsoft.com/en-us/graph/graph-explorer";
+const GRAPH_EXPLORER_FALLBACK_URL = "https://tryit.graphexplorer.microsoft.com/";
+const GRAPH_SIGN_IN_HYDRATED_PAGE_TEXT_THRESHOLD = 3000;
+const GRAPH_SIGN_IN_CONFIRM_COUNT = 3;
+const TOKEN_EXPIRY_SKEW_SECONDS = 60;
+const TOKEN_CACHE_VERSION = 1;
+
+function expandHome(value) {
+  const text = String(value || "");
+  if (text === "~") {
+    return os.homedir();
+  }
+  if (text.startsWith("~/")) {
+    return path.join(os.homedir(), text.slice(2));
+  }
+  return text;
+}
+
+function defaultTokenCachePath() {
+  if (process.env.M365C_TOKEN_CACHE_PATH) {
+    return expandHome(process.env.M365C_TOKEN_CACHE_PATH);
+  }
+  return path.join(os.homedir(), ".m365connector", "token-cache.json");
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function nowSeconds() {
+  return Math.floor(Date.now() / 1000);
+}
+
+function normalizeAudience(aud) {
+  return String(aud || "").replace(/\/$/, "");
+}
+
+export function parseJwtPayload(token) {
+  const parts = String(token || "").split(".");
+  if (parts.length < 2) {
+    return null;
+  }
+  const raw = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  const padded = raw + "=".repeat((4 - (raw.length % 4 || 4)) % 4);
+  try {
+    return JSON.parse(Buffer.from(padded, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function hasScope(payload, scope) {
+  if (!scope) {
+    return true;
+  }
+  const scopes = new Set(String(payload?.scp || "").split(" ").filter(Boolean));
+  if (scopes.has(scope)) {
+    return true;
+  }
+  if (scope.endsWith(".Read")) {
+    return scopes.has(scope.slice(0, -".Read".length) + ".ReadWrite");
+  }
+  if (scope.endsWith(".Read.All")) {
+    return scopes.has(scope.slice(0, -".Read.All".length) + ".ReadWrite.All");
+  }
+  return false;
+}
+
+function tokenEntryFromJwt(token, canonicalAudience = null) {
+  const payload = parseJwtPayload(token);
+  if (!payload) {
+    return null;
+  }
+  const aud = canonicalAudience || normalizeAudience(payload.aud);
+  const exp = Number(payload.exp || 0);
+  if (!aud || !payload.oid || !payload.tid || !Number.isFinite(exp)) {
+    return null;
+  }
+  return {
+    token,
+    aud,
+    oid: payload.oid,
+    tid: payload.tid,
+    upn: payload.upn || payload.preferred_username || "",
+    exp,
+    payload,
+    capturedAt: Date.now()
+  };
+}
+
+export class ServerTokenManager {
+  constructor(options = {}) {
+    this.tokenEntries = new Map();
+    this.activeIdentity = null;
+    this.logger = options.logger || console;
+    this.cachePath = options.cachePath === false ? null : (options.cachePath || defaultTokenCachePath());
+    this.#loadFromDisk();
+  }
+
+  setEntry(entry) {
+    if (!entry?.aud || !entry?.oid || !entry?.tid) {
+      return;
+    }
+    const key = `${entry.aud}|${entry.oid}|${entry.tid}`;
+    this.tokenEntries.set(key, entry);
+    this.activeIdentity = {
+      oid: entry.oid,
+      tid: entry.tid,
+      upn: entry.upn || ""
+    };
+    this.#saveToDisk();
+  }
+
+  getTokenEntry(audience, minRemainingSeconds = TOKEN_EXPIRY_SKEW_SECONDS) {
+    const aud = normalizeAudience(audience);
+    if (!this.activeIdentity?.oid || !this.activeIdentity?.tid) {
+      return null;
+    }
+    const entry = this.tokenEntries.get(`${aud}|${this.activeIdentity.oid}|${this.activeIdentity.tid}`);
+    if (!entry) {
+      return null;
+    }
+    if (entry.exp - nowSeconds() <= minRemainingSeconds) {
+      return null;
+    }
+    return entry;
+  }
+
+  async evictToken(audience, expectedToken = null) {
+    const aud = normalizeAudience(audience);
+    if (!this.activeIdentity?.oid || !this.activeIdentity?.tid) {
+      return;
+    }
+    const key = `${aud}|${this.activeIdentity.oid}|${this.activeIdentity.tid}`;
+    const entry = this.tokenEntries.get(key);
+    if (entry && (!expectedToken || entry.token === expectedToken)) {
+      this.tokenEntries.delete(key);
+      this.#saveToDisk();
+    }
+  }
+
+  #loadFromDisk() {
+    if (!this.cachePath) {
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(fs.readFileSync(this.cachePath, "utf-8"));
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        this.logger.warn("[m365connector][token] failed to read token cache:", err.message);
+      }
+      return;
+    }
+
+    if (parsed?.version !== TOKEN_CACHE_VERSION || !Array.isArray(parsed.entries)) {
+      return;
+    }
+
+    const now = nowSeconds();
+    for (const rawEntry of parsed.entries) {
+      const entry = tokenEntryFromJwt(rawEntry?.token, rawEntry?.aud);
+      if (!entry || entry.exp - now <= TOKEN_EXPIRY_SKEW_SECONDS) {
+        continue;
+      }
+      if (rawEntry?.requestUrl) {
+        entry.requestUrl = String(rawEntry.requestUrl);
+      }
+      const key = `${entry.aud}|${entry.oid}|${entry.tid}`;
+      this.tokenEntries.set(key, entry);
+    }
+
+    const active = parsed.activeIdentity;
+    if (active?.oid && active?.tid) {
+      this.activeIdentity = {
+        oid: String(active.oid),
+        tid: String(active.tid),
+        upn: String(active.upn || "")
+      };
+      if (!this.#hasEntryForIdentity(this.activeIdentity)) {
+        this.activeIdentity = null;
+      }
+    }
+
+    if (!this.activeIdentity && this.tokenEntries.size) {
+      const first = this.tokenEntries.values().next().value;
+      this.activeIdentity = {
+        oid: first.oid,
+        tid: first.tid,
+        upn: first.upn || ""
+      };
+    }
+  }
+
+  #hasEntryForIdentity(identity) {
+    for (const entry of this.tokenEntries.values()) {
+      if (entry.oid === identity.oid && entry.tid === identity.tid) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  #saveToDisk() {
+    if (!this.cachePath) {
+      return;
+    }
+
+    const now = nowSeconds();
+    const entries = [];
+    for (const [key, entry] of this.tokenEntries.entries()) {
+      if (entry.exp - now <= TOKEN_EXPIRY_SKEW_SECONDS) {
+        this.tokenEntries.delete(key);
+        continue;
+      }
+      entries.push({
+        aud: entry.aud,
+        token: entry.token,
+        requestUrl: entry.requestUrl || "",
+        capturedAt: entry.capturedAt || Date.now()
+      });
+    }
+
+    const payload = {
+      version: TOKEN_CACHE_VERSION,
+      activeIdentity: this.activeIdentity,
+      entries
+    };
+
+    try {
+      fs.mkdirSync(path.dirname(this.cachePath), { recursive: true, mode: 0o700 });
+      const tmp = `${this.cachePath}.${process.pid}.${Date.now()}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), { encoding: "utf-8", mode: 0o600 });
+      fs.chmodSync(tmp, 0o600);
+      fs.renameSync(tmp, this.cachePath);
+      fs.chmodSync(this.cachePath, 0o600);
+    } catch (err) {
+      this.logger.warn("[m365connector][token] failed to write token cache:", err.message);
+    }
+  }
+}
+
+export class SubstrateTokenProvider {
+  constructor(browserSession, tokenManager, options = {}) {
+    this.browserSession = browserSession;
+    this.tokenManager = tokenManager;
+    this.logger = options.logger || console;
+    this.refreshPromise = null;
+  }
+
+  async getTokenEntry() {
+    const cached = this.tokenManager.getTokenEntry(SUBSTRATE_AUDIENCE);
+    if (cached) {
+      return cached;
+    }
+    await this.refresh();
+    return this.tokenManager.getTokenEntry(SUBSTRATE_AUDIENCE);
+  }
+
+  async refresh() {
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+    this.refreshPromise = this.#refreshInternal().finally(() => {
+      this.refreshPromise = null;
+    });
+    return this.refreshPromise;
+  }
+
+  async #refreshInternal() {
+    await this.browserSession.start();
+    const page = await this.browserSession.createPage("about:blank", { active: false });
+    let captured = null;
+
+    const onBearer = ({ token, url }) => {
+      const payload = parseJwtPayload(token);
+      if (!payload) {
+        return;
+      }
+      const rawAud = normalizeAudience(payload.aud);
+      const aud = SUBSTRATE_ALIASES.get(rawAud) || rawAud;
+      if (aud !== SUBSTRATE_AUDIENCE) {
+        return;
+      }
+      captured = tokenEntryFromJwt(token, SUBSTRATE_AUDIENCE);
+      if (captured) {
+        captured.requestUrl = url || "";
+      }
+    };
+
+    page.on("bearer", onBearer);
+    try {
+      await page.navigate(M365_SEARCH_URL, 30000).catch(() => {});
+      const deadline = Date.now() + 45000;
+      while (!captured && Date.now() < deadline) {
+        await sleep(500);
+      }
+
+      if (!captured) {
+        throw new Error("Substrate token unavailable. Sign into Microsoft 365 in the opened Edge profile, then retry.");
+      }
+
+      this.tokenManager.setEntry(captured);
+      this.logger.info("[m365connector][token] captured Substrate token for", captured.upn || captured.oid);
+      return captured;
+    } finally {
+      page.off("bearer", onBearer);
+      if (captured) {
+        await page.close().catch(() => {});
+      }
+    }
+  }
+}
+
+function extractGraphTokenFromPage() {
+  const text = document.body?.innerText || "";
+  const controlText = Array.from(
+    document.querySelectorAll("textarea,input,[contenteditable=true],pre,code")
+  )
+    .map((node) => node.value || node.textContent || "")
+    .filter(Boolean)
+    .join("\n");
+  const searchableText = `${text}\n${controlText}`;
+  const jwtMatches = [...searchableText.matchAll(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g)]
+    .map((match) => match[0]);
+  const uniqueTokens = [...new Set(jwtMatches)];
+  const graphAudiences = new Set([
+    "https://graph.microsoft.com",
+    "00000003-0000-0000-c000-000000000000"
+  ]);
+  const now = Math.floor(Date.now() / 1000);
+  const candidates = [];
+
+  for (const jwt of uniqueTokens) {
+    const parts = jwt.split(".");
+    if (parts.length < 2) {
+      continue;
+    }
+    try {
+      const rawPayload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+      const pad = rawPayload.length % 4;
+      const paddedPayload = pad === 0 ? rawPayload : rawPayload + "=".repeat(4 - pad);
+      const payload = JSON.parse(atob(paddedPayload));
+      const exp = Number(payload.exp || 0);
+      if (graphAudiences.has(payload.aud) && Number.isFinite(exp) && exp > now) {
+        candidates.push({ jwt, aud: payload.aud, exp });
+      }
+    } catch {
+      // Ignore non-token examples or stale rendered snippets.
+    }
+  }
+
+  candidates.sort((a, b) => b.exp - a.exp);
+  const selected = candidates[0] || null;
+  return {
+    token: selected?.jwt || null,
+    jwtMatchCount: uniqueTokens.length,
+    validGraphTokenCount: candidates.length,
+    selectedAud: selected?.aud || null,
+    selectedExp: selected?.exp || null,
+    pageTextLength: text.length,
+    controlTextLength: controlText.length,
+    url: location.href,
+    hasJwtMatch: uniqueTokens.length > 0,
+    hasSignInButton: Boolean(document.querySelector('button[aria-label="Sign in"]')),
+    hasAccessTokenSignInMessage: text.toLowerCase().includes("to view your access token")
+      && text.toLowerCase().includes("sign in")
+  };
+}
+
+function activateAccessTokenTab() {
+  const tabs = document.querySelectorAll("[role=tab]");
+  for (const tab of tabs) {
+    const label = `${tab.textContent || ""} ${tab.getAttribute("aria-label") || ""}`.trim();
+    if (label.toLowerCase().includes("access token")) {
+      tab.click();
+      return true;
+    }
+  }
+  return false;
+}
+
+function clickGraphExplorerSignIn() {
+  const direct = document.querySelector('button[aria-label="Sign in"]');
+  if (direct) {
+    const rect = direct.getBoundingClientRect();
+    direct.click();
+    return {
+      clicked: true,
+      strategy: "aria-label",
+      rect: { x: rect.x, y: rect.y, w: rect.width, h: rect.height }
+    };
+  }
+
+  const buttons = Array.from(document.querySelectorAll("button"));
+  for (const button of buttons) {
+    const label = `${button.textContent || ""} ${button.getAttribute("aria-label") || ""} ${button.title || ""}`.toLowerCase();
+    if (label.includes("sign in") || label.includes("sign-in") || label.includes("account")) {
+      const rect = button.getBoundingClientRect();
+      button.click();
+      return {
+        clicked: true,
+        strategy: "button-label",
+        label: label.slice(0, 120),
+        rect: { x: rect.x, y: rect.y, w: rect.width, h: rect.height }
+      };
+    }
+  }
+
+  return { clicked: false };
+}
+
+function pickGraphTokenExtraction(results) {
+  const infos = (results || [])
+    .map((entry) => ({ frameId: entry?.frameId || null, ...(entry?.result || {}) }))
+    .filter((info) => info && typeof info === "object");
+  if (!infos.length) {
+    return null;
+  }
+
+  const withToken = infos.find((info) => info.token);
+  if (withToken) {
+    return withToken;
+  }
+
+  infos.sort((a, b) => {
+    const aScore = Number(a.validGraphTokenCount || 0) * 100000
+      + Number(a.jwtMatchCount || 0) * 1000
+      + Number(a.pageTextLength || 0)
+      + Number(a.controlTextLength || 0);
+    const bScore = Number(b.validGraphTokenCount || 0) * 100000
+      + Number(b.jwtMatchCount || 0) * 1000
+      + Number(b.pageTextLength || 0)
+      + Number(b.controlTextLength || 0);
+    return bScore - aScore;
+  });
+  return infos[0];
+}
+
+function clickSignedInMicrosoftAccount() {
+  const text = document.body?.innerText || "";
+  const rows = Array.from(document.querySelectorAll('[role="button"], button, div, a'));
+  const scored = [];
+
+  for (const row of rows) {
+    const label = `${row.textContent || ""} ${row.getAttribute?.("aria-label") || ""}`.replace(/\s+/g, " ").trim();
+    if (!label) {
+      continue;
+    }
+    const lower = label.toLowerCase();
+    const rect = row.getBoundingClientRect();
+    if (rect.width <= 0 || rect.height <= 0) {
+      continue;
+    }
+    let score = 0;
+    if (lower.includes("signed in")) score += 10;
+    if (lower.includes("@")) score += 5;
+    if (lower.includes("jietong@microsoft.com")) score += 20;
+    if (lower.includes("use another account")) score -= 20;
+    if (lower.includes("pick an account")) score -= 5;
+    if (score > 0) {
+      scored.push({ row, label, score, rect });
+    }
+  }
+
+  scored.sort((a, b) => b.score - a.score);
+  const selected = scored[0];
+  if (!selected) {
+    return { clicked: false, textLength: text.length };
+  }
+
+  selected.row.click();
+  return {
+    clicked: true,
+    label: selected.label.slice(0, 160),
+    score: selected.score,
+    rect: {
+      x: selected.rect.x,
+      y: selected.rect.y,
+      w: selected.rect.width,
+      h: selected.rect.height
+    }
+  };
+}
+
+export class GraphTokenProvider {
+  constructor(browserSession, options = {}) {
+    this.browserSession = browserSession;
+    this.logger = options.logger || console;
+    this.tokenManager = options.tokenManager || null;
+    this.token = null;
+    this.tokenPayload = null;
+    this.tokenExp = 0;
+    this.page = null;
+    this.refreshPromise = null;
+  }
+
+  async getToken(requiredScope = null) {
+    const cached = this.tokenManager?.getTokenEntry(GRAPH_AUDIENCE, 600);
+    if (cached && hasScope(cached.payload, requiredScope)) {
+      this.#useTokenEntry(cached);
+      return cached.token;
+    }
+    if (this.#isTokenValid(600) && hasScope(this.tokenPayload, requiredScope)) {
+      return this.token;
+    }
+    await this.refresh();
+    if (this.#isTokenValid(60) && hasScope(this.tokenPayload, requiredScope)) {
+      return this.token;
+    }
+    return null;
+  }
+
+  async refresh() {
+    if (this.refreshPromise) {
+      return this.refreshPromise;
+    }
+    this.refreshPromise = this.#refreshInternal().finally(() => {
+      this.refreshPromise = null;
+    });
+    return this.refreshPromise;
+  }
+
+  async #refreshInternal() {
+    await this.browserSession.start();
+    const candidates = [
+      this.page?.url || GRAPH_EXPLORER_PRIMARY_URL,
+      GRAPH_EXPLORER_PRIMARY_URL,
+      GRAPH_EXPLORER_FALLBACK_URL
+    ];
+    const urls = [...new Set(candidates.filter(Boolean))];
+
+    for (const url of urls) {
+      const token = await this.#tryGraphExplorerUrl(url);
+      if (token) {
+        return token;
+      }
+    }
+
+    return null;
+  }
+
+  async #tryGraphExplorerUrl(url) {
+    if (!this.page || this.page.closed) {
+      this.page = await this.browserSession.createPage("about:blank", { active: false });
+    }
+
+    let headerToken = null;
+    const onBearer = ({ token }) => {
+      const payload = parseJwtPayload(token);
+      if (payload && GRAPH_AUDIENCES.has(payload.aud) && Number(payload.exp || 0) > nowSeconds()) {
+        headerToken = token;
+      }
+    };
+    this.page.on("bearer", onBearer);
+
+    try {
+      await this.page.navigate(url, 30000).catch(() => {});
+      const deadline = Date.now() + 120000;
+      let lastInfo = null;
+      let signInClicked = false;
+      let signInDetectCount = 0;
+      while (Date.now() < deadline) {
+        if (headerToken && this.#acceptToken(headerToken)) {
+          return headerToken;
+        }
+
+        const executions = await this.page.evaluateFunction(
+          extractGraphTokenFromPage,
+          [],
+          { allFrames: true }
+        ).catch(() => []);
+        const info = pickGraphTokenExtraction(executions);
+        if (info && typeof info === "object") {
+          lastInfo = info;
+          if (info.token && this.#acceptToken(info.token)) {
+            this.logger.info("[m365connector][graph] captured Graph token from Graph Explorer page text");
+            return info.token;
+          }
+          if (!info.token) {
+            await this.page.evaluateFunction(activateAccessTokenTab, [], { allFrames: true }).catch(() => {});
+          }
+          if (info.pageTextLength >= GRAPH_SIGN_IN_HYDRATED_PAGE_TEXT_THRESHOLD && info.hasSignInButton) {
+            signInDetectCount += 1;
+          } else if (info.pageTextLength >= GRAPH_SIGN_IN_HYDRATED_PAGE_TEXT_THRESHOLD) {
+            signInDetectCount = 0;
+          }
+          const signInReady = info.hasSignInButton
+            && (
+              signInDetectCount >= GRAPH_SIGN_IN_CONFIRM_COUNT
+              || info.hasAccessTokenSignInMessage
+            );
+          if (signInReady && !signInClicked) {
+            signInClicked = true;
+            const clickResults = await this.page.evaluateFunction(
+              clickGraphExplorerSignIn,
+              [],
+              { allFrames: true }
+            ).catch(() => []);
+            const clickResult = (clickResults || []).find((entry) => entry?.result?.clicked)
+              || clickResults?.[0];
+            const rect = clickResult?.result?.rect;
+            if (rect && rect.w > 0 && rect.h > 0) {
+              await this.page.clickAt(rect.x + rect.w / 2, rect.y + rect.h / 2).catch(() => {});
+            }
+            this.logger.warn(
+              "[m365connector][graph] clicked Graph Explorer sign-in:",
+              JSON.stringify(clickResult?.result || {})
+            );
+            await this.#completeLoginPopup(deadline);
+            await sleep(3000);
+            continue;
+          }
+        }
+
+        await sleep(1200);
+      }
+
+      this.logger.warn(
+        "[m365connector][graph] no token from Graph Explorer",
+        url,
+        lastInfo ? `jwtMatches=${lastInfo.jwtMatchCount} valid=${lastInfo.validGraphTokenCount}` : ""
+      );
+      return null;
+    } finally {
+      this.page.off("bearer", onBearer);
+    }
+  }
+
+  async #completeLoginPopup(deadline) {
+    let accountClicked = false;
+    while (Date.now() < deadline) {
+      const loginPage = await this.browserSession.findPage((target) => {
+        try {
+          const parsed = new URL(target.url || "");
+          return parsed.hostname === "login.microsoftonline.com";
+        } catch {
+          return false;
+        }
+      }).catch(() => null);
+
+      if (!loginPage) {
+        if (accountClicked) {
+          return true;
+        }
+        await sleep(500);
+        continue;
+      }
+
+      const [result] = await loginPage.evaluateFunction(clickSignedInMicrosoftAccount).catch(() => []);
+      const info = result?.result || {};
+      if (info.clicked) {
+        accountClicked = true;
+        const rect = info.rect;
+        if (rect && rect.w > 0 && rect.h > 0) {
+          await loginPage.clickAt(rect.x + rect.w / 2, rect.y + rect.h / 2).catch(() => {});
+        }
+        this.logger.warn("[m365connector][graph] clicked Microsoft login account:", JSON.stringify(info));
+        await sleep(3000);
+      } else {
+        await sleep(1000);
+      }
+
+      const stillLogin = await this.browserSession.findPage((target) => {
+        try {
+          return new URL(target.url || "").hostname === "login.microsoftonline.com";
+        } catch {
+          return false;
+        }
+      }).catch(() => null);
+      if (!stillLogin && accountClicked) {
+        return true;
+      }
+    }
+    return accountClicked;
+  }
+
+  #acceptToken(token) {
+    const payload = parseJwtPayload(token);
+    const exp = Number(payload?.exp || 0);
+    if (!payload || !GRAPH_AUDIENCES.has(payload.aud) || !Number.isFinite(exp) || exp <= nowSeconds()) {
+      return false;
+    }
+    this.token = token;
+    this.tokenPayload = payload;
+    this.tokenExp = exp;
+    const entry = tokenEntryFromJwt(token, GRAPH_AUDIENCE);
+    if (entry) {
+      this.tokenManager?.setEntry(entry);
+    }
+    return true;
+  }
+
+  #useTokenEntry(entry) {
+    this.token = entry.token;
+    this.tokenPayload = entry.payload;
+    this.tokenExp = entry.exp;
+  }
+
+  #isTokenValid(minRemainingSeconds) {
+    return Boolean(this.token && this.tokenExp - nowSeconds() > minRemainingSeconds);
+  }
+
+  async getStatus() {
+    const remainingSeconds = this.tokenExp ? this.tokenExp - nowSeconds() : null;
+    return {
+      enabled: true,
+      permissionGranted: true,
+      state: remainingSeconds && remainingSeconds > 0 ? (remainingSeconds < 600 ? "expiring" : "valid") : "missing",
+      exp: this.tokenExp || null,
+      remainingSeconds,
+      scopes: this.tokenPayload?.scp || "",
+      tabId: this.page?.id || null
+    };
+  }
+}
+
+export const TOKEN_AUDIENCES = {
+  SUBSTRATE: SUBSTRATE_AUDIENCE,
+  GRAPH: GRAPH_AUDIENCE
+};