recker 1.0.20 → 1.0.21-next.ab2d00f

package/dist/plugins/auth/oidc.js

@@ -0,0 +1,222 @@
+import { createHash, randomBytes } from 'node:crypto';
+const discoveryCache = new Map();
+async function fetchDiscoveryDocument(issuer, customFetch = fetch) {
+    const cached = discoveryCache.get(issuer);
+    if (cached && cached.expiresAt > Date.now()) {
+        return cached.doc;
+    }
+    const wellKnownUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+    const response = await customFetch(wellKnownUrl);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch OIDC discovery document: ${response.status}`);
+    }
+    const doc = await response.json();
+    discoveryCache.set(issuer, {
+        doc,
+        expiresAt: Date.now() + 3600000,
+    });
+    return doc;
+}
+async function exchangeCode(discovery, options, code, codeVerifier, customFetch = fetch) {
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: options.clientId,
+        code,
+        redirect_uri: options.redirectUri || '',
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    if (codeVerifier) {
+        params.set('code_verifier', codeVerifier);
+    }
+    const response = await customFetch(discovery.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Token exchange failed: ${error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+async function refreshTokens(discovery, options, refreshToken, customFetch = fetch) {
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: options.clientId,
+        refresh_token: refreshToken,
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    const response = await customFetch(discovery.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Token refresh failed: ${error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token || refreshToken,
+        idToken: data.id_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+async function clientCredentialsFlow(discovery, options, customFetch = fetch) {
+    if (!options.clientSecret) {
+        throw new Error('Client credentials flow requires clientSecret');
+    }
+    const params = new URLSearchParams({
+        grant_type: 'client_credentials',
+        client_id: options.clientId,
+        client_secret: options.clientSecret,
+    });
+    if (options.scopes && options.scopes.length > 0) {
+        params.set('scope', options.scopes.join(' '));
+    }
+    if (options.audience) {
+        params.set('audience', options.audience);
+    }
+    const response = await customFetch(discovery.token_endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Client credentials flow failed: ${error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+export function generatePKCE() {
+    const codeVerifier = randomBytes(32).toString('base64url');
+    const codeChallenge = createHash('sha256')
+        .update(codeVerifier)
+        .digest('base64url');
+    return { codeVerifier, codeChallenge };
+}
+export async function generateAuthorizationUrl(options) {
+    const discovery = await fetchDiscoveryDocument(options.issuer, options.fetch);
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri || '',
+        scope: (options.scopes || ['openid']).join(' '),
+    });
+    if (options.state) {
+        params.set('state', options.state);
+    }
+    if (options.nonce) {
+        params.set('nonce', options.nonce);
+    }
+    if (options.pkce) {
+        params.set('code_challenge', options.pkce.codeChallenge);
+        params.set('code_challenge_method', 'S256');
+    }
+    if (options.audience) {
+        params.set('audience', options.audience);
+    }
+    return `${discovery.authorization_endpoint}?${params.toString()}`;
+}
+export function oidc(options) {
+    let cachedTokens = null;
+    let discoveryDoc = null;
+    const customFetch = options.fetch || fetch;
+    const getDiscovery = async () => {
+        if (!discoveryDoc) {
+            discoveryDoc = await fetchDiscoveryDocument(options.issuer, customFetch);
+        }
+        return discoveryDoc;
+    };
+    const getTokens = async () => {
+        if (options.tokenStorage) {
+            const stored = await options.tokenStorage.get();
+            if (stored) {
+                cachedTokens = stored;
+            }
+        }
+        if (cachedTokens && cachedTokens.expiresAt && cachedTokens.expiresAt > Date.now() + 60000) {
+            return cachedTokens;
+        }
+        if (cachedTokens?.refreshToken || options.refreshToken) {
+            const discovery = await getDiscovery();
+            const refreshToken = cachedTokens?.refreshToken || options.refreshToken;
+            try {
+                cachedTokens = await refreshTokens(discovery, options, refreshToken, customFetch);
+                if (options.tokenStorage) {
+                    await options.tokenStorage.set(cachedTokens);
+                }
+                return cachedTokens;
+            }
+            catch {
+            }
+        }
+        if (options.accessToken) {
+            const token = typeof options.accessToken === 'function'
+                ? await options.accessToken()
+                : options.accessToken;
+            return { accessToken: token, tokenType: 'Bearer' };
+        }
+        if (options.clientSecret) {
+            const discovery = await getDiscovery();
+            cachedTokens = await clientCredentialsFlow(discovery, options, customFetch);
+            if (options.tokenStorage) {
+                await options.tokenStorage.set(cachedTokens);
+            }
+            return cachedTokens;
+        }
+        throw new Error('No valid authentication method available. Provide accessToken, refreshToken, or clientSecret.');
+    };
+    return async (req, next) => {
+        const tokens = await getTokens();
+        const tokenType = tokens.tokenType || 'Bearer';
+        const authReq = req.withHeader('Authorization', `${tokenType} ${tokens.accessToken}`);
+        const response = await next(authReq);
+        if (response.status === 401 && (cachedTokens?.refreshToken || options.refreshToken)) {
+            try {
+                const discovery = await getDiscovery();
+                const refreshToken = cachedTokens?.refreshToken || options.refreshToken;
+                cachedTokens = await refreshTokens(discovery, options, refreshToken, customFetch);
+                if (options.tokenStorage) {
+                    await options.tokenStorage.set(cachedTokens);
+                }
+                const retryReq = req.withHeader('Authorization', `${cachedTokens.tokenType || 'Bearer'} ${cachedTokens.accessToken}`);
+                return next(retryReq);
+            }
+            catch {
+                return response;
+            }
+        }
+        return response;
+    };
+}
+export function oidcPlugin(options) {
+    return (client) => {
+        client.use(oidc(options));
+    };
+}
+export { fetchDiscoveryDocument, exchangeCode, refreshTokens, clientCredentialsFlow };

package/dist/plugins/auth/okta.d.ts

@@ -0,0 +1,47 @@
+import { Middleware, Plugin } from '../../types/index.js';
+import { OIDCTokens } from './oidc.js';
+export interface OktaOptions {
+    domain: string;
+    clientId: string;
+    clientSecret?: string;
+    authorizationServerId?: string;
+    scopes?: string[];
+    accessToken?: string | (() => string | Promise<string>);
+    refreshToken?: string;
+    tokenStorage?: {
+        get: () => Promise<OIDCTokens | null>;
+        set: (tokens: OIDCTokens) => Promise<void>;
+    };
+    apiToken?: string;
+}
+export declare function generateOktaAuthUrl(options: OktaOptions & {
+    redirectUri: string;
+    state?: string;
+    nonce?: string;
+    usePKCE?: boolean;
+    prompt?: 'none' | 'consent' | 'login';
+    idp?: string;
+    loginHint?: string;
+}): Promise<{
+    url: string;
+    codeVerifier?: string;
+}>;
+export declare function exchangeOktaCode(options: OktaOptions & {
+    code: string;
+    redirectUri: string;
+    codeVerifier?: string;
+}): Promise<OIDCTokens>;
+export declare function getOktaUserInfo(domain: string, authorizationServerId: string | undefined, accessToken: string): Promise<Record<string, unknown>>;
+export declare function introspectOktaToken(options: OktaOptions & {
+    token: string;
+    tokenTypeHint?: 'access_token' | 'refresh_token';
+}): Promise<{
+    active: boolean;
+    [key: string]: unknown;
+}>;
+export declare function revokeOktaToken(options: OktaOptions & {
+    token: string;
+    tokenTypeHint?: 'access_token' | 'refresh_token';
+}): Promise<void>;
+export declare function okta(options: OktaOptions): Middleware;
+export declare function oktaPlugin(options: OktaOptions): Plugin;

package/dist/plugins/auth/okta.js

@@ -0,0 +1,157 @@
+import { oidc, generatePKCE } from './oidc.js';
+function getOktaIssuer(domain, authorizationServerId) {
+    const serverId = authorizationServerId || 'default';
+    return `https://${domain}/oauth2/${serverId}`;
+}
+export async function generateOktaAuthUrl(options) {
+    const issuer = getOktaIssuer(options.domain, options.authorizationServerId);
+    const pkce = options.usePKCE ? generatePKCE() : undefined;
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),
+    });
+    if (options.state) {
+        params.set('state', options.state);
+    }
+    if (options.nonce) {
+        params.set('nonce', options.nonce);
+    }
+    if (pkce) {
+        params.set('code_challenge', pkce.codeChallenge);
+        params.set('code_challenge_method', 'S256');
+    }
+    if (options.prompt) {
+        params.set('prompt', options.prompt);
+    }
+    if (options.idp) {
+        params.set('idp', options.idp);
+    }
+    if (options.loginHint) {
+        params.set('login_hint', options.loginHint);
+    }
+    return {
+        url: `${issuer}/v1/authorize?${params.toString()}`,
+        codeVerifier: pkce?.codeVerifier,
+    };
+}
+export async function exchangeOktaCode(options) {
+    const issuer = getOktaIssuer(options.domain, options.authorizationServerId);
+    const tokenUrl = `${issuer}/v1/token`;
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: options.clientId,
+        code: options.code,
+        redirect_uri: options.redirectUri,
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    if (options.codeVerifier) {
+        params.set('code_verifier', options.codeVerifier);
+    }
+    const response = await fetch(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(`Okta token exchange failed: ${error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+export async function getOktaUserInfo(domain, authorizationServerId, accessToken) {
+    const issuer = getOktaIssuer(domain, authorizationServerId);
+    const response = await fetch(`${issuer}/v1/userinfo`, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to get user info: ${response.status}`);
+    }
+    return response.json();
+}
+export async function introspectOktaToken(options) {
+    const issuer = getOktaIssuer(options.domain, options.authorizationServerId);
+    const params = new URLSearchParams({
+        token: options.token,
+        client_id: options.clientId,
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    if (options.tokenTypeHint) {
+        params.set('token_type_hint', options.tokenTypeHint);
+    }
+    const response = await fetch(`${issuer}/v1/introspect`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token introspection failed: ${response.status}`);
+    }
+    return response.json();
+}
+export async function revokeOktaToken(options) {
+    const issuer = getOktaIssuer(options.domain, options.authorizationServerId);
+    const params = new URLSearchParams({
+        token: options.token,
+        client_id: options.clientId,
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    if (options.tokenTypeHint) {
+        params.set('token_type_hint', options.tokenTypeHint);
+    }
+    const response = await fetch(`${issuer}/v1/revoke`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        throw new Error(`Token revocation failed: ${response.status}`);
+    }
+}
+export function okta(options) {
+    if (options.apiToken) {
+        return async (req, next) => {
+            const authReq = req.withHeader('Authorization', `SSWS ${options.apiToken}`);
+            return next(authReq);
+        };
+    }
+    const issuer = getOktaIssuer(options.domain, options.authorizationServerId);
+    return oidc({
+        issuer,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        scopes: options.scopes || ['openid', 'profile', 'email'],
+        accessToken: options.accessToken,
+        refreshToken: options.refreshToken,
+        tokenStorage: options.tokenStorage,
+    });
+}
+export function oktaPlugin(options) {
+    return (client) => {
+        client.use(okta(options));
+    };
+}

package/dist/plugins/auth.d.ts

@@ -1,45 +1 @@
-import { Middleware, Plugin } from '../types/index.js';
-export interface BasicAuthOptions {
-    username: string;
-    password: string;
-}
-export declare function basicAuth(options: BasicAuthOptions): Middleware;
-export declare function basicAuthPlugin(options: BasicAuthOptions): Plugin;
-export interface BearerAuthOptions {
-    token: string | (() => string | Promise<string>);
-    type?: string;
-    headerName?: string;
-}
-export declare function bearerAuth(options: BearerAuthOptions): Middleware;
-export declare function bearerAuthPlugin(options: BearerAuthOptions): Plugin;
-export interface ApiKeyAuthOptions {
-    key: string | (() => string | Promise<string>);
-    in?: 'header' | 'query';
-    name?: string;
-}
-export declare function apiKeyAuth(options: ApiKeyAuthOptions): Middleware;
-export declare function apiKeyAuthPlugin(options: ApiKeyAuthOptions): Plugin;
-export interface DigestAuthOptions {
-    username: string;
-    password: string;
-    preemptive?: boolean;
-}
-export declare function digestAuth(options: DigestAuthOptions): Middleware;
-export declare function digestAuthPlugin(options: DigestAuthOptions): Plugin;
-export interface OAuth2Options {
-    accessToken: string | (() => string | Promise<string>);
-    tokenType?: string;
-    onTokenExpired?: () => Promise<string>;
-}
-export declare function oauth2(options: OAuth2Options): Middleware;
-export declare function oauth2Plugin(options: OAuth2Options): Plugin;
-export interface AWSSignatureV4Options {
-    accessKeyId: string;
-    secretAccessKey: string;
-    region: string;
-    service: string;
-    sessionToken?: string;
-}
-export declare function awsSignatureV4(options: AWSSignatureV4Options): Middleware;
-export declare function awsSignatureV4Plugin(options: AWSSignatureV4Options): Plugin;
-//# sourceMappingURL=auth.d.ts.map
+export * from './auth/index.js';