snow-flow 8.42.12 → 9.0.1

package/dist/utils/snow-oauth.js

@@ -1,1033 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/**
- * ServiceNow OAuth Authentication Utility with Code Paste Flow
- * Handles OAuth2 flow for ServiceNow integration (Claude-style)
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceNowOAuth = void 0;
-const fs_1 = require("fs");
-const path_1 = require("path");
-const os_1 = __importDefault(require("os"));
-const http_1 = require("http");
-const url_1 = require("url");
-const axios_1 = __importDefault(require("axios"));
-const https_1 = __importDefault(require("https"));
-const net_1 = __importDefault(require("net"));
-const crypto_1 = __importDefault(require("crypto"));
-const prompts = __importStar(require("@clack/prompts"));
-const snow_flow_config_js_1 = require("../config/snow-flow-config.js");
-const unified_auth_store_js_1 = require("./unified-auth-store.js");
-const oauth_html_templates_js_1 = require("./oauth-html-templates.js");
-class ServiceNowOAuth {
-    constructor() {
-        // 🔒 SEC-002 FIX: Add rate limiting to prevent authentication bypass attacks
-        this.lastTokenRequest = 0;
-        this.tokenRequestCount = 0;
-        this.TOKEN_REQUEST_WINDOW_MS = 60000; // 1 minute window
-        this.MAX_TOKEN_REQUESTS_PER_WINDOW = 10; // Max 10 token requests per minute
-        // Store tokens in user's home directory
-        const configDir = process.env.SNOW_FLOW_HOME || (0, path_1.join)(os_1.default.homedir(), '.snow-flow');
-        this.tokenPath = (0, path_1.join)(configDir, 'auth.json');
-    }
-    /**
-     * 🔒 SEC-002 FIX: Check rate limiting for token requests to prevent brute force attacks
-     */
-    checkTokenRequestRateLimit() {
-        const now = Date.now();
-        // Reset counter if window has passed
-        if (now - this.lastTokenRequest > this.TOKEN_REQUEST_WINDOW_MS) {
-            this.tokenRequestCount = 0;
-            this.lastTokenRequest = now;
-        }
-        // Check if within rate limit
-        if (this.tokenRequestCount >= this.MAX_TOKEN_REQUESTS_PER_WINDOW) {
-            prompts.log.warn('Rate limit exceeded: Too many token requests. Please wait before retrying.');
-            return false;
-        }
-        this.tokenRequestCount++;
-        return true;
-    }
-    /**
-     * Generate a random state parameter for CSRF protection
-     */
-    generateState() {
-        return Math.random().toString(36).substring(2, 15) +
-            Math.random().toString(36).substring(2, 15);
-    }
-    /**
-     * Generate PKCE code verifier and challenge
-     */
-    generatePKCE() {
-        // Generate code verifier (43-128 characters)
-        this.codeVerifier = crypto_1.default.randomBytes(32).toString('base64url');
-        // Generate code challenge (SHA256 hash of verifier)
-        const hash = crypto_1.default.createHash('sha256');
-        hash.update(this.codeVerifier);
-        this.codeChallenge = hash.digest('base64url');
-    }
-    /**
-     * Check if a specific port is available
-     */
-    async checkPortAvailable(port) {
-        return new Promise((resolve) => {
-            const server = net_1.default.createServer();
-            server.on('error', () => {
-                resolve(false);
-            });
-            server.listen(port, () => {
-                server.close(() => {
-                    resolve(true);
-                });
-            });
-        });
-    }
-    /**
-     * 🔧 CRIT-002 FIX: Normalize instance URL to prevent trailing slash 400 errors
-     */
-    normalizeInstanceUrl(instance) {
-        // Remove any trailing slashes that cause 400 errors
-        let normalized = instance.replace(/\/+$/, '');
-        // Add https:// if missing
-        if (!normalized.startsWith('http://') && !normalized.startsWith('https://')) {
-            normalized = `https://${normalized}`;
-        }
-        // Ensure .service-now.com suffix if it's just the instance name
-        if (!normalized.includes('.service-now.com') && !normalized.includes('localhost') && !normalized.includes('127.0.0.1')) {
-            const instanceName = normalized.replace('https://', '').replace('http://', '');
-            normalized = `https://${instanceName}.service-now.com`;
-        }
-        return normalized;
-    }
-    /**
-     * 🎯 NEW: Simplified OAuth flow with code paste (Claude-style)
-     * No local server required - user manually pastes authorization code
-     */
-    async authenticateWithCodePaste(instance, clientId, clientSecret) {
-        try {
-            // Normalize instance URL
-            const normalizedInstance = this.normalizeInstanceUrl(instance);
-            // Validate client secret
-            const secretValidation = this.validateClientSecret(clientSecret);
-            if (!secretValidation.valid) {
-                prompts.log.error(`Invalid OAuth Client Secret: ${secretValidation.reason}`);
-                prompts.log.info('To get a valid OAuth secret:');
-                prompts.log.message('   1. Log into ServiceNow as admin');
-                prompts.log.message('   2. Navigate to: System OAuth > Application Registry');
-                prompts.log.message('   3. Create a new OAuth application');
-                prompts.log.message('   4. Copy the generated Client Secret (long random string)');
-                return {
-                    success: false,
-                    error: secretValidation.reason
-                };
-            }
-            // For code paste flow, we use a special redirect URI that shows the code
-            const redirectUri = 'urn:ietf:wg:oauth:2.0:oob'; // Out-of-band redirect for manual code entry
-            // Store credentials
-            this.credentials = {
-                instance: normalizedInstance.replace('https://', '').replace('http://', ''),
-                clientId,
-                clientSecret,
-                redirectUri
-            };
-            prompts.log.step('Starting ServiceNow OAuth flow');
-            prompts.log.info(`Instance: ${normalizedInstance}`);
-            prompts.log.info(`Client ID: ${clientId}`);
-            // Generate state parameter and PKCE
-            this.stateParameter = this.generateState();
-            this.generatePKCE();
-            // Generate authorization URL
-            const authUrl = this.generateAuthUrl(this.credentials.instance, clientId, redirectUri);
-            prompts.log.message('');
-            prompts.log.step('Authorization URL generated');
-            prompts.log.message(`\n${authUrl}\n`);
-            prompts.log.warn(`Go to: ${authUrl}`);
-            prompts.log.message('');
-            const authCode = await prompts.text({
-                message: 'Paste the authorization code here',
-                placeholder: 'Enter the code from the browser after authorizing',
-                validate: (value) => {
-                    if (!value || value.trim() === '')
-                        return 'Authorization code is required';
-                    if (value.length < 10)
-                        return 'Code seems too short - please paste the full authorization code';
-                }
-            });
-            if (prompts.isCancel(authCode)) {
-                prompts.cancel('Authentication cancelled');
-                return {
-                    success: false,
-                    error: 'Authentication cancelled by user'
-                };
-            }
-            // Extract code if user pasted full URL
-            let code = authCode.trim();
-            if (code.includes('code=')) {
-                const match = code.match(/code=([^&]+)/);
-                if (match) {
-                    code = match[1];
-                }
-            }
-            // Exchange code for tokens
-            const spinner = prompts.spinner();
-            spinner.start('Exchanging authorization code for tokens');
-            let tokenResult;
-            try {
-                tokenResult = await this.exchangeCodeForTokens(code);
-                if (tokenResult.success && tokenResult.accessToken) {
-                    // Save tokens
-                    await this.saveTokens({
-                        accessToken: tokenResult.accessToken,
-                        refreshToken: tokenResult.refreshToken || '',
-                        expiresIn: tokenResult.expiresIn || 3600,
-                        instance: this.credentials.instance,
-                        clientId,
-                        clientSecret
-                    });
-                    spinner.stop('Authentication successful');
-                    prompts.log.success('Tokens saved securely');
-                }
-                else {
-                    spinner.stop('Token exchange failed');
-                }
-            }
-            catch (error) {
-                spinner.stop('Token exchange failed');
-                throw error;
-            }
-            return tokenResult;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            prompts.log.error(`Authentication failed: ${errorMessage}`);
-            return {
-                success: false,
-                error: errorMessage
-            };
-        }
-    }
-    /**
-     * Original OAuth flow with local server (fallback)
-     */
-    async authenticate(instance, clientId, clientSecret) {
-        try {
-            // 🔧 CRIT-002 FIX: Apply URL normalization
-            const normalizedInstance = this.normalizeInstanceUrl(instance);
-            // Validate client secret format
-            const secretValidation = this.validateClientSecret(clientSecret);
-            if (!secretValidation.valid) {
-                prompts.log.error(`Invalid OAuth Client Secret: ${secretValidation.reason}`);
-                prompts.log.info('To get a valid OAuth secret:');
-                prompts.log.message('   1. Log into ServiceNow as admin');
-                prompts.log.message('   2. Navigate to: System OAuth > Application Registry');
-                prompts.log.message('   3. Create a new OAuth application');
-                prompts.log.message('   4. Copy the generated Client Secret (long random string)');
-                return {
-                    success: false,
-                    error: secretValidation.reason
-                };
-            }
-            // Get OAuth redirect configuration from environment or use defaults
-            const oauthConfig = snow_flow_config_js_1.snowFlowConfig.servicenow.oauth;
-            const port = oauthConfig.redirectPort;
-            const host = oauthConfig.redirectHost;
-            const path = oauthConfig.redirectPath;
-            const redirectUri = `http://${host}:${port}${path}`;
-            // Check if port is available
-            const isPortAvailable = await this.checkPortAvailable(port);
-            if (!isPortAvailable) {
-                prompts.log.error(`Port ${port} is already in use!`);
-                prompts.log.warn(`Please close any application using port ${port} and try again.`);
-                return {
-                    success: false,
-                    error: `Port ${port} is already in use. Please free up the port and try again.`
-                };
-            }
-            // Store credentials temporarily with normalized instance
-            this.credentials = {
-                instance: normalizedInstance.replace('https://', '').replace('http://', ''),
-                clientId,
-                clientSecret,
-                redirectUri
-            };
-            prompts.log.step('Starting ServiceNow OAuth flow');
-            prompts.log.info(`Instance: ${normalizedInstance}`);
-            prompts.log.info(`Client ID: ${clientId}`);
-            prompts.log.info(`Redirect URI: ${redirectUri}`);
-            // Generate state parameter for CSRF protection
-            this.stateParameter = this.generateState();
-            // Generate PKCE parameters
-            this.generatePKCE();
-            // Generate authorization URL
-            const authUrl = this.generateAuthUrl(this.credentials.instance, clientId, redirectUri);
-            prompts.log.step('Authorization URL generated');
-            prompts.log.message('');
-            prompts.log.message(`\n${authUrl}\n`);
-            prompts.log.message('');
-            // Start local server to handle callback
-            const authResult = await this.startCallbackServer(redirectUri, port);
-            if (authResult.success && authResult.accessToken) {
-                // Save tokens with normalized instance
-                await this.saveTokens({
-                    accessToken: authResult.accessToken,
-                    refreshToken: authResult.refreshToken || '',
-                    expiresIn: authResult.expiresIn || 3600,
-                    instance: this.credentials.instance,
-                    clientId,
-                    clientSecret
-                });
-                prompts.log.success('Authentication successful');
-                prompts.log.success('Tokens saved securely');
-            }
-            return authResult;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            prompts.log.error(`Authentication failed: ${errorMessage}`);
-            return {
-                success: false,
-                error: errorMessage
-            };
-        }
-    }
-    /**
-     * Generate ServiceNow OAuth authorization URL
-     */
-    generateAuthUrl(instance, clientId, redirectUri) {
-        const baseUrl = `https://${instance}/oauth_auth.do`;
-        const params = new URLSearchParams({
-            response_type: 'code',
-            client_id: clientId,
-            redirect_uri: redirectUri,
-            scope: 'useraccount write admin',
-            state: this.stateParameter || '',
-            code_challenge: this.codeChallenge || '',
-            code_challenge_method: 'S256'
-        });
-        return `${baseUrl}?${params.toString()}`;
-    }
-    /**
-     * Start local HTTP server to handle OAuth callback
-     * Also supports manual callback URL paste as fallback
-     */
-    async startCallbackServer(redirectUri, port) {
-        return new Promise(async (resolve) => {
-            let resolved = false;
-            let timeoutHandle = null;
-            // Helper function to cleanup and close server
-            const cleanup = () => {
-                if (timeoutHandle) {
-                    clearTimeout(timeoutHandle);
-                    timeoutHandle = null;
-                }
-                server.close();
-            };
-            const server = (0, http_1.createServer)(async (req, res) => {
-                if (resolved)
-                    return;
-                try {
-                    const url = new url_1.URL(req.url, `http://${snow_flow_config_js_1.snowFlowConfig.servicenow.oauth.redirectHost}:${port}`);
-                    if (url.pathname === '/callback') {
-                        const code = url.searchParams.get('code');
-                        const error = url.searchParams.get('error');
-                        const state = url.searchParams.get('state');
-                        // Validate state parameter
-                        if (state !== this.stateParameter) {
-                            res.writeHead(400, { 'Content-Type': 'text/html' });
-                            res.end(oauth_html_templates_js_1.OAuthTemplates.securityError);
-                            resolved = true;
-                            cleanup();
-                            resolve({
-                                success: false,
-                                error: 'Invalid state parameter'
-                            });
-                            return;
-                        }
-                        if (error) {
-                            res.writeHead(400, { 'Content-Type': 'text/html' });
-                            res.end(oauth_html_templates_js_1.OAuthTemplates.error(error));
-                            resolved = true;
-                            cleanup();
-                            resolve({
-                                success: false,
-                                error: `OAuth error: ${error}`
-                            });
-                            return;
-                        }
-                        if (!code) {
-                            res.writeHead(400, { 'Content-Type': 'text/html' });
-                            res.end(oauth_html_templates_js_1.OAuthTemplates.missingCode);
-                            resolved = true;
-                            cleanup();
-                            resolve({
-                                success: false,
-                                error: 'No authorization code received'
-                            });
-                            return;
-                        }
-                        // Exchange code for tokens
-                        resolved = true;
-                        const spinner = prompts.spinner();
-                        spinner.start('Exchanging authorization code for tokens');
-                        let tokenResult;
-                        try {
-                            tokenResult = await this.exchangeCodeForTokens(code);
-                            spinner.stop(tokenResult.success ? 'Token exchange successful' : 'Token exchange failed');
-                            if (tokenResult.success) {
-                                res.writeHead(200, { 'Content-Type': 'text/html' });
-                                res.end(oauth_html_templates_js_1.OAuthTemplates.success);
-                                cleanup();
-                                resolve(tokenResult);
-                            }
-                            else {
-                                res.writeHead(500, { 'Content-Type': 'text/html' });
-                                res.end(oauth_html_templates_js_1.OAuthTemplates.tokenExchangeFailed(tokenResult.error || 'Unknown error'));
-                                cleanup();
-                                resolve(tokenResult);
-                            }
-                        }
-                        catch (error) {
-                            spinner.stop('Token exchange failed');
-                            res.writeHead(500, { 'Content-Type': 'text/html' });
-                            res.end(oauth_html_templates_js_1.OAuthTemplates.tokenExchangeFailed('Unexpected error during token exchange'));
-                            cleanup();
-                            resolve({
-                                success: false,
-                                error: error instanceof Error ? error.message : String(error)
-                            });
-                        }
-                    }
-                    else {
-                        res.writeHead(404, { 'Content-Type': 'text/plain' });
-                        res.end('Not Found');
-                    }
-                }
-                catch (error) {
-                    prompts.log.error(`Callback server error: ${error}`);
-                    res.writeHead(500, { 'Content-Type': 'text/plain' });
-                    res.end('Internal Server Error');
-                    resolved = true;
-                    cleanup();
-                    resolve({
-                        success: false,
-                        error: error instanceof Error ? error.message : String(error)
-                    });
-                }
-            });
-            server.listen(port, () => {
-                // Prevent server from keeping process alive after authentication completes
-                server.unref();
-                prompts.log.step(`OAuth callback server started on http://${snow_flow_config_js_1.snowFlowConfig.servicenow.oauth.redirectHost}:${port}`);
-                prompts.log.warn('Please open the authorization URL in your browser');
-                prompts.log.info('Waiting for OAuth callback...');
-                // Auto-open browser if possible
-                // Try to auto-open browser if not in headless environment
-                const isCodespaces = process.env.CODESPACES === 'true';
-                const isContainer = process.env.CONTAINER === 'true' || (0, fs_1.existsSync)('/.dockerenv');
-                const isHeadless = isCodespaces || isContainer || process.env.CI === 'true';
-                if (!isHeadless) {
-                    try {
-                        const { spawn } = require('child_process');
-                        const authUrl = this.generateAuthUrl(this.credentials.instance, this.credentials.clientId, redirectUri);
-                        let browserProcess;
-                        // Try to open browser based on platform
-                        if (process.platform === 'darwin') {
-                            browserProcess = spawn('open', [authUrl], { detached: true, stdio: 'ignore' });
-                        }
-                        else if (process.platform === 'win32') {
-                            browserProcess = spawn('cmd', ['/c', 'start', authUrl], { detached: true, stdio: 'ignore' });
-                        }
-                        else if (process.platform === 'linux') {
-                            // Try multiple Linux browser openers
-                            const openers = ['xdg-open', 'gnome-open', 'kde-open', 'sensible-browser'];
-                            for (const opener of openers) {
-                                try {
-                                    browserProcess = spawn(opener, [authUrl], { detached: true, stdio: 'ignore' });
-                                    break; // If successful, stop trying
-                                }
-                                catch (e) {
-                                    // Try next opener
-                                    continue;
-                                }
-                            }
-                        }
-                        else {
-                            prompts.log.warn(`Unknown OS: ${process.platform}`);
-                        }
-                        // Prevent the spawn from keeping the process alive
-                        if (browserProcess && browserProcess.unref) {
-                            browserProcess.unref();
-                        }
-                    }
-                    catch (err) {
-                        // Silently fail - user can manually open URL
-                        prompts.log.warn('Browser auto-open failed. Please manually copy and open the URL above.');
-                    }
-                }
-                // Offer manual callback URL paste as alternative
-                prompts.log.message('');
-                prompts.log.info('Alternatively, paste the callback URL here after authorizing:');
-                // Start prompt for manual URL paste (race with server callback)
-                (async () => {
-                    try {
-                        const callbackUrl = await prompts.text({
-                            message: 'Paste callback URL (or press Enter to wait for automatic redirect)',
-                            placeholder: 'http://localhost:3005/callback?code=...&state=...',
-                            validate: (value) => {
-                                // Allow empty (waiting for server callback)
-                                if (!value || value.trim() === '')
-                                    return undefined;
-                                // Validate if URL was pasted
-                                if (!value.includes('callback'))
-                                    return 'Invalid callback URL - must contain "callback"';
-                                if (!value.includes('code='))
-                                    return 'Invalid callback URL - must contain code parameter';
-                            }
-                        });
-                        // If user pressed Enter without pasting, just wait for server callback
-                        if (prompts.isCancel(callbackUrl) || !callbackUrl || callbackUrl.trim() === '') {
-                            prompts.log.info('Waiting for browser redirect...');
-                            return;
-                        }
-                        // User pasted a URL - parse it
-                        if (resolved)
-                            return; // Server already handled it
-                        resolved = true;
-                        try {
-                            const url = new url_1.URL(callbackUrl);
-                            const code = url.searchParams.get('code');
-                            const state = url.searchParams.get('state');
-                            const error = url.searchParams.get('error');
-                            // Validate state
-                            if (state !== this.stateParameter) {
-                                cleanup();
-                                resolve({
-                                    success: false,
-                                    error: 'Invalid state parameter - security check failed'
-                                });
-                                return;
-                            }
-                            if (error) {
-                                cleanup();
-                                resolve({
-                                    success: false,
-                                    error: `OAuth error: ${error}`
-                                });
-                                return;
-                            }
-                            if (!code) {
-                                cleanup();
-                                resolve({
-                                    success: false,
-                                    error: 'No authorization code found in URL'
-                                });
-                                return;
-                            }
-                            // Exchange code for tokens
-                            prompts.log.success('Authorization code received from pasted URL');
-                            const spinner = prompts.spinner();
-                            spinner.start('Exchanging authorization code for tokens');
-                            let tokenResult;
-                            try {
-                                tokenResult = await this.exchangeCodeForTokens(code);
-                                spinner.stop(tokenResult.success ? 'Token exchange successful' : 'Token exchange failed');
-                                cleanup();
-                                resolve(tokenResult);
-                            }
-                            catch (error) {
-                                spinner.stop('Token exchange failed');
-                                cleanup();
-                                resolve({
-                                    success: false,
-                                    error: error instanceof Error ? error.message : 'Unexpected error during token exchange'
-                                });
-                            }
-                        }
-                        catch (err) {
-                            cleanup();
-                            resolve({
-                                success: false,
-                                error: 'Invalid callback URL format'
-                            });
-                        }
-                    }
-                    catch (err) {
-                        // Prompt was cancelled or errored - just wait for server callback
-                        if (!resolved) {
-                            prompts.log.info('Waiting for browser redirect...');
-                        }
-                    }
-                })();
-                // Add 5-minute timeout for OAuth flow
-                timeoutHandle = setTimeout(() => {
-                    if (!resolved) {
-                        resolved = true;
-                        cleanup();
-                        prompts.log.error('OAuth authorization timed out after 5 minutes');
-                        prompts.log.info('Please try again: snow-flow auth login');
-                        resolve({
-                            success: false,
-                            error: 'OAuth authorization timed out - no callback received within 5 minutes'
-                        });
-                    }
-                }, 300000); // 5 minutes
-            });
-        });
-    }
-    /**
-     * Exchange authorization code for tokens
-     */
-    async exchangeCodeForTokens(code) {
-        try {
-            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
-            if (!this.checkTokenRequestRateLimit()) {
-                return {
-                    success: false,
-                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
-                };
-            }
-            const tokenUrl = `https://${this.credentials.instance}/oauth_token.do`;
-            const response = await axios_1.default.post(tokenUrl, new URLSearchParams({
-                grant_type: 'authorization_code',
-                code,
-                client_id: this.credentials.clientId,
-                client_secret: this.credentials.clientSecret,
-                redirect_uri: this.credentials.redirectUri,
-                code_verifier: this.codeVerifier || ''
-            }), {
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                timeout: 15000, // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
-                // Allow self-signed certificates for dev instances
-                httpsAgent: new https_1.default.Agent({
-                    rejectUnauthorized: false
-                })
-            });
-            const data = response.data;
-            if (data.access_token) {
-                return {
-                    success: true,
-                    accessToken: data.access_token,
-                    refreshToken: data.refresh_token,
-                    expiresIn: data.expires_in
-                };
-            }
-            else {
-                return {
-                    success: false,
-                    error: 'No access token received'
-                };
-            }
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            // Check for invalid redirect_uri error
-            if (axios_1.default.isAxiosError(error) && error.response) {
-                const responseData = error.response.data;
-                const errorDescription = responseData?.error_description || responseData?.error || '';
-                // Special handling for redirect_uri errors
-                if (errorDescription.toLowerCase().includes('redirect_uri') ||
-                    errorDescription.toLowerCase().includes('redirect uri')) {
-                    prompts.log.error('Invalid redirect_uri configuration');
-                    prompts.log.message('');
-                    prompts.log.warn('The OAuth application in ServiceNow is not configured correctly.');
-                    prompts.log.message('');
-                    prompts.log.step('Fix this by following these steps:');
-                    prompts.log.message('');
-                    prompts.log.info('1. Log into ServiceNow as administrator');
-                    prompts.log.info(`2. Navigate to: System OAuth → Application Registry`);
-                    prompts.log.info(`3. Find your OAuth application (Client ID: ${this.credentials.clientId})`);
-                    prompts.log.info('4. Edit the "Redirect URL" field');
-                    prompts.log.info('5. Change it to: http://localhost:3005/callback');
-                    prompts.log.message('   (exactly this - copy/paste to avoid typos!)');
-                    prompts.log.info('6. Save the application');
-                    prompts.log.info('7. Run "snow-flow auth login" again');
-                    prompts.log.message('');
-                    prompts.log.warn('The redirect URI MUST be exactly: http://localhost:3005/callback');
-                    prompts.log.message('');
-                    return {
-                        success: false,
-                        error: 'Invalid redirect_uri - OAuth application not configured. See instructions above.'
-                    };
-                }
-                // Log other API errors
-                prompts.log.error(`ServiceNow OAuth error: ${errorDescription}`);
-                prompts.log.error(`Response data: ${JSON.stringify(responseData)}`);
-            }
-            else {
-                prompts.log.error(`Token exchange error: ${errorMessage}`);
-            }
-            return {
-                success: false,
-                error: errorMessage
-            };
-        }
-    }
-    /**
-     * Save tokens to file
-     */
-    async saveTokens(tokenData) {
-        try {
-            const expiresAt = new Date();
-            expiresAt.setSeconds(expiresAt.getSeconds() + tokenData.expiresIn);
-            const authData = {
-                ...tokenData,
-                expiresAt: expiresAt.toISOString()
-            };
-            // Use unified auth store
-            await unified_auth_store_js_1.unifiedAuthStore.saveTokens(authData);
-            // Bridge to MCP servers immediately
-            await unified_auth_store_js_1.unifiedAuthStore.bridgeToMCP();
-        }
-        catch (error) {
-            prompts.log.error(`Failed to save tokens: ${error}`);
-            throw error;
-        }
-    }
-    /**
-     * Load tokens from file
-     */
-    async loadTokens() {
-        try {
-            return await unified_auth_store_js_1.unifiedAuthStore.getTokens();
-        }
-        catch (error) {
-            return null;
-        }
-    }
-    /**
-     * Check if authenticated
-     */
-    async isAuthenticated() {
-        try {
-            const tokens = await this.loadTokens();
-            if (!tokens)
-                return false;
-            // Check if token is expired
-            const expiresAt = new Date(tokens.expiresAt);
-            const now = new Date();
-            return now < expiresAt;
-        }
-        catch (error) {
-            return false;
-        }
-    }
-    /**
-     * Get access token (refresh if needed)
-     */
-    async getAccessToken() {
-        try {
-            const tokens = await this.loadTokens();
-            if (!tokens)
-                return null;
-            // Check if token is expired
-            const expiresAt = new Date(tokens.expiresAt);
-            const now = new Date();
-            if (now >= expiresAt && tokens.refreshToken) {
-                // Token expired, try to refresh
-                prompts.log.info('Token expired, refreshing...');
-                const refreshResult = await this.refreshAccessToken(tokens);
-                if (refreshResult.success && refreshResult.accessToken) {
-                    // Update saved tokens
-                    await this.saveTokens({
-                        ...tokens,
-                        accessToken: refreshResult.accessToken,
-                        expiresIn: refreshResult.expiresIn || 3600
-                    });
-                    return refreshResult.accessToken;
-                }
-                else {
-                    prompts.log.error(`Token refresh failed: ${refreshResult.error}`);
-                    return null;
-                }
-            }
-            return tokens.accessToken;
-        }
-        catch (error) {
-            prompts.log.error(`Failed to get access token: ${error}`);
-            return null;
-        }
-    }
-    /**
-     * Refresh access token
-     */
-    async refreshAccessToken(tokens) {
-        try {
-            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
-            if (!this.checkTokenRequestRateLimit()) {
-                return {
-                    success: false,
-                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
-                };
-            }
-            // If no tokens provided, load from file
-            if (!tokens) {
-                tokens = await this.loadTokens();
-                if (!tokens) {
-                    return {
-                        success: false,
-                        error: 'No tokens found to refresh'
-                    };
-                }
-            }
-            const tokenUrl = `https://${tokens.instance}/oauth_token.do`;
-            const response = await axios_1.default.post(tokenUrl, new URLSearchParams({
-                grant_type: 'refresh_token',
-                refresh_token: tokens.refreshToken,
-                client_id: tokens.clientId,
-                client_secret: tokens.clientSecret
-            }), {
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                timeout: 15000, // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
-                // Allow self-signed certificates for dev instances
-                httpsAgent: new https_1.default.Agent({
-                    rejectUnauthorized: false
-                })
-            });
-            const data = response.data;
-            if (data.access_token) {
-                // Update saved tokens
-                await this.saveTokens({
-                    ...tokens,
-                    accessToken: data.access_token,
-                    expiresIn: data.expires_in || 3600
-                });
-                return {
-                    success: true,
-                    accessToken: data.access_token,
-                    expiresIn: data.expires_in
-                };
-            }
-            else {
-                return {
-                    success: false,
-                    error: 'No access token received'
-                };
-            }
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            return {
-                success: false,
-                error: errorMessage
-            };
-        }
-    }
-    /**
-     * Logout - clear saved tokens
-     */
-    async logout() {
-        try {
-            await fs_1.promises.unlink(this.tokenPath);
-            prompts.log.success('Logged out successfully');
-        }
-        catch (error) {
-            prompts.log.info('No active session to logout from');
-        }
-    }
-    /**
-     * Get stored OAuth tokens for use in other contexts (MCP servers)
-     */
-    async getStoredTokens() {
-        return await this.loadTokens();
-    }
-    /**
-     * Load credentials (including tokens) with .env fallback
-     */
-    async loadCredentials() {
-        try {
-            // First, try to load saved OAuth tokens
-            const tokens = await this.loadTokens();
-            if (tokens && tokens.accessToken) {
-                // Validate client secret when loading
-                if (tokens.clientSecret) {
-                    const secretValidation = this.validateClientSecret(tokens.clientSecret);
-                    if (!secretValidation.valid) {
-                        prompts.log.warn(`OAuth Configuration Issue: ${secretValidation.reason}`);
-                        prompts.log.info('Your stored client secret may be incorrect. Re-authenticate with: snow-flow auth login');
-                    }
-                }
-                // Check if token is expired
-                const expiresAt = new Date(tokens.expiresAt);
-                const now = new Date();
-                if (now < expiresAt) {
-                    prompts.log.success('Using saved OAuth tokens');
-                    return {
-                        instance: tokens.instance,
-                        clientId: tokens.clientId,
-                        clientSecret: tokens.clientSecret,
-                        accessToken: tokens.accessToken,
-                        refreshToken: tokens.refreshToken,
-                        expiresAt: tokens.expiresAt
-                    };
-                }
-                else {
-                    prompts.log.warn('Saved OAuth token expired, will try refresh...');
-                }
-            }
-            // 🔧 NEW: Fallback to .env file if no valid tokens
-            prompts.log.info('No valid OAuth tokens found, checking .env file...');
-            // Load environment variables with dotenv
-            try {
-                require('dotenv').config();
-            }
-            catch (err) {
-                prompts.log.message('dotenv not available, using process.env directly');
-            }
-            const envInstance = process.env.SNOW_INSTANCE;
-            const envClientId = process.env.SNOW_CLIENT_ID;
-            const envClientSecret = process.env.SNOW_CLIENT_SECRET;
-            if (envInstance && envClientId && envClientSecret) {
-                prompts.log.success('Found ServiceNow credentials in .env file');
-                prompts.log.message(`   - Instance: ${envInstance}`);
-                prompts.log.message(`   - Client ID: ${envClientId}`);
-                prompts.log.message('   - Client Secret: Present');
-                // Validate client secret
-                const secretValidation = this.validateClientSecret(envClientSecret);
-                if (!secretValidation.valid) {
-                    prompts.log.error(`Invalid OAuth Client Secret in .env file: ${secretValidation.reason}`);
-                    prompts.log.warn('Please update SNOW_CLIENT_SECRET in .env with proper OAuth secret from ServiceNow');
-                    return null;
-                }
-                prompts.log.message('');
-                prompts.log.info('OAuth Setup Required:');
-                prompts.log.message('   Your .env has OAuth credentials but no active session.');
-                prompts.log.message('   Run: snow-flow auth login');
-                prompts.log.message('   This will authenticate and create persistent tokens.');
-                prompts.log.message('');
-                // Return credentials without access token - this will trigger auth flow
-                return {
-                    instance: envInstance.replace(/\/$/, ''),
-                    clientId: envClientId,
-                    clientSecret: envClientSecret,
-                    // No accessToken - this signals that OAuth login is needed
-                };
-            }
-            // 🔧 Check for old username/password setup in .env
-            const envUsername = process.env.SNOW_USERNAME;
-            const envPassword = process.env.SNOW_PASSWORD;
-            if (envInstance && envUsername && envPassword) {
-                prompts.log.warn('Found username/password in .env - OAuth is recommended');
-                prompts.log.info('For better security, set up OAuth credentials:');
-                prompts.log.message('   1. In ServiceNow: System OAuth > Application Registry > New');
-                prompts.log.message('   2. Update .env with SNOW_CLIENT_ID and SNOW_CLIENT_SECRET');
-                prompts.log.message('   3. Run: snow-flow auth login');
-                // Don't return username/password - force OAuth setup
-                return null;
-            }
-            // No credentials found anywhere
-            prompts.log.error('No ServiceNow credentials found!');
-            prompts.log.message('');
-            prompts.log.info('Setup Instructions:');
-            prompts.log.message('   1. Create .env file with OAuth credentials:');
-            prompts.log.message('      SNOW_INSTANCE=your-instance.service-now.com');
-            prompts.log.message('      SNOW_CLIENT_ID=your_oauth_client_id');
-            prompts.log.message('      SNOW_CLIENT_SECRET=your_oauth_client_secret');
-            prompts.log.message('   2. Run: snow-flow auth login');
-            prompts.log.message('');
-            prompts.log.info('To get OAuth credentials:');
-            prompts.log.message('   • ServiceNow: System OAuth > Application Registry > New OAuth Application');
-            prompts.log.message(`   • Redirect URI: http://${snow_flow_config_js_1.snowFlowConfig.servicenow.oauth.redirectHost}:${snow_flow_config_js_1.snowFlowConfig.servicenow.oauth.redirectPort}${snow_flow_config_js_1.snowFlowConfig.servicenow.oauth.redirectPath}`);
-            prompts.log.message('   • Scopes: useraccount write admin');
-            prompts.log.message('');
-            return null;
-        }
-        catch (error) {
-            prompts.log.error(`Error loading credentials: ${error}`);
-            return null;
-        }
-    }
-    /**
-     * Validate OAuth client secret format
-     * OAuth secrets are typically long random strings (32+ chars) with mixed case and alphanumeric
-     * Common passwords are shorter and may contain dictionary words
-     */
-    validateClientSecret(clientSecret) {
-        // Check minimum length - OAuth secrets are typically 32+ characters
-        if (clientSecret.length < 20) {
-            return {
-                valid: false,
-                reason: 'OAuth Client Secret too short. Expected 32+ character random string from ServiceNow.'
-            };
-        }
-        // Check for common password patterns
-        const commonPasswordPatterns = [
-            /^password/i,
-            /^admin/i,
-            /^test/i,
-            /^demo/i,
-            /^welcome/i,
-            /123456/,
-            /qwerty/i,
-            /^[a-z]+\d{1,4}$/i, // Simple word + numbers like "Welkom123"
-            /^[A-Z][a-z]+\d{1,4}$/ // Capitalized word + numbers
-        ];
-        for (const pattern of commonPasswordPatterns) {
-            if (pattern.test(clientSecret)) {
-                return {
-                    valid: false,
-                    reason: `OAuth Client Secret appears to be a password. ServiceNow OAuth secrets are long random strings (e.g., "a1b2c3d4e5f6..."). Check your Application Registry in ServiceNow.`
-                };
-            }
-        }
-        // Check for sufficient entropy (mix of upper, lower, numbers)
-        const hasUpper = /[A-Z]/.test(clientSecret);
-        const hasLower = /[a-z]/.test(clientSecret);
-        const hasNumber = /[0-9]/.test(clientSecret);
-        const charTypes = [hasUpper, hasLower, hasNumber].filter(Boolean).length;
-        if (charTypes < 2) {
-            return {
-                valid: false,
-                reason: 'OAuth Client Secret lacks complexity. ServiceNow generates secrets with mixed case and numbers.'
-            };
-        }
-        return { valid: true };
-    }
-    /**
-     * Get credentials (compatibility method for MCP servers)
-     */
-    async getCredentials() {
-        return await this.loadCredentials();
-    }
-}
-exports.ServiceNowOAuth = ServiceNowOAuth;
-//# sourceMappingURL=snow-oauth.js.map