longcelot-sheet-db/dist/auth/oauth.js

Google Sheets-backed staging database adapter for Node.js with schema-first design

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.OAuthManager = void 0;
exports.createOAuthManager = createOAuthManager;
exports.createLoginOAuthManager = createLoginOAuthManager;
const google_auth_library_1 = require("google-auth-library");
const SHEETS_SCOPES = [
    'https://www.googleapis.com/auth/spreadsheets',
    'https://www.googleapis.com/auth/drive.file',
];
const LOGIN_SCOPES = [
    'openid',
    'email',
    'profile',
    ...SHEETS_SCOPES,
];
class OAuthManager {
    constructor(config, defaultScopes = SHEETS_SCOPES) {
        this.client = new google_auth_library_1.OAuth2Client(config.clientId, config.clientSecret, config.redirectUri);
        this.defaultScopes = defaultScopes;
    }
    /**
     * @param state Opaque value round-tripped through Google and returned on the callback.
     *   Pass a per-login, unpredictable value (e.g. `signState()` in router.ts) and verify it
     *   on callback — without this, the OAuth flow has no CSRF protection: an attacker can start
     *   their own OAuth transaction, capture the callback, and trick a victim's browser into
     *   completing it (login CSRF / session fixation).
     */
    getAuthUrl(scopes = this.defaultScopes, state) {
        return this.client.generateAuthUrl({
            access_type: 'offline',
            scope: scopes,
            prompt: 'consent',
            ...(state ? { state } : {}),
        });
    }
    async getTokens(code) {
        const { tokens } = await this.client.getToken(code);
        return tokens;
    }
    async refreshTokens(refreshToken) {
        this.client.setCredentials({ refresh_token: refreshToken });
        const { credentials } = await this.client.refreshAccessToken();
        return credentials;
    }
    /** Verifies a Google ID token. Only works when `openid` scope was requested (use createLoginOAuthManager). */
    async verifyToken(idToken) {
        const ticket = await this.client.verifyIdToken({
            idToken,
            audience: this.client._clientId,
        });
        return ticket.getPayload();
    }
}
exports.OAuthManager = OAuthManager;
/** Standard adapter-only OAuth — for backend-to-Sheets communication. Does NOT produce id_token. */
function createOAuthManager(config) {
    return new OAuthManager(config, SHEETS_SCOPES);
}
/**
 * Login OAuth manager — pre-configured with `openid email profile` scopes alongside
 * Sheets scopes. Use this for user-facing Google Sign-In. The tokens it produces include
 * an `id_token` that can be verified with `manager.verifyToken(idToken)`.
 */
function createLoginOAuthManager(config) {
    return new OAuthManager(config, LOGIN_SCOPES);
}
//# sourceMappingURL=oauth.js.map