longcelot-sheet-db/dist/auth/oauth.js

Google Sheets-backed staging database adapter for Node.js with schema-first design

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.OAuthManager = exports.LOGIN_SCOPES = void 0;
exports.createOAuthManager = createOAuthManager;
exports.createLoginOAuthManager = createLoginOAuthManager;
const google_auth_library_1 = require("google-auth-library");
const SHEETS_SCOPES = [
    'https://www.googleapis.com/auth/spreadsheets',
    'https://www.googleapis.com/auth/drive.file',
];
/** Default scopes for `createLoginOAuthManager()` / `createAuthRouter()`. Exported so a
 *  caller overriding `AuthRouterOptions.scopes` can extend rather than fully replace it,
 *  e.g. `[...LOGIN_SCOPES, 'https://www.googleapis.com/auth/calendar.readonly']`. */
exports.LOGIN_SCOPES = [
    'openid',
    'email',
    'profile',
    ...SHEETS_SCOPES,
];
class OAuthManager {
    constructor(config, defaultScopes = SHEETS_SCOPES) {
        this.client = new google_auth_library_1.OAuth2Client(config.clientId, config.clientSecret, config.redirectUri);
        this.defaultScopes = defaultScopes;
        this.redirectUri = config.redirectUri;
    }
    /** The configured redirect URI. Lets a caller (e.g. the CLI's loopback OAuth capture) inspect
     *  where Google will send the browser back to without needing to keep its own copy of `config`. */
    getRedirectUri() {
        return this.redirectUri;
    }
    /**
     * @param state Opaque value round-tripped through Google and returned on the callback.
     *   Pass a per-login, unpredictable value (e.g. `signState()` in router.ts) and verify it
     *   on callback — without this, the OAuth flow has no CSRF protection: an attacker can start
     *   their own OAuth transaction, capture the callback, and trick a victim's browser into
     *   completing it (login CSRF / session fixation).
     */
    getAuthUrl(scopes = this.defaultScopes, state) {
        return this.client.generateAuthUrl({
            access_type: 'offline',
            scope: scopes,
            prompt: 'consent',
            ...(state ? { state } : {}),
        });
    }
    async getTokens(code) {
        const { tokens } = await this.client.getToken(code);
        return tokens;
    }
    async refreshTokens(refreshToken) {
        this.client.setCredentials({ refresh_token: refreshToken });
        const { credentials } = await this.client.refreshAccessToken();
        return credentials;
    }
    /** Verifies a Google ID token. Only works when `openid` scope was requested (use createLoginOAuthManager). */
    async verifyToken(idToken) {
        const ticket = await this.client.verifyIdToken({
            idToken,
            audience: this.client._clientId,
        });
        return ticket.getPayload();
    }
}
exports.OAuthManager = OAuthManager;
/** Standard adapter-only OAuth — for backend-to-Sheets communication. Does NOT produce id_token. */
function createOAuthManager(config) {
    return new OAuthManager(config, SHEETS_SCOPES);
}
/**
 * Login OAuth manager — pre-configured with `openid email profile` scopes alongside
 * Sheets scopes. Use this for user-facing Google Sign-In. The tokens it produces include
 * an `id_token` that can be verified with `manager.verifyToken(idToken)`.
 */
function createLoginOAuthManager(config) {
    return new OAuthManager(config, exports.LOGIN_SCOPES);
}
//# sourceMappingURL=oauth.js.map