@commercetools/sdk-middleware-auth/dist/sdk-middleware-auth.cjs.js

'use strict';

Object.defineProperty(exports, '__esModule', { value: true });

function _defineProperty(obj, key, value) {
  if (key in obj) {
    Object.defineProperty(obj, key, {
      value: value,
      enumerable: true,
      configurable: true,
      writable: true
    });
  } else {
    obj[key] = value;
  }

  return obj;
}

function ownKeys(object, enumerableOnly) {
  var keys = Object.keys(object);

  if (Object.getOwnPropertySymbols) {
    var symbols = Object.getOwnPropertySymbols(object);
    if (enumerableOnly) symbols = symbols.filter(function (sym) {
      return Object.getOwnPropertyDescriptor(object, sym).enumerable;
    });
    keys.push.apply(keys, symbols);
  }

  return keys;
}

function _objectSpread2(target) {
  for (var i = 1; i < arguments.length; i++) {
    var source = arguments[i] != null ? arguments[i] : {};

    if (i % 2) {
      ownKeys(Object(source), true).forEach(function (key) {
        _defineProperty(target, key, source[key]);
      });
    } else if (Object.getOwnPropertyDescriptors) {
      Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
    } else {
      ownKeys(Object(source)).forEach(function (key) {
        Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
      });
    }
  }

  return target;
}

// POST https://{host}/oauth/token?grant_type=client_credentials&scope={scope}
// Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
function buildRequestForClientCredentialsFlow(options) {
  if (!options) throw new Error('Missing required options');
  if (!options.host) throw new Error('Missing required option (host)');
  if (!options.projectKey) throw new Error('Missing required option (projectKey)');
  if (!options.credentials) throw new Error('Missing required option (credentials)');
  var _options$credentials = options.credentials,
      clientId = _options$credentials.clientId,
      clientSecret = _options$credentials.clientSecret;
  if (!(clientId && clientSecret)) throw new Error('Missing required credentials (clientId, clientSecret)');
  var scope = options.scopes ? options.scopes.join(' ') : undefined;
  var basicAuth = Buffer.from("".concat(clientId, ":").concat(clientSecret)).toString('base64'); // This is mostly useful for internal testing purposes to be able to check
  // other oauth endpoints.

  var oauthUri = options.oauthUri || '/oauth/token';
  var url = options.host.replace(/\/$/, '') + oauthUri;
  var body = "grant_type=client_credentials".concat(scope ? "&scope=".concat(scope) : '');
  return {
    basicAuth: basicAuth,
    url: url,
    body: body
  };
}
function buildRequestForPasswordFlow(options) {
  if (!options) throw new Error('Missing required options');
  if (!options.host) throw new Error('Missing required option (host)');
  if (!options.projectKey) throw new Error('Missing required option (projectKey)');
  if (!options.credentials) throw new Error('Missing required option (credentials)');
  var _options$credentials2 = options.credentials,
      clientId = _options$credentials2.clientId,
      clientSecret = _options$credentials2.clientSecret,
      user = _options$credentials2.user;
  var pKey = options.projectKey;
  if (!(clientId && clientSecret && user)) throw new Error('Missing required credentials (clientId, clientSecret, user)');
  var username = user.username,
      password = user.password;
  if (!(username && password)) throw new Error('Missing required user credentials (username, password)');
  var scope = (options.scopes || []).join(' ');
  var scopeStr = scope ? "&scope=".concat(scope) : '';
  var basicAuth = Buffer.from("".concat(clientId, ":").concat(clientSecret)).toString('base64'); // This is mostly useful for internal testing purposes to be able to check
  // other oauth endpoints.

  var oauthUri = options.oauthUri || "/oauth/".concat(pKey, "/customers/token");
  var url = options.host.replace(/\/$/, '') + oauthUri; // eslint-disable-next-line max-len
  // encode username and password as requested by platform

  var body = "grant_type=password&username=".concat(encodeURIComponent(username), "&password=").concat(encodeURIComponent(password)).concat(scopeStr);
  return {
    basicAuth: basicAuth,
    url: url,
    body: body
  };
}
function buildRequestForRefreshTokenFlow(options) {
  if (!options) throw new Error('Missing required options');
  if (!options.host) throw new Error('Missing required option (host)');
  if (!options.projectKey) throw new Error('Missing required option (projectKey)');
  if (!options.credentials) throw new Error('Missing required option (credentials)');
  if (!options.refreshToken) throw new Error('Missing required option (refreshToken)');
  var _options$credentials3 = options.credentials,
      clientId = _options$credentials3.clientId,
      clientSecret = _options$credentials3.clientSecret;
  if (!(clientId && clientSecret)) throw new Error('Missing required credentials (clientId, clientSecret)');
  var basicAuth = Buffer.from("".concat(clientId, ":").concat(clientSecret)).toString('base64'); // This is mostly useful for internal testing purposes to be able to check
  // other oauth endpoints.

  var oauthUri = options.oauthUri || '/oauth/token';
  var url = options.host.replace(/\/$/, '') + oauthUri;
  var body = "grant_type=refresh_token&refresh_token=".concat(encodeURIComponent(options.refreshToken));
  return {
    basicAuth: basicAuth,
    url: url,
    body: body
  };
}
function buildRequestForAnonymousSessionFlow(options) {
  if (!options) throw new Error('Missing required options');
  if (!options.projectKey) throw new Error('Missing required option (projectKey)');
  var pKey = options.projectKey; // eslint-disable-next-line no-param-reassign

  options.oauthUri = options.oauthUri || "/oauth/".concat(pKey, "/anonymous/token");
  var result = buildRequestForClientCredentialsFlow(options);
  if (options.credentials.anonymousId) result.body += "&anonymous_id=".concat(options.credentials.anonymousId);
  return _objectSpread2({}, result);
}

function buildTokenCacheKey(options) {
  return {
    clientId: options.credentials.clientId,
    host: options.host,
    projectKey: options.projectKey
  };
}

function mergeAuthHeader(token, req) {
  return _objectSpread2({}, req, {
    headers: _objectSpread2({}, req.headers, {
      Authorization: "Bearer ".concat(token)
    })
  });
}

function calculateExpirationTime(expiresIn) {
  return Date.now() + expiresIn * 1000 - // Add a gap of 2 hours before expiration time.
  2 * 60 * 60 * 1000;
}

function executeRequest(_ref) {
  var fetcher = _ref.fetcher,
      url = _ref.url,
      basicAuth = _ref.basicAuth,
      body = _ref.body,
      tokenCache = _ref.tokenCache,
      requestState = _ref.requestState,
      pendingTasks = _ref.pendingTasks,
      response = _ref.response,
      tokenCacheKey = _ref.tokenCacheKey;
  fetcher(url, {
    method: 'POST',
    headers: {
      Authorization: "Basic ".concat(basicAuth),
      'Content-Length': Buffer.byteLength(body).toString(),
      'Content-Type': 'application/x-www-form-urlencoded'
    },
    body: body
  }).then(function (res) {
    if (res.ok) return res.json().then(function (_ref2) {
      var token = _ref2.access_token,
          expiresIn = _ref2.expires_in,
          refreshToken = _ref2.refresh_token;
      var expirationTime = calculateExpirationTime(expiresIn); // Cache new token

      tokenCache.set({
        token: token,
        expirationTime: expirationTime,
        refreshToken: refreshToken
      }, tokenCacheKey); // Dispatch all pending requests

      requestState.set(false); // Freeze and copy pending queue, reset original one for accepting
      // new pending tasks

      var executionQueue = pendingTasks.slice(); // eslint-disable-next-line no-param-reassign

      pendingTasks = [];
      executionQueue.forEach(function (task) {
        // Assign the new token in the request header
        var requestWithAuth = mergeAuthHeader(token, task.request); // console.log('test', cache, pendingTasks)
        // Continue by calling the task's own next function

        task.next(requestWithAuth, task.response);
      });
    }); // Handle error response

    return res.text().then(function (text) {
      var parsed;

      try {
        parsed = JSON.parse(text);
      } catch (error) {
        /* noop */
      }

      var error = new Error(parsed ? parsed.message : text);
      if (parsed) error.body = parsed;
      response.reject(error);
    });
  }).catch(function (error) {
    if (response && typeof response.reject === 'function') response.reject(error);
  });
}

function authMiddlewareBase(_ref3, next, userOptions) {
  var request = _ref3.request,
      response = _ref3.response,
      url = _ref3.url,
      basicAuth = _ref3.basicAuth,
      body = _ref3.body,
      pendingTasks = _ref3.pendingTasks,
      requestState = _ref3.requestState,
      tokenCache = _ref3.tokenCache,
      tokenCacheKey = _ref3.tokenCacheKey,
      fetcher = _ref3.fetch;
  if (!fetcher && typeof fetch === 'undefined') throw new Error('`fetch` is not available. Please pass in `fetch` as an option or have it globally available.');
  if (!fetcher) // eslint-disable-next-line
    fetcher = fetch; // Check if there is already a `Authorization` header in the request.
  // If so, then go directly to the next middleware.

  if (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) {
    next(request, response);
    return;
  } // If there was a token in the tokenCache, and it's not expired, append
  // the token in the `Authorization` header.


  var tokenObj = tokenCache.get(tokenCacheKey);

  if (tokenObj && tokenObj.token && Date.now() < tokenObj.expirationTime) {
    var requestWithAuth = mergeAuthHeader(tokenObj.token, request);
    next(requestWithAuth, response);
    return;
  } // Keep pending tasks until a token is fetched
  // Save next function as well, to call it once the token has been fetched, which prevents
  // unexpected behaviour in a context in which the next function uses global vars
  // or Promises to capture the token to hand it to other libraries, e.g. Apollo


  pendingTasks.push({
    request: request,
    response: response,
    next: next
  }); // If a token is currently being fetched, just wait ;)

  if (requestState.get()) return; // Mark that a token is being fetched

  requestState.set(true); // If there was a refreshToken in the tokenCache, and there was an expired
  // token or no token in the tokenCache, use the refreshToken flow

  if (tokenObj && tokenObj.refreshToken && (!tokenObj.token || tokenObj.token && Date.now() > tokenObj.expirationTime)) {
    if (!userOptions) throw new Error('Missing required options') // eslint-disable-next-line
    ;
    executeRequest(_objectSpread2({
      fetcher: fetcher
    }, buildRequestForRefreshTokenFlow(_objectSpread2({}, userOptions, {
      refreshToken: tokenObj.refreshToken
    })), {
      tokenCacheKey: tokenCacheKey,
      tokenCache: tokenCache,
      requestState: requestState,
      pendingTasks: pendingTasks,
      response: response
    }));
    return;
  } // Token and refreshToken are not present or invalid. Request a new token...


  executeRequest({
    fetcher: fetcher,
    url: url,
    basicAuth: basicAuth,
    body: body,
    tokenCacheKey: tokenCacheKey,
    tokenCache: tokenCache,
    requestState: requestState,
    pendingTasks: pendingTasks,
    response: response
  });
}

function store(initVal) {
  var value = initVal;
  return {
    get: function get() {
      return value;
    },
    set: function set(val) {
      value = val;
      return value;
    }
  };
}

function createAuthMiddlewareForClientCredentialsFlow(options) {
  var tokenCache = options.tokenCache || store({
    token: '',
    expirationTime: -1
  });
  var requestState = store(false);
  var pendingTasks = [];
  return function (next) {
    return function (request, response) {
      // Check if there is already a `Authorization` header in the request.
      // If so, then go directly to the next middleware.
      if (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) {
        next(request, response);
        return;
      }

      var params = _objectSpread2({
        request: request,
        response: response
      }, buildRequestForClientCredentialsFlow(options), {
        pendingTasks: pendingTasks,
        requestState: requestState,
        tokenCache: tokenCache,
        tokenCacheKey: buildTokenCacheKey(options),
        fetch: options.fetch
      });

      authMiddlewareBase(params, next);
    };
  };
}

function createAuthMiddlewareForPasswordFlow(options) {
  var tokenCache = store({});
  var pendingTasks = [];
  var requestState = store(false);
  return function (next) {
    return function (request, response) {
      // Check if there is already a `Authorization` header in the request.
      // If so, then go directly to the next middleware.
      if (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) {
        next(request, response);
        return;
      }

      var params = _objectSpread2({
        request: request,
        response: response
      }, buildRequestForPasswordFlow(options), {
        pendingTasks: pendingTasks,
        requestState: requestState,
        tokenCache: tokenCache,
        fetch: options.fetch
      });

      authMiddlewareBase(params, next, options);
    };
  };
}

function createAuthMiddlewareForRefreshTokenFlow(options) {
  var tokenCache = store({});
  var pendingTasks = [];
  var requestState = store(false);
  return function (next) {
    return function (request, response) {
      // Check if there is already a `Authorization` header in the request.
      // If so, then go directly to the next middleware.
      if (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) {
        next(request, response);
        return;
      }

      var params = _objectSpread2({
        request: request,
        response: response
      }, buildRequestForRefreshTokenFlow(options), {
        pendingTasks: pendingTasks,
        requestState: requestState,
        tokenCache: tokenCache,
        fetch: options.fetch
      });

      authMiddlewareBase(params, next);
    };
  };
}

function createAuthMiddlewareForAnonymousSessionFlow(options) {
  var tokenCache = store({});
  var pendingTasks = [];
  var requestState = store(false);
  return function (next) {
    return function (request, response) {
      // Check if there is already a `Authorization` header in the request.
      // If so, then go directly to the next middleware.
      if (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) {
        next(request, response);
        return;
      }

      var params = _objectSpread2({
        request: request,
        response: response
      }, buildRequestForAnonymousSessionFlow(options), {
        pendingTasks: pendingTasks,
        requestState: requestState,
        tokenCache: tokenCache,
        fetch: options.fetch
      });

      authMiddlewareBase(params, next, options);
    };
  };
}

function createAuthMiddlewareWithExistingToken() {
  var authorization = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : '';
  var options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
  return function (next) {
    return function (request, response) {
      if (typeof authorization !== 'string') throw new Error('authorization must be a string');
      var force = options.force === undefined ? true : options.force;
      /** The request will not be modified if:
       *  1. no argument is passed
       *  2. force is false and authorization header exists
       */

      if (!authorization || (request.headers && request.headers.authorization || request.headers && request.headers.Authorization) && force === false) {
        return next(request, response);
      }

      var requestWithAuth = _objectSpread2({}, request, {
        headers: _objectSpread2({}, request.headers, {
          Authorization: authorization
        })
      });

      return next(requestWithAuth, response);
    };
  };
}

var MANAGE_PROJECT = 'manage_project';
var MANAGE_PRODUCTS = 'manage_products';
var VIEW_PRODUCTS = 'view_products';
var MANAGE_ORDERS = 'manage_orders';
var VIEW_ORDERS = 'view_orders';
var MANAGE_MY_ORDERS = 'manage_my_orders';
var MANAGE_CUSTOMERS = 'manage_customers';
var VIEW_CUSTOMERS = 'view_customers';
var MANAGE_MY_PROFILE = 'manage_my_profile';
var MANAGE_TYPES = 'manage_types';
var VIEW_TYPES = 'view_types';
var MANAGE_PAYMENTS = 'manage_payments';
var VIEW_PAYMENTS = 'view_payments';
var CREATE_ANONYMOUS_TOKEN = 'create_anonymous_token';
var MANAGE_SUBSCRIPTIONS = 'manage_subscriptions';

var scopes = /*#__PURE__*/Object.freeze({
  __proto__: null,
  MANAGE_PROJECT: MANAGE_PROJECT,
  MANAGE_PRODUCTS: MANAGE_PRODUCTS,
  VIEW_PRODUCTS: VIEW_PRODUCTS,
  MANAGE_ORDERS: MANAGE_ORDERS,
  VIEW_ORDERS: VIEW_ORDERS,
  MANAGE_MY_ORDERS: MANAGE_MY_ORDERS,
  MANAGE_CUSTOMERS: MANAGE_CUSTOMERS,
  VIEW_CUSTOMERS: VIEW_CUSTOMERS,
  MANAGE_MY_PROFILE: MANAGE_MY_PROFILE,
  MANAGE_TYPES: MANAGE_TYPES,
  VIEW_TYPES: VIEW_TYPES,
  MANAGE_PAYMENTS: MANAGE_PAYMENTS,
  VIEW_PAYMENTS: VIEW_PAYMENTS,
  CREATE_ANONYMOUS_TOKEN: CREATE_ANONYMOUS_TOKEN,
  MANAGE_SUBSCRIPTIONS: MANAGE_SUBSCRIPTIONS
});

exports.createAuthMiddlewareForAnonymousSessionFlow = createAuthMiddlewareForAnonymousSessionFlow;
exports.createAuthMiddlewareForClientCredentialsFlow = createAuthMiddlewareForClientCredentialsFlow;
exports.createAuthMiddlewareForPasswordFlow = createAuthMiddlewareForPasswordFlow;
exports.createAuthMiddlewareForRefreshTokenFlow = createAuthMiddlewareForRefreshTokenFlow;
exports.createAuthMiddlewareWithExistingToken = createAuthMiddlewareWithExistingToken;
exports.scopes = scopes;