feat: better oauth defaults

__tests__/unit/authenticationManager.test.ts

@@ -1,5 +1,8 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { AuthenticationManager, type AuthenticationOptions } from '../../src/authenticationManager';
+import {
+  AuthenticationManager,
+  type AuthenticationOptions,
+} from '../../src/authenticationManager';
 import * as openidClient from 'openid-client';
 import * as jwtDecodeModule from 'jwt-decode';
 import * as grpc from '@grpc/grpc-js';
@@ -43,7 +46,7 @@ describe('AuthenticationManager', () => {
     );
     expect(openidClient.clientCredentialsGrant).toHaveBeenCalledWith(
       mockDiscovery,
-      { audience: 'crisp-athena-dev', scope: options.scope }
+      { audience: 'crisp-athena-live', scope: options.scope },
     );
   });
 
@@ -67,7 +70,9 @@ describe('AuthenticationManager', () => {
       ...mockToken,
       access_token: 'new_access_token',
     });
-    (jwtDecodeModule.jwtDecode as any).mockReturnValue({ exp: Math.floor(Date.now() / 1000) + 3600 });
+    (jwtDecodeModule.jwtDecode as any).mockReturnValue({
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
 
     const header = await manager.getAuthenticationHeader();
     expect(openidClient.refreshTokenGrant).toHaveBeenCalled();
@@ -82,7 +87,9 @@ describe('AuthenticationManager', () => {
       ...mockToken,
       access_token: 'reacquired_access_token',
     });
-    (jwtDecodeModule.jwtDecode as any).mockReturnValue({ exp: Math.floor(Date.now() / 1000) + 3600 });
+    (jwtDecodeModule.jwtDecode as any).mockReturnValue({
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
 
     const header = await manager.getAuthenticationHeader();
     expect(openidClient.clientCredentialsGrant).toHaveBeenCalled();
@@ -93,12 +100,16 @@ describe('AuthenticationManager', () => {
     await manager.getAuthenticationHeader();
     (manager as any).tokenExpiration = new Date(Date.now() - 1000); // expired
     (manager as any).token.refresh_token = 'mock_refresh_token';
-    (openidClient.refreshTokenGrant as any).mockRejectedValue(new Error('refresh failed'));
+    (openidClient.refreshTokenGrant as any).mockRejectedValue(
+      new Error('refresh failed'),
+    );
     (openidClient.clientCredentialsGrant as any).mockResolvedValue({
       ...mockToken,
       access_token: 'fallback_access_token',
     });
-    (jwtDecodeModule.jwtDecode as any).mockReturnValue({ exp: Math.floor(Date.now() / 1000) + 3600 });
+    (jwtDecodeModule.jwtDecode as any).mockReturnValue({
+      exp: Math.floor(Date.now() / 1000) + 3600,
+    });
 
     const header = await manager.getAuthenticationHeader();
     expect(openidClient.refreshTokenGrant).toHaveBeenCalled();

src/authenticationManager.ts

@@ -21,7 +21,9 @@ export type AuthenticationOptions = {
   /** Whether to automatically refresh the access token. */
   autoRefresh?: boolean;
   /** OAuth scope to request. */
-  scope: 'manage:classify';
+  scope?: string;
+  /** OAuth audience to request. */
+  audience?: 'crisp-athena-live';
 };
 
 /**
@@ -41,6 +43,10 @@ export class AuthenticationManager {
    */
   constructor(options: AuthenticationOptions) {
     this.options = options;
+
+    if (!this.options.issuerUrl) {
+      this.options.issuerUrl = 'https://crispthinking.auth0.com/';
+    }
   }
 
   /**
@@ -112,10 +118,17 @@ export class AuthenticationManager {
     }
 
     if (this.token === undefined) {
-      this.token = await clientCredentialsGrant(this.discovery, {
-        audience: 'crisp-athena-dev',
-        scope: this.options.scope,
-      });
+      if (this.options.scope) {
+        this.token = await clientCredentialsGrant(this.discovery, {
+          audience: 'crisp-athena-live',
+          scope: this.options.scope,
+        });
+      } else {
+        this.token = await clientCredentialsGrant(this.discovery, {
+          audience: 'crisp-athena-live',
+        });
+      }
+
       this.decoded = jwtDecode(this.token.access_token);
 
       // Calculate expiry date of jwt

src/index.ts

@@ -81,8 +81,7 @@ export type ClassifierEvents = {
   open: () => void;
 };
 
-export const defaultGrpcAddress =
-  'csam-classification-messages.crispdev.com:443';
+export const defaultGrpcAddress = 'trust.messages.crispthinking.com:443';
 
 /**
  * SDK for interacting with the Athena classification service via gRPC.