the_order/packages/auth/src/azure-logic-apps.ts

/**
 * Azure Logic Apps connector
 * Provides integration with Azure Logic Apps for workflow orchestration
 */

import fetch from 'node-fetch';

export interface LogicAppsConfig {
  workflowUrl: string;
  accessKey?: string;
  managedIdentityClientId?: string;
}

export interface LogicAppsTriggerRequest {
  triggerName?: string;
  body?: Record<string, unknown>;
  headers?: Record<string, string>;
}

export interface LogicAppsResponse {
  statusCode: number;
  body?: unknown;
  headers?: Record<string, string>;
}

/**
 * Azure Logic Apps client
 */
export class AzureLogicAppsClient {
  constructor(private config: LogicAppsConfig) {}

  /**
   * Trigger a Logic App workflow
   */
  async triggerWorkflow(
    request: LogicAppsTriggerRequest
  ): Promise<LogicAppsResponse> {
    const url = this.config.accessKey
      ? `${this.config.workflowUrl}?api-version=2016-10-01&sp=/triggers/${request.triggerName || 'manual'}/run&sv=1.0&sig=${this.config.accessKey}`
      : `${this.config.workflowUrl}/triggers/${request.triggerName || 'manual'}/run?api-version=2016-10-01`;

    const headers: Record<string, string> = {
      'Content-Type': 'application/json',
      ...request.headers,
    };

    // If using managed identity, add Authorization header
    if (this.config.managedIdentityClientId && !this.config.accessKey) {
      // In production, get token from Azure Managed Identity endpoint
      // This is a placeholder - actual implementation would use @azure/identity
      headers['Authorization'] = `Bearer ${await this.getManagedIdentityToken()}`;
    }

    const response = await fetch(url, {
      method: 'POST',
      headers,
      body: request.body ? JSON.stringify(request.body) : undefined,
    });

    if (!response.ok) {
      const errorText = await response.text();
      throw new Error(`Failed to trigger Logic App: ${response.status} ${errorText}`);
    }

    const responseBody = await response.json().catch(() => ({}));

    return {
      statusCode: response.status,
      body: responseBody,
      headers: Object.fromEntries(response.headers.entries()),
    };
  }

  /**
   * Get managed identity token using @azure/identity
   */
  private async getManagedIdentityToken(): Promise<string> {
    try {
      // Dynamic import to avoid requiring @azure/identity if not using managed identity
      const { DefaultAzureCredential } = await import('@azure/identity');
      const credential = new DefaultAzureCredential({
        managedIdentityClientId: this.config.managedIdentityClientId,
      });
      const token = await credential.getToken('https://logic.azure.com/.default');
      return token.token;
    } catch (error) {
      throw new Error(
        `Failed to get managed identity token: ${error instanceof Error ? error.message : String(error)}`
      );
    }
  }

  /**
   * Trigger workflow for eIDAS verification
   */
  async triggerEIDASVerification(
    documentId: string,
    userId: string,
    eidasProviderUrl: string
  ): Promise<LogicAppsResponse> {
    return this.triggerWorkflow({
      triggerName: 'eidas-verification',
      body: {
        documentId,
        userId,
        eidasProviderUrl,
        timestamp: new Date().toISOString(),
      },
    });
  }

  /**
   * Trigger workflow for VC issuance via Entra VerifiedID
   */
  async triggerVCIssuance(
    userId: string,
    credentialType: string,
    claims: Record<string, string>
  ): Promise<LogicAppsResponse> {
    return this.triggerWorkflow({
      triggerName: 'vc-issuance',
      body: {
        userId,
        credentialType,
        claims,
        timestamp: new Date().toISOString(),
      },
    });
  }

  /**
   * Trigger workflow for document processing
   */
  async triggerDocumentProcessing(
    documentId: string,
    documentUrl: string,
    documentType: string
  ): Promise<LogicAppsResponse> {
    return this.triggerWorkflow({
      triggerName: 'document-processing',
      body: {
        documentId,
        documentUrl,
        documentType,
        timestamp: new Date().toISOString(),
      },
    });
  }
}