Create src/server.ts

src/server.ts

@@ -0,0 +1,129 @@
+import express, { Request, Response } from "express";
+
+// Environment variables
+const OKTA_AUTH = process.env.OKTA_EVENT_HOOK_AUTH || ""; // e.g., "Bearer my-shared-secret"
+const FORWARD_URL = process.env.FORWARD_URL || "";        // external API endpoint you don't own
+const FORWARD_AUTH = process.env.FORWARD_AUTH || "";      // optional auth for that API
+const PORT = parseInt(process.env.PORT || "7860", 10);    // HF Spaces usually route to 7860
+
+// Minimal types for Okta event payloads
+type OktaTarget = {
+  id?: string;
+  type?: string;          // "User"
+  alternateId?: string;   // usually the user's email
+};
+
+type OktaEvent = {
+  uuid?: string;
+  eventType?: string;     // "user.lifecycle.delete"
+  published?: string;     // ISO timestamp
+  target?: OktaTarget[];
+};
+
+type OktaEventHookBody = {
+  data?: { events?: OktaEvent[] };
+};
+
+// A tiny in-memory LRU-ish idempotency cache (swap for Redis/DB in prod)
+class IdempotencyCache {
+  private maxSize: number;
+  private map = new Map<string, true>();
+  constructor(maxSize = 2000) { this.maxSize = maxSize; }
+  has(uuid: string) { return this.map.has(uuid); }
+  add(uuid: string) {
+    this.map.set(uuid, true);
+    if (this.map.size > this.maxSize) {
+      const firstKey = this.map.keys().next().value;
+      this.map.delete(firstKey);
+    }
+  }
+}
+const IDEMPOTENCY = new IdempotencyCache(2000);
+
+const app = express();
+app.disable("x-powered-by");
+app.use(express.json({ limit: "256kb" }));
+
+/**
+ * 1) One-time verification (Okta sends GET with x-okta-verification-challenge header)
+ */
+app.get("/okta/events", (req: Request, res: Response) => {
+  const challenge = req.header("x-okta-verification-challenge");
+  if (!challenge) return res.status(400).send("Missing challenge");
+  return res.json({ verification: challenge });
+});
+
+/**
+ * 2) Event deliveries (POST). Respond fast (204); process in the background.
+ */
+app.post("/okta/events", async (req: Request, res: Response) => {
+  if (OKTA_AUTH) {
+    const auth = req.header("authorization") || "";
+    if (auth !== OKTA_AUTH) {
+      return res.status(401).send("Unauthorized");
+    }
+  }
+
+  const body = (req.body || {}) as OktaEventHookBody;
+  const events = body.data?.events ?? [];
+
+  // Acknowledge immediately so Okta doesn't retry for slowness
+  res.status(204).end();
+
+  // Continue work asynchronously
+  setImmediate(() => processEvents(events).catch(console.error));
+});
+
+async function processEvents(events: OktaEvent[]) {
+  for (const evt of events) {
+    const uuid = evt.uuid;
+    if (!uuid) continue;
+    if (IDEMPOTENCY.has(uuid)) continue;
+    IDEMPOTENCY.add(uuid);
+
+    if (evt.eventType !== "user.lifecycle.delete") continue;
+
+    const user = (evt.target || []).find(t => t.type === "User");
+    const email = user?.alternateId;
+    if (!email) continue;
+
+    // Construct the payload expected by the external API (adjust as needed)
+    const payload = {
+      email,
+      eventTime: evt.published,
+      oktaUserId: user?.id,
+      eventId: uuid,
+    };
+
+    if (!FORWARD_URL) {
+      console.warn("FORWARD_URL not set; skipping forward:", payload);
+      continue;
+    }
+
+    try {
+      const headers: Record<string, string> = { "content-type": "application/json" };
+      if (FORWARD_AUTH) headers["authorization"] = FORWARD_AUTH;
+
+      const resp = await fetch(FORWARD_URL, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload),
+      });
+
+      if (!resp.ok) {
+        console.error(`Forward failed: ${resp.status} ${resp.statusText}`);
+      }
+    } catch (err) {
+      console.error("Forward failed:", err);
+      // In production, enqueue for retry (e.g., SQS/Queue) rather than dropping it.
+    }
+  }
+}
+
+app.get("/", (_req, res) => {
+  res.type("text/plain").send("Okta Event Hook TS relay is running.");
+});
+
+app.listen(PORT, () => {
+  console.log(`Listening on http://0.0.0.0:${PORT}`);
+});