fastlane-security-patched 2.216.0

data/spaceship/lib/spaceship/commands_generator.rb

@@ -0,0 +1,55 @@
+require 'highline'
+
+HighLine.track_eof = false
+
+require 'fastlane/version'
+require 'fastlane_core/ui/help_formatter'
+require_relative 'playground'
+require_relative 'spaceauth_runner'
+
+module Spaceship
+  class CommandsGenerator
+    include Commander::Methods
+
+    def self.start
+      self.new.run
+    end
+
+    def run
+      program :name, 'spaceship'
+      program :version, Fastlane::VERSION
+      program :description, Spaceship::DESCRIPTION
+      program :help, 'Author', 'Felix Krause <spaceship@krausefx.com>'
+      program :help, 'Website', 'https://fastlane.tools'
+      program :help, 'GitHub', 'https://github.com/fastlane/fastlane/tree/master/spaceship'
+      program :help_formatter, FastlaneCore::HelpFormatter
+
+      global_option('-u', '--user USERNAME', 'Specify the Apple ID you want to log in with')
+      global_option('--verbose') { FastlaneCore::Globals.verbose = true }
+      global_option('--env STRING[,STRING2]', String, 'Add environment(s) to use with `dotenv`')
+
+      command :playground do |c|
+        c.syntax = 'fastlane spaceship playground'
+        c.description = 'Run an interactive shell that connects you to Apple web services'
+
+        c.action do |args, options|
+          Spaceship::Playground.new(username: options.user).run
+        end
+      end
+
+      command :spaceauth do |c|
+        c.syntax = 'fastlane spaceship spaceauth'
+        c.description = 'Authentication helper for spaceship/fastlane to work with Apple 2-Step/2FA'
+        c.option('--copy_to_clipboard', 'Whether the session string should be copied to clipboard. For more info see https://docs.fastlane.tools/best-practices/continuous-integration/#storing-a-manually-verified-session-using-spaceauth`')
+        c.option('--check_session', 'Check to see if there is a valid session (either in the cache or via FASTLANE_SESSION). Sets the exit code to 0 if the session is valid or 1 if not.') { Spaceship::Globals.check_session = true }
+        c.action do |args, options|
+          Spaceship::SpaceauthRunner.new(username: options.user, copy_to_clipboard: options.copy_to_clipboard).run
+        end
+      end
+
+      default_command(:playground)
+
+      run!
+    end
+  end
+end

data/spaceship/lib/spaceship/connect_api/api_client.rb

@@ -0,0 +1,375 @@
+
+require_relative '../client'
+require_relative './response'
+require_relative '../client'
+require_relative './response'
+require_relative './token_refresh_middleware'
+
+require_relative '../stats_middleware'
+
+module Spaceship
+  class ConnectAPI
+    class APIClient < Spaceship::Client
+      attr_accessor :token
+
+      #####################################################
+      # @!group Client Init
+      #####################################################
+
+      # Instantiates a client with cookie session or a JWT token.
+      def initialize(cookie: nil, current_team_id: nil, token: nil, csrf_tokens: nil, another_client: nil)
+        params_count = [cookie, token, another_client].compact.size
+        if params_count != 1
+          raise "Must initialize with one of :cookie, :token, or :another_client"
+        end
+
+        if token.nil?
+          if another_client.nil?
+            super(cookie: cookie, current_team_id: current_team_id, csrf_tokens: csrf_tokens, timeout: 1200)
+            return
+          end
+          super(cookie: another_client.instance_variable_get(:@cookie), current_team_id: another_client.team_id, csrf_tokens: another_client.csrf_tokens)
+        else
+          options = {
+            request: {
+              timeout:       (ENV["SPACESHIP_TIMEOUT"] || 300).to_i,
+              open_timeout:  (ENV["SPACESHIP_TIMEOUT"] || 300).to_i
+            }
+          }
+          @token = token
+          @current_team_id = current_team_id
+
+          @client = Faraday.new(hostname, options) do |c|
+            c.response(:json, content_type: /\bjson$/)
+            c.response(:plist, content_type: /\bplist$/)
+            c.use(FaradayMiddleware::RelsMiddleware)
+            c.use(Spaceship::StatsMiddleware)
+            c.use(Spaceship::TokenRefreshMiddleware, token)
+            c.adapter(Faraday.default_adapter)
+
+            if ENV['SPACESHIP_DEBUG']
+              # for debugging only
+              # This enables tracking of networking requests using Charles Web Proxy
+              c.proxy = "https://127.0.0.1:8888"
+              c.ssl[:verify_mode] = OpenSSL::SSL::VERIFY_NONE
+            elsif ENV["SPACESHIP_PROXY"]
+              c.proxy = ENV["SPACESHIP_PROXY"]
+              c.ssl[:verify_mode] = OpenSSL::SSL::VERIFY_NONE if ENV["SPACESHIP_PROXY_SSL_VERIFY_NONE"]
+            end
+
+            if ENV["DEBUG"]
+              puts("To run spaceship through a local proxy, use SPACESHIP_DEBUG")
+            end
+          end
+        end
+      end
+
+      # Instance level hostname only used when creating
+      # App Store Connect API Farady client.
+      # Forwarding to class level if using web session.
+      def hostname
+        if @token
+          return "https://api.appstoreconnect.apple.com/v1/"
+        end
+        return self.class.hostname
+      end
+
+      def self.hostname
+        # Implemented in subclass
+        not_implemented(__method__)
+      end
+
+      #
+      # Helpers
+      #
+
+      def web_session?
+        return @token.nil?
+      end
+
+      def build_params(filter: nil, includes: nil, fields: nil, limit: nil, sort: nil, cursor: nil)
+        params = {}
+
+        filter = filter.delete_if { |k, v| v.nil? } if filter
+
+        params[:filter] = filter if filter && !filter.empty?
+        params[:include] = includes if includes
+        params[:fields] = fields if fields
+        params[:limit] = limit if limit
+        params[:sort] = sort if sort
+        params[:cursor] = cursor if cursor
+
+        return params
+      end
+
+      def get(url_or_path, params = nil)
+        response = with_asc_retry do
+          request(:get) do |req|
+            req.url(url_or_path)
+            req.options.params_encoder = Faraday::NestedParamsEncoder
+            req.params = params if params
+            req.headers['Content-Type'] = 'application/json'
+          end
+        end
+        handle_response(response)
+      end
+
+      def post(url_or_path, body, tries: 5)
+        response = with_asc_retry(tries) do
+          request(:post) do |req|
+            req.url(url_or_path)
+            req.body = body.to_json
+            req.headers['Content-Type'] = 'application/json'
+          end
+        end
+        handle_response(response)
+      end
+
+      def patch(url_or_path, body)
+        response = with_asc_retry do
+          request(:patch) do |req|
+            req.url(url_or_path)
+            req.body = body.to_json
+            req.headers['Content-Type'] = 'application/json'
+          end
+        end
+        handle_response(response)
+      end
+
+      def delete(url_or_path, params = nil, body = nil)
+        response = with_asc_retry do
+          request(:delete) do |req|
+            req.url(url_or_path)
+            req.options.params_encoder = Faraday::NestedParamsEncoder if params
+            req.params = params if params
+            req.body = body.to_json if body
+            req.headers['Content-Type'] = 'application/json' if body
+          end
+        end
+        handle_response(response)
+      end
+
+      protected
+
+      class TimeoutRetryError < StandardError
+        def initialize(msg)
+          super
+        end
+      end
+
+      class TooManyRequestsError < StandardError
+        def initialize(msg)
+          super
+        end
+      end
+
+      def with_asc_retry(tries = 5, backoff = 1, &_block)
+        response = yield
+
+        status = response.status if response
+
+        if [500, 504].include?(status)
+          msg = "Timeout received! Retrying after 3 seconds (remaining: #{tries})..."
+          raise TimeoutRetryError, msg
+        end
+
+        if status == 429
+          raise TooManyRequestsError, "Too many requests, backing off #{backoff} seconds"
+        end
+
+        return response
+      rescue UnauthorizedAccessError => error
+        tries -= 1
+        puts(error) if Spaceship::Globals.verbose?
+        if tries.zero?
+          raise error
+        else
+          msg = "Token has expired or has been revoked! Trying to refresh..."
+          puts(msg) if Spaceship::Globals.verbose?
+          @token.refresh!
+          retry
+        end
+      rescue TimeoutRetryError => error
+        tries -= 1
+        puts(error) if Spaceship::Globals.verbose?
+        if tries.zero?
+          return response
+        else
+          retry
+        end
+      rescue TooManyRequestsError => error
+        if backoff > 3600
+          raise TooManyRequestsError, "Too many requests, giving up after backing off for > 3600 seconds."
+        end
+        puts(error) if Spaceship::Globals.verbose?
+        Kernel.sleep(backoff)
+        backoff *= 2
+        retry
+      end
+
+      def handle_response(response)
+        if (200...300).cover?(response.status) && (response.body.nil? || response.body.empty?)
+          return
+        end
+
+        raise InternalServerError, "Server error got #{response.status}" if (500...600).cover?(response.status)
+
+        unless response.body.kind_of?(Hash)
+          raise UnexpectedResponse, response.body
+        end
+
+        raise UnexpectedResponse, response.body['error'] if response.body['error']
+
+        raise UnexpectedResponse, format_errors(response) if response.body['errors']
+
+        raise UnexpectedResponse, "Temporary App Store Connect error: #{response.body}" if response.body['statusCode'] == 'ERROR'
+
+        store_csrf_tokens(response)
+
+        return Spaceship::ConnectAPI::Response.new(body: response.body, status: response.status, headers: response.headers, client: self)
+      end
+
+      # Overridden from Spaceship::Client
+      def handle_error(response)
+        body = response.body.empty? ? {} : response.body
+
+        # Setting body nil if invalid JSON which can happen if 502
+        begin
+          body = JSON.parse(body) if body.kind_of?(String)
+        rescue
+          nil
+        end
+
+        case response.status.to_i
+        when 401
+          raise UnauthorizedAccessError, format_errors(response)
+        when 403
+          error = (body['errors'] || []).first || {}
+          error_code = error['code']
+          if error_code == "FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED"
+            raise ProgramLicenseAgreementUpdated, format_errors(response)
+          else
+            raise AccessForbiddenError, format_errors(response)
+          end
+        when 502
+          # Issue - https://github.com/fastlane/fastlane/issues/19264
+          # This 502 with "Could not process this request" body sometimes
+          # work and sometimes doesn't
+          # Usually retrying once or twice will solve the issue
+          if body && body.include?("Could not process this request")
+            raise BadGatewayError, "Could not process this request"
+          end
+        end
+      end
+
+      def format_errors(response)
+        # Example error format
+        # {
+        # "errors":[
+        #     {
+        #       "id":"cbfd8674-4802-4857-bfe8-444e1ea36e32",
+        #       "status":"409",
+        #       "code":"STATE_ERROR",
+        #       "title":"The request cannot be fulfilled because of the state of another resource.",
+        #       "detail":"Submit for review errors found.",
+        #       "meta":{
+        #           "associatedErrors":{
+        #             "/v1/appScreenshots/":[
+        #                 {
+        #                   "id":"23d1734f-b81f-411a-98e4-6d3e763d54ed",
+        #                   "status":"409",
+        #                   "code":"STATE_ERROR.SCREENSHOT_REQUIRED.APP_WATCH_SERIES_4",
+        #                   "title":"App screenshot missing (APP_WATCH_SERIES_4)."
+        #                 },
+        #                 {
+        #                   "id":"db993030-0a93-48e9-9fd7-7e5676633431",
+        #                   "status":"409",
+        #                   "code":"STATE_ERROR.SCREENSHOT_REQUIRED.APP_WATCH_SERIES_4",
+        #                   "title":"App screenshot missing (APP_WATCH_SERIES_4)."
+        #                 }
+        #             ],
+        #             "/v1/builds/d710b6fa-5235-4fe4-b791-2b80d6818db0":[
+        #                 {
+        #                   "id":"e421fe6f-0e3b-464b-89dc-ba437e7bb77d",
+        #                   "status":"409",
+        #                   "code":"ENTITY_ERROR.ATTRIBUTE.REQUIRED",
+        #                   "title":"The provided entity is missing a required attribute",
+        #                   "detail":"You must provide a value for the attribute 'usesNonExemptEncryption' with this request",
+        #                   "source":{
+        #                       "pointer":"/data/attributes/usesNonExemptEncryption"
+        #                   }
+        #                 }
+        #             ]
+        #           }
+        #       }
+        #     }
+        # ]
+        # }
+
+        # Detail is missing in this response making debugging super hard
+        # {"errors" =>
+        #   [
+        #     {
+        #       "id"=>"80ea6cff-0043-4543-9cd1-3e26b0fce383",
+        #       "status"=>"409",
+        #       "code"=>"ENTITY_ERROR.RELATIONSHIP.INVALID",
+        #       "title"=>"The provided entity includes a relationship with an invalid value",
+        #       "source"=>{
+        #         "pointer"=>"/data/relationships/primarySubcategoryOne"
+        #       }
+        #     }
+        #   ]
+        # }
+
+        # Membership expired
+        # {
+        #   "errors" : [
+        #     {
+        #       "id" : "UUID",
+        #       "status" : "403",
+        #       "code" : "FORBIDDEN_ERROR",
+        #       "title" : "This request is forbidden for security reasons",
+        #       "detail" : "Team ID: 'ID' is not associated with an active membership. To check your teams membership status, sign in your account on the developer website. https://developer.apple.com/account/"
+        #     }
+        #   ]
+        # }
+
+        body = response.body.empty? ? {} : response.body
+        body = JSON.parse(body) if body.kind_of?(String)
+
+        formatted_errors = (body['errors'] || []).map do |error|
+          messages = [[error['title'], error['detail'], error.dig("source", "pointer")].compact.join(" - ")]
+
+          meta = error["meta"] || {}
+          associated_errors = meta["associatedErrors"] || {}
+
+          messages + associated_errors.values.flatten.map do |associated_error|
+            [[associated_error["title"], associated_error["detail"]].compact.join(" - ")]
+          end
+        end.flatten.join("\n")
+
+        if formatted_errors.empty?
+          formatted_errors << "Unknown error"
+        end
+
+        return formatted_errors
+      end
+
+      private
+
+      def local_variable_get(binding, name)
+        if binding.respond_to?(:local_variable_get)
+          binding.local_variable_get(name)
+        else
+          binding.eval(name.to_s)
+        end
+      end
+
+      def provider_id
+        return team_id if self.provider.nil?
+        self.provider.provider_id
+      end
+    end
+  end
+  # rubocop:enable Metrics/ClassLength
+end

data/spaceship/lib/spaceship/connect_api/client.rb

@@ -0,0 +1,216 @@
+require_relative './token'
+require_relative './provisioning/provisioning'
+require_relative './testflight/testflight'
+require_relative './tunes/tunes'
+require_relative './users/users'
+
+module Spaceship
+  class ConnectAPI
+    class Client
+      attr_accessor :token
+      attr_accessor :tunes_client
+      attr_accessor :portal_client
+
+      # Initializes client with Apple's App Store Connect JWT auth key.
+      #
+      # This method will automatically use the arguments from environment
+      # variables if not given.
+      #
+      # The key_id, issuer_id and either filepath or key are needed to authenticate.
+      #
+      # @param key_id (String) (optional): The key id
+      # @param issuer_id (String) (optional): The issuer id
+      # @param filepath (String) (optional): The filepath
+      # @param key (String) (optional): The key
+      # @param duration (Integer) (optional): How long this session should last
+      # @param in_house (Boolean) (optional): Whether this session is an Enterprise one
+      #
+      # @raise InvalidUserCredentialsError: raised if authentication failed
+      #
+      # @return (Spaceship::ConnectAPI::Client) The client the login method was called for
+      def self.auth(key_id: nil, issuer_id: nil, filepath: nil, key: nil, duration: nil, in_house: nil)
+        token = Spaceship::ConnectAPI::Token.create(key_id: key_id, issuer_id: issuer_id, filepath: filepath, key: key, duration: duration, in_house: in_house)
+        return ConnectAPI::Client.new(token: token)
+      end
+
+      # Authenticates with Apple's web services. This method has to be called once
+      # to generate a valid session.
+      #
+      # This method will automatically use the username from the Appfile (if available)
+      # and fetch the password from the Keychain (if available)
+      #
+      # @param user (String) (optional): The username (usually the email address)
+      # @param password (String) (optional): The password
+      # @param use_portal (Boolean) (optional): Whether to log in to Spaceship::Portal or not
+      # @param use_tunes (Boolean) (optional): Whether to log in to Spaceship::Tunes or not
+      # @param portal_team_id (String) (optional): The Spaceship::Portal team id
+      # @param tunes_team_id (String) (optional): The Spaceship::Tunes team id
+      # @param team_name (String) (optional): The team name
+      # @param skip_select_team (Boolean) (optional): Whether to skip automatic selection or prompt for team
+      #
+      # @raise InvalidUserCredentialsError: raised if authentication failed
+      #
+      # @return (Spaceship::ConnectAPI::Client) The client the login method was called for
+      def self.login(user = nil, password = nil, use_portal: true, use_tunes: true, portal_team_id: nil, tunes_team_id: nil, team_name: nil, skip_select_team: false)
+        portal_client = Spaceship::Portal.login(user, password) if use_portal
+        tunes_client = Spaceship::Tunes.login(user, password) if use_tunes
+
+        unless skip_select_team
+          # Check if environment variables are set for Spaceship::Portal or Spaceship::Tunes to select team
+          portal_team_id ||= ENV['FASTLANE_TEAM_ID']
+          portal_team_name = team_name || ENV['FASTLANE_TEAM_NAME']
+          tunes_team_id ||= ENV['FASTLANE_ITC_TEAM_ID']
+          tunes_team_name = team_name || ENV['FASTLANE_ITC_TEAM_NAME']
+
+          # The clients will prompt for a team selection if:
+          # 1. client exists
+          # 2. team_id and team_name are nil and user belongs to multiple teams
+          portal_client.select_team(team_id: portal_team_id, team_name: portal_team_name) if portal_client
+          tunes_client.select_team(team_id: tunes_team_id, team_name: tunes_team_name) if tunes_client
+        end
+
+        return ConnectAPI::Client.new(tunes_client: tunes_client, portal_client: portal_client)
+      end
+
+      def initialize(cookie: nil, current_team_id: nil, token: nil, tunes_client: nil, portal_client: nil)
+        @token = token
+
+        # If using web session...
+        # Spaceship::Tunes is needed for TestFlight::API, Tunes::API, and Users::API
+        # Spaceship::Portal is needed for Provisioning::API
+        @tunes_client = tunes_client
+        @portal_client = portal_client
+
+        # Extending this instance to add API endpoints from these modules
+        # Each of these modules adds a new setter method for an instance
+        # of an ConnectAPI::APIClient
+        # These get set in set_indvidual_clients
+        self.extend(Spaceship::ConnectAPI::TestFlight::API)
+        self.extend(Spaceship::ConnectAPI::Tunes::API)
+        self.extend(Spaceship::ConnectAPI::Provisioning::API)
+        self.extend(Spaceship::ConnectAPI::Users::API)
+
+        set_indvidual_clients(
+          cookie: cookie,
+          current_team_id: current_team_id,
+          token: token,
+          tunes_client: @tunes_client,
+          portal_client: @portal_client
+        )
+      end
+
+      def portal_team_id
+        if token
+          message = [
+            "Cannot determine portal team id via the App Store Connect API (yet)",
+            "Look to see if you can get the portal team id from somewhere else",
+            "View more info in the docs at https://docs.fastlane.tools/app-store-connect-api/"
+          ]
+          raise message.join('. ')
+        elsif @portal_client
+          return @portal_client.team_id
+        else
+          raise "No App Store Connect API token or Portal Client set"
+        end
+      end
+
+      def tunes_team_id
+        return nil if @tunes_client.nil?
+        return @tunes_client.team_id
+      end
+
+      def portal_teams
+        return nil if @portal_client.nil?
+        return @portal_client.teams
+      end
+
+      def tunes_teams
+        return nil if @tunes_client.nil?
+        return @tunes_client.teams
+      end
+
+      def in_house?
+        if token
+          if token.in_house.nil?
+            message = [
+              "Cannot determine if team is App Store or Enterprise via the App Store Connect API (yet)",
+              "Set 'in_house' on your Spaceship::ConnectAPI::Token",
+              "Or set 'in_house' in your App Store Connect API key JSON file",
+              "Or set the 'SPACESHIP_CONNECT_API_IN_HOUSE' environment variable to 'true'",
+              "View more info in the docs at https://docs.fastlane.tools/app-store-connect-api/"
+            ]
+            raise message.join('. ')
+          end
+          return !!token.in_house
+        elsif @portal_client
+          return @portal_client.in_house?
+        else
+          raise "No App Store Connect API token or Portal Client set"
+        end
+      end
+
+      def select_team(portal_team_id: nil, tunes_team_id: nil, team_name: nil)
+        @portal_client.select_team(team_id: portal_team_id, team_name: team_name) unless @portal_client.nil?
+        @tunes_client.select_team(team_id: tunes_team_id, team_name: team_name) unless @tunes_client.nil?
+
+        # Updating the tunes and portal clients requires resetting
+        # of the clients in the API modules
+        set_indvidual_clients(
+          cookie: nil,
+          current_team_id: nil,
+          token: nil,
+          tunes_client: tunes_client,
+          portal_client: portal_client
+        )
+      end
+
+      private
+
+      def set_indvidual_clients(cookie: nil, current_team_id: nil, token: nil, tunes_client: nil, portal_client: nil)
+        # This was added by Spaceship::ConnectAPI::TestFlight::API and is required
+        # to be set for API methods to have a client to send request on
+        if cookie || token || tunes_client
+          self.test_flight_request_client = Spaceship::ConnectAPI::TestFlight::Client.new(
+            cookie: cookie,
+            current_team_id: current_team_id,
+            token: token,
+            another_client: tunes_client
+          )
+        end
+
+        # This was added by Spaceship::ConnectAPI::Tunes::API and is required
+        # to be set for API methods to have a client to send request on
+        if cookie || token || tunes_client
+          self.tunes_request_client = Spaceship::ConnectAPI::Tunes::Client.new(
+            cookie: cookie,
+            current_team_id: current_team_id,
+            token: token,
+            another_client: tunes_client
+          )
+        end
+
+        # This was added by Spaceship::ConnectAPI::Provisioning::API and is required
+        # to be set for API methods to have a client to send request on
+        if cookie || token || portal_client
+          self.provisioning_request_client = Spaceship::ConnectAPI::Provisioning::Client.new(
+            cookie: cookie,
+            current_team_id: current_team_id,
+            token: token,
+            another_client: portal_client
+          )
+        end
+
+        # This was added by Spaceship::ConnectAPI::Users::API and is required
+        # to be set for API methods to have a client to send request on
+        if cookie || token || tunes_client
+          self.users_request_client = Spaceship::ConnectAPI::Users::Client.new(
+            cookie: cookie,
+            current_team_id: current_team_id,
+            token: token,
+            another_client: tunes_client
+          )
+        end
+      end
+    end
+  end
+end