@aderis-erp/cli 1.0.15 → 1.1.0

package/dist/lib/auth/validated-url.js

@@ -0,0 +1,53 @@
+import { URL } from 'node:url';
+/**
+ * Hosts the CLI may talk to. Every outbound URL the auth layer builds — API,
+ * Keycloak discovery and the endpoints discovery returns — goes through
+ * {@link buildValidatedUrl}, so a tampered config file or discovery document
+ * cannot redirect tokens elsewhere.
+ */
+const ALLOWED_HOSTS = new Set([
+    'aderis-erp-nonprod.cloud-iam.com',
+    'aderis-erp-prod.cloud-iam.com',
+    'api-dev.aderis.com',
+    'api-staging.aderis.com',
+    'api-test.aderis.com',
+    'api.aderis.com',
+    'iam-dev.aderis.com',
+    'iam-staging.aderis.com',
+    'iam-test.aderis.com',
+    'iam.aderis.com',
+    'localhost',
+]);
+function hasTraversal(segment) {
+    return segment.includes('/../') || /\/%2e%2e\//i.test(segment);
+}
+/**
+ * Validates `baseUrl` against the host allowlist and optionally appends `path`.
+ * Throws `Error('Invalid URL')` for anything off-list, non-http(s), or
+ * containing path traversal.
+ */
+export function buildValidatedUrl(baseUrl, path) {
+    try {
+        if (hasTraversal(baseUrl)) {
+            throw new Error('Invalid path');
+        }
+        const url = new URL(baseUrl);
+        if (!ALLOWED_HOSTS.has(url.hostname)) {
+            throw new Error(`Invalid host: ${url.hostname}`);
+        }
+        if (!['http:', 'https:'].includes(url.protocol)) {
+            throw new Error('Invalid protocol');
+        }
+        if (path) {
+            if (hasTraversal(path)) {
+                throw new Error('Invalid path');
+            }
+            const cleanPath = path.startsWith('/') ? path : '/' + path;
+            url.pathname = url.pathname.replace(/\/$/, '') + cleanPath;
+        }
+        return url.href;
+    }
+    catch {
+        throw new Error('Invalid URL');
+    }
+}

package/dist/lib/config.d.ts

@@ -1,5 +1,5 @@
 import Conf from 'conf';
-export type Environment = 'dev' | 'live' | 'staging';
+export type Environment = 'dev' | 'live' | 'staging' | 'test';
 /**
  * How a context authenticates against the API.
  *
@@ -12,10 +12,10 @@ export type Environment = 'dev' | 'live' | 'staging';
 export type AuthType = 'api_key' | 'oauth2';
 export interface BaseUrls {
     api: string;
-    auth: string;
 }
 export declare const BASE_URLS: Record<Environment, BaseUrls>;
-export declare const DEFAULT_CLIENT_IDS: Record<Environment, string>;
+/** The Keycloak CLI client: one public client (PKCE S256, loopback redirect) in every realm. */
+export declare const DEFAULT_KEYCLOAK_CLIENT_ID = "aderis-cli-login";
 export interface TokenData {
     access_token: string;
     expires_at?: number;
@@ -34,6 +34,12 @@ export interface Context {
     client_id?: string;
     client_secret?: string;
     environment: Environment;
+    /**
+     * Keycloak origin to use instead of the environment's default host
+     * (`keycloak` contexts only; https, allowlisted, origin without a path). The
+     * realm is still the environment's.
+     */
+    keycloak_base_url?: string;
     name: string;
     tenant_id?: string;
     tokens?: TokenData;
@@ -72,6 +78,10 @@ export declare function hasCredentials(context: Context): boolean;
  * the context's auth type instead of always suggesting `auth login`.
  */
 export declare function missingCredentialsMessage(context: Context): string;
+/** Error message for an expired OAuth session; `aderis switch` matches on it to offer a re-login. */
+export declare const SESSION_EXPIRED_MESSAGE = "Session expired. Please run: aderis auth login";
+/** The error for a 401 on a context that holds a credential. */
+export declare function unauthorizedMessage(context: Context): string;
 /** Redact a key for display: first and last 4 characters only. */
 export declare function maskApiKey(apiKey: string): string;
 export declare function getBaseUrls(environment: Environment): BaseUrls;

package/dist/lib/config.js

@@ -3,26 +3,21 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 export const BASE_URLS = {
-    dev: {
-        api: 'https://api-dev.aderis.com',
-        auth: 'https://auth-dev.aderis.com',
-    },
-    live: {
-        api: 'https://api.aderis.com',
-        auth: 'https://auth.aderis.com',
-    },
-    staging: {
-        api: 'https://api-staging.aderis.com',
-        auth: 'https://auth-staging.aderis.com',
-    },
-};
-// Default OAuth client IDs per environment (public clients, no secret required)
-export const DEFAULT_CLIENT_IDS = {
-    dev: '74fd96f8-cf4b-49d8-b713-2a121ea22910',
-    live: '970d9568-84c9-4613-b966-30d7e1d93828',
-    staging: 'bf0e5dd6-419f-4d64-8951-2c385533651f',
+    dev: { api: 'https://api-dev.aderis.com' },
+    live: { api: 'https://api.aderis.com' },
+    staging: { api: 'https://api-staging.aderis.com' },
+    test: { api: 'https://api-test.aderis.com' },
 };
-const CONFIG_DIR = path.join(os.homedir(), '.aderis');
+/** The Keycloak CLI client: one public client (PKCE S256, loopback redirect) in every realm. */
+export const DEFAULT_KEYCLOAK_CLIENT_ID = 'aderis-cli-login';
+/**
+ * Directory of `config.json`: `ADERIS_CONFIG_DIR`, resolved to an absolute path
+ * so a relative value does not depend on each command's working directory, or
+ * `~/.aderis`.
+ */
+const CONFIG_DIR = process.env.ADERIS_CONFIG_DIR
+    ? path.resolve(process.env.ADERIS_CONFIG_DIR)
+    : path.join(os.homedir(), '.aderis');
 // Ensure config directory exists
 if (!fs.existsSync(CONFIG_DIR)) {
     fs.mkdirSync(CONFIG_DIR, { mode: 0o700, recursive: true });
@@ -160,6 +155,16 @@ export function missingCredentialsMessage(context) {
         ? `No API key set for context "${context.name}". Run: aderis config set-api-key --context ${context.name}`
         : `Not logged in to context "${context.name}". Run: aderis auth login --context ${context.name}`;
 }
+/** Error message for an expired OAuth session; `aderis switch` matches on it to offer a re-login. */
+export const SESSION_EXPIRED_MESSAGE = 'Session expired. Please run: aderis auth login';
+/** The error for a 401 on a context that holds a credential. */
+export function unauthorizedMessage(context) {
+    if (getAuthType(context) === 'api_key') {
+        return `API key for context "${context.name}" was rejected. Check the key with: aderis config set-api-key --context ${context.name}`;
+    }
+    // TODO(infrastructure-stacks#152): return SESSION_EXPIRED_MESSAGE once the API accepts iam-* issuers.
+    return 'Session rejected by the API (issuer or audience mismatch) — see https://github.com/AderisERP/infrastructure-stacks/issues/152, or run: aderis auth login';
+}
 /** Redact a key for display: first and last 4 characters only. */
 export function maskApiKey(apiKey) {
     return apiKey.length <= 8 ? '*'.repeat(apiKey.length) : `${apiKey.slice(0, 4)}${'*'.repeat(8)}${apiKey.slice(-4)}`;