@adinsure-ops/ops-cli 5.4.2 → 5.5.0-rc1

package/lib/security/context.d.ts

@@ -1,10 +1,11 @@
-/// <reference types="node" />
-import { ParsedUrlQuery } from 'querystring';
+import { ParsedUrlQuery } from 'node:querystring';
+import HttpClient from '../lib/http.js';
 /**
  * Security context that keeps track of current authentication token.
  * It's not recommended you instantiate this class on your own but rather inherit your commands from [[CommandBase]].
  */
 export default class SecurityContext {
+    private readonly http;
     private readonly clientId;
     private readonly devopsResourceId;
     private readonly managementCoreWindowsNet;
@@ -25,7 +26,7 @@ export default class SecurityContext {
      * Initializes [[SecurityContext]] with config directory where access token JSON will be stored.
      * @param configDir Directory where CLI configuration is stored
      */
-    constructor(configDir: string);
+    constructor(configDir: string, http?: HttpClient);
     /**
      * Get the accessTokenPath, as it is a private variable
      * @returns {string} Returns access token path
@@ -42,10 +43,10 @@ export default class SecurityContext {
      */
     getConfigPath(): string;
     /**
-     * Contacts authority server, fetches and saves the authentication token to be used in subsequent requests.
+     * Generates a PKCE pair and builds the AAD sign-in URL for the interactive browser login.
+     * The PKCE verifier is kept for the following [[acquireToken]] call.
      *
-     * @param code Authorization code used to fetch the token.
-     * @returns [[Promise<TokenResponse>]]
+     * @returns Promise that resolves the authorization URL to open in the browser
      */
     getLoginUrl(): Promise<string>;
     /**
@@ -83,8 +84,9 @@ export default class SecurityContext {
     /**
      * Contacts authority server, fetches and saves the authentication token to be used in subsequent requests.
      *
-     * @param query Authorization query used to fetch the token.
-     * @returns [[Promise<TokenResponse>]]
+     * @param query Query of the AAD redirect: `code` and `client_info`, or `error` and `error_description`.
+     * @throws Error when the redirect carries an error, the PKCE verifier is missing or the code exchange fails
+     * @returns Promise that resolves the signed-in account's display name, username, or '' when neither is known
      */
     acquireToken(query: ParsedUrlQuery): Promise<string>;
     /**

package/lib/security/context.js

@@ -1,11 +1,9 @@
 import { __awaiter } from "tslib";
 import { AuthError, ConfidentialClientApplication, CryptoProvider, InteractionRequiredAuthError, PublicClientApplication, } from '@azure/msal-node';
-import { reject } from 'lodash-es';
-import path from 'path';
-import fs from 'fs';
-import querystring from 'querystring';
+import path from 'node:path';
+import fs from 'node:fs';
 import LocalCachePlugin from './cache.js';
-import axios from 'axios';
+import HttpClient from '../lib/http.js';
 /**
  * Security context that keeps track of current authentication token.
  * It's not recommended you instantiate this class on your own but rather inherit your commands from [[CommandBase]].
@@ -15,7 +13,8 @@ export default class SecurityContext {
      * Initializes [[SecurityContext]] with config directory where access token JSON will be stored.
      * @param configDir Directory where CLI configuration is stored
      */
-    constructor(configDir) {
+    constructor(configDir, http = new HttpClient()) {
+        this.http = http;
         this.clientId = 'bed40d09-53d7-4af8-bf63-3288658b65fb';
         this.devopsResourceId = '499b84ac-1321-427f-aa17-267ca6975798';
         this.managementCoreWindowsNet = 'https://management.core.windows.net//';
@@ -63,38 +62,25 @@ export default class SecurityContext {
         return this._accessConfigPath;
     }
     /**
-     * Contacts authority server, fetches and saves the authentication token to be used in subsequent requests.
+     * Generates a PKCE pair and builds the AAD sign-in URL for the interactive browser login.
+     * The PKCE verifier is kept for the following [[acquireToken]] call.
      *
-     * @param code Authorization code used to fetch the token.
-     * @returns [[Promise<TokenResponse>]]
+     * @returns Promise that resolves the authorization URL to open in the browser
      */
     getLoginUrl() {
-        return new Promise((resolve) => {
+        return __awaiter(this, void 0, void 0, function* () {
             // Generate PKCE Codes before starting the authorization flow
-            this._cryptoProvider
-                .generatePkceCodes()
-                .then(({ verifier, challenge }) => {
-                this._verifier = verifier;
-                this._challenge = challenge;
-                const authCodeUrlParameters = {
-                    scopes: [this.resource + '/.default', 'offline_access'],
-                    redirectUri: this.redirectUri,
-                    codeChallenge: this._challenge,
-                    codeChallengeMethod: 'S256',
-                };
-                // Get url to sign user in and consent to scopes needed for applicatio
-                this._pca
-                    .getAuthCodeUrl(authCodeUrlParameters)
-                    .then((url) => {
-                    resolve(url);
-                })
-                    .catch((error) => {
-                    reject(JSON.stringify(error));
-                });
-            })
-                .catch((error) => {
-                reject(error);
-            });
+            const { verifier, challenge } = yield this._cryptoProvider.generatePkceCodes();
+            this._verifier = verifier;
+            this._challenge = challenge;
+            const authCodeUrlParameters = {
+                scopes: [this.resource + '/.default', 'offline_access'],
+                redirectUri: this.redirectUri,
+                codeChallenge: this._challenge,
+                codeChallengeMethod: 'S256',
+            };
+            // Get url to sign user in and consent to scopes needed for application
+            return this._pca.getAuthCodeUrl(authCodeUrlParameters);
         });
     }
     /**
@@ -155,7 +141,7 @@ export default class SecurityContext {
                                     forceCache: true,
                                 });
                                 if (tokenRespone === null) {
-                                    throw new AuthError('Cannot retrieve user cache and use the refresh token!');
+                                    throw new AuthError('refresh_token_failed', '', 'Cannot retrieve user cache and use the refresh token!');
                                 }
                                 resolve(tokenRespone.accessToken);
                                 //eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -205,9 +191,7 @@ export default class SecurityContext {
                         })
                             .then((response) => {
                             if (response) {
-                                const { accessToken } = response;
-                                console.log(accessToken);
-                                resolve(accessToken);
+                                resolve(response.accessToken);
                             }
                             else {
                                 reject(new Error('Error getting token, please call `ops login`.'));
@@ -219,7 +203,7 @@ export default class SecurityContext {
                     }
                 }
                 else {
-                    throw new Error('You are not authenticated, please call `ops login`.');
+                    reject(new Error('You are not authenticated, please call `ops login`.'));
                 }
             }));
         });
@@ -242,7 +226,7 @@ export default class SecurityContext {
             //eslint-disable-next-line @typescript-eslint/no-explicit-any
         }
         catch (err) {
-            throw new Error(`Failed to retrieve GitLabRu token: ${err.message}`);
+            throw new Error(`Failed to retrieve GitLabRu token: ${err.message}`, { cause: err });
         }
     }
     getAADToken() {
@@ -287,7 +271,7 @@ export default class SecurityContext {
                 // service=<registry>
                 // tenant=<tenantId>
                 // access_token=<aadAccessToken>
-                const postData = querystring.stringify({
+                const postData = new URLSearchParams({
                     grant_type: 'access_token',
                     service: this.registry, // e.g., "adinsure.azurecr.io"
                     tenant: this.tenantId, // e.g., "cdeb9156-219a-49e3-b414-f63acd298e9c"
@@ -296,7 +280,7 @@ export default class SecurityContext {
                 // Define the URL for token exchange:
                 const url = `https://${this.registry}/oauth2/exchange`;
                 // Make the POST request with the appropriate headers.
-                const response = yield axios.post(url, postData, {
+                const response = yield this.http.postForm(url, postData, {
                     headers: {
                         'Content-Type': 'application/x-www-form-urlencoded',
                     },
@@ -311,20 +295,28 @@ export default class SecurityContext {
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
             }
             catch (error) {
-                throw new Error('Failed to retrieve ACR token: ' + error.message);
+                throw new Error('Failed to retrieve ACR token: ' + error.message, { cause: error });
             }
         });
     }
     /**
      * Contacts authority server, fetches and saves the authentication token to be used in subsequent requests.
      *
-     * @param query Authorization query used to fetch the token.
-     * @returns [[Promise<TokenResponse>]]
+     * @param query Query of the AAD redirect: `code` and `client_info`, or `error` and `error_description`.
+     * @throws Error when the redirect carries an error, the PKCE verifier is missing or the code exchange fails
+     * @returns Promise that resolves the signed-in account's display name, username, or '' when neither is known
      */
     acquireToken(query) {
-        return new Promise((resolve) => {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
             if (this._verifier === null) {
-                throw new Error(`PKCE verifier missing.`);
+                throw new Error('PKCE verifier missing.');
+            }
+            if (!query.code) {
+                const reason = (_b = (_a = query.error_description) !== null && _a !== void 0 ? _a : query.error) !== null && _b !== void 0 ? _b : 'Authorization code missing.';
+                // The redirect query is untrusted input; keep terminal control sequences out of the message.
+                // eslint-disable-next-line no-control-regex
+                throw new Error(`Login failed: ${String(reason).replace(/[\u0000-\u001f\u007f-\u009f]/g, '')}`);
             }
             // Add PKCE code verifier to token request object
             const tokenRequest = {
@@ -334,25 +326,18 @@ export default class SecurityContext {
                 codeVerifier: this._verifier,
                 clientInfo: query.client_info,
             };
-            this._pca
-                .acquireTokenByCode(tokenRequest)
-                .then((token) => {
-                var _a;
-                if ((_a = token.account) === null || _a === void 0 ? void 0 : _a.name) {
-                    resolve(token.account.name);
-                }
-            })
-                .catch((error) => {
+            try {
+                const token = yield this._pca.acquireTokenByCode(tokenRequest);
+                return (_f = (_d = (_c = token.account) === null || _c === void 0 ? void 0 : _c.name) !== null && _d !== void 0 ? _d : (_e = token.account) === null || _e === void 0 ? void 0 : _e.username) !== null && _f !== void 0 ? _f : '';
+            }
+            catch (error) {
                 if (error instanceof AuthError) {
-                    const authError = error;
-                    console.log(`Error name:  + ${authError.name}`);
-                    console.log(`Error message:  + ${authError.message}`);
-                    console.log(`Inner error message:  + ${authError.errorMessage}`);
-                    console.log(`Error correlation id:  + ${authError.correlationId}`);
-                    console.error();
+                    // The message itself is reported by the caller; add only what helps trace the request.
+                    console.error(`Error name: ${error.name}`);
+                    console.error(`Error correlation id: ${error.correlationId}`);
                 }
-                throw new Error(error);
-            });
+                throw error;
+            }
         });
     }
     /**