@agentproto/auth 0.2.0 → 1.0.1

package/dist/index.mjs

@@ -4,7 +4,7 @@ import matter from 'gray-matter';
 import { createInterface } from 'readline';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
-import { createDecipheriv, randomBytes, createCipheriv } from 'crypto';
+import { createHash, createDecipheriv, randomBytes, createCipheriv } from 'crypto';
 import { readFile, mkdir, writeFile } from 'fs/promises';
 import { dirname, resolve, join } from 'path';
 import { homedir } from 'os';
@@ -380,6 +380,21 @@ async function writeKeychainToken(service, account, token) {
     "agentproto auth token"
   ]);
 }
+async function deleteKeychainToken(service, account) {
+  assertKeychainSupported();
+  try {
+    await exec("security", [
+      "delete-generic-password",
+      "-s",
+      service,
+      "-a",
+      account
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/store/keychain-store.ts
 var envelopeSchema = z.object({
@@ -415,6 +430,10 @@ var KeychainStore = class {
     };
     await writeKeychainToken(ref.path, account, JSON.stringify(envelope));
   }
+  async delete(ref) {
+    const account = ref.account ?? ref.path;
+    await deleteKeychainToken(ref.path, account);
+  }
 };
 
 // src/store/resolve-ref.ts
@@ -1165,13 +1184,30 @@ var CredentialBroker = class {
   }
 };
 var authMethodSchema = z.enum(["oauth-bearer", "api-key"]);
+var modelCurationSchema = z.object({
+  mode: z.enum(["all", "allow"]),
+  ids: z.array(z.string())
+});
+var costBudgetSchema = z.object({
+  maxCostUsd: z.number(),
+  window: z.string(),
+  scope: z.enum(["session", "profile"])
+});
 var authProfileSchema = z.object({
   id: z.string(),
   vendor: z.string(),
   method: authMethodSchema,
-  credentialRef: z.string(),
-  label: z.string().optional()
-});
+  credentialRef: z.string().optional(),
+  source: z.string().optional(),
+  label: z.string().optional(),
+  // Additive, back-compat fields — an entry that predates them parses
+  // unchanged (both optional), and `endpoint` still shadows the on-disk
+  // `vendor` alias below.
+  disabled: z.boolean().optional(),
+  models: modelCurationSchema.optional(),
+  costBudget: costBudgetSchema.optional(),
+  origin: z.string().optional()
+}).transform(({ vendor, ...profile }) => ({ ...profile, endpoint: vendor }));
 var authProfilesFileSchema = z.object({
   version: z.literal(1),
   profiles: z.record(z.string(), authProfileSchema)
@@ -1193,15 +1229,24 @@ async function loadAuthProfiles() {
 async function writeAuthProfiles(file) {
   const dir = join(homedir(), ".agentproto");
   await mkdir(dir, { recursive: true });
-  await writeFile(authProfilesPath(), JSON.stringify(file, null, 2) + "\n", {
+  const diskFile = {
+    version: file.version,
+    profiles: Object.fromEntries(
+      Object.entries(file.profiles).map(([id, { endpoint, ...profile }]) => [
+        id,
+        { ...profile, vendor: endpoint }
+      ])
+    )
+  };
+  await writeFile(authProfilesPath(), JSON.stringify(diskFile, null, 2) + "\n", {
     encoding: "utf8",
     mode: 384
   });
 }
-async function listAuthProfiles(vendor) {
+async function listAuthProfiles(endpoint) {
   const file = await loadAuthProfiles();
   const all = Object.values(file.profiles);
-  return vendor === void 0 ? all : all.filter((p) => p.vendor === vendor);
+  return endpoint === void 0 ? all : all.filter((p) => p.endpoint === endpoint);
 }
 async function getAuthProfile(id) {
   const file = await loadAuthProfiles();
@@ -1219,30 +1264,248 @@ async function removeAuthProfile(id) {
   await writeAuthProfiles(file);
   return true;
 }
+var AuthProfileValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthProfileValidationError";
+  }
+};
+var AUTH_METHODS = ["oauth-bearer", "api-key"];
+var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function validateCreateInput(input) {
+  const id = (input.id ?? "").trim();
+  if (!id) throw new AuthProfileValidationError("id is required");
+  if (!SLUG_RE.test(id)) {
+    throw new AuthProfileValidationError(
+      `id "${id}" is invalid \u2014 use letters, digits, ".", "_" or "-", starting with a letter or digit`
+    );
+  }
+  const endpoint = (input.endpoint ?? "").trim();
+  if (!endpoint) throw new AuthProfileValidationError("endpoint is required");
+  if (!SLUG_RE.test(endpoint)) {
+    throw new AuthProfileValidationError(
+      `endpoint "${endpoint}" is invalid \u2014 use letters, digits, ".", "_" or "-"`
+    );
+  }
+  const method = input.method;
+  if (!AUTH_METHODS.includes(method)) {
+    throw new AuthProfileValidationError(
+      `method must be one of ${AUTH_METHODS.join(" | ")} (got "${String(method)}")`
+    );
+  }
+  const credential = input.credential !== void 0 ? input.credential.trim() : void 0;
+  const source = input.source?.trim();
+  if (method === "api-key") {
+    if (source) {
+      throw new AuthProfileValidationError(
+        "source is only supported for oauth-bearer profiles \u2014 api-key profiles require a credential"
+      );
+    }
+    if (!credential) throw new AuthProfileValidationError("credential is required");
+  } else {
+    if (credential && source) {
+      throw new AuthProfileValidationError(
+        "give either credential or source, not both \u2014 a source-backed profile stores no secret"
+      );
+    }
+    if (!credential && !source) {
+      throw new AuthProfileValidationError("credential or source is required");
+    }
+  }
+  const label = input.label?.trim();
+  const credentialRef = input.credentialRef?.trim();
+  if (credentialRef !== void 0 && credentialRef !== "" && !SLUG_RE.test(credentialRef)) {
+    throw new AuthProfileValidationError(
+      `credentialRef "${credentialRef}" is invalid \u2014 use letters, digits, ".", "_" or "-"`
+    );
+  }
+  const origin = input.origin?.trim();
+  return {
+    id,
+    endpoint,
+    method,
+    ...credential ? { credential } : {},
+    ...source ? { source } : {},
+    ...label ? { label } : {},
+    ...credentialRef ? { credentialRef } : {},
+    ...origin ? { origin } : {}
+  };
+}
+function deriveCredentialRef(input) {
+  const parts = ["agentproto", "auth", input.endpoint];
+  if (input.method === "oauth-bearer") parts.push("sub");
+  if (input.qualifier) parts.push(input.qualifier);
+  return parts.join(".");
+}
+function fingerprintCredential(secret) {
+  return createHash("sha256").update(secret, "utf8").digest("hex").slice(0, 12);
+}
+var MIN_LEN_FOR_LAST4 = 8;
+function credentialIdentity(secret) {
+  return {
+    fingerprint: fingerprintCredential(secret),
+    ...secret.length >= MIN_LEN_FOR_LAST4 ? { last4: secret.slice(-4) } : {}
+  };
+}
+function credentialKind(method) {
+  return method === "oauth-bearer" ? "oat" : "pat";
+}
+async function createAuthProfile(input, deps) {
+  const v = validateCreateInput(input);
+  if (await deps.getProfile(v.id)) {
+    throw new AuthProfileValidationError(
+      `a profile with id "${v.id}" already exists \u2014 delete it first or pick another id`
+    );
+  }
+  if (v.source !== void 0) {
+    const profile2 = {
+      id: v.id,
+      endpoint: v.endpoint,
+      method: v.method,
+      source: v.source,
+      ...v.label ? { label: v.label } : {},
+      ...v.origin ? { origin: v.origin } : {}
+    };
+    await deps.addProfile(profile2);
+    return {
+      id: profile2.id,
+      endpoint: profile2.endpoint,
+      method: profile2.method,
+      source: v.source,
+      ...profile2.label ? { label: profile2.label } : {},
+      ...profile2.origin ? { origin: profile2.origin } : {}
+    };
+  }
+  const credential = v.credential;
+  const existing = await deps.listProfiles();
+  const takenRefs = new Set(existing.map((p) => p.credentialRef));
+  let credentialRef = v.credentialRef ?? deriveCredentialRef(v);
+  if (!v.credentialRef && takenRefs.has(credentialRef)) {
+    credentialRef = deriveCredentialRef({ ...v, qualifier: v.id });
+  }
+  await deps.store.write(
+    { path: credentialRef },
+    { value: credential, kind: credentialKind(v.method) }
+  );
+  const profile = {
+    id: v.id,
+    endpoint: v.endpoint,
+    method: v.method,
+    credentialRef,
+    ...v.label ? { label: v.label } : {},
+    ...v.origin ? { origin: v.origin } : {}
+  };
+  await deps.addProfile(profile);
+  return {
+    id: profile.id,
+    endpoint: profile.endpoint,
+    method: profile.method,
+    credentialRef,
+    ...profile.label ? { label: profile.label } : {},
+    ...profile.origin ? { origin: profile.origin } : {},
+    fingerprint: fingerprintCredential(credential)
+  };
+}
+async function deleteAuthProfile(id, deps) {
+  const trimmed = (id ?? "").trim();
+  if (!trimmed) throw new AuthProfileValidationError("id is required");
+  const profile = await deps.getProfile(trimmed);
+  if (!profile) return { deleted: false, id: trimmed };
+  await deps.removeProfile(trimmed);
+  if (profile.credentialRef === void 0) {
+    return { deleted: true, id: trimmed };
+  }
+  const stillReferenced = (await deps.listProfiles()).some(
+    (p) => p.credentialRef === profile.credentialRef
+  );
+  if (!stillReferenced && deps.store.delete) {
+    await deps.store.delete({ path: profile.credentialRef });
+  }
+  return { deleted: true, id: trimmed, credentialRef: profile.credentialRef };
+}
+async function setAuthProfileEnabled(id, enabled, deps) {
+  const trimmed = (id ?? "").trim();
+  if (!trimmed) throw new AuthProfileValidationError("id is required");
+  const profile = await deps.getProfile(trimmed);
+  if (!profile) {
+    throw new AuthProfileValidationError(`no profile with id "${trimmed}"`);
+  }
+  const { disabled: _drop, ...rest } = profile;
+  const updated = enabled ? { ...rest } : { ...rest, disabled: true };
+  await deps.addProfile(updated);
+  return updated;
+}
+async function setAuthProfileModels(id, curation, deps) {
+  const trimmed = (id ?? "").trim();
+  if (!trimmed) throw new AuthProfileValidationError("id is required");
+  if (curation.mode !== "all" && curation.mode !== "allow") {
+    throw new AuthProfileValidationError(
+      `models.mode must be "all" or "allow" (got "${String(curation.mode)}")`
+    );
+  }
+  const profile = await deps.getProfile(trimmed);
+  if (!profile) {
+    throw new AuthProfileValidationError(`no profile with id "${trimmed}"`);
+  }
+  const { models: _drop, ...rest } = profile;
+  if (curation.mode === "all") {
+    const updated2 = { ...rest };
+    await deps.addProfile(updated2);
+    return updated2;
+  }
+  const ids = [...new Set((curation.ids ?? []).map((s) => s.trim()).filter(Boolean))];
+  const updated = { ...rest, models: { mode: "allow", ids } };
+  await deps.addProfile(updated);
+  return updated;
+}
+async function refreshAuthProfileModels(id, currentIds, deps) {
+  const trimmed = (id ?? "").trim();
+  if (!trimmed) throw new AuthProfileValidationError("id is required");
+  const profile = await deps.getProfile(trimmed);
+  if (!profile) {
+    throw new AuthProfileValidationError(`no profile with id "${trimmed}"`);
+  }
+  if (!profile.models || profile.models.mode !== "allow") {
+    throw new AuthProfileValidationError(
+      `profile "${trimmed}" has no mode:"allow" curation to refresh \u2014 mode:"all" (or absent models) already tracks the live catalog on every read`
+    );
+  }
+  const nextIds = [...new Set(currentIds.map((s) => s.trim()).filter(Boolean))];
+  const prevIds = profile.models.ids;
+  const prevSet = new Set(prevIds);
+  const nextSet = new Set(nextIds);
+  const added = nextIds.filter((i) => !prevSet.has(i));
+  const removed = prevIds.filter((i) => !nextSet.has(i));
+  const updated = { ...profile, models: { mode: "allow", ids: nextIds } };
+  await deps.addProfile(updated);
+  return { profile: updated, added, removed };
+}
 
 // src/eligibility.ts
 function resolveEndpoint(manifest, route) {
-  const vendor = manifest.vendorByRoute[route];
-  if (vendor === void 0) {
+  const endpoint = manifest.endpointByRoute[route];
+  if (endpoint === void 0) {
     throw new Error(
-      `resolveEndpoint: adapter "${manifest.id}" declares no vendor for route "${route}"`
+      `resolveEndpoint: adapter "${manifest.id}" declares no endpoint for route "${route}"`
     );
   }
-  return { vendor };
+  return { endpoint };
 }
 function methodsPresentable(manifest, route) {
   return [...manifest.methodsByRoute[route] ?? []];
 }
 function eligibleProfiles(profiles, manifest, route) {
-  const { vendor } = resolveEndpoint(manifest, route);
+  const { endpoint } = resolveEndpoint(manifest, route);
   const methods = methodsPresentable(manifest, route);
-  return profiles.filter((p) => p.vendor === vendor && methods.includes(p.method));
+  return profiles.filter(
+    (p) => !p.disabled && p.endpoint === endpoint && methods.includes(p.method)
+  );
 }
 
 // src/index.ts
 var SPEC_NAME = "agentauth";
 var SPEC_VERSION = "v1";
 
-export { BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, defineAuthProvider, discoverEndpoints, eligibleProfiles, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, tokenStoreSpecSchema, writeKeychainToken };
+export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, validateCreateInput, writeKeychainToken };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map