@agentteams/cli 0.1.84 → 0.1.85
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.eslintcache +1 -1
- package/dist/api/plan.d.ts +2 -0
- package/dist/api/plan.d.ts.map +1 -1
- package/dist/api/plan.js.map +1 -1
- package/dist/auth/credentialStore.d.ts +30 -1
- package/dist/auth/credentialStore.d.ts.map +1 -1
- package/dist/auth/credentialStore.js +110 -24
- package/dist/auth/credentialStore.js.map +1 -1
- package/dist/auth/personalTokenClient.d.ts +34 -0
- package/dist/auth/personalTokenClient.d.ts.map +1 -1
- package/dist/auth/personalTokenClient.js +73 -6
- package/dist/auth/personalTokenClient.js.map +1 -1
- package/dist/auth/personalTokenStore.d.ts +3 -2
- package/dist/auth/personalTokenStore.d.ts.map +1 -1
- package/dist/auth/personalTokenStore.js +1 -1
- package/dist/auth/personalTokenStore.js.map +1 -1
- package/dist/auth/refreshLock.d.ts +74 -0
- package/dist/auth/refreshLock.d.ts.map +1 -0
- package/dist/auth/refreshLock.js +225 -0
- package/dist/auth/refreshLock.js.map +1 -0
- package/dist/commands/attachment.d.ts.map +1 -1
- package/dist/commands/attachment.js +10 -2
- package/dist/commands/attachment.js.map +1 -1
- package/dist/commands/plan.d.ts +15 -0
- package/dist/commands/plan.d.ts.map +1 -1
- package/dist/commands/plan.js +28 -0
- package/dist/commands/plan.js.map +1 -1
- package/dist/index.js +7 -3
- package/dist/index.js.map +1 -1
- package/dist/utils/authFormat.d.ts +18 -0
- package/dist/utils/authFormat.d.ts.map +1 -0
- package/dist/utils/authFormat.js +130 -0
- package/dist/utils/authFormat.js.map +1 -0
- package/dist/utils/config.d.ts +10 -1
- package/dist/utils/config.d.ts.map +1 -1
- package/dist/utils/config.js +23 -4
- package/dist/utils/config.js.map +1 -1
- package/package.json +1 -1
package/dist/api/plan.d.ts
CHANGED
|
@@ -22,6 +22,7 @@ export declare function quickPlan(apiUrl: string, projectId: string, headers: an
|
|
|
22
22
|
complexity: string;
|
|
23
23
|
priority: string;
|
|
24
24
|
repositoryRemoteUrl?: string;
|
|
25
|
+
assignedTo?: string;
|
|
25
26
|
startCommit?: string;
|
|
26
27
|
startBranch?: string;
|
|
27
28
|
runnerType: string;
|
|
@@ -49,6 +50,7 @@ export declare function quickPlan(apiUrl: string, projectId: string, headers: an
|
|
|
49
50
|
export declare function updatePlan(apiUrl: string, projectId: string, headers: any, id: string, body: Record<string, unknown>): Promise<any>;
|
|
50
51
|
export declare function startPlanLifecycle(apiUrl: string, projectId: string, headers: any, id: string, body: {
|
|
51
52
|
task?: string;
|
|
53
|
+
assignedTo?: string;
|
|
52
54
|
startCommit?: string;
|
|
53
55
|
startBranch?: string;
|
|
54
56
|
runnerType?: string;
|
package/dist/api/plan.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/api/plan.ts"],"names":[],"mappings":"AAGA,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACvC,OAAO,CAAC,GAAG,CAAC,CAMd;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIvG;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAInH;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;IACJ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;IACJ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE;QACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE;QACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAM1G;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAI7G;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIpH;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,GAAG,CAAC,CAMd;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,GAAG,CAAC,CAId"}
|
|
1
|
+
{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/api/plan.ts"],"names":[],"mappings":"AAGA,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACvC,OAAO,CAAC,GAAG,CAAC,CAMd;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIvG;AAID,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAInH;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;IACJ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;IACJ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE;QACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE;QACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAM1G;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAI7G;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIpH;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,GAAG,CAAC,CAMd;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,GAAG,CAAC,CAId"}
|
package/dist/api/plan.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/api/plan.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,MAAwC;IAExC,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAEnG,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IACvF,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAiB,EACjB,OAA+B,EAC/B,EAAU;IAEV,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IACnG,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,IAYC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,
|
|
1
|
+
{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/api/plan.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,MAAwC;IAExC,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAEnG,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IACvF,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAiB,EACjB,OAA+B,EAC/B,EAAU;IAEV,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IACnG,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,IAYC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,IA+BC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,EAAU,EACV,IAA6B;IAE7B,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,EAAU,EACV,IAQC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,EAAU,EACV,IAuBC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IAC1F,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,EAAE,EAAE;QAC3D,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,EAAU;IAC7F,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,EAAU,EACV,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAY,EAAE,MAAc;IACpG,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,MAAM,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,MAAc,EACd,IAMC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,MAAM,gBAAgB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,MAAc,EACd,OAAe;IAEf,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,MAAM,kBAAkB,OAAO,EAAE,EAAE;QACxF,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC;KACzC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAiB,EACjB,OAAY,EACZ,EAAU,EACV,IAIC;IAED,MAAM,OAAO,GAAG,GAAG,MAAM,iBAAiB,SAAS,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}
|
|
@@ -54,11 +54,39 @@ export interface CredentialCommand {
|
|
|
54
54
|
input?: string;
|
|
55
55
|
/** Extra environment for the child. Used on Windows so the secret stays off argv. */
|
|
56
56
|
env?: Record<string, string>;
|
|
57
|
+
/**
|
|
58
|
+
* Run the child in its own session, with no controlling terminal.
|
|
59
|
+
*
|
|
60
|
+
* Required for any tool that reads a secret from stdin: macOS `security`
|
|
61
|
+
* collects the password with `readpassphrase(3)`, which opens the controlling
|
|
62
|
+
* terminal in preference to stdin and only falls back to stdin when there is
|
|
63
|
+
* none to open. Piping the token in therefore works from a script or a test but is
|
|
64
|
+
* silently ignored in an interactive shell, where `security` prompts the user
|
|
65
|
+
* instead and stores whatever the terminal happened to supply. Detaching
|
|
66
|
+
* removes the terminal, so the piped value is the only thing it can read.
|
|
67
|
+
*/
|
|
68
|
+
detachTerminal?: boolean;
|
|
57
69
|
}
|
|
58
70
|
export type CommandRunner = (command: CredentialCommand) => CommandResult;
|
|
71
|
+
export interface CredentialReadOptions {
|
|
72
|
+
/**
|
|
73
|
+
* Skip the process-lifetime read cache and ask the backend again.
|
|
74
|
+
*
|
|
75
|
+
* Required before presenting a **rotating** credential: another process may
|
|
76
|
+
* have rotated it since this one first read it, and the cached copy would then
|
|
77
|
+
* be a superseded token the server treats as reuse.
|
|
78
|
+
*
|
|
79
|
+
* Fails closed — if the backend cannot be read, the call returns null rather
|
|
80
|
+
* than the cached guess, because the caller is about to present the value
|
|
81
|
+
* somewhere that punishes staleness. Ignored for an account whose only copy is
|
|
82
|
+
* in memory (a write that could not be persisted), since there the cache *is*
|
|
83
|
+
* the credential.
|
|
84
|
+
*/
|
|
85
|
+
fresh?: boolean;
|
|
86
|
+
}
|
|
59
87
|
export interface CredentialStore {
|
|
60
88
|
status(): CredentialStoreStatus;
|
|
61
|
-
read(account: string): string | null;
|
|
89
|
+
read(account: string, options?: CredentialReadOptions): string | null;
|
|
62
90
|
save(account: string, secret: string): CredentialSaveOutcome;
|
|
63
91
|
remove(account: string): void;
|
|
64
92
|
}
|
|
@@ -67,6 +95,7 @@ export interface CreateCredentialStoreOptions {
|
|
|
67
95
|
platform?: NodeJS.Platform;
|
|
68
96
|
service?: string;
|
|
69
97
|
}
|
|
98
|
+
export declare function isMissingItemStatus(backend: CredentialBackendId, status: number | null): boolean;
|
|
70
99
|
export declare function resolveBackendId(platform: NodeJS.Platform): CredentialBackendId;
|
|
71
100
|
/** Cheap "is this backend usable at all" call. Exit code 0 means yes. */
|
|
72
101
|
export declare function buildProbeCommand(backend: CredentialBackendId): CredentialCommand | null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentialStore.d.ts","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,4BAA4B,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,GAAG,YAAY,GAAG,sBAAsB,GAAG,cAAc,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,sFAAsF;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"credentialStore.d.ts","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,4BAA4B,GAAG,WAAW,GAAG,MAAM,CAAC;AAEzG;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,GAAG,YAAY,GAAG,sBAAsB,GAAG,cAAc,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,sFAAsF;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,aAAa,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,IAAI,qBAAqB,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAAC;IACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC7D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAwCD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAMhG;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,mBAAmB,CAW/E;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,GAAG,IAAI,CAWxF;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAe1B;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,iBAAiB,GAAG,IAAI,CA4B1B;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAc1B;AAoBD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,eAAe,CAgLjG;AAID,uFAAuF;AACvF,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED,qDAAqD;AACrD,wBAAgB,4BAA4B,IAAI,IAAI,CAEnD"}
|
|
@@ -41,6 +41,27 @@ function powershellCommand(script, env) {
|
|
|
41
41
|
command.env = env;
|
|
42
42
|
return command;
|
|
43
43
|
}
|
|
44
|
+
/**
|
|
45
|
+
* Exit statuses that mean "no such item" rather than "the read failed".
|
|
46
|
+
*
|
|
47
|
+
* `security` answers a missing generic password with 44 (errSecItemNotFound);
|
|
48
|
+
* `secret-tool lookup` exits 1 with no output. Anything else — a locked keychain,
|
|
49
|
+
* a denied access prompt, a dead Secret Service — is an error, and must not be
|
|
50
|
+
* mistaken for the credential having been removed.
|
|
51
|
+
*/
|
|
52
|
+
const MISSING_ITEM_STATUS = {
|
|
53
|
+
'macos-keychain': [44],
|
|
54
|
+
libsecret: [1],
|
|
55
|
+
};
|
|
56
|
+
export function isMissingItemStatus(backend, status) {
|
|
57
|
+
if (status === null)
|
|
58
|
+
return false;
|
|
59
|
+
// PasswordVault throws for a missing item and PowerShell turns that into 1;
|
|
60
|
+
// there is no separate code to key on, so it is treated as absence.
|
|
61
|
+
if (backend === 'windows-credential-manager')
|
|
62
|
+
return status === 1;
|
|
63
|
+
return (MISSING_ITEM_STATUS[backend] ?? []).includes(status);
|
|
64
|
+
}
|
|
44
65
|
export function resolveBackendId(platform) {
|
|
45
66
|
switch (platform) {
|
|
46
67
|
case 'darwin':
|
|
@@ -82,13 +103,15 @@ export function buildReadCommand(backend, service, account) {
|
|
|
82
103
|
export function buildSaveCommand(backend, service, account, secret) {
|
|
83
104
|
switch (backend) {
|
|
84
105
|
case 'macos-keychain':
|
|
85
|
-
// `-w` without a value makes `security` read the password
|
|
86
|
-
// it
|
|
87
|
-
//
|
|
106
|
+
// `-w` without a value makes `security` read the password rather than take
|
|
107
|
+
// it from argv, where `ps` would expose it. It asks twice ("retype
|
|
108
|
+
// password"), so the value is written twice. `detachTerminal` is what makes
|
|
109
|
+
// it read *this* stdin instead of prompting the user's terminal.
|
|
88
110
|
return {
|
|
89
111
|
command: 'security',
|
|
90
112
|
args: ['add-generic-password', '-a', account, '-s', service, '-U', '-w'],
|
|
91
113
|
input: `${secret}\n${secret}\n`,
|
|
114
|
+
detachTerminal: true,
|
|
92
115
|
};
|
|
93
116
|
case 'libsecret':
|
|
94
117
|
return {
|
|
@@ -121,6 +144,9 @@ const defaultRunner = (command) => {
|
|
|
121
144
|
input: command.input,
|
|
122
145
|
windowsHide: true,
|
|
123
146
|
env: command.env ? { ...process.env, ...command.env } : process.env,
|
|
147
|
+
// `spawnSync` still waits for the child, so detaching only changes which
|
|
148
|
+
// session it belongs to — there is nothing left running afterwards.
|
|
149
|
+
...(command.detachTerminal ? { detached: true } : {}),
|
|
124
150
|
});
|
|
125
151
|
return {
|
|
126
152
|
status: result.error ? null : result.status,
|
|
@@ -151,6 +177,13 @@ export function createCredentialStore(options = {}) {
|
|
|
151
177
|
* would otherwise re-shell out on every credential resolution.
|
|
152
178
|
*/
|
|
153
179
|
const memory = new Map();
|
|
180
|
+
/**
|
|
181
|
+
* Accounts whose only copy is in {@link memory}, because a write could not be
|
|
182
|
+
* persisted. Tracked per account rather than as one store-wide latch: one
|
|
183
|
+
* account's failed write says nothing about another's, and a store-wide flag
|
|
184
|
+
* would silently turn every later `{ fresh: true }` read back into a cache hit.
|
|
185
|
+
*/
|
|
186
|
+
const memoryOnlyAccounts = new Set();
|
|
154
187
|
let availability = null;
|
|
155
188
|
/**
|
|
156
189
|
* Set once a write is rejected by a backend that passed the probe. From then
|
|
@@ -181,38 +214,71 @@ export function createCredentialStore(options = {}) {
|
|
|
181
214
|
const available = isAvailable();
|
|
182
215
|
return { backend, persisted: available, reason: available ? 'OK' : 'NO_BACKEND' };
|
|
183
216
|
};
|
|
217
|
+
/**
|
|
218
|
+
* The backend's own answer, with no memory cache in front of it.
|
|
219
|
+
*
|
|
220
|
+
* `missing` and `error` must stay apart. Collapsing them makes a locked
|
|
221
|
+
* keychain or a denied access prompt look exactly like "another process logged
|
|
222
|
+
* out", which would drop a live credential from the cache and let `logout`
|
|
223
|
+
* claim there is nothing to revoke while a valid refresh token sits in the
|
|
224
|
+
* store.
|
|
225
|
+
*/
|
|
226
|
+
const readFromBackend = (account) => {
|
|
227
|
+
if (!isAvailable())
|
|
228
|
+
return { kind: 'error', detail: 'the credential store is not available' };
|
|
229
|
+
const command = buildReadCommand(backend, service, account);
|
|
230
|
+
if (!command)
|
|
231
|
+
return { kind: 'error', detail: 'no read command for this backend' };
|
|
232
|
+
const result = runner(command);
|
|
233
|
+
if (result.status !== 0) {
|
|
234
|
+
return isMissingItemStatus(backend, result.status)
|
|
235
|
+
? { kind: 'missing' }
|
|
236
|
+
: { kind: 'error', detail: `${result.stderr}`.trim() || `the credential store read failed (${result.status})` };
|
|
237
|
+
}
|
|
238
|
+
// `security -w` and `secret-tool lookup` both terminate the value with a
|
|
239
|
+
// newline; a token never legitimately ends in whitespace.
|
|
240
|
+
const secret = result.stdout.replace(/\r?\n$/, '');
|
|
241
|
+
return secret.length === 0 ? { kind: 'missing' } : { kind: 'found', secret };
|
|
242
|
+
};
|
|
184
243
|
return {
|
|
185
244
|
status,
|
|
186
|
-
read(account) {
|
|
245
|
+
read(account, options) {
|
|
187
246
|
const cached = memory.get(account);
|
|
188
|
-
|
|
247
|
+
// A re-read only makes sense when the backend, not memory, holds the
|
|
248
|
+
// authoritative copy for this account. Where a write could not be
|
|
249
|
+
// persisted, memory is the only copy there is and consulting the backend
|
|
250
|
+
// would throw the live credential away.
|
|
251
|
+
const reread = options?.fresh === true && isAvailable() && !memoryOnlyAccounts.has(account);
|
|
252
|
+
if (cached !== undefined && !reread)
|
|
189
253
|
return cached;
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
//
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
//
|
|
201
|
-
//
|
|
202
|
-
|
|
203
|
-
if (secret.length === 0)
|
|
254
|
+
const outcome = readFromBackend(account);
|
|
255
|
+
if (outcome.kind === 'found') {
|
|
256
|
+
memory.set(account, outcome.secret);
|
|
257
|
+
return outcome.secret;
|
|
258
|
+
}
|
|
259
|
+
// Only a definite absence means another process removed the credential; a
|
|
260
|
+
// read that merely failed says nothing, so the cached copy stays.
|
|
261
|
+
if (outcome.kind === 'missing' && reread)
|
|
262
|
+
memory.delete(account);
|
|
263
|
+
// Either way this call cannot vouch for what the backend holds. A caller
|
|
264
|
+
// that asked for a fresh value is about to present it somewhere that
|
|
265
|
+
// punishes staleness, so it gets nothing rather than the cached guess.
|
|
266
|
+
if (reread)
|
|
204
267
|
return null;
|
|
205
|
-
|
|
206
|
-
return secret;
|
|
268
|
+
return cached ?? null;
|
|
207
269
|
},
|
|
208
270
|
save(account, secret) {
|
|
209
271
|
memory.set(account, secret);
|
|
272
|
+
const markMemoryOnly = (reason, detail) => {
|
|
273
|
+
memoryOnlyAccounts.add(account);
|
|
274
|
+
return detail === undefined ? { persisted: false, reason } : { persisted: false, reason, detail };
|
|
275
|
+
};
|
|
210
276
|
if (!isAvailable()) {
|
|
211
|
-
return
|
|
277
|
+
return markMemoryOnly(backend === 'none' ? 'UNSUPPORTED_PLATFORM' : 'NO_BACKEND');
|
|
212
278
|
}
|
|
213
279
|
const command = buildSaveCommand(backend, service, account, secret);
|
|
214
280
|
if (!command) {
|
|
215
|
-
return
|
|
281
|
+
return markMemoryOnly('NO_BACKEND');
|
|
216
282
|
}
|
|
217
283
|
const result = runner(command);
|
|
218
284
|
if (result.status !== 0) {
|
|
@@ -221,9 +287,29 @@ export function createCredentialStore(options = {}) {
|
|
|
221
287
|
// here would kill the documented session-only fallback at the exact
|
|
222
288
|
// moment it is needed.
|
|
223
289
|
writeFailureDetail = maskSecret(`${result.stderr}`.trim(), secret) || 'the credential store rejected the write';
|
|
224
|
-
return
|
|
290
|
+
return markMemoryOnly('WRITE_FAILED', writeFailureDetail);
|
|
291
|
+
}
|
|
292
|
+
// A zero exit is not proof the value landed. A backend tool that collects
|
|
293
|
+
// the secret interactively can store something else entirely and still
|
|
294
|
+
// succeed, and the caller would then commit to a credential that is only
|
|
295
|
+
// discovered to be wrong when the server rejects it — as an expired login,
|
|
296
|
+
// which sends the user back to a re-login that fails the same way. Reading
|
|
297
|
+
// it back turns that silent corruption into an honest WRITE_FAILED.
|
|
298
|
+
//
|
|
299
|
+
// A read that fails is not evidence either way, so it is not treated as a
|
|
300
|
+
// mismatch: doing so would revoke a token that did store, on nothing more
|
|
301
|
+
// than a locked keychain.
|
|
302
|
+
const stored = readFromBackend(account);
|
|
303
|
+
if (stored.kind === 'error') {
|
|
304
|
+
writeFailureDetail = `the write could not be verified: ${stored.detail}`;
|
|
305
|
+
return markMemoryOnly('WRITE_FAILED', writeFailureDetail);
|
|
306
|
+
}
|
|
307
|
+
if (stored.kind === 'missing' || stored.secret !== secret) {
|
|
308
|
+
writeFailureDetail = 'the credential store did not keep the value that was written';
|
|
309
|
+
return markMemoryOnly('WRITE_FAILED', writeFailureDetail);
|
|
225
310
|
}
|
|
226
311
|
writeFailureDetail = null;
|
|
312
|
+
memoryOnlyAccounts.delete(account);
|
|
227
313
|
return { persisted: true, reason: 'OK' };
|
|
228
314
|
},
|
|
229
315
|
remove(account) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"credentialStore.js","sourceRoot":"","sources":["../../src/auth/credentialStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AA0FnD,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAC5D,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,iCAAiC;IACjC,4GAA4G;IAC5G,gEAAgE;CACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,iBAAiB,CAAC,MAAc,EAAE,GAA4B;IACrE,MAAM,OAAO,GAAsB;QACjC,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,gBAAgB,KAAK,MAAM,EAAE,CAAC;KACtF,CAAC;IACF,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAA4D;IACnF,gBAAgB,EAAE,CAAC,EAAE,CAAC;IACtB,SAAS,EAAE,CAAC,CAAC,CAAC;CACf,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,OAA4B,EAAE,MAAqB;IACrF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClC,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,OAAO,KAAK,4BAA4B;QAAE,OAAO,MAAM,KAAK,CAAC,CAAC;IAClE,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACxD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,4BAA4B,CAAC;QACtC,KAAK,OAAO;YACV,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAA4B,EAC5B,OAAe,EACf,OAAe;IAEf,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACtG,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9F,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,6BAA6B,mBAAmB,UAAU,mBAAmB,KAAK;gBAChF,0DAA0D,EAC5D,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CACnE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAA4B,EAC5B,OAAe,EACf,OAAe,EACf,MAAc;IAEd,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,2EAA2E;YAC3E,mEAAmE;YACnE,4EAA4E;YAC5E,iEAAiE;YACjE,OAAO;gBACL,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;gBACxE,KAAK,EAAE,GAAG,MAAM,KAAK,MAAM,IAAI;gBAC/B,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,KAAK,WAAW;YACd,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,KAAK,OAAO,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;gBAC7F,KAAK,EAAE,MAAM;aACd,CAAC;QACJ,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,yEAAyE;gBACvE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,kBAAkB,KAAK,EAC3F,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CACjG,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA4B,EAC5B,OAAe,EACf,OAAe;IAEf,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,gBAAgB;YACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAClG,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7F,KAAK,4BAA4B;YAC/B,OAAO,iBAAiB,CACtB,6BAA6B,mBAAmB,UAAU,mBAAmB,sBAAsB,EACnG,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CACnE,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAkB,CAAC,OAAO,EAAE,EAAE;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;QACtD,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACnE,yEAAyE;QACzE,oEAAoE;QACpE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;KAC5B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACtD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE3C;;;;OAIG;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC;;;;;OAKG;IACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,YAAY,GAAmB,IAAI,CAAC;IACxC;;;;OAIG;IACH,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAE7C,MAAM,WAAW,GAAG,GAAY,EAAE;QAChC,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC;QAE/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,GAAG,KAAK,CAAC;YACrB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAA0B,EAAE;QACzC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,CACtB,OAAe,EAC8E,EAAE;QAC/F,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAE9F,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAEnF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;gBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,qCAAqC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACpH,CAAC;QAED,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC/E,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QAEN,IAAI,CAAC,OAAO,EAAE,OAAO;YACnB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,qEAAqE;YACrE,kEAAkE;YAClE,yEAAyE;YACzE,wCAAwC;YACxC,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,KAAK,IAAI,IAAI,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC;YAEnD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,OAAO,CAAC,MAAM,CAAC;YACxB,CAAC;YAED,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAEjE,yEAAyE;YACzE,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO,MAAM,IAAI,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,MAAM;YAClB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAE5B,MAAM,cAAc,GAAG,CAAC,MAA6B,EAAE,MAAe,EAAyB,EAAE;gBAC/F,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACpG,CAAC,CAAC;YAEF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACnB,OAAO,cAAc,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,wEAAwE;gBACxE,uEAAuE;gBACvE,oEAAoE;gBACpE,uBAAuB;gBACvB,kBAAkB,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,yCAAyC,CAAC;gBAChH,OAAO,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC5D,CAAC;YAED,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oEAAoE;YACpE,EAAE;YACF,0EAA0E;YAC1E,0EAA0E;YAC1E,0BAA0B;YAC1B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,kBAAkB,GAAG,oCAAoC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzE,OAAO,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1D,kBAAkB,GAAG,8DAA8D,CAAC;gBACpF,OAAO,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC5D,CAAC;YAED,kBAAkB,GAAG,IAAI,CAAC;YAC1B,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,CAAC,OAAO;YACZ,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO;YAE3B,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,WAAW,GAA2B,IAAI,CAAC;AAE/C,uFAAuF;AACvF,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,qBAAqB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,4BAA4B;IAC1C,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC"}
|
|
@@ -12,13 +12,28 @@
|
|
|
12
12
|
* 3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
|
|
13
13
|
* A flaky network must not log the user out — otherwise one offline moment
|
|
14
14
|
* costs a full re-login even after connectivity returns.
|
|
15
|
+
*
|
|
16
|
+
* Guarantee 2 covers one process. Rotation also has to be serialized *across*
|
|
17
|
+
* processes, because a one-shot `agentteams` command and a long-lived
|
|
18
|
+
* `agentteams mcp` share one credential slot: see {@link RefreshLock}.
|
|
15
19
|
*/
|
|
16
20
|
import type { CredentialBackendId, CredentialStoreReason } from './credentialStore.js';
|
|
17
21
|
import { type PersonalTokenStore } from './personalTokenStore.js';
|
|
22
|
+
import { type RefreshLock } from './refreshLock.js';
|
|
18
23
|
/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
|
|
19
24
|
export declare const CLI_OAUTH_CLIENT_ID = "agentteams-cli";
|
|
20
25
|
/** Refresh this far before the server-declared expiry rather than at it. */
|
|
21
26
|
export declare const ACCESS_REFRESH_SKEW_MS = 60000;
|
|
27
|
+
/**
|
|
28
|
+
* Cap on a token-endpoint request.
|
|
29
|
+
*
|
|
30
|
+
* Deliberately below {@link DEFAULT_STALE_AFTER_MS}: a rotation runs with the
|
|
31
|
+
* cross-process lock held, and if it could outlast the staleness window another
|
|
32
|
+
* process would judge the lock abandoned, take it, and rotate the same refresh
|
|
33
|
+
* token — the reuse that revokes the whole family. Bounding the request keeps the
|
|
34
|
+
* holder inside the window it promised.
|
|
35
|
+
*/
|
|
36
|
+
export declare const TOKEN_REQUEST_TIMEOUT_MS: number;
|
|
22
37
|
export type PersonalTokenErrorCode = 'INVALID_GRANT' | 'TRANSIENT' | 'NOT_LOGGED_IN' | 'MALFORMED_RESPONSE' | 'REVOKE_FAILED'
|
|
23
38
|
/** A fresh login succeeded but the credential could not be kept anywhere durable. */
|
|
24
39
|
| 'STORE_UNAVAILABLE';
|
|
@@ -37,6 +52,14 @@ export interface PersonalTokenSession {
|
|
|
37
52
|
expiresAt: number;
|
|
38
53
|
identity: PersonalTokenIdentity;
|
|
39
54
|
}
|
|
55
|
+
/**
|
|
56
|
+
* Why the last refresh attempt produced no token. `null` once one succeeds.
|
|
57
|
+
*
|
|
58
|
+
* Exists so the caller can name the actual problem: every one of these used to
|
|
59
|
+
* surface as "check your network connection", which sends the user after a
|
|
60
|
+
* network that is fine.
|
|
61
|
+
*/
|
|
62
|
+
export type PersonalTokenRefreshFailure = 'NETWORK' | 'LOCK_CONTENTION' | 'LOCK_UNAVAILABLE';
|
|
40
63
|
export interface PersonalTokenState {
|
|
41
64
|
/** A refresh token exists locally. It may still turn out to be revoked. */
|
|
42
65
|
connected: boolean;
|
|
@@ -49,6 +72,8 @@ export interface PersonalTokenState {
|
|
|
49
72
|
expiresAt: number | null;
|
|
50
73
|
/** The server rejected the refresh token; only a fresh login recovers. */
|
|
51
74
|
reconnectRequired: boolean;
|
|
75
|
+
/** Why the last refresh produced nothing; null when it succeeded or never ran. */
|
|
76
|
+
refreshFailure: PersonalTokenRefreshFailure | null;
|
|
52
77
|
}
|
|
53
78
|
export interface AuthorizationCodeGrant {
|
|
54
79
|
code: string;
|
|
@@ -60,6 +85,12 @@ export interface PersonalTokenClientDeps {
|
|
|
60
85
|
store: PersonalTokenStore;
|
|
61
86
|
fetch?: typeof fetch;
|
|
62
87
|
now?: () => number;
|
|
88
|
+
/**
|
|
89
|
+
* Serializes rotation against other processes. Defaults to a pass-through so
|
|
90
|
+
* a client built in a test touches no filesystem; {@link getPersonalTokenClient}
|
|
91
|
+
* supplies the real file lock for every shipped code path.
|
|
92
|
+
*/
|
|
93
|
+
lock?: RefreshLock;
|
|
63
94
|
}
|
|
64
95
|
interface TokenResponse {
|
|
65
96
|
accessToken: string;
|
|
@@ -90,6 +121,7 @@ export declare class PersonalTokenClient {
|
|
|
90
121
|
private accessExpiresAt;
|
|
91
122
|
private identity;
|
|
92
123
|
private reconnectRequired;
|
|
124
|
+
private refreshFailure;
|
|
93
125
|
private refreshInFlight;
|
|
94
126
|
constructor(deps: PersonalTokenClientDeps);
|
|
95
127
|
state(): PersonalTokenState;
|
|
@@ -137,6 +169,8 @@ export declare class PersonalTokenClient {
|
|
|
137
169
|
*/
|
|
138
170
|
forgetLocalCredential(): void;
|
|
139
171
|
private refresh;
|
|
172
|
+
/** The rotation itself. Runs with the cross-process lock held. */
|
|
173
|
+
private rotate;
|
|
140
174
|
private postToken;
|
|
141
175
|
/**
|
|
142
176
|
* A failed save is reported, never thrown: a long-running `agentteams mcp`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAc3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}
|
|
@@ -12,12 +12,27 @@
|
|
|
12
12
|
* 3. Delete the stored refresh token **only** on an explicit `invalid_grant`.
|
|
13
13
|
* A flaky network must not log the user out — otherwise one offline moment
|
|
14
14
|
* costs a full re-login even after connectivity returns.
|
|
15
|
+
*
|
|
16
|
+
* Guarantee 2 covers one process. Rotation also has to be serialized *across*
|
|
17
|
+
* processes, because a one-shot `agentteams` command and a long-lived
|
|
18
|
+
* `agentteams mcp` share one credential slot: see {@link RefreshLock}.
|
|
15
19
|
*/
|
|
16
|
-
import { createPersonalTokenStore } from './personalTokenStore.js';
|
|
20
|
+
import { createPersonalTokenStore, personalTokenSlot } from './personalTokenStore.js';
|
|
21
|
+
import { createFileRefreshLock, noopRefreshLock, DEFAULT_STALE_AFTER_MS, RefreshLockTimeoutError, RefreshLockUnavailableError, } from './refreshLock.js';
|
|
17
22
|
/** Registered in `api/src/services/personalTokenClients.ts`; the server rejects anything else. */
|
|
18
23
|
export const CLI_OAUTH_CLIENT_ID = 'agentteams-cli';
|
|
19
24
|
/** Refresh this far before the server-declared expiry rather than at it. */
|
|
20
25
|
export const ACCESS_REFRESH_SKEW_MS = 60_000;
|
|
26
|
+
/**
|
|
27
|
+
* Cap on a token-endpoint request.
|
|
28
|
+
*
|
|
29
|
+
* Deliberately below {@link DEFAULT_STALE_AFTER_MS}: a rotation runs with the
|
|
30
|
+
* cross-process lock held, and if it could outlast the staleness window another
|
|
31
|
+
* process would judge the lock abandoned, take it, and rotate the same refresh
|
|
32
|
+
* token — the reuse that revokes the whole family. Bounding the request keeps the
|
|
33
|
+
* holder inside the window it promised.
|
|
34
|
+
*/
|
|
35
|
+
export const TOKEN_REQUEST_TIMEOUT_MS = Math.floor(DEFAULT_STALE_AFTER_MS / 2);
|
|
21
36
|
export class PersonalTokenError extends Error {
|
|
22
37
|
code;
|
|
23
38
|
constructor(code, message) {
|
|
@@ -79,6 +94,7 @@ export class PersonalTokenClient {
|
|
|
79
94
|
accessExpiresAt = 0;
|
|
80
95
|
identity = null;
|
|
81
96
|
reconnectRequired = false;
|
|
97
|
+
refreshFailure = null;
|
|
82
98
|
refreshInFlight = null;
|
|
83
99
|
constructor(deps) {
|
|
84
100
|
this.deps = deps;
|
|
@@ -93,6 +109,7 @@ export class PersonalTokenClient {
|
|
|
93
109
|
identity: this.identity,
|
|
94
110
|
expiresAt: this.accessToken ? this.accessExpiresAt : null,
|
|
95
111
|
reconnectRequired: this.reconnectRequired,
|
|
112
|
+
refreshFailure: this.refreshFailure,
|
|
96
113
|
};
|
|
97
114
|
}
|
|
98
115
|
hasCredential() {
|
|
@@ -194,7 +211,15 @@ export class PersonalTokenClient {
|
|
|
194
211
|
* cancel.
|
|
195
212
|
*/
|
|
196
213
|
async revoke() {
|
|
197
|
-
|
|
214
|
+
// Fresh: a logout has to revoke the token the family is actually on, not a
|
|
215
|
+
// copy this process cached before someone else rotated it.
|
|
216
|
+
//
|
|
217
|
+
// Falling back to the cached copy is safe and necessary here: revocation
|
|
218
|
+
// kills the whole family, so a superseded token from the same family does the
|
|
219
|
+
// same job, and a read that failed (locked keychain, denied prompt) must not
|
|
220
|
+
// make logout claim there is nothing to revoke while a live token sits in the
|
|
221
|
+
// store — that would leave it valid server-side with no way to reach it.
|
|
222
|
+
const refreshToken = this.deps.store.read({ fresh: true }) ?? this.deps.store.read();
|
|
198
223
|
if (!refreshToken) {
|
|
199
224
|
throw new PersonalTokenError('NOT_LOGGED_IN', 'No personal token is stored for this server.');
|
|
200
225
|
}
|
|
@@ -225,7 +250,39 @@ export class PersonalTokenClient {
|
|
|
225
250
|
this.clear();
|
|
226
251
|
}
|
|
227
252
|
async refresh() {
|
|
228
|
-
|
|
253
|
+
// Cheap pre-check off the cache: no credential means there is nothing to
|
|
254
|
+
// serialize against, so the lock is never taken for a logged-out process.
|
|
255
|
+
if (!this.deps.store.read())
|
|
256
|
+
return null;
|
|
257
|
+
try {
|
|
258
|
+
const accessToken = await (this.deps.lock ?? noopRefreshLock).withLock(() => this.rotate());
|
|
259
|
+
if (accessToken)
|
|
260
|
+
this.refreshFailure = null;
|
|
261
|
+
return accessToken;
|
|
262
|
+
}
|
|
263
|
+
catch (error) {
|
|
264
|
+
// Both lock problems leave the refresh token exactly where it is, so the
|
|
265
|
+
// next command retries. Rotating anyway would risk the server's reuse
|
|
266
|
+
// detection revoking the whole family, which costs a full re-login. They
|
|
267
|
+
// are recorded distinctly so the caller does not blame the network.
|
|
268
|
+
if (error instanceof RefreshLockTimeoutError) {
|
|
269
|
+
this.refreshFailure = 'LOCK_CONTENTION';
|
|
270
|
+
return null;
|
|
271
|
+
}
|
|
272
|
+
if (error instanceof RefreshLockUnavailableError) {
|
|
273
|
+
this.refreshFailure = 'LOCK_UNAVAILABLE';
|
|
274
|
+
return null;
|
|
275
|
+
}
|
|
276
|
+
throw error;
|
|
277
|
+
}
|
|
278
|
+
}
|
|
279
|
+
/** The rotation itself. Runs with the cross-process lock held. */
|
|
280
|
+
async rotate() {
|
|
281
|
+
// Re-read past the store's process-lifetime cache. Another process may have
|
|
282
|
+
// rotated — or cleared — the family while this one waited for the lock, and
|
|
283
|
+
// presenting the superseded token is precisely what makes the server revoke
|
|
284
|
+
// every token in the family.
|
|
285
|
+
const refreshToken = this.deps.store.read({ fresh: true });
|
|
229
286
|
if (!refreshToken)
|
|
230
287
|
return null;
|
|
231
288
|
let parsed;
|
|
@@ -237,8 +294,10 @@ export class PersonalTokenClient {
|
|
|
237
294
|
});
|
|
238
295
|
}
|
|
239
296
|
catch {
|
|
240
|
-
// Network-level failure
|
|
241
|
-
//
|
|
297
|
+
// Network-level failure, which now includes the request outrunning
|
|
298
|
+
// TOKEN_REQUEST_TIMEOUT_MS. The refresh token is still presumed valid, so
|
|
299
|
+
// it stays exactly where it is; the next command can try again.
|
|
300
|
+
this.refreshFailure = 'NETWORK';
|
|
242
301
|
return null;
|
|
243
302
|
}
|
|
244
303
|
if (parsed.kind === 'invalidGrant') {
|
|
@@ -258,6 +317,7 @@ export class PersonalTokenClient {
|
|
|
258
317
|
method: 'POST',
|
|
259
318
|
headers: { 'Content-Type': 'application/json' },
|
|
260
319
|
body: JSON.stringify(body),
|
|
320
|
+
signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
|
|
261
321
|
});
|
|
262
322
|
return parseTokenResponse(response);
|
|
263
323
|
}
|
|
@@ -279,6 +339,7 @@ export class PersonalTokenClient {
|
|
|
279
339
|
this.accessExpiresAt = 0;
|
|
280
340
|
this.identity = null;
|
|
281
341
|
this.reconnectRequired = false;
|
|
342
|
+
this.refreshFailure = null;
|
|
282
343
|
this.deps.store.remove();
|
|
283
344
|
}
|
|
284
345
|
now() {
|
|
@@ -300,7 +361,13 @@ export function getPersonalTokenClient(apiUrl) {
|
|
|
300
361
|
const key = apiUrl.replace(/\/+$/, '');
|
|
301
362
|
let client = clients.get(key);
|
|
302
363
|
if (!client) {
|
|
303
|
-
|
|
364
|
+
const slot = personalTokenSlot(key);
|
|
365
|
+
client = new PersonalTokenClient({
|
|
366
|
+
apiUrl: key,
|
|
367
|
+
store: createPersonalTokenStore(key),
|
|
368
|
+
// Per slot, so a dev-API rotation never blocks a production one.
|
|
369
|
+
lock: createFileRefreshLock(slot),
|
|
370
|
+
});
|
|
304
371
|
clients.set(key, client);
|
|
305
372
|
}
|
|
306
373
|
return client;
|