npm - @allocator-one/harness-cli - Versions diffs - 1.8.0 → 1.9.0 - Mend

@allocator-one/harness-cli 1.8.0 → 1.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/cli.js +283 -52
package/dist/login-page-UVUKFFTT.js +292 -0
package/package.json +1 -1

package/dist/cli.js CHANGED Viewed

@@ -93,31 +93,15 @@ import { accessSync, constants as fsConstants } from "fs";
 import { createServer } from "http";
 import { delimiter, join } from "path";
 import { createInterface } from "readline";
-// src/core/login-page.ts
-var LOGO = '<svg width="210" height="34" viewBox="0 0 210 34" fill="none" role="img" aria-label="Infra One" xmlns="http://www.w3.org/2000/svg">\n  <style>\n    path {\n      fill: #353535\n    }\n\n    @media (prefers-color-scheme: dark) {\n      path {\n        fill: white\n      }\n    }\n  </style>\n  <g id="I1_logo_full">\n    <g id="Infra One Logo">\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M44.2202 29.5139V4.04761H49.617V29.5139H44.2202Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M121.159 11.873V13.998C119.877 12.4464 117.853 11.4345 115.29 11.4345C110.23 11.4345 106.284 15.3809 106.284 20.7103C106.284 26.0397 110.23 29.9861 115.29 29.9861C118.157 29.9861 119.877 28.9742 121.159 27.3214V29.4464H125.948V11.9067H121.159V11.873ZM116.099 25.8373C113.063 25.8373 110.938 23.7123 110.938 20.6091C110.938 17.5059 113.063 15.4484 116.099 15.4484C119.135 15.4484 121.327 17.5734 121.327 20.6091C121.327 23.6448 119.034 25.8373 116.099 25.8373Z" />\n      <path d="M15.6508 0H27.8611V34H15.6508V0ZM0 11.131C0 7.92659 2.66468 5.2619 5.86905 5.2619H6.34127C9.54564 5.2619 12.2103 7.92659 12.2103 11.131C12.2103 14.3353 9.54564 17 6.34127 17H5.86905C2.66468 17 0 14.3353 0 11.131Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M88.4405 10.4901C87.6984 10.2203 87.3611 10.0179 86.3155 10.0179C84.8651 10.0179 84.123 10.7599 84.123 12.2103V13.627H89.4524V17.6746H84.123V29.4802H79.3333V17.6746H76.2976V13.627H79.3333V12.2103C79.3333 8.36511 81.1548 5.86908 85.4048 5.86908C87.631 5.86908 88.1706 6.13892 89.621 6.71233L88.4405 10.4901Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M98.0199 14.4365C99.133 12.4127 101.224 11.2321 104.091 11.6032V15.9206C100.246 15.381 98.0199 17.0337 98.0199 21.7897V29.4127H93.2302V11.873H98.0199V14.4365Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M65.5715 11.4008C70.3611 11.4008 72.756 14.5377 72.756 19.2262V29.5139H67.9663V20.0357C67.9663 17.371 66.6845 15.6171 64.1211 15.6171C61.5576 15.6171 59.7024 17.6409 59.7024 20.7778V29.5139H54.9127V11.873H59.7024V14.0655C60.9842 12.5139 62.9068 11.4008 65.5715 11.4008Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M151.01 4.621C143.387 4.621 137.687 10.0516 137.687 17.3035C137.687 24.5555 143.286 29.9861 151.01 29.9861C158.734 29.9861 164.232 24.4881 164.232 17.3035C164.232 10.119 158.633 4.621 151.01 4.621ZM151.01 25.5674C145.95 25.5674 142.746 21.992 142.746 17.3035C142.746 12.6151 145.95 9.10712 151.01 9.10712C156.069 9.10712 159.274 12.7837 159.274 17.3035C159.274 21.8234 155.968 25.5674 151.01 25.5674Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M179.309 11.4008C184.099 11.4008 186.494 14.5377 186.494 19.2262V29.5139H181.704V20.0357C181.704 17.371 180.423 15.6171 177.859 15.6171C175.296 15.6171 173.44 17.6409 173.44 20.7778V29.5139H168.651V11.873H173.44V14.0655C174.722 12.5139 176.645 11.4008 179.309 11.4008Z" />\n      <path fill-rule="evenodd" clip-rule="evenodd" d="M209.565 20.2381C209.565 15.1786 206.26 11.3333 200.188 11.3333C194.117 11.3333 190.643 15.3809 190.643 20.6091C190.643 25.8373 194.69 29.8849 200.559 29.8849C206.429 29.8849 208.284 27.119 209.397 24.8254L205.079 23.6448C204.337 24.9266 202.954 25.9385 200.661 25.9385C197.355 25.9385 195.702 24.1845 195.331 21.8909H209.498C209.599 21.3512 209.599 20.7778 209.599 20.2381H209.565ZM195.298 19.125C195.567 17.1012 197.321 15.2797 200.155 15.2797C202.988 15.2797 204.742 17.0337 204.944 19.125H195.298Z" />\n    </g>\n  </g>\n</svg>';
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function loginPage(message) {
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<!-- The logo paints itself white under a dark preference; without this the
-     canvas stays white and the logo disappears. -->
-<meta name="color-scheme" content="light dark">
-<title>harness login</title></head>
-<body style="margin: 0;">
-<main style="min-height: 100vh; padding: 1.5rem; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 2rem; text-align: center; font-family: system-ui, sans-serif;">
-${LOGO}
-<p style="margin: 0;">${escapeHtml(message)}</p>
-</main>
-</body></html>
-`;
-}
-// src/core/auth.ts
 var DEFAULT_TIMEOUT_MS = 18e4;
+var RESPONSE_DRAIN_GRACE_MS = 100;
+var RESPONSE_FLUSH_TIMEOUT_MS = 2e3;
+var MAX_PAGE_RESPONSES = 4;
+var loginPageImport;
+function loadLoginPage() {
+  loginPageImport ??= import("./login-page-UVUKFFTT.js");
+  return loginPageImport;
+}
 function generateState() {
   return randomBytes(24).toString("base64url");
 }
@@ -183,72 +167,313 @@ async function loopbackLogin(baseUrl, options) {
     });
   });
   if (port === null) {
-    return { ok: false, message: "could not open a loopback port for the browser handoff" };
+    return {
+      ok: false,
+      message: "could not open a loopback port for the browser handoff"
+    };
   }
   try {
     const query = new URLSearchParams({ port: String(port), state: state2, challenge });
     const url = `${baseUrl}/cli/login?${query.toString()}`;
+    const callbackPromise = awaitCallback(server, state2, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    void loadLoginPage().catch(() => {
+      loginPageImport = void 0;
+    });
     const openBrowser = options.openBrowser ?? defaultOpenBrowser;
-    openBrowser(url);
+    try {
+      openBrowser(url);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      return { ok: false, message: `could not open a browser: ${detail}` };
+    }
     notify(`Opening ${url}`);
     notify("Waiting for the browser authorization (Ctrl-C to abort)\u2026");
-    const code = await awaitCallback(server, state2, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    if (!code.ok) return code;
-    const token = await exchangeCode(baseUrl, code.code, verifier, options);
-    if (!token.ok) return token;
-    return await verifyAndStore(baseUrl, token.token, options);
+    const callback = await callbackPromise;
+    if (!callback.ok) return callback;
+    try {
+      const token = await exchangeCode(baseUrl, callback.code, verifier, options);
+      if (!token.ok) {
+        await callback.respond(
+          400,
+          "Harness could not exchange the browser authorization. Return to the terminal for details.",
+          "error"
+        );
+        return token;
+      }
+      const result = await verifyAndStore(baseUrl, token.token, options);
+      if (result.ok) {
+        await callback.respond(200, "You can close this browser and return to the terminal.", "success");
+      } else {
+        await callback.respond(
+          400,
+          "Harness could not verify and store this login. Return to the terminal for details.",
+          "error"
+        );
+      }
+      return result;
+    } catch (error) {
+      await callback.respond(500, "Harness could not finish the login. Return to the terminal for details.", "error");
+      const detail = error instanceof Error ? error.message : String(error);
+      return { ok: false, message: `could not finish the browser login: ${detail}` };
+    }
   } finally {
-    server.closeAllConnections();
     server.close();
+    const forceClose = setTimeout(
+      () => server.closeAllConnections(),
+      RESPONSE_FLUSH_TIMEOUT_MS + RESPONSE_DRAIN_GRACE_MS
+    );
+    forceClose.unref();
   }
 }
 function awaitCallback(server, state2, timeoutMs) {
   return new Promise((resolve) => {
+    let phase = "waiting";
+    let finalResponse = null;
+    let callbackPageResponses = 0;
+    const rootPageResponses = /* @__PURE__ */ new Map();
+    const acceptedResponders = [];
+    const inFlightResponses = /* @__PURE__ */ new Set();
+    const trackResponse = (responsePromise) => {
+      inFlightResponses.add(responsePromise);
+      void responsePromise.finally(() => inFlightResponses.delete(responsePromise));
+      return responsePromise;
+    };
+    const drainTrackedResponses = async () => {
+      await new Promise((settle) => setTimeout(settle, RESPONSE_DRAIN_GRACE_MS));
+      const deadline = Date.now() + RESPONSE_FLUSH_TIMEOUT_MS;
+      while (inFlightResponses.size > 0 && Date.now() < deadline) {
+        const remaining = deadline - Date.now();
+        await Promise.race([
+          Promise.allSettled([...inFlightResponses]),
+          new Promise((settle) => setTimeout(settle, remaining))
+        ]);
+      }
+    };
     const timer = setTimeout(() => {
-      resolve({ ok: false, message: "timed out waiting for the browser authorization" });
+      if (phase !== "waiting") return;
+      const timeoutResponse = {
+        status: 410,
+        message: "This login attempt has ended \u2014 run harness login again if needed.",
+        pageState: "error"
+      };
+      phase = "terminal";
+      finalResponse = timeoutResponse;
+      resolve({
+        ok: false,
+        message: "timed out waiting for the browser authorization"
+      });
+      void drainTrackedResponses();
     }, timeoutMs);
+    server.once("close", () => {
+      clearTimeout(timer);
+      if (phase !== "waiting") return;
+      phase = "terminal";
+      resolve({ ok: false, message: "the browser login listener closed before authorization completed" });
+    });
     server.on("request", (request, response) => {
-      const respond = (status, message) => {
-        response.writeHead(status, { "content-type": "text/html; charset=utf-8" });
-        response.end(loginPage(message));
+      const respond = callbackResponder(response);
+      const respondWithPage = (status, message, pageState) => {
+        if (callbackPageResponses >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return Promise.resolve();
+        }
+        callbackPageResponses += 1;
+        return respond(status, message, pageState);
+      };
+      const respondAtRoot = (status, message, pageState) => {
+        const rootPhase = phase === "terminal" ? "terminal" : "waiting";
+        const responses = rootPageResponses.get(rootPhase) ?? 0;
+        if (responses >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return Promise.resolve();
+        }
+        rootPageResponses.set(rootPhase, responses + 1);
+        return respond(status, message, pageState);
       };
       let url;
       try {
         url = new URL(request.url ?? "/", "http://127.0.0.1");
       } catch {
-        respond(404, "Waiting for the harness login callback.");
+        respondEmpty(response, 404);
+        return;
+      }
+      const path = url.pathname.replace(/\/+$/, "") || "/";
+      if (path !== "/callback") {
+        if (path === "/") {
+          const rootResponse = phase === "terminal" && finalResponse ? finalResponse : {
+            status: 200,
+            message: "Waiting for the Harness browser authorization to finish.",
+            pageState: "waiting"
+          };
+          void trackResponse(
+            respondAtRoot(rootResponse.status, rootResponse.message, rootResponse.pageState)
+          );
+        } else {
+          respondEmpty(response, path === "/favicon.ico" ? 204 : 404);
+        }
         return;
       }
-      if (url.pathname !== "/callback") {
-        respond(404, "Waiting for the harness login callback.");
+      const matchingState = url.searchParams.get("state") === state2;
+      if (!matchingState) {
+        respondEmpty(response, 400);
+        return;
+      }
+      if (phase === "terminal") {
+        if (!url.searchParams.has("code") && !url.searchParams.has("error")) {
+          respondEmpty(response, 400);
+          return;
+        }
+        const result = finalResponse ?? {
+          status: 410,
+          message: "This login attempt has ended \u2014 run harness login again if needed.",
+          pageState: "error"
+        };
+        void trackResponse(respondWithPage(result.status, result.message, result.pageState));
+        return;
+      }
+      if (phase === "processing") {
+        if (url.searchParams.has("error")) {
+          respondEmpty(response, 409);
+          return;
+        }
+        const duplicateCode = url.searchParams.get("code");
+        if (duplicateCode === null || duplicateCode === "") {
+          respondEmpty(response, 400);
+          return;
+        }
+        if (acceptedResponders.length >= MAX_PAGE_RESPONSES) {
+          respondEmpty(response, 429);
+          return;
+        }
+        acceptedResponders.push(respondWithPage);
+        return;
+      }
+      if (url.searchParams.has("error")) {
+        const denialResponse = {
+          status: 400,
+          message: "Browser authorization was denied. Return to the terminal to try again.",
+          pageState: "error"
+        };
+        phase = "terminal";
+        finalResponse = denialResponse;
+        clearTimeout(timer);
+        void (async () => {
+          await trackResponse(respondWithPage(denialResponse.status, denialResponse.message, denialResponse.pageState));
+          await drainTrackedResponses();
+          resolve({ ok: false, message: "browser authorization was denied" });
+        })();
         return;
       }
       const code = url.searchParams.get("code");
-      if (url.searchParams.get("state") === state2 && code !== null && code !== "") {
-        respond(200, "Signed in \u2014 you can close this tab and return to the terminal.");
+      if (code !== null && code !== "") {
+        phase = "processing";
+        acceptedResponders.push(respondWithPage);
         clearTimeout(timer);
-        resolve({ ok: true, code });
+        resolve({
+          ok: true,
+          code,
+          respond: async (status, message, pageState) => {
+            finalResponse = { status, message, pageState };
+            phase = "terminal";
+            const responders = acceptedResponders.splice(0);
+            await Promise.all(
+              responders.map((acceptedRespond) => trackResponse(acceptedRespond(status, message, pageState)))
+            );
+            await drainTrackedResponses();
+          }
+        });
       } else {
-        respond(400, "This is not the callback this login is waiting for \u2014 run harness login again if needed.");
+        respondEmpty(response, 400);
       }
     });
   });
 }
+function callbackResponder(response) {
+  return async (status, message, state2) => {
+    if (response.writableEnded || response.destroyed) return;
+    return new Promise((resolve) => {
+      let flushTimer;
+      const armFlushTimeout = () => {
+        if (flushTimer !== void 0) clearTimeout(flushTimer);
+        flushTimer = setTimeout(() => {
+          response.destroy();
+          settle();
+        }, RESPONSE_FLUSH_TIMEOUT_MS);
+        flushTimer.unref();
+      };
+      const settle = () => {
+        if (flushTimer !== void 0) clearTimeout(flushTimer);
+        response.off("finish", settle);
+        response.off("close", settle);
+        response.off("error", settle);
+        response.off("drain", armFlushTimeout);
+        resolve();
+      };
+      response.once("finish", settle);
+      response.once("close", settle);
+      response.once("error", settle);
+      response.on("drain", armFlushTimeout);
+      void loadLoginPage().then(({ loginPage }) => {
+        if (response.writableEnded || response.destroyed) {
+          settle();
+          return;
+        }
+        try {
+          const html = loginPage(message, state2);
+          response.writeHead(status, {
+            "cache-control": "no-store",
+            connection: "close",
+            "content-length": String(Buffer.byteLength(html)),
+            "content-type": "text/html; charset=utf-8",
+            "x-content-type-options": "nosniff"
+          });
+          armFlushTimeout();
+          response.end(html);
+        } catch {
+          response.destroy();
+          settle();
+        }
+      }).catch(() => {
+        response.destroy();
+        settle();
+      });
+    });
+  };
+}
+function respondEmpty(response, status) {
+  response.once("error", () => void 0);
+  try {
+    response.writeHead(status, {
+      "cache-control": "no-store",
+      connection: "close",
+      "x-content-type-options": "nosniff"
+    });
+    response.end();
+  } catch {
+    response.destroy();
+  }
+}
 async function exchangeCode(baseUrl, code, verifier, options) {
   try {
-    const body = await bareClient(baseUrl, "", options).post(
-      "/api/v1/cli/token-exchange",
-      { code, code_verifier: verifier }
-    );
+    const body = await bareClient(baseUrl, "", options).post("/api/v1/cli/token-exchange", { code, code_verifier: verifier });
     const token = body.data?.token;
     if (typeof token === "string" && token !== "") return { ok: true, token };
-    return { ok: false, message: "the login-code exchange returned no token \u2014 aborting" };
+    return {
+      ok: false,
+      message: "the login-code exchange returned no token \u2014 aborting"
+    };
   } catch (error) {
     if (error instanceof HttpError) {
-      return { ok: false, message: `the login-code exchange failed: ${error.message}` };
+      return {
+        ok: false,
+        message: `the login-code exchange failed: ${error.message}`
+      };
     }
     if (error instanceof TransportError) {
-      return { ok: false, message: `the login-code exchange failed: cannot reach the API (${error.message})` };
+      return {
+        ok: false,
+        message: `the login-code exchange failed: cannot reach the API (${error.message})`
+      };
     }
     throw error;
   }
@@ -288,7 +513,10 @@ async function verifyAndStore(baseUrl, token, options) {
   } catch (error) {
     await client.delete("/api/v1/session").catch(() => void 0);
     const detail = error instanceof Error ? error.message : String(error);
-    return { ok: false, message: `could not store credentials at ${path}: ${detail}` };
+    return {
+      ok: false,
+      message: `could not store credentials at ${path}: ${detail}`
+    };
   }
   if (superseded !== null) {
     await bareClient(superseded.url, superseded.token, options).delete("/api/v1/session").catch(() => void 0);
@@ -378,7 +606,10 @@ function defaultNotify(line) {
   process.stderr.write(line + "\n");
 }
 function defaultPrompt() {
-  const readline = createInterface({ input: process.stdin, output: process.stderr });
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
   return new Promise((resolve) => {
     readline.question("Token: ", (answer) => {
       readline.close();