@alwaysmeticulous/client 2.307.0 → 2.311.0

package/dist/oauth/oauth-device-login.js

@@ -0,0 +1,169 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c23e572f-3089-543e-a18d-04649f6856ee")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.performDeviceLogin = void 0;
+const common_1 = require("@alwaysmeticulous/common");
+const oauth_constants_1 = require("./oauth-constants");
+const oauth_pkce_1 = require("./oauth-pkce");
+const oauth_token_store_1 = require("./oauth-token-store");
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+const performDeviceLogin = async () => {
+    const logger = (0, common_1.initLogger)();
+    // PKCE binds the token poll to this process: Keycloak enforces the client's
+    // PKCE policy on the device authorization endpoint too.
+    const codeVerifier = (0, oauth_pkce_1.generateCodeVerifier)();
+    const authorization = await requestDeviceAuthorization({
+        codeChallenge: (0, oauth_pkce_1.generateCodeChallenge)(codeVerifier),
+    });
+    const webappBaseUrl = (0, oauth_constants_1.getWebappBaseUrl)();
+    const cliLoginParams = new URLSearchParams({
+        user_code: authorization.user_code,
+        issuer: oauth_constants_1.KEYCLOAK_ISSUER_URL,
+    });
+    logger.info(`On any device, open: ${webappBaseUrl}/cli-device-login?${cliLoginParams.toString()} ` +
+        `and confirm the code: ${authorization.user_code}`);
+    logger.info(authorization.verification_uri_complete
+        ? `If that doesn't work, open ${authorization.verification_uri_complete}`
+        : `If that doesn't work, open ${authorization.verification_uri} and enter the code manually: ${authorization.user_code}`);
+    const tokens = await pollForTokens({ authorization, codeVerifier });
+    (0, oauth_token_store_1.storeOAuthTokens)(tokens);
+    logger.info("Authentication successful.");
+    return tokens;
+};
+exports.performDeviceLogin = performDeviceLogin;
+const requestDeviceAuthorization = async ({ codeChallenge, }) => {
+    const deviceAuthorizationEndpoint = await (0, oauth_constants_1.getDeviceAuthorizationEndpoint)();
+    const body = new URLSearchParams({
+        client_id: oauth_constants_1.CLI_CLIENT_ID,
+        scope: oauth_constants_1.OAUTH_SCOPES,
+        code_challenge: codeChallenge,
+        code_challenge_method: "S256",
+    });
+    const response = await fetch(deviceAuthorizationEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    const bodyText = await response.text();
+    if (!response.ok) {
+        // Discovery advertises `device_authorization_endpoint` at the realm level
+        // regardless of whether the grant is enabled on this specific client, so
+        // disabling it only on `meticulous-cli` isn't caught by
+        // `getDeviceAuthorizationEndpoint()`. Keycloak instead rejects the request
+        // itself with `unauthorized_client` — catch that here for the same clear
+        // message.
+        if (parseOAuthErrorCode(bodyText) === "unauthorized_client") {
+            throw new Error("The OAuth 2.0 Device Authorization Grant is not enabled for the " +
+                `meticulous-cli client on this realm (${oauth_constants_1.KEYCLOAK_ISSUER_URL}).`);
+        }
+        throw new Error(`Device authorization request failed: ${response.status} ${bodyText}`);
+    }
+    return parseDeviceAuthorizationResponse(bodyText);
+};
+const REQUIRED_DEVICE_AUTHORIZATION_STRING_FIELDS = [
+    "device_code",
+    "user_code",
+    "verification_uri",
+];
+const parseDeviceAuthorizationResponse = (bodyText) => {
+    const data = JSON.parse(bodyText);
+    for (const field of REQUIRED_DEVICE_AUTHORIZATION_STRING_FIELDS) {
+        if (typeof data[field] !== "string" || data[field].length === 0) {
+            throw new Error(`Device authorization response missing required field "${field}".`);
+        }
+    }
+    if (typeof data.expires_in !== "number" ||
+        !Number.isFinite(data.expires_in)) {
+        throw new Error('Device authorization response missing a valid "expires_in".');
+    }
+    return data;
+};
+const pollForTokens = async ({ authorization, codeVerifier, }) => {
+    const tokenEndpoint = await (0, oauth_constants_1.getTokenEndpoint)();
+    const deadline = Date.now() + authorization.expires_in * 1000;
+    let intervalSeconds = authorization.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+    for (;;) {
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new Error("Device code expired, run login again.");
+        }
+        // Cap the sleep to the remaining lifetime so a final token request still
+        // fires before the local deadline, instead of giving up one interval early.
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+        const result = await requestDeviceToken({
+            tokenEndpoint,
+            deviceCode: authorization.device_code,
+            codeVerifier,
+        });
+        if (result.kind === "success") {
+            return result.tokens;
+        }
+        if (result.kind === "slow_down") {
+            intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+        }
+    }
+};
+const requestDeviceToken = async ({ tokenEndpoint, deviceCode, codeVerifier, }) => {
+    const body = new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: deviceCode,
+        client_id: oauth_constants_1.CLI_CLIENT_ID,
+        code_verifier: codeVerifier,
+    });
+    let response;
+    let bodyText;
+    try {
+        response = await fetch(tokenEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: body.toString(),
+        });
+        bodyText = await response.text();
+    }
+    catch {
+        // Transient network blip: keep polling until the local deadline instead
+        // of aborting an otherwise-valid, in-progress login.
+        return { kind: "pending" };
+    }
+    if (response.ok) {
+        const data = JSON.parse(bodyText);
+        return { kind: "success", tokens: mapTokenResponse(data) };
+    }
+    if (response.status >= 500) {
+        // Transient server error (5xx): same reasoning as the network-error case.
+        return { kind: "pending" };
+    }
+    const errorCode = parseOAuthErrorCode(bodyText);
+    if (errorCode === "authorization_pending") {
+        return { kind: "pending" };
+    }
+    if (errorCode === "slow_down") {
+        return { kind: "slow_down" };
+    }
+    if (errorCode === "access_denied") {
+        throw new Error("Login was denied.");
+    }
+    if (errorCode === "expired_token") {
+        throw new Error("Device code expired, run login again.");
+    }
+    throw new Error(`Device token request failed: ${response.status} ${bodyText}`);
+};
+const parseOAuthErrorCode = (bodyText) => {
+    try {
+        return JSON.parse(bodyText).error;
+    }
+    catch {
+        return undefined;
+    }
+};
+const mapTokenResponse = (data) => ({
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token,
+    expiresAt: Math.floor(Date.now() / 1000) + data.expires_in,
+    idToken: data.id_token,
+});
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//# sourceMappingURL=oauth-device-login.js.map
+//# debugId=c23e572f-3089-543e-a18d-04649f6856ee

package/dist/oauth/oauth-device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-login.js","sources":["../../src/oauth/oauth-device-login.ts"],"sourceRoot":"","names":[],"mappings":";;;;;AAAA,qDAAsD;AACtD,uDAO2B;AAC3B,6CAA2E;AAE3E,2DAAuD;AAEvD,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAuB/B,MAAM,kBAAkB,GAAG,KAAK,IAAgC,EAAE;IACvE,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAC;IAE5B,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,YAAY,GAAG,IAAA,iCAAoB,GAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC;QACrD,aAAa,EAAE,IAAA,kCAAqB,EAAC,YAAY,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,IAAA,kCAAgB,GAAE,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,eAAe,CAAC;QACzC,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,MAAM,EAAE,qCAAmB;KAC5B,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,wBAAwB,aAAa,qBAAqB,cAAc,CAAC,QAAQ,EAAE,GAAG;QACpF,yBAAyB,aAAa,CAAC,SAAS,EAAE,CACrD,CAAC;IACF,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,yBAAyB;QACrC,CAAC,CAAC,8BAA8B,aAAa,CAAC,yBAAyB,EAAE;QACzE,CAAC,CAAC,8BAA8B,aAAa,CAAC,gBAAgB,iCAAiC,aAAa,CAAC,SAAS,EAAE,CAC3H,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAEpE,IAAA,oCAAgB,EAAC,MAAM,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAE1C,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AA/BW,QAAA,kBAAkB,sBA+B7B;AAEF,MAAM,0BAA0B,GAAG,KAAK,EAAE,EACxC,aAAa,GAGd,EAAwC,EAAE;IACzC,MAAM,2BAA2B,GAAG,MAAM,IAAA,gDAA8B,GAAE,CAAC;IAE3E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,SAAS,EAAE,+BAAa;QACxB,KAAK,EAAE,8BAAY;QACnB,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,2BAA2B,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,0EAA0E;QAC1E,yEAAyE;QACzE,wDAAwD;QACxD,2EAA2E;QAC3E,yEAAyE;QACzE,WAAW;QACX,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,wCAAwC,qCAAmB,IAAI,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,gCAAgC,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,2CAA2C,GAAG;IAClD,aAAa;IACb,WAAW;IACX,kBAAkB;CACV,CAAC;AAEX,MAAM,gCAAgC,GAAG,CACvC,QAAgB,EACa,EAAE;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAyC,CAAC;IAE1E,KAAK,MAAM,KAAK,IAAI,2CAA2C,EAAE,CAAC;QAChE,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,IAAI,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,IAAmC,CAAC;AAC7C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,EAC3B,aAAa,EACb,YAAY,GAIb,EAA8B,EAAE;IAC/B,MAAM,aAAa,GAAG,MAAM,IAAA,kCAAgB,GAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC;IAC9D,IAAI,eAAe,GAAG,aAAa,CAAC,QAAQ,IAAI,6BAA6B,CAAC;IAE9E,SAAS,CAAC;QACR,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,aAAa;YACb,UAAU,EAAE,aAAa,CAAC,WAAW;YACrC,YAAY;SACb,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,eAAe,IAAI,2BAA2B,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,EAChC,aAAa,EACb,UAAU,EACV,YAAY,GAKb,EAAkC,EAAE;IACnC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,+BAAa;QACxB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;IAEH,IAAI,QAAkB,CAAC;IACvB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,qDAAqD;QACrD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE,CAC9D,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAsB,EAAE;IACnE,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwB,CAAC,KAAK,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,IAAgC,EACb,EAAE,CAAC,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC,YAAY;IAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;IAChC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU;IAC1D,OAAO,EAAE,IAAI,CAAC,QAAQ;CACvB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC","debugId":"c23e572f-3089-543e-a18d-04649f6856ee"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "2.307.0";
+export declare const VERSION = "2.311.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -5,6 +5,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 // AUTO-GENERATED by scripts/generate-version.mjs — do not edit by hand.
 // Regenerated from package.json on every build.
-exports.VERSION = "2.307.0";
+exports.VERSION = "2.311.0";
 //# sourceMappingURL=version.js.map
 //# debugId=ac10f4cc-7a38-5615-8b9d-956b50ad79da

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alwaysmeticulous/client",
-  "version": "2.307.0",
+  "version": "2.311.0",
   "description": "Helper methods for using the Meticulous backend API",
   "license": "ISC",
   "main": "dist/index.js",
@@ -12,8 +12,8 @@
     "loglevel": "^1.8.0",
     "proxy-agent": "^6.4.0",
     "undici": "^6.24.1",
-    "@alwaysmeticulous/api": "2.307.0",
-    "@alwaysmeticulous/common": "2.301.0"
+    "@alwaysmeticulous/common": "2.310.0",
+    "@alwaysmeticulous/api": "2.310.0"
   },
   "author": {
     "name": "The Meticulous Team",