@automattic/vip 4.0.10 → 4.0.11

package/dist/lib/rechallenge/types.js

@@ -0,0 +1,15 @@
+"use strict";
+
+exports.__esModule = true;
+exports.RECHALLENGE_VERSION = exports.ELEVATED_PERMISSION_ERROR_CODE = exports.CLIENT_TYPE = void 0;
+const ELEVATED_PERMISSION_ERROR_CODE = exports.ELEVATED_PERMISSION_ERROR_CODE = 'elevated-permission-required';
+const RECHALLENGE_VERSION = exports.RECHALLENGE_VERSION = 'v2';
+const CLIENT_TYPE = exports.CLIENT_TYPE = 'cli';
+
+/** Shape of `errors[0].extensions.rechallenge` from the API. */
+
+/** Response from POST {createSessionPath}. */
+
+/** Response from GET {statusPathTemplate}. */
+
+/** Response from POST {exchangePathTemplate}. */

package/dist/lib/token.js

@@ -4,7 +4,7 @@ exports.__esModule = true;
 exports.default = exports.SERVICE = void 0;
 var _jwtDecode = require("jwt-decode");
 var _nodeCrypto = require("node:crypto");
-var _api = require("./api");
+var _constants = require("./api/constants");
 var _keychain = require("./keychain");
 // Config
 const SERVICE = exports.SERVICE = 'vip-go-cli';
@@ -92,8 +92,8 @@ class Token {
   }
   static getServiceName(modifier = '') {
     let service = SERVICE;
-    if (_api.PRODUCTION_API_HOST !== _api.API_HOST) {
-      const sanitized = _api.API_HOST.replace(/[^a-z0-9]/gi, '-');
+    if (_constants.PRODUCTION_API_HOST !== _constants.API_HOST) {
+      const sanitized = _constants.API_HOST.replace(/[^a-z0-9]/gi, '-');
       service = `${SERVICE}:${sanitized}`;
     }
     return `${service}${modifier}`;

package/docs/SETUP.md

@@ -63,7 +63,7 @@ npm run build
 
 ## Usage
 
-The software runs as standalone CLI and relies on environmental variables for configuration and a few configuration files.
+The software runs as standalone CLI and relies on environment variables for configuration and a few configuration files.
 
 ### Starting up locally
 
@@ -85,15 +85,15 @@ By default, we record information about the usage of this tool using an in-house
 
 Install the software locally, run and follow the instructions to configure the access token.
 
-### Environmental variables
+### Environment variables
 
-#### Configuring environmental variables
+#### Configuring environment variables
 
-Environmental variables are configured in the shell. Use normal shell commands to set them.
+Environment variables are configured in the shell. Use normal shell commands to set them.
 
-#### List of environmental variables
+#### List of environment variables
 
-This application uses environmental variables for vital configuration information. Find a partial list below.
+This application uses environment variables for vital configuration information. Find a partial list below.
 
 TODO: Update description of the variables.
 
@@ -108,6 +108,7 @@ TODO: Update description of the variables.
 - `HTTP_PROXY`:
 - `NO_PROXY`:
 - `VIP_PROXY`: [For internal VIP use](TESTING.md#local-testing).
+- `VIP_RECHALLENGE_WAIT`: set to `1` to print the verification URL and wait for rechallenge completion on another device.
 - `VIP_USE_SYSTEM_PROXY`:
 - `WPVIP_DEPLOY_TOKEN`: For use with `vip app deploy` on sites that have custom deploys enabled.
 

package/docs/decisions/0001-operation-scoped-elevated-token-reuse.md

@@ -0,0 +1,87 @@
+---
+status: accepted
+date: 2026-07-01
+---
+
+# Accept Operation-Scoped Elevated Token Reuse
+
+## Context and Problem Statement
+
+Step-up rechallenge currently issues elevated tokens scoped by GraphQL `requestedOperation` (mutation field name or operation domain), not by app, environment, or payload details.
+
+The team must decide whether this behavior should be treated as a defect that requires per-resource rebinding, or as intended product behavior.
+
+Primary workflow motivation: users may need to perform the same protected operation repeatedly across many targets, such as adding many domains to multiple environments. Requiring a new rechallenge for every target would add significant friction.
+
+## Decision Drivers
+
+- Reduce repeated operator friction in bulk workflows.
+- Preserve baseline authorization enforcement at resolver level.
+- Keep step-up semantics understandable: user confirms an operation class, not one specific payload.
+- Avoid unnecessary complexity in token minting, validation, and client caching.
+- Keep room for future hardening if product intent changes.
+
+## Considered Options
+
+- Option 1: Keep operation-scoped elevated token reuse.
+- Option 2: Require per-resource scoped elevated tokens (bind to app/environment/payload).
+- Option 3: Disable reuse and force fresh rechallenge on every protected mutation.
+
+## Decision Outcome
+
+Chosen option: Option 1, keep operation-scoped elevated token reuse.
+
+Accepted behavior: a valid elevated token for a protected operation may be reused across app/environment targets while token validity holds.
+
+This is intentional because it removes repeated rechallenge prompts in high-volume administrative workflows, including adding many domains across multiple environments.
+
+### Consequences
+
+Good, because:
+
+- Bulk operations become materially faster and less error-prone for users.
+- Behavior aligns with current implementation and avoids disruptive contract changes.
+- Security posture remains layered: resolver authorization still enforces target access for the authenticated user.
+
+Bad, because:
+
+- Some readers may incorrectly assume step-up approval is resource-bound.
+- If future product intent requires per-resource confirmation, this decision will need to be superseded and implementation changed.
+
+Neutral, because:
+
+- This decision does not change which mutations are protected; it defines scope behavior once a mutation is protected.
+
+### Confirmation
+
+The decision is considered correctly implemented when all of the following hold:
+
+- Rechallenge token scope is derived from `requestedOperation`.
+- Elevated token validation checks operation/operationDomain compatibility.
+- Resolver-level authorization remains enforced independently of elevated token scope.
+- Documentation and support guidance describe operation-scoped reuse as intended behavior.
+
+## Pros and Cons of the Options
+
+### Option 1: Keep operation-scoped elevated token reuse
+
+- Good, because it optimizes repeated protected actions across many targets.
+- Good, because it matches existing VIP CLI and GOOP behavior.
+- Bad, because it may be perceived as broader than least-privilege if readers expect resource scoping.
+
+### Option 2: Require per-resource scoped elevated tokens
+
+- Good, because it enforces tighter binding between step-up and target resource.
+- Bad, because it increases user friction and rechallenge frequency in bulk workflows.
+- Bad, because it introduces higher implementation and rollout complexity.
+
+### Option 3: Disable reuse and force fresh rechallenge every time
+
+- Good, because the model is simple and strict.
+- Bad, because it has the worst user experience for repetitive operations.
+- Bad, because it provides limited practical security gain beyond existing authorization checks.
+
+## More Information
+
+- Source validation and rationale: https://github.com/Automattic/vip-cli/pull/2869
+- Revisit trigger: if product/security policy explicitly requires per-resource step-up approval, supersede this ADR with a new decision and migration plan.

package/npm-shrinkwrap.json

@@ -1,16 +1,16 @@
 {
   "name": "@automattic/vip",
-  "version": "4.0.10",
+  "version": "4.0.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@automattic/vip",
-      "version": "4.0.10",
+      "version": "4.0.11",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@apollo/client": "4.2.3",
+        "@apollo/client": "4.2.5",
         "@automattic/vip-search-replace": "^2.0.0",
         "@json2csv/plainjs": "^7.0.3",
         "@wwa/single-line-log": "^1.1.4",
@@ -145,9 +145,9 @@
       }
     },
     "node_modules/@apollo/client": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/@apollo/client/-/client-4.2.3.tgz",
-      "integrity": "sha512-+auRYBXow2v7cT+wKzvjyMyyEojq+G7Sf80vIR57rtEPcxRFuMXuU9IKjwxZ3muclUgdGKwZXNeuki+g0GabgQ==",
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/@apollo/client/-/client-4.2.5.tgz",
+      "integrity": "sha512-1VyJ4eAriUFCfK2Btc09PQtxxgrnmoO1Dbg2A1O7MQbsK1ri5GSWBzc7/P6A0KJrkWll/Ojf9HC6ptIET8yv3g==",
       "license": "MIT",
       "dependencies": {
         "@graphql-typed-document-node/core": "^3.1.1",
@@ -4594,9 +4594,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.0.0.tgz",
-      "integrity": "sha512-vf2YFi1iY9lHGwNJMs01biZFbKJkrZR1T6/MlzjhJLPdntOHLhTrDSnSVcdtvjihi4VQNlrFRIxLsDBlQpAipA==",
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.0.tgz",
+      "integrity": "sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.3.0"
@@ -6914,9 +6914,9 @@
       }
     },
     "node_modules/dockerode": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/dockerode/-/dockerode-5.0.0.tgz",
-      "integrity": "sha512-C52mvJ+7lcyhWNfrzVfFsbTrBfy/ezE9FGEYLpu17FUeBcCkxERk9nN7uDl/478ynDiQ4U+5DbQC2vENHkVEtQ==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/dockerode/-/dockerode-5.0.1.tgz",
+      "integrity": "sha512-avsq/xk4YPIrn0CgleX5bjT9Y8IT1p9PxrNQ++RBQ2WEyFfHCTDsT9kmyxz+H/axnjAwg8wJWEIuPGOUuNupiA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@balena/dockerignore": "^1.0.2",
@@ -11418,9 +11418,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.0.tgz",
-      "integrity": "sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
+      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
       "funding": [
         {
           "type": "github",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/vip",
-  "version": "4.0.10",
+  "version": "4.0.11",
   "description": "The VIP Javascript library & CLI",
   "main": "index.js",
   "bin": {
@@ -27,6 +27,10 @@
     "vip-config-software-update": "dist/bin/vip-config-software-update.js",
     "vip-db": "dist/bin/vip-db.js",
     "vip-db-phpmyadmin": "dist/bin/vip-db-phpmyadmin.js",
+    "vip-defensive-mode": "dist/bin/vip-defensive-mode.js",
+    "vip-defensive-mode-configure": "dist/bin/vip-defensive-mode-configure.js",
+    "vip-defensive-mode-disable": "dist/bin/vip-defensive-mode-disable.js",
+    "vip-defensive-mode-enable": "dist/bin/vip-defensive-mode-enable.js",
     "vip-dev-env": "dist/bin/vip-dev-env.js",
     "vip-dev-env-create": "dist/bin/vip-dev-env-create.js",
     "vip-dev-env-update": "dist/bin/vip-dev-env-update.js",
@@ -141,7 +145,7 @@
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@apollo/client": "4.2.3",
+    "@apollo/client": "4.2.5",
     "@automattic/vip-search-replace": "^2.0.0",
     "@json2csv/plainjs": "^7.0.3",
     "@wwa/single-line-log": "^1.1.4",