@automattic/vip 4.0.10 → 4.0.13

package/dist/lib/defensive-mode/api.js

@@ -0,0 +1,106 @@
+"use strict";
+
+exports.__esModule = true;
+exports.appQuery = void 0;
+exports.updateDefensiveModeConfig = updateDefensiveModeConfig;
+exports.updateDefensiveModeStatus = updateDefensiveModeStatus;
+var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
+var _api = _interopRequireDefault(require("../api"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const appQuery = exports.appQuery = `
+	id
+	name
+	typeId
+	environments {
+		id
+		appId
+		name
+		primaryDomain {
+			name
+		}
+		type
+		defensiveMode {
+			config {
+				effective {
+					enabled
+					challengeType
+					connectionThresholdAbsolute
+					connectionThresholdPercentage
+					disableAtEpoch
+					keepEnabledUnderThresholdForSeconds
+					maxRequestRate
+					priorityBypass
+				}
+				stored {
+					enabled
+					challengeType
+					connectionThresholdAbsolute
+					connectionThresholdPercentage
+				}
+			}
+		}
+	}
+	organization {
+		id
+		name
+		salesforceId
+	}
+`;
+const STATUS_MUTATION = (0, _graphqlTag.default)`
+	mutation UpdateDefensiveModeStatus($input: AppEnvironmentDefensiveModeUpdateStatusInput) {
+		updateDefensiveModeStatus(input: $input) {
+			success
+			message
+		}
+	}
+`;
+const CONFIG_MUTATION = (0, _graphqlTag.default)`
+	mutation UpdateDefensiveModeConfig($input: AppEnvironmentDefensiveModeConfigInput) {
+		updateDefensiveModeConfig(input: $input) {
+			success
+			message
+		}
+	}
+`;
+async function updateDefensiveModeStatus(input) {
+  const api = (0, _api.default)();
+  const result = await api.mutate({
+    mutation: STATUS_MUTATION,
+    variables: {
+      input: {
+        id: input.appId,
+        environmentId: input.envId,
+        enabled: input.enabled
+      }
+    }
+  });
+  if (!result.data) {
+    throw new Error('updateDefensiveModeStatus returned no data; the API may have rejected the request.');
+  }
+  return result.data.updateDefensiveModeStatus;
+}
+async function updateDefensiveModeConfig(input) {
+  const api = (0, _api.default)();
+  const mutationInput = {
+    id: input.appId,
+    environmentId: input.envId,
+    enabled: input.enabled,
+    challengeType: input.challengeType
+  };
+  if (input.connectionThresholdAbsolute !== undefined) {
+    mutationInput.connectionThresholdAbsolute = input.connectionThresholdAbsolute;
+  }
+  if (input.connectionThresholdPercentage !== undefined) {
+    mutationInput.connectionThresholdPercentage = input.connectionThresholdPercentage;
+  }
+  const result = await api.mutate({
+    mutation: CONFIG_MUTATION,
+    variables: {
+      input: mutationInput
+    }
+  });
+  if (!result.data) {
+    throw new Error('updateDefensiveModeConfig returned no data; the API may have rejected the request.');
+  }
+  return result.data.updateDefensiveModeConfig;
+}

package/dist/lib/defensive-mode/cli-helpers.js

@@ -0,0 +1,60 @@
+"use strict";
+
+exports.__esModule = true;
+exports.guardProductionMutation = guardProductionMutation;
+exports.isInteractive = isInteractive;
+exports.reportMutationResult = reportMutationResult;
+var _chalk = _interopRequireDefault(require("chalk"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+function isInteractive(opt) {
+  if (process.env.VIP_NON_INTERACTIVE === '1') {
+    return false;
+  }
+  if (opt.nonInteractive) {
+    return false;
+  }
+  return Boolean(process.stdout.isTTY);
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+
+/**
+ * Guards production mutations that require confirmation.
+ * Returns when the command should proceed. In non-interactive contexts without
+ * --skip-confirmation it emits an error and calls process.exit(1) directly.
+ * If the user declines the interactive prompt it calls process.exit() directly.
+ */
+async function guardProductionMutation(opt, action, trackingParams, confirmFn, trackEventFn, formatEnvironment) {
+  if (opt.skipConfirmation || opt.env.type !== 'production') {
+    return;
+  }
+  if (!isInteractive(opt)) {
+    console.error(_chalk.default.red(`Refusing to ${action} defensive mode on production without confirmation. ` + 'Pass --skip-confirmation to proceed non-interactively.'));
+    await trackEventFn(`defensive_mode_${action}_command_cancelled`, trackingParams);
+    process.exit(1);
+  }
+  const yes = await confirmFn(`${capitalize(action)} defensive mode on ${formatEnvironment(opt.env.type)} for ${opt.app.name}?`);
+  if (!yes) {
+    await trackEventFn(`defensive_mode_${action}_command_cancelled`, trackingParams);
+    console.log('Command cancelled');
+    process.exit();
+  }
+}
+
+/**
+ * Handles success/failure reporting, telemetry, and log output after a
+ * defensive-mode mutation. Exits the process on failure.
+ */
+async function reportMutationResult(result, trackingParams, action, appName, envType, successVerb, failureVerb, trackEventFn) {
+  if (!result.success) {
+    await trackEventFn(`defensive_mode_${action}_command_error`, {
+      ...trackingParams,
+      error: result.message
+    });
+    console.error(_chalk.default.red(`Failed to ${failureVerb}: ${result.message}`));
+    process.exit(1);
+  }
+  await trackEventFn(`defensive_mode_${action}_command_success`, trackingParams);
+  console.log(_chalk.default.green('✓'), `Defensive mode ${successVerb} for ${appName}.${envType} — ${result.message}`);
+}

package/dist/lib/dev-environment/dev-environment-configuration-file.js

@@ -6,7 +6,6 @@ exports.getConfigurationFileOptions = getConfigurationFileOptions;
 exports.mergeConfigurationFileOptions = mergeConfigurationFileOptions;
 var _chalk = _interopRequireDefault(require("chalk"));
 var _debug = _interopRequireDefault(require("debug"));
-var _ejs = _interopRequireDefault(require("ejs"));
 var _jsYaml = _interopRequireWildcard(require("js-yaml"));
 var _promises = require("node:fs/promises");
 var _nodePath = _interopRequireDefault(require("node:path"));
@@ -17,6 +16,8 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 const debug = (0, _debug.default)('@automattic/vip:bin:dev-environment');
 const CONFIGURATION_FILE_NAME = exports.CONFIGURATION_FILE_NAME = 'vip-dev-env.yml';
 const CONFIGURATION_TEMPLATE_FILE_NAME = exports.CONFIGURATION_TEMPLATE_FILE_NAME = 'vip-dev-env.yml.ejs';
+const ALLOWED_CONFIG_DIR_TEMPLATE = /<%=\s*configDir\s*%>/g;
+const EJS_TEMPLATE_TAG = /<%[\s\S]*?%>/;
 async function getConfigurationFileOptions() {
   const configurationFile = await findConfigurationFile();
   if (configurationFile === false) {
@@ -176,26 +177,30 @@ async function findConfigurationFile() {
     file,
     template
   } of locations) {
+    let contents;
     try {
       // eslint-disable-next-line no-await-in-loop
-      const contents = await (0, _promises.readFile)(file, 'utf8');
-      if (template) {
-        const rendered = _ejs.default.render(contents, {
-          configDir: dir
-        });
-        return {
-          configurationPath: file,
-          configurationContents: rendered
-        };
+      contents = await (0, _promises.readFile)(file, 'utf8');
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error('Unknown error');
+      debug(`Error reading file ${file}: ${err.message}`);
+      continue;
+    }
+    if (template) {
+      const stripped = contents.replace(ALLOWED_CONFIG_DIR_TEMPLATE, '');
+      if (EJS_TEMPLATE_TAG.test(stripped)) {
+        exit.withError(`EJS JavaScript is not supported in dev-env configuration file ${file}. ` + 'Use plain YAML, or only the supported <%= configDir %> placeholder.');
       }
+      const rendered = contents.replace(ALLOWED_CONFIG_DIR_TEMPLATE, () => dir);
       return {
         configurationPath: file,
-        configurationContents: contents
+        configurationContents: rendered
       };
-    } catch (error) {
-      const err = error instanceof Error ? error : new Error('Unknown error');
-      debug(`Error reading or rendering file ${file}: ${err.message}`);
     }
+    return {
+      configurationPath: file,
+      configurationContents: contents
+    };
   }
   return false;
 }

package/dist/lib/logout.js

@@ -3,14 +3,19 @@
 exports.__esModule = true;
 exports.default = void 0;
 var _http = _interopRequireDefault(require("../lib/api/http"));
+var _tokenCache = _interopRequireDefault(require("../lib/rechallenge/token-cache"));
 var _token = _interopRequireDefault(require("../lib/token"));
 var _tracker = require("../lib/tracker");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 var _default = async () => {
-  await (0, _http.default)('/logout', {
-    method: 'post'
-  });
-  await _token.default.purge();
+  try {
+    await (0, _http.default)('/logout', {
+      method: 'post'
+    });
+  } finally {
+    await _token.default.purge();
+    await _tokenCache.default.clearAll();
+  }
   await (0, _tracker.trackEvent)('logout_command_execute');
 };
 exports.default = _default;

package/dist/lib/rechallenge/client.js

@@ -0,0 +1,55 @@
+"use strict";
+
+exports.__esModule = true;
+exports.createSession = createSession;
+exports.exchange = exchange;
+exports.getSessionStatus = getSessionStatus;
+var _debug = _interopRequireDefault(require("debug"));
+var _nodeCrypto = require("node:crypto");
+var _errors = require("./errors");
+var _types = require("./types");
+var _http = _interopRequireDefault(require("../api/http"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+// Derived from http() rather than imported from a fetch library, so this module
+// keeps compiling across the node-fetch -> undici migration (trunk #2837).
+
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:client');
+function fillTemplate(template, challengeId) {
+  return template.replaceAll('{challengeId}', encodeURIComponent(challengeId));
+}
+async function parseOrThrow(response, scope) {
+  if (!response.ok) {
+    const text = await response.text();
+    throw new _errors.RechallengeHttpError(response.status, text, scope);
+  }
+  return await response.json();
+}
+async function createSession(opts) {
+  debug('createSession scope=%s', opts.requestedOperation);
+  const response = await (0, _http.default)(opts.path, {
+    method: 'POST',
+    headers: {
+      // New UUID per call — intent is a fresh session per invocation, not request deduplication.
+      'Idempotency-Key': (0, _nodeCrypto.randomUUID)()
+    },
+    body: {
+      clientType: _types.CLIENT_TYPE,
+      requestedOperation: opts.requestedOperation
+    }
+  });
+  return parseOrThrow(response, opts.requestedOperation);
+}
+async function getSessionStatus(opts) {
+  const path = fillTemplate(opts.template, opts.challengeId);
+  const response = await (0, _http.default)(path, {
+    method: 'GET'
+  });
+  return parseOrThrow(response, opts.scope ?? '');
+}
+async function exchange(opts) {
+  const path = fillTemplate(opts.template, opts.challengeId);
+  const response = await (0, _http.default)(path, {
+    method: 'POST'
+  });
+  return parseOrThrow(response, opts.scope ?? '');
+}

package/dist/lib/rechallenge/errors.js

@@ -0,0 +1,55 @@
+"use strict";
+
+exports.__esModule = true;
+exports.RechallengeUnsupportedVersionError = exports.RechallengeTerminalError = exports.RechallengeInteractionRequiredError = exports.RechallengeHttpError = exports.RechallengeError = exports.RechallengeAbortedError = void 0;
+var _types = require("./types");
+class RechallengeError extends Error {
+  scope;
+  constructor(message, scope) {
+    super(message);
+    this.name = 'RechallengeError';
+    this.scope = scope;
+  }
+}
+exports.RechallengeError = RechallengeError;
+class RechallengeUnsupportedVersionError extends RechallengeError {
+  constructor(version, scope) {
+    super(`Server requested rechallenge version "${version}" but this CLI only supports ${_types.RECHALLENGE_VERSION}. Update vip-cli.`, scope);
+    this.name = 'RechallengeUnsupportedVersionError';
+  }
+}
+exports.RechallengeUnsupportedVersionError = RechallengeUnsupportedVersionError;
+class RechallengeTerminalError extends RechallengeError {
+  status;
+  constructor(status, scope, detail) {
+    super(`Step-up verification did not complete (status=${status})${detail ? `: ${detail}` : ''}.`, scope);
+    this.name = 'RechallengeTerminalError';
+    this.status = status;
+  }
+}
+exports.RechallengeTerminalError = RechallengeTerminalError;
+class RechallengeAbortedError extends RechallengeError {
+  constructor(scope) {
+    super('Step-up verification was cancelled.', scope);
+    this.name = 'RechallengeAbortedError';
+  }
+}
+exports.RechallengeAbortedError = RechallengeAbortedError;
+class RechallengeHttpError extends RechallengeError {
+  statusCode;
+  bodyText;
+  constructor(statusCode, bodyText, scope) {
+    super(`Step-up verification request failed (HTTP ${statusCode}): ${bodyText}`, scope);
+    this.name = 'RechallengeHttpError';
+    this.statusCode = statusCode;
+    this.bodyText = bodyText;
+  }
+}
+exports.RechallengeHttpError = RechallengeHttpError;
+class RechallengeInteractionRequiredError extends RechallengeError {
+  constructor(scope) {
+    super(`Step-up verification is required for ${scope}, but this is a non-interactive session. ` + 'Re-run the command interactively, or pass --rechallenge-wait (or set VIP_RECHALLENGE_WAIT=1) ' + 'to print the verification URL and wait for you to complete it on another device.', scope);
+    this.name = 'RechallengeInteractionRequiredError';
+  }
+}
+exports.RechallengeInteractionRequiredError = RechallengeInteractionRequiredError;

package/dist/lib/rechallenge/flow.js

@@ -0,0 +1,145 @@
+"use strict";
+
+exports.__esModule = true;
+exports.isInteractiveContext = isInteractiveContext;
+exports.runRechallenge = runRechallenge;
+exports.shouldWaitForRechallenge = shouldWaitForRechallenge;
+var _chalk = _interopRequireDefault(require("chalk"));
+var _debug = _interopRequireDefault(require("debug"));
+var _promises = require("node:timers/promises");
+var _tracker = require("../tracker");
+var client = _interopRequireWildcard(require("./client"));
+var _errors = require("./errors");
+var _openBrowser = require("./open-browser");
+var _tokenCache = _interopRequireDefault(require("./token-cache"));
+var _types = require("./types");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:flow');
+
+// Floor for the server-provided poll interval. Guards against a missing/0/NaN
+// value (which would otherwise produce a tight status-poll loop) and clamps
+// implausibly small values so a misbehaving server cannot make us hammer the API.
+const MIN_POLL_INTERVAL_SECONDS = 2;
+const TERMINAL = new Set(['verified', 'expired', 'failed', 'cancelled']);
+async function runRechallenge(opts) {
+  const {
+    requestedOperation,
+    rechallenge,
+    interactive,
+    wait,
+    signal
+  } = opts;
+  if (rechallenge.version !== _types.RECHALLENGE_VERSION) {
+    throw new _errors.RechallengeUnsupportedVersionError(rechallenge.version, requestedOperation);
+  }
+  await (0, _tracker.trackEvent)('rechallenge_required', {
+    scope: requestedOperation,
+    clientType: _types.CLIENT_TYPE
+  });
+
+  // In a non-interactive session with no opt-in to wait, fail fast instead of
+  // creating a verification session no human can complete — automation would
+  // otherwise block until the session expires.
+  if (!interactive && !wait) {
+    await (0, _tracker.trackEvent)('rechallenge_interaction_required', {
+      scope: requestedOperation
+    });
+    throw new _errors.RechallengeInteractionRequiredError(requestedOperation);
+  }
+  const session = await client.createSession({
+    path: rechallenge.createSessionPath,
+    requestedOperation
+  });
+  await (0, _tracker.trackEvent)('rechallenge_session_created', {
+    scope: requestedOperation
+  });
+  const verificationUrl = session.verificationUrl;
+  const expiresIso = session.expiresAt;
+  if (interactive) {
+    await (0, _openBrowser.openBrowser)(verificationUrl);
+    console.warn(_chalk.default.yellow('⚠'), `Step-up verification required for ${_chalk.default.bold(requestedOperation)}.`);
+    console.warn(`  Open ${_chalk.default.cyan(verificationUrl)}`);
+    console.warn(`  If your browser did not open, copy and paste the URL above. Expires at ${expiresIso}.`);
+  } else {
+    console.warn(`Step-up verification required for ${requestedOperation}. ` + `Complete it at: ${verificationUrl} (expires at ${expiresIso}).`);
+  }
+  const requestedInterval = Number(session.pollIntervalSeconds);
+  const interval = Math.max(Number.isFinite(requestedInterval) ? requestedInterval : MIN_POLL_INTERVAL_SECONDS, MIN_POLL_INTERVAL_SECONDS) * 1000;
+  const deadline = Date.parse(session.expiresAt);
+  if (Number.isNaN(deadline)) {
+    throw new _errors.RechallengeTerminalError('expired', requestedOperation, 'server returned unparseable expiresAt');
+  }
+
+  /* eslint-disable no-await-in-loop -- polling loop; each iteration must complete before the next */
+  while (true) {
+    if (signal?.aborted) {
+      throw new _errors.RechallengeAbortedError(requestedOperation);
+    }
+    try {
+      await (0, _promises.setTimeout)(interval, undefined, {
+        signal
+      });
+    } catch {
+      throw new _errors.RechallengeAbortedError(requestedOperation);
+    }
+    if (!Number.isNaN(deadline) && Date.now() > deadline) {
+      throw new _errors.RechallengeTerminalError('expired', requestedOperation, 'session window elapsed before completion');
+    }
+    const status = await client.getSessionStatus({
+      template: rechallenge.statusPathTemplate,
+      challengeId: session.challengeId,
+      scope: requestedOperation
+    });
+    if (!TERMINAL.has(status.status)) {
+      debug('still %s; polling again', status.status);
+      continue;
+    }
+    if (status.status === 'verified') {
+      await (0, _tracker.trackEvent)('rechallenge_verified', {
+        scope: requestedOperation,
+        provider: status.provider ?? 'unknown'
+      });
+      const {
+        elevatedToken
+      } = await client.exchange({
+        template: rechallenge.exchangePathTemplate,
+        challengeId: session.challengeId,
+        scope: requestedOperation
+      });
+      await (0, _tracker.trackEvent)('rechallenge_exchanged', {
+        scope: requestedOperation
+      });
+      await _tokenCache.default.set(requestedOperation, {
+        ...elevatedToken,
+        headerName: rechallenge.elevatedHeaderName
+      });
+      return elevatedToken;
+    }
+    await (0, _tracker.trackEvent)(`rechallenge_${status.status}`, {
+      scope: requestedOperation
+    });
+    throw new _errors.RechallengeTerminalError(status.status, requestedOperation, status.statusReason?.message);
+  }
+  /* eslint-enable no-await-in-loop */
+}
+function isInteractiveContext(argvOrFlags = process.argv) {
+  if (process.env.VIP_NON_INTERACTIVE === '1') {
+    return false;
+  }
+  if (argvOrFlags.some(item => item === '--non-interactive' || item.startsWith('--non-interactive=') && !/^--non-interactive=(0|false|no|off)$/i.test(item))) {
+    return false;
+  }
+  return Boolean(process.stdout.isTTY);
+}
+
+// Opt-in for waiting on step-up in a non-interactive session: the operator can
+// complete browser verification on another device while the command polls.
+// Mirrors isInteractiveContext's argv/env detection because the rechallenge link
+// is instantiated globally and cannot read a command's parsed options.
+function shouldWaitForRechallenge(argvOrFlags = process.argv) {
+  if (process.env.VIP_RECHALLENGE_WAIT === '1') {
+    return true;
+  }
+  return argvOrFlags.some(item => item === '--rechallenge-wait' || item.startsWith('--rechallenge-wait=') && !/^--rechallenge-wait=(0|false|no|off)$/i.test(item));
+}

package/dist/lib/rechallenge/index.js

@@ -0,0 +1,27 @@
+"use strict";
+
+exports.__esModule = true;
+var _exportNames = {
+  rechallengeLink: true,
+  tokenCache: true
+};
+exports.tokenCache = exports.rechallengeLink = void 0;
+var _link = _interopRequireDefault(require("./link"));
+exports.rechallengeLink = _link.default;
+var _tokenCache = _interopRequireDefault(require("./token-cache"));
+exports.tokenCache = _tokenCache.default;
+var _types = require("./types");
+Object.keys(_types).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _types[key]) return;
+  exports[key] = _types[key];
+});
+var _errors = require("./errors");
+Object.keys(_errors).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _errors[key]) return;
+  exports[key] = _errors[key];
+});
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }