@automattic/vip 4.0.9 → 4.0.11

package/dist/lib/rechallenge/token-cache.js

@@ -0,0 +1,113 @@
+"use strict";
+
+exports.__esModule = true;
+exports.default = void 0;
+var _debug = _interopRequireDefault(require("debug"));
+var _constants = require("../api/constants");
+var _keychain = require("../keychain");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('@automattic/vip:rechallenge:cache');
+// Storage strategy: a single keychain entry holds a JSON map { [scope]: ElevatedToken }.
+// The vip-cli Keychain interface (src/lib/keychain/keychain.ts) is service-only — there
+// is no separate account argument — so per-scope entries under the keytar model would
+// require a different keying scheme. The single-blob approach also keeps clearAll() cheap.
+// This is marked subject-to-change in the spec pending security review.
+const BASE_SERVICE = 'vip-go-cli:elevated';
+function serviceName() {
+  if (_constants.API_HOST === _constants.PRODUCTION_API_HOST) {
+    return BASE_SERVICE;
+  }
+  const sanitized = _constants.API_HOST.replace(/[^a-z0-9]/gi, '-');
+  return `${BASE_SERVICE}:${sanitized}`;
+}
+let inMemory = null;
+async function read() {
+  if (inMemory) {
+    return inMemory;
+  }
+  const keychain = await (0, _keychain.getKeychain)();
+  const raw = await keychain.getPassword(serviceName());
+  if (!raw) {
+    inMemory = {};
+    return inMemory;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+      inMemory = parsed;
+    } else {
+      debug('Elevated token blob had unexpected shape; resetting');
+      inMemory = {};
+      await keychain.deletePassword(serviceName());
+    }
+  } catch (err) {
+    debug('Failed to parse elevated token blob; resetting (%o)', err);
+    inMemory = {};
+    await keychain.deletePassword(serviceName());
+  }
+  return inMemory;
+}
+async function write(blob) {
+  inMemory = blob;
+  const keychain = await (0, _keychain.getKeychain)();
+  if (Object.keys(blob).length === 0) {
+    await keychain.deletePassword(serviceName());
+  } else {
+    await keychain.setPassword(serviceName(), JSON.stringify(blob));
+  }
+}
+function isExpired(token) {
+  const exp = Date.parse(token.expiresAt);
+  if (Number.isNaN(exp)) {
+    return true;
+  }
+  // Treat tokens within the next 5 seconds as effectively expired.
+  return Date.now() >= exp - 5_000;
+}
+async function get(scope) {
+  const blob = await read();
+  const token = blob[scope];
+  if (!token) {
+    return null;
+  }
+  if (isExpired(token)) {
+    debug('Cached elevated token for %s is expired; evicting', scope);
+    const {
+      [scope]: _evicted,
+      ...rest
+    } = blob;
+    await write(rest);
+    return null;
+  }
+  return token;
+}
+async function set(scope, token) {
+  const blob = await read();
+  blob[scope] = token;
+  await write(blob);
+}
+async function clearScope(scope) {
+  const blob = await read();
+  if (scope in blob) {
+    const {
+      [scope]: _removed,
+      ...rest
+    } = blob;
+    await write(rest);
+  }
+}
+async function clearAll() {
+  inMemory = {};
+  const keychain = await (0, _keychain.getKeychain)();
+  await keychain.deletePassword(serviceName());
+}
+function _resetInMemoryForTests() {
+  inMemory = null;
+}
+var _default = exports.default = {
+  get,
+  set,
+  clearScope,
+  clearAll,
+  _resetInMemoryForTests
+};

package/dist/lib/rechallenge/types.js

@@ -0,0 +1,15 @@
+"use strict";
+
+exports.__esModule = true;
+exports.RECHALLENGE_VERSION = exports.ELEVATED_PERMISSION_ERROR_CODE = exports.CLIENT_TYPE = void 0;
+const ELEVATED_PERMISSION_ERROR_CODE = exports.ELEVATED_PERMISSION_ERROR_CODE = 'elevated-permission-required';
+const RECHALLENGE_VERSION = exports.RECHALLENGE_VERSION = 'v2';
+const CLIENT_TYPE = exports.CLIENT_TYPE = 'cli';
+
+/** Shape of `errors[0].extensions.rechallenge` from the API. */
+
+/** Response from POST {createSessionPath}. */
+
+/** Response from GET {statusPathTemplate}. */
+
+/** Response from POST {exchangePathTemplate}. */

package/dist/lib/token.js

@@ -4,9 +4,8 @@ exports.__esModule = true;
 exports.default = exports.SERVICE = void 0;
 var _jwtDecode = require("jwt-decode");
 var _nodeCrypto = require("node:crypto");
-var _api = require("./api");
-var _keychain = _interopRequireDefault(require("./keychain"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+var _constants = require("./api/constants");
+var _keychain = require("./keychain");
 // Config
 const SERVICE = exports.SERVICE = 'vip-go-cli';
 class Token {
@@ -62,34 +61,39 @@ class Token {
   }
   static async uuid() {
     const service = Token.getServiceName('-uuid');
-    let _uuid = await _keychain.default.getPassword(service);
+    const keychain = await (0, _keychain.getKeychain)();
+    let _uuid = await keychain.getPassword(service);
     if (!_uuid) {
       _uuid = (0, _nodeCrypto.randomUUID)();
-      await _keychain.default.setPassword(service, _uuid);
+      await keychain.setPassword(service, _uuid);
     }
     return _uuid;
   }
   static async setUuid(_uuid) {
     const service = Token.getServiceName('-uuid');
-    await _keychain.default.setPassword(service, _uuid);
+    const keychain = await (0, _keychain.getKeychain)();
+    await keychain.setPassword(service, _uuid);
   }
-  static set(token) {
+  static async set(token) {
     const service = Token.getServiceName();
-    return _keychain.default.setPassword(service, token);
+    const keychain = await (0, _keychain.getKeychain)();
+    return keychain.setPassword(service, token);
   }
   static async get() {
     const service = Token.getServiceName();
-    const token = (await _keychain.default.getPassword(service)) ?? '';
-    return new Token(token);
+    const keychain = await (0, _keychain.getKeychain)();
+    const token = await keychain.getPassword(service);
+    return new Token(token ?? '');
   }
-  static purge() {
+  static async purge() {
     const service = Token.getServiceName();
-    return _keychain.default.deletePassword(service);
+    const keychain = await (0, _keychain.getKeychain)();
+    return keychain.deletePassword(service);
   }
   static getServiceName(modifier = '') {
     let service = SERVICE;
-    if (_api.PRODUCTION_API_HOST !== _api.API_HOST) {
-      const sanitized = _api.API_HOST.replace(/[^a-z0-9]/gi, '-');
+    if (_constants.PRODUCTION_API_HOST !== _constants.API_HOST) {
+      const sanitized = _constants.API_HOST.replace(/[^a-z0-9]/gi, '-');
       service = `${SERVICE}:${sanitized}`;
     }
     return `${service}${modifier}`;

package/docs/SETUP.md

@@ -63,7 +63,7 @@ npm run build
 
 ## Usage
 
-The software runs as standalone CLI and relies on environmental variables for configuration and a few configuration files.
+The software runs as standalone CLI and relies on environment variables for configuration and a few configuration files.
 
 ### Starting up locally
 
@@ -85,15 +85,15 @@ By default, we record information about the usage of this tool using an in-house
 
 Install the software locally, run and follow the instructions to configure the access token.
 
-### Environmental variables
+### Environment variables
 
-#### Configuring environmental variables
+#### Configuring environment variables
 
-Environmental variables are configured in the shell. Use normal shell commands to set them.
+Environment variables are configured in the shell. Use normal shell commands to set them.
 
-#### List of environmental variables
+#### List of environment variables
 
-This application uses environmental variables for vital configuration information. Find a partial list below.
+This application uses environment variables for vital configuration information. Find a partial list below.
 
 TODO: Update description of the variables.
 
@@ -108,6 +108,7 @@ TODO: Update description of the variables.
 - `HTTP_PROXY`:
 - `NO_PROXY`:
 - `VIP_PROXY`: [For internal VIP use](TESTING.md#local-testing).
+- `VIP_RECHALLENGE_WAIT`: set to `1` to print the verification URL and wait for rechallenge completion on another device.
 - `VIP_USE_SYSTEM_PROXY`:
 - `WPVIP_DEPLOY_TOKEN`: For use with `vip app deploy` on sites that have custom deploys enabled.
 

package/docs/decisions/0001-operation-scoped-elevated-token-reuse.md

@@ -0,0 +1,87 @@
+---
+status: accepted
+date: 2026-07-01
+---
+
+# Accept Operation-Scoped Elevated Token Reuse
+
+## Context and Problem Statement
+
+Step-up rechallenge currently issues elevated tokens scoped by GraphQL `requestedOperation` (mutation field name or operation domain), not by app, environment, or payload details.
+
+The team must decide whether this behavior should be treated as a defect that requires per-resource rebinding, or as intended product behavior.
+
+Primary workflow motivation: users may need to perform the same protected operation repeatedly across many targets, such as adding many domains to multiple environments. Requiring a new rechallenge for every target would add significant friction.
+
+## Decision Drivers
+
+- Reduce repeated operator friction in bulk workflows.
+- Preserve baseline authorization enforcement at resolver level.
+- Keep step-up semantics understandable: user confirms an operation class, not one specific payload.
+- Avoid unnecessary complexity in token minting, validation, and client caching.
+- Keep room for future hardening if product intent changes.
+
+## Considered Options
+
+- Option 1: Keep operation-scoped elevated token reuse.
+- Option 2: Require per-resource scoped elevated tokens (bind to app/environment/payload).
+- Option 3: Disable reuse and force fresh rechallenge on every protected mutation.
+
+## Decision Outcome
+
+Chosen option: Option 1, keep operation-scoped elevated token reuse.
+
+Accepted behavior: a valid elevated token for a protected operation may be reused across app/environment targets while token validity holds.
+
+This is intentional because it removes repeated rechallenge prompts in high-volume administrative workflows, including adding many domains across multiple environments.
+
+### Consequences
+
+Good, because:
+
+- Bulk operations become materially faster and less error-prone for users.
+- Behavior aligns with current implementation and avoids disruptive contract changes.
+- Security posture remains layered: resolver authorization still enforces target access for the authenticated user.
+
+Bad, because:
+
+- Some readers may incorrectly assume step-up approval is resource-bound.
+- If future product intent requires per-resource confirmation, this decision will need to be superseded and implementation changed.
+
+Neutral, because:
+
+- This decision does not change which mutations are protected; it defines scope behavior once a mutation is protected.
+
+### Confirmation
+
+The decision is considered correctly implemented when all of the following hold:
+
+- Rechallenge token scope is derived from `requestedOperation`.
+- Elevated token validation checks operation/operationDomain compatibility.
+- Resolver-level authorization remains enforced independently of elevated token scope.
+- Documentation and support guidance describe operation-scoped reuse as intended behavior.
+
+## Pros and Cons of the Options
+
+### Option 1: Keep operation-scoped elevated token reuse
+
+- Good, because it optimizes repeated protected actions across many targets.
+- Good, because it matches existing VIP CLI and GOOP behavior.
+- Bad, because it may be perceived as broader than least-privilege if readers expect resource scoping.
+
+### Option 2: Require per-resource scoped elevated tokens
+
+- Good, because it enforces tighter binding between step-up and target resource.
+- Bad, because it increases user friction and rechallenge frequency in bulk workflows.
+- Bad, because it introduces higher implementation and rollout complexity.
+
+### Option 3: Disable reuse and force fresh rechallenge every time
+
+- Good, because the model is simple and strict.
+- Bad, because it has the worst user experience for repetitive operations.
+- Bad, because it provides limited practical security gain beyond existing authorization checks.
+
+## More Information
+
+- Source validation and rationale: https://github.com/Automattic/vip-cli/pull/2869
+- Revisit trigger: if product/security policy explicitly requires per-resource step-up approval, supersede this ADR with a new decision and migration plan.

package/npm-shrinkwrap.json

@@ -1,16 +1,16 @@
 {
   "name": "@automattic/vip",
-  "version": "4.0.9",
+  "version": "4.0.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@automattic/vip",
-      "version": "4.0.9",
+      "version": "4.0.11",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@apollo/client": "4.2.3",
+        "@apollo/client": "4.2.5",
         "@automattic/vip-search-replace": "^2.0.0",
         "@json2csv/plainjs": "^7.0.3",
         "@wwa/single-line-log": "^1.1.4",
@@ -145,9 +145,9 @@
       }
     },
     "node_modules/@apollo/client": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/@apollo/client/-/client-4.2.3.tgz",
-      "integrity": "sha512-+auRYBXow2v7cT+wKzvjyMyyEojq+G7Sf80vIR57rtEPcxRFuMXuU9IKjwxZ3muclUgdGKwZXNeuki+g0GabgQ==",
+      "version": "4.2.5",
+      "resolved": "https://registry.npmjs.org/@apollo/client/-/client-4.2.5.tgz",
+      "integrity": "sha512-1VyJ4eAriUFCfK2Btc09PQtxxgrnmoO1Dbg2A1O7MQbsK1ri5GSWBzc7/P6A0KJrkWll/Ojf9HC6ptIET8yv3g==",
       "license": "MIT",
       "dependencies": {
         "@graphql-typed-document-node/core": "^3.1.1",
@@ -4594,9 +4594,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.0.0.tgz",
-      "integrity": "sha512-vf2YFi1iY9lHGwNJMs01biZFbKJkrZR1T6/MlzjhJLPdntOHLhTrDSnSVcdtvjihi4VQNlrFRIxLsDBlQpAipA==",
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.0.tgz",
+      "integrity": "sha512-O0A1G3xPGy4w7AgQdAQYUlQ+BKk2Oovw8eRpofyp5KdBZULnbe+WqaOVNrm705SHphCiG4XHsACrSmPu1f+Kgw==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.3.0"
@@ -6914,9 +6914,9 @@
       }
     },
     "node_modules/dockerode": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/dockerode/-/dockerode-5.0.0.tgz",
-      "integrity": "sha512-C52mvJ+7lcyhWNfrzVfFsbTrBfy/ezE9FGEYLpu17FUeBcCkxERk9nN7uDl/478ynDiQ4U+5DbQC2vENHkVEtQ==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/dockerode/-/dockerode-5.0.1.tgz",
+      "integrity": "sha512-avsq/xk4YPIrn0CgleX5bjT9Y8IT1p9PxrNQ++RBQ2WEyFfHCTDsT9kmyxz+H/axnjAwg8wJWEIuPGOUuNupiA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@balena/dockerignore": "^1.0.2",
@@ -11418,9 +11418,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.1.0.tgz",
-      "integrity": "sha512-s8VA5jkR8f22S3NAXmhKPFqGUduqZGlsufabVOgN14iTdw/RXcym7bKkbwjxLK9Yw2lEvvmJjFp119+KPeo8Kg==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
+      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
       "funding": [
         {
           "type": "github",
@@ -14172,9 +14172,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.19",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
+      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automattic/vip",
-  "version": "4.0.9",
+  "version": "4.0.11",
   "description": "The VIP Javascript library & CLI",
   "main": "index.js",
   "bin": {
@@ -27,6 +27,10 @@
     "vip-config-software-update": "dist/bin/vip-config-software-update.js",
     "vip-db": "dist/bin/vip-db.js",
     "vip-db-phpmyadmin": "dist/bin/vip-db-phpmyadmin.js",
+    "vip-defensive-mode": "dist/bin/vip-defensive-mode.js",
+    "vip-defensive-mode-configure": "dist/bin/vip-defensive-mode-configure.js",
+    "vip-defensive-mode-disable": "dist/bin/vip-defensive-mode-disable.js",
+    "vip-defensive-mode-enable": "dist/bin/vip-defensive-mode-enable.js",
     "vip-dev-env": "dist/bin/vip-dev-env.js",
     "vip-dev-env-create": "dist/bin/vip-dev-env-create.js",
     "vip-dev-env-update": "dist/bin/vip-dev-env-update.js",
@@ -141,7 +145,7 @@
     "typescript": "^6.0.2"
   },
   "dependencies": {
-    "@apollo/client": "4.2.3",
+    "@apollo/client": "4.2.5",
     "@automattic/vip-search-replace": "^2.0.0",
     "@json2csv/plainjs": "^7.0.3",
     "@wwa/single-line-log": "^1.1.4",