@automattic/vip 4.1.6 → 4.1.8

package/dist/lib/rechallenge/link.js

@@ -1,167 +1,169 @@
 "use strict";
-
-exports.__esModule = true;
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = createRechallengeLink;
-var _core = require("@apollo/client/core");
-var _debug = _interopRequireDefault(require("debug"));
-var _graphql = require("graphql");
-var _flow = require("./flow");
-var _tokenCache = _interopRequireDefault(require("./token-cache"));
-var _types = require("./types");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('@automattic/vip:rechallenge:link');
+const core_1 = require("@apollo/client/core");
+const debug_1 = __importDefault(require("debug"));
+const graphql_1 = require("graphql");
+const flow_1 = require("./flow");
+const token_cache_1 = __importDefault(require("./token-cache"));
+const types_1 = require("./types");
+const debug = (0, debug_1.default)('@automattic/vip:rechallenge:link');
 function operationDefinition(doc) {
-  return doc.definitions.find(def => def.kind === _graphql.Kind.OPERATION_DEFINITION);
+    return doc.definitions.find((def) => def.kind === graphql_1.Kind.OPERATION_DEFINITION);
 }
 function isMutation(doc) {
-  return operationDefinition(doc)?.operation === _graphql.OperationTypeNode.MUTATION;
+    return operationDefinition(doc)?.operation === graphql_1.OperationTypeNode.MUTATION;
 }
 function primaryMutationFieldName(doc) {
-  const op = operationDefinition(doc);
-  if (!op || op.operation !== _graphql.OperationTypeNode.MUTATION) {
-    return null;
-  }
-  const first = op.selectionSet.selections.find(sel => sel.kind === _graphql.Kind.FIELD);
-  return first?.name.value ?? null;
+    const op = operationDefinition(doc);
+    if (!op || op.operation !== graphql_1.OperationTypeNode.MUTATION) {
+        return null;
+    }
+    const first = op.selectionSet.selections.find((sel) => sel.kind === graphql_1.Kind.FIELD);
+    return first?.name.value ?? null;
 }
 function extractElevatedPermission(result) {
-  const errors = result.errors ?? [];
-  for (const err of errors) {
-    const ext = err.extensions ?? {};
-    if (ext.code !== _types.ELEVATED_PERMISSION_ERROR_CODE) {
-      continue;
-    }
-    const rechallenge = ext.rechallenge;
-    if (rechallenge && typeof rechallenge.createSessionPath === 'string' && typeof rechallenge.statusPathTemplate === 'string' && typeof rechallenge.exchangePathTemplate === 'string' && typeof rechallenge.elevatedHeaderName === 'string') {
-      return {
-        rechallenge
-      };
+    const errors = result.errors ?? [];
+    for (const err of errors) {
+        const ext = (err.extensions ?? {});
+        if (ext.code !== types_1.ELEVATED_PERMISSION_ERROR_CODE) {
+            continue;
+        }
+        const rechallenge = ext.rechallenge;
+        if (rechallenge &&
+            typeof rechallenge.createSessionPath === 'string' &&
+            typeof rechallenge.statusPathTemplate === 'string' &&
+            typeof rechallenge.exchangePathTemplate === 'string' &&
+            typeof rechallenge.elevatedHeaderName === 'string') {
+            return { rechallenge };
+        }
     }
-  }
-  return null;
+    return null;
 }
 function attachElevatedHeader(operation, headerName, token) {
-  const ctx = operation.getContext();
-  const headers = {
-    ...ctx.headers
-  };
-  headers[headerName] = token.token;
-  operation.setContext({
-    ...ctx,
-    headers
-  });
+    const ctx = operation.getContext();
+    const headers = { ...ctx.headers };
+    headers[headerName] = token.token;
+    operation.setContext({ ...ctx, headers });
 }
 const DEFAULT_HEADER = 'x-elevated-token';
 function createRechallengeLink() {
-  return new _core.ApolloLink((operation, forward) => {
-    const scope = primaryMutationFieldName(operation.query);
-    const eligible = isMutation(operation.query) && Boolean(scope);
-    return new _core.Observable(observer => {
-      let retrying = false;
-      let cancelled = false;
-      let firstSub = null;
-      let retrySub = null;
-      const abortController = new AbortController();
-      const preflight = async () => {
-        if (!eligible || !scope) {
-          return;
-        }
-        const cached = await _tokenCache.default.get(scope);
-        if (cached) {
-          attachElevatedHeader(operation, cached.headerName || DEFAULT_HEADER, cached);
-        }
-      };
-      const handleRetry = async (result, elevated) => {
-        retrying = true;
-        const headerName = elevated.rechallenge.elevatedHeaderName || DEFAULT_HEADER;
-        let token;
-        try {
-          token = await (0, _flow.runRechallenge)({
-            requestedOperation: scope,
-            rechallenge: elevated.rechallenge,
-            interactive: (0, _flow.isInteractiveContext)(),
-            wait: (0, _flow.shouldWaitForRechallenge)(),
-            signal: abortController.signal
-          });
-        } catch (err) {
-          debug('rechallenge flow failed: %o', err);
-          if (cancelled || observer.closed) {
-            return;
-          }
-          // Surface the original elevated-permission error to upstream
-          // so errorLink and consumers see it.
-          observer.next(result);
-          observer.complete();
-          return;
-        }
-        if (cancelled || observer.closed) {
-          return;
-        }
-        attachElevatedHeader(operation, headerName, token);
-        try {
-          retrySub = forward(operation).subscribe({
-            next: res => observer.next(res),
-            error: err => observer.error(err),
-            complete: () => observer.complete()
-          });
-        } catch (err) {
-          if (cancelled || observer.closed) {
-            return;
-          }
-          observer.error(err);
-        }
-      };
-      const start = async () => {
-        try {
-          await preflight();
-        } catch (err) {
-          debug('preflight error: %o', err);
-        }
-        if (cancelled || observer.closed) {
-          return;
-        }
-        try {
-          firstSub = forward(operation).subscribe({
-            next: result => {
-              if (retrying || !eligible || !scope) {
-                observer.next(result);
-                return;
-              }
-              const elevated = extractElevatedPermission(result);
-              if (!elevated) {
-                observer.next(result);
-                return;
-              }
-              void handleRetry(result, elevated);
-            },
-            error: err => observer.error(err),
-            complete: () => {
-              if (!retrying) {
-                observer.complete();
-              }
-            }
-          });
-        } catch (err) {
-          if (cancelled || observer.closed) {
-            return;
-          }
-          observer.error(err);
-        }
-      };
-      void start().catch(err => {
-        if (cancelled || observer.closed) {
-          return;
-        }
-        observer.error(err);
-      });
-      return () => {
-        cancelled = true;
-        // Abort any in-flight rechallenge polling so the loop, its tracking
-        // events, and the token-cache write stop instead of running to expiry.
-        abortController.abort();
-        firstSub?.unsubscribe();
-        retrySub?.unsubscribe();
-      };
+    return new core_1.ApolloLink((operation, forward) => {
+        const scope = primaryMutationFieldName(operation.query);
+        const eligible = isMutation(operation.query) && Boolean(scope);
+        return new core_1.Observable(observer => {
+            let retrying = false;
+            let cancelled = false;
+            let firstSub = null;
+            let retrySub = null;
+            const abortController = new AbortController();
+            const preflight = async () => {
+                if (!eligible || !scope) {
+                    return;
+                }
+                const cached = await token_cache_1.default.get(scope);
+                if (cached) {
+                    attachElevatedHeader(operation, cached.headerName || DEFAULT_HEADER, cached);
+                }
+            };
+            const handleRetry = async (result, elevated) => {
+                retrying = true;
+                const headerName = elevated.rechallenge.elevatedHeaderName || DEFAULT_HEADER;
+                let token;
+                try {
+                    token = await (0, flow_1.runRechallenge)({
+                        requestedOperation: scope,
+                        rechallenge: elevated.rechallenge,
+                        interactive: (0, flow_1.isInteractiveContext)(),
+                        wait: (0, flow_1.shouldWaitForRechallenge)(),
+                        signal: abortController.signal,
+                    });
+                }
+                catch (err) {
+                    debug('rechallenge flow failed: %o', err);
+                    if (cancelled || observer.closed) {
+                        return;
+                    }
+                    // Surface the original elevated-permission error to upstream
+                    // so errorLink and consumers see it.
+                    observer.next(result);
+                    observer.complete();
+                    return;
+                }
+                if (cancelled || observer.closed) {
+                    return;
+                }
+                attachElevatedHeader(operation, headerName, token);
+                try {
+                    retrySub = forward(operation).subscribe({
+                        next: res => observer.next(res),
+                        error: err => observer.error(err),
+                        complete: () => observer.complete(),
+                    });
+                }
+                catch (err) {
+                    if (cancelled || observer.closed) {
+                        return;
+                    }
+                    observer.error(err);
+                }
+            };
+            const start = async () => {
+                try {
+                    await preflight();
+                }
+                catch (err) {
+                    debug('preflight error: %o', err);
+                }
+                if (cancelled || observer.closed) {
+                    return;
+                }
+                try {
+                    firstSub = forward(operation).subscribe({
+                        next: result => {
+                            if (retrying || !eligible || !scope) {
+                                observer.next(result);
+                                return;
+                            }
+                            const elevated = extractElevatedPermission(result);
+                            if (!elevated) {
+                                observer.next(result);
+                                return;
+                            }
+                            void handleRetry(result, elevated);
+                        },
+                        error: err => observer.error(err),
+                        complete: () => {
+                            if (!retrying) {
+                                observer.complete();
+                            }
+                        },
+                    });
+                }
+                catch (err) {
+                    if (cancelled || observer.closed) {
+                        return;
+                    }
+                    observer.error(err);
+                }
+            };
+            void start().catch(err => {
+                if (cancelled || observer.closed) {
+                    return;
+                }
+                observer.error(err);
+            });
+            return () => {
+                cancelled = true;
+                // Abort any in-flight rechallenge polling so the loop, its tracking
+                // events, and the token-cache write stop instead of running to expiry.
+                abortController.abort();
+                firstSub?.unsubscribe();
+                retrySub?.unsubscribe();
+            };
+        });
     });
-  });
-}
+}

package/dist/lib/rechallenge/open-browser.js

@@ -1,21 +1,18 @@
 "use strict";
-
-exports.__esModule = true;
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.openBrowser = openBrowser;
-var _debug = _interopRequireDefault(require("debug"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('@automattic/vip:rechallenge:open-browser');
-
+const debug_1 = __importDefault(require("debug"));
+const debug = (0, debug_1.default)('@automattic/vip:rechallenge:open-browser');
 /** Opens a URL in the default browser. Wraps the ESM-only `open` package. */
 async function openBrowser(url) {
-  try {
-    const {
-      default: open
-    } = await import('open');
-    await open(url, {
-      wait: false
-    });
-  } catch (err) {
-    debug('Failed to open(%s): %o', url, err);
-  }
-}
+    try {
+        const { default: open } = await import('open');
+        await open(url, { wait: false });
+    }
+    catch (err) {
+        debug('Failed to open(%s): %o', url, err);
+    }
+}

package/dist/lib/rechallenge/token-cache.js

@@ -1,12 +1,12 @@
 "use strict";
-
-exports.__esModule = true;
-exports.default = void 0;
-var _debug = _interopRequireDefault(require("debug"));
-var _constants = require("../api/constants");
-var _keychain = require("../keychain");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('@automattic/vip:rechallenge:cache');
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const debug_1 = __importDefault(require("debug"));
+const constants_1 = require("../api/constants");
+const keychain_1 = require("../keychain");
+const debug = (0, debug_1.default)('@automattic/vip:rechallenge:cache');
 // Storage strategy: a single keychain entry holds a JSON map { [scope]: ElevatedToken }.
 // The vip-cli Keychain interface (src/lib/keychain/keychain.ts) is service-only — there
 // is no separate account argument — so per-scope entries under the keytar model would
@@ -14,100 +14,97 @@ const debug = (0, _debug.default)('@automattic/vip:rechallenge:cache');
 // This is marked subject-to-change in the spec pending security review.
 const BASE_SERVICE = 'vip-go-cli:elevated';
 function serviceName() {
-  if (_constants.API_HOST === _constants.PRODUCTION_API_HOST) {
-    return BASE_SERVICE;
-  }
-  const sanitized = _constants.API_HOST.replace(/[^a-z0-9]/gi, '-');
-  return `${BASE_SERVICE}:${sanitized}`;
+    if (constants_1.API_HOST === constants_1.PRODUCTION_API_HOST) {
+        return BASE_SERVICE;
+    }
+    const sanitized = constants_1.API_HOST.replace(/[^a-z0-9]/gi, '-');
+    return `${BASE_SERVICE}:${sanitized}`;
 }
 let inMemory = null;
 async function read() {
-  if (inMemory) {
-    return inMemory;
-  }
-  const keychain = await (0, _keychain.getKeychain)();
-  const raw = await keychain.getPassword(serviceName());
-  if (!raw) {
-    inMemory = {};
-    return inMemory;
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
-      inMemory = parsed;
-    } else {
-      debug('Elevated token blob had unexpected shape; resetting');
-      inMemory = {};
-      await keychain.deletePassword(serviceName());
+    if (inMemory) {
+        return inMemory;
     }
-  } catch (err) {
-    debug('Failed to parse elevated token blob; resetting (%o)', err);
-    inMemory = {};
-    await keychain.deletePassword(serviceName());
-  }
-  return inMemory;
+    const keychain = await (0, keychain_1.getKeychain)();
+    const raw = await keychain.getPassword(serviceName());
+    if (!raw) {
+        inMemory = {};
+        return inMemory;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            inMemory = parsed;
+        }
+        else {
+            debug('Elevated token blob had unexpected shape; resetting');
+            inMemory = {};
+            await keychain.deletePassword(serviceName());
+        }
+    }
+    catch (err) {
+        debug('Failed to parse elevated token blob; resetting (%o)', err);
+        inMemory = {};
+        await keychain.deletePassword(serviceName());
+    }
+    return inMemory;
 }
 async function write(blob) {
-  inMemory = blob;
-  const keychain = await (0, _keychain.getKeychain)();
-  if (Object.keys(blob).length === 0) {
-    await keychain.deletePassword(serviceName());
-  } else {
-    await keychain.setPassword(serviceName(), JSON.stringify(blob));
-  }
+    inMemory = blob;
+    const keychain = await (0, keychain_1.getKeychain)();
+    if (Object.keys(blob).length === 0) {
+        await keychain.deletePassword(serviceName());
+    }
+    else {
+        await keychain.setPassword(serviceName(), JSON.stringify(blob));
+    }
 }
 function isExpired(token) {
-  const exp = Date.parse(token.expiresAt);
-  if (Number.isNaN(exp)) {
-    return true;
-  }
-  // Treat tokens within the next 5 seconds as effectively expired.
-  return Date.now() >= exp - 5_000;
+    const exp = Date.parse(token.expiresAt);
+    if (Number.isNaN(exp)) {
+        return true;
+    }
+    // Treat tokens within the next 5 seconds as effectively expired.
+    return Date.now() >= exp - 5_000;
 }
 async function get(scope) {
-  const blob = await read();
-  const token = blob[scope];
-  if (!token) {
-    return null;
-  }
-  if (isExpired(token)) {
-    debug('Cached elevated token for %s is expired; evicting', scope);
-    const {
-      [scope]: _evicted,
-      ...rest
-    } = blob;
-    await write(rest);
-    return null;
-  }
-  return token;
+    const blob = await read();
+    const token = blob[scope];
+    if (!token) {
+        return null;
+    }
+    if (isExpired(token)) {
+        debug('Cached elevated token for %s is expired; evicting', scope);
+        const { [scope]: _evicted, ...rest } = blob;
+        await write(rest);
+        return null;
+    }
+    return token;
 }
 async function set(scope, token) {
-  const blob = await read();
-  blob[scope] = token;
-  await write(blob);
+    const blob = await read();
+    blob[scope] = token;
+    await write(blob);
 }
 async function clearScope(scope) {
-  const blob = await read();
-  if (scope in blob) {
-    const {
-      [scope]: _removed,
-      ...rest
-    } = blob;
-    await write(rest);
-  }
+    const blob = await read();
+    if (scope in blob) {
+        const { [scope]: _removed, ...rest } = blob;
+        await write(rest);
+    }
 }
 async function clearAll() {
-  inMemory = {};
-  const keychain = await (0, _keychain.getKeychain)();
-  await keychain.deletePassword(serviceName());
+    inMemory = {};
+    const keychain = await (0, keychain_1.getKeychain)();
+    await keychain.deletePassword(serviceName());
 }
 function _resetInMemoryForTests() {
-  inMemory = null;
+    inMemory = null;
 }
-var _default = exports.default = {
-  get,
-  set,
-  clearScope,
-  clearAll,
-  _resetInMemoryForTests
-};
+exports.default = {
+    get,
+    set,
+    clearScope,
+    clearAll,
+    _resetInMemoryForTests,
+};

package/dist/lib/rechallenge/types.js

@@ -1,15 +1,6 @@
 "use strict";
-
-exports.__esModule = true;
-exports.RECHALLENGE_VERSION = exports.ELEVATED_PERMISSION_ERROR_CODE = exports.CLIENT_TYPE = void 0;
-const ELEVATED_PERMISSION_ERROR_CODE = exports.ELEVATED_PERMISSION_ERROR_CODE = 'elevated-permission-required';
-const RECHALLENGE_VERSION = exports.RECHALLENGE_VERSION = 'v2';
-const CLIENT_TYPE = exports.CLIENT_TYPE = 'cli';
-
-/** Shape of `errors[0].extensions.rechallenge` from the API. */
-
-/** Response from POST {createSessionPath}. */
-
-/** Response from GET {statusPathTemplate}. */
-
-/** Response from POST {exchangePathTemplate}. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_TYPE = exports.RECHALLENGE_VERSION = exports.ELEVATED_PERMISSION_ERROR_CODE = void 0;
+exports.ELEVATED_PERMISSION_ERROR_CODE = 'elevated-permission-required';
+exports.RECHALLENGE_VERSION = 'v2';
+exports.CLIENT_TYPE = 'cli';