@briefgate/mcp 0.7.4 → 0.7.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +118 -19
- package/dist/client.d.ts +8 -0
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +6 -1
- package/dist/client.js.map +1 -1
- package/dist/credentials.d.ts +31 -0
- package/dist/credentials.d.ts.map +1 -0
- package/dist/credentials.js +89 -0
- package/dist/credentials.js.map +1 -0
- package/dist/device-auth.d.ts +41 -0
- package/dist/device-auth.d.ts.map +1 -0
- package/dist/device-auth.js +119 -0
- package/dist/device-auth.js.map +1 -0
- package/dist/http-auth.d.ts +39 -5
- package/dist/http-auth.d.ts.map +1 -1
- package/dist/http-auth.js +63 -7
- package/dist/http-auth.js.map +1 -1
- package/dist/index.js +392 -187
- package/dist/index.js.map +1 -1
- package/dist/login.d.ts +49 -0
- package/dist/login.d.ts.map +1 -0
- package/dist/login.js +205 -0
- package/dist/login.js.map +1 -0
- package/dist/tools.d.ts +65 -5
- package/dist/tools.d.ts.map +1 -1
- package/dist/tools.js +87 -2
- package/dist/tools.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -14,14 +14,25 @@ Agent: keeps building the website ✅
|
|
|
14
14
|
|
|
15
15
|
## Quickstart — Claude Code
|
|
16
16
|
|
|
17
|
-
**1
|
|
17
|
+
**Option 1 — sign in, nothing to copy:**
|
|
18
18
|
|
|
19
|
-
|
|
19
|
+
```bash
|
|
20
|
+
claude mcp add briefgate -- npx -y @briefgate/mcp
|
|
21
|
+
npx -y @briefgate/mcp login
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
`login` prints a short code and a URL, tries to open your browser to it, and waits (up to 10 minutes) for you to click **Allow**. On success it prints `Signed in as <account>` and exits; the key lands in `~/.briefgate/credentials.json` (mode `0600`) and the server picks it up automatically — no restart, nothing to paste into config. `npx -y @briefgate/mcp logout` removes it again and best-effort revokes it on the server too.
|
|
25
|
+
|
|
26
|
+
Prefer to sign in from inside the agent instead of a terminal? Skip the `login` command above and just ask Claude Code to "call the briefgate `login` tool" instead — same flow, one call at a time. See [Sign in without an API key](#sign-in-without-an-api-key).
|
|
27
|
+
|
|
28
|
+
Prefer connecting straight to the hosted endpoint instead of running the package locally? `claude mcp add --transport http briefgate https://mcp.briefgate.dev/mcp` walks you through OAuth in the browser — see [Hosted endpoint + OAuth](#hosted-endpoint--oauth) below.
|
|
29
|
+
|
|
30
|
+
**Option 2 — paste an API key** (for CI, scripts, or if you'd rather manage the key yourself). Get one at [briefgate.dev](https://briefgate.dev) (free tier available, no card required):
|
|
20
31
|
|
|
21
32
|
```bash
|
|
22
33
|
claude mcp add briefgate \
|
|
23
34
|
-e BRIEFGATE_API_KEY=bg_live_... \
|
|
24
|
-
-- npx @briefgate/mcp
|
|
35
|
+
-- npx -y @briefgate/mcp
|
|
25
36
|
```
|
|
26
37
|
|
|
27
38
|
Or add manually to `~/.claude/settings.json`:
|
|
@@ -31,7 +42,7 @@ Or add manually to `~/.claude/settings.json`:
|
|
|
31
42
|
"mcpServers": {
|
|
32
43
|
"briefgate": {
|
|
33
44
|
"command": "npx",
|
|
34
|
-
"args": ["@briefgate/mcp"],
|
|
45
|
+
"args": ["-y", "@briefgate/mcp"],
|
|
35
46
|
"env": {
|
|
36
47
|
"BRIEFGATE_API_KEY": "bg_live_..."
|
|
37
48
|
}
|
|
@@ -40,11 +51,26 @@ Or add manually to `~/.claude/settings.json`:
|
|
|
40
51
|
}
|
|
41
52
|
```
|
|
42
53
|
|
|
43
|
-
|
|
54
|
+
`BRIEFGATE_API_KEY` (or `--api-key` on the command line), if set, always takes precedence over a key `login` stored locally — running `login` while one is configured just says so instead of doing anything.
|
|
55
|
+
|
|
56
|
+
**Verify it loaded** — run `/mcp` in Claude Code and look for `briefgate` with 11 tools.
|
|
44
57
|
|
|
45
58
|
## Quickstart — Cursor / Codex / other MCP clients
|
|
46
59
|
|
|
47
|
-
|
|
60
|
+
`login` / `logout` work the same way for any client that runs the package locally: register it with no key at all, then either run `npx -y @briefgate/mcp login` yourself or ask the agent to call the `login` tool.
|
|
61
|
+
|
|
62
|
+
```json
|
|
63
|
+
{
|
|
64
|
+
"mcpServers": {
|
|
65
|
+
"briefgate": {
|
|
66
|
+
"command": "npx",
|
|
67
|
+
"args": ["-y", "@briefgate/mcp"]
|
|
68
|
+
}
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
Or paste an API key instead, add to your MCP config (usually `.cursor/mcp.json` or similar):
|
|
48
74
|
|
|
49
75
|
```json
|
|
50
76
|
{
|
|
@@ -60,14 +86,43 @@ Add to your MCP config (usually `.cursor/mcp.json` or similar):
|
|
|
60
86
|
}
|
|
61
87
|
```
|
|
62
88
|
|
|
89
|
+
## Sign in without an API key
|
|
90
|
+
|
|
91
|
+
Two ways to get a key onto this machine without pasting one — both run the same device-authorization flow (RFC 8628) against the same credential file, so pick whichever fits how you're using the package.
|
|
92
|
+
|
|
93
|
+
**From a terminal — the `login` / `logout` subcommands:**
|
|
94
|
+
|
|
95
|
+
```bash
|
|
96
|
+
npx -y @briefgate/mcp login # prints a code + URL, waits for approval, saves the key
|
|
97
|
+
npx -y @briefgate/mcp logout # removes the local key, best-effort revokes it remotely
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
`login` blocks until you approve it (or it times out at 10 minutes), then prints `Signed in as <account_name>` and exits `0` — or prints why it didn't work (denied, expired, an error) and exits `1`. `logout` always removes the local copy; it also sends `DELETE /v1/keys/current` using that same key to revoke it server-side, and if that call fails (no network, API unreachable) it says so and points at the BriefGate dashboard instead of leaving you unsure whether the key is still live.
|
|
101
|
+
|
|
102
|
+
**From an agent — the `login` / `logout` tools** (see [Tools](#tools)):
|
|
103
|
+
|
|
104
|
+
Same flow, for a client that can't block a terminal on your click. `login` is **two-phase** because a tool call can't sit open for minutes:
|
|
105
|
+
|
|
106
|
+
1. The first call starts the flow and returns immediately with the code and URL. A browser is opened automatically where possible.
|
|
107
|
+
2. Call `login` again — any time, or once you've approved it — to check progress. While it's still waiting, it says so; once approved, that same call reports success and the key is saved. No restart needed: the very next tool call is signed in.
|
|
108
|
+
|
|
109
|
+
`logout` as a tool does exactly what the subcommand does, including the best-effort remote revoke.
|
|
110
|
+
|
|
111
|
+
**Either way**, the key lands in `~/.briefgate/credentials.json` (directory mode `0700`, file mode `0600`; override the path with `BRIEFGATE_CREDENTIALS_FILE`), keyed by which BriefGate server it's for so a staging `BRIEFGATE_BASE_URL` and production never collide. An explicit key always wins over a stored one — `--api-key`, then `BRIEFGATE_API_KEY`, then whatever `login` last saved — and `login` says so instead of running the flow when one of those is already set. Neither the subcommands nor the tools apply to the shared hosted endpoint (`mcp.briefgate.dev`) — see [Hosted endpoint + OAuth](#hosted-endpoint--oauth), where connecting a client triggers real OAuth instead.
|
|
112
|
+
|
|
63
113
|
## Environment variables
|
|
64
114
|
|
|
65
115
|
| Variable | Required | Default | Description |
|
|
66
116
|
|---|---|---|---|
|
|
67
|
-
| `BRIEFGATE_API_KEY` |
|
|
117
|
+
| `BRIEFGATE_API_KEY` | No | — | API key (`bg_live_...` or `bg_test_...`). Takes precedence over a credential stored by `login`. If nothing is configured, tool calls fail with a message pointing at `login`. |
|
|
68
118
|
| `BRIEFGATE_BASE_URL` | No | `https://api.briefgate.dev` | Override for staging or local development. |
|
|
119
|
+
| `BRIEFGATE_CREDENTIALS_FILE` | No | `~/.briefgate/credentials.json` | Where `login`/`logout` store the key. Mainly for tests and unusual setups. |
|
|
69
120
|
| `BRIEFGATE_MCP_HTTP` | No | — | Set to `1` to start Streamable HTTP instead of stdio. |
|
|
70
121
|
| `BRIEFGATE_MCP_PORT` | No | `3000` | Port for HTTP mode. |
|
|
122
|
+
| `BRIEFGATE_MCP_PUBLIC_HOST` | No | — | Publishes the server as a shared, multi-customer OAuth endpoint. See [Hosted endpoint + OAuth](#hosted-endpoint--oauth). |
|
|
123
|
+
| `BRIEFGATE_MCP_AUTH_SERVER` | No | `BRIEFGATE_BASE_URL` | The OAuth authorization server advertised to clients in published mode. Defaults to `BRIEFGATE_BASE_URL` for local dev, where they're usually the same address; a real deployment behind a container network sets this explicitly (see below). |
|
|
124
|
+
|
|
125
|
+
`--api-key bg_live_...` is also accepted on the command line, ahead of `BRIEFGATE_API_KEY` in priority. `login` and `logout` are also accepted as the first command-line argument (`npx @briefgate/mcp login`), instead of `--http`/no flag.
|
|
71
126
|
|
|
72
127
|
## HTTP (Streamable HTTP) mode
|
|
73
128
|
|
|
@@ -79,28 +134,60 @@ BRIEFGATE_API_KEY=bg_live_... npx @briefgate/mcp --http --port 3000
|
|
|
79
134
|
|
|
80
135
|
The server binds to `127.0.0.1` only and includes DNS-rebinding protection. Behind a reverse proxy, terminate TLS there and forward to the local port — do not expose the port directly.
|
|
81
136
|
|
|
82
|
-
|
|
137
|
+
## Hosted endpoint + OAuth
|
|
83
138
|
|
|
84
139
|
Set `BRIEFGATE_MCP_PUBLIC_HOST` to the hostname the server is published under and
|
|
85
|
-
it becomes a multi-customer endpoint: each caller sends its own key as
|
|
86
|
-
`Authorization: Bearer bg_live_
|
|
87
|
-
as that
|
|
140
|
+
it becomes a shared, multi-customer endpoint: each caller sends its own key as
|
|
141
|
+
`Authorization: Bearer bg_live_...` (an OAuth access token, for this API, *is*
|
|
142
|
+
that same key — see below), and the server speaks to the BriefGate API as that
|
|
143
|
+
caller. The public instance is `https://mcp.briefgate.dev/mcp`.
|
|
88
144
|
|
|
89
145
|
```bash
|
|
90
146
|
BRIEFGATE_MCP_PUBLIC_HOST=mcp.example.com npx @briefgate/mcp --http --port 3000
|
|
91
147
|
```
|
|
92
148
|
|
|
93
|
-
|
|
149
|
+
Several things change, on purpose:
|
|
94
150
|
|
|
95
151
|
- the listener binds `0.0.0.0` and the Host guard accepts that name, because a
|
|
96
152
|
server behind a reverse proxy is reached by its public name;
|
|
97
|
-
- **the `BRIEFGATE_API_KEY` fallback
|
|
98
|
-
an anonymous caller spend the
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
153
|
+
- **the `BRIEFGATE_API_KEY` fallback and the local `login` credential are both
|
|
154
|
+
switched off.** Leaving either on would let an anonymous caller spend the
|
|
155
|
+
operator's key, or read whatever the machine's own `login` last stored;
|
|
156
|
+
- **`login`/`logout`, tools and subcommands alike, are unavailable** —
|
|
157
|
+
connecting a client triggers real OAuth instead, described below;
|
|
158
|
+
- the server becomes an OAuth 2.1 *resource server*, per the MCP authorization
|
|
159
|
+
spec, so an OAuth-aware client can add it with nothing but the URL. This
|
|
160
|
+
package never runs the authorization flow itself — it only advertises where
|
|
161
|
+
to find it and enforces that a request carries a token:
|
|
162
|
+
- it serves `GET /.well-known/oauth-protected-resource` (RFC 9728), and the
|
|
163
|
+
same content again under `/.well-known/oauth-protected-resource/mcp` (the
|
|
164
|
+
resource-scoped path the MCP spec also has clients try), both with open
|
|
165
|
+
CORS and naming the BriefGate API as the authorization server — see
|
|
166
|
+
`BRIEFGATE_MCP_AUTH_SERVER` above;
|
|
167
|
+
- **every** MCP request now needs a Bearer token — including `initialize`
|
|
168
|
+
and `tools/list`, which used to work without one so a registry could
|
|
169
|
+
introspect the tool list. One with no token gets HTTP `401` and a
|
|
170
|
+
`WWW-Authenticate: Bearer resource_metadata="https://<host>/.well-known/oauth-protected-resource"`
|
|
171
|
+
header, which is the signal an OAuth client uses to start signing in;
|
|
172
|
+
- if a tool call's key turns out to be expired or revoked (the API answers
|
|
173
|
+
`401`), the response is rewritten into a real HTTP `401` with the same
|
|
174
|
+
header plus `error="invalid_token"`, rather than an ordinary tool error —
|
|
175
|
+
so the client knows to refresh rather than just reporting the call failed.
|
|
176
|
+
|
|
177
|
+
What a connecting client actually does, against the authorization server named
|
|
178
|
+
in that metadata: standard OAuth 2.1 discovery
|
|
179
|
+
(`GET /.well-known/oauth-authorization-server`), dynamic client registration
|
|
180
|
+
(`POST /v1/oauth/register`), then an authorization-code exchange with PKCE
|
|
181
|
+
(S256) at `POST /v1/oauth/token` — no client secret, since MCP clients are
|
|
182
|
+
public clients — and `POST /v1/oauth/revoke` to end a session. None of that is
|
|
183
|
+
this package's concern; it only has to be a correct resource server pointing
|
|
184
|
+
at it. The access token that comes out the other end is a `bg_live_...` key
|
|
185
|
+
like any other, with a one-hour expiry the API enforces.
|
|
186
|
+
|
|
187
|
+
None of this applies without `BRIEFGATE_MCP_PUBLIC_HOST`: a local `--http` run
|
|
188
|
+
keeps behaving exactly as before, including an absent key reaching
|
|
189
|
+
`initialize`/`tools/list` and a plain `Authorization: Bearer ...` header
|
|
190
|
+
working with no OAuth involved.
|
|
104
191
|
|
|
105
192
|
## Tools
|
|
106
193
|
|
|
@@ -242,6 +329,18 @@ Because an agent receives the secret in a tool result, it can come to rest where
|
|
|
242
329
|
|
|
243
330
|
Only register an endpoint you can actually receive on. An agent running in a terminal has no public HTTPS address; for that case register nothing and check on a schedule instead (see below).
|
|
244
331
|
|
|
332
|
+
### `login`
|
|
333
|
+
|
|
334
|
+
Sign in without an API key — see [Sign in without an API key](#sign-in-without-an-api-key). Takes no arguments.
|
|
335
|
+
|
|
336
|
+
Call it whenever another tool reports "Not signed in" or that the stored key was revoked or expired. The first call starts a device-authorization flow and returns a URL and a short code immediately; call it again (any time) to check whether it's been approved yet. Has no effect — it says so instead — if `--api-key` or `BRIEFGATE_API_KEY` already supplies a key. Not available on the hosted endpoint. Same flow as running `npx @briefgate/mcp login` from a terminal (which blocks until approved instead of needing a second call) — see [Sign in without an API key](#sign-in-without-an-api-key).
|
|
337
|
+
|
|
338
|
+
### `logout`
|
|
339
|
+
|
|
340
|
+
Removes the API key `login` stored locally for this BriefGate server, and best-effort revokes it on the server too. Takes no arguments.
|
|
341
|
+
|
|
342
|
+
If the revoke call fails — no network, the API unreachable — the local copy is still removed; the response says so and points at the BriefGate dashboard to revoke it there instead. Not available on the hosted endpoint. Same effect as running `npx @briefgate/mcp logout` from a terminal — see [Sign in without an API key](#sign-in-without-an-api-key).
|
|
343
|
+
|
|
245
344
|
## Decisions — questions for the developer
|
|
246
345
|
|
|
247
346
|
An agent building something hits things only the account holder can settle: *does the discounted plan cost $19 or $29?* Stopping to wait wastes the run; picking silently buries the assumption. A decision is the third option — pose the question, record the answer you are proceeding on, keep building.
|
package/dist/client.d.ts
CHANGED
|
@@ -1,6 +1,13 @@
|
|
|
1
1
|
export interface BriefGateConfig {
|
|
2
2
|
apiKey: string;
|
|
3
3
|
baseUrl: string;
|
|
4
|
+
/**
|
|
5
|
+
* How `apiKey` was obtained. Never read by apiRequest — it exists only so
|
|
6
|
+
* the `login` tool can tell whether calling it would do anything: a key
|
|
7
|
+
* from `--api-key`/env/an explicit header always overrides the locally
|
|
8
|
+
* stored one, so signing in again would have no effect until it's removed.
|
|
9
|
+
*/
|
|
10
|
+
apiKeySource?: 'flag' | 'env' | 'header' | 'file' | 'none';
|
|
4
11
|
}
|
|
5
12
|
export type ItemType = 'text' | 'longtext' | 'file' | 'file_list' | 'image' | 'color_list' | 'select' | 'multiselect' | 'boolean' | 'url' | 'secret' | 'structured';
|
|
6
13
|
export type ItemStatus = 'pending' | 'submitted' | 'needs_revision' | 'approved';
|
|
@@ -125,6 +132,7 @@ export interface UsageResult {
|
|
|
125
132
|
};
|
|
126
133
|
}
|
|
127
134
|
export declare function apiRequest<T>(config: BriefGateConfig, method: string, path: string, body?: unknown, extraHeaders?: Record<string, string>): Promise<T>;
|
|
135
|
+
export declare const AUTH_FAILED_MESSAGE = "Authentication failed \u2014 verify your BRIEFGATE_API_KEY is correct and has not been revoked.";
|
|
128
136
|
export declare function createIntake(config: BriefGateConfig, payload: unknown, idempotencyKey: string): Promise<IntakeCreated>;
|
|
129
137
|
export declare function listIntakes(config: BriefGateConfig, params: {
|
|
130
138
|
status?: string;
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;CAC5D;AAID,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,UAAU,GACV,MAAM,GACN,WAAW,GACX,OAAO,GACP,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,SAAS,GACT,KAAK,GACL,QAAQ,GACR,YAAY,CAAC;AAEjB,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,GAAG,UAAU,CAAC;AACjF,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,WAAW,GAAG,UAAU,CAAC;AACvF,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/E,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAClD,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,KAAK,EAAE,KAAK,CAAC;QACX,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,MAAM,CACV,MAAM,EACN;QACE,IAAI,EAAE,QAAQ,CAAC;QACf,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CACF,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtD,kBAAkB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,wBAAsB,UAAU,CAAC,CAAC,EAChC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,OAAO,CAAC,CAAC,CAAC,CAmDZ;AAMD,eAAO,MAAM,mBAAmB,oGAC8D,CAAC;AA+D/F,wBAAsB,YAAY,CAChC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC,CAIxB;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAClF,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACxD,OAAO,CAAC,aAAa,CAAC,CAMxB;AAED,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAEjF;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAO/C;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,OAAO,GAAG,KAAK,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,CAIzB;AASD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,QAAQ,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAE1C;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/C;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAE5B;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5E"}
|
package/dist/client.js
CHANGED
|
@@ -50,6 +50,11 @@ export async function apiRequest(config, method, path, body, extraHeaders) {
|
|
|
50
50
|
throw new Error(`BriefGate API returned an unexpected non-JSON response (status ${res.status}). This may indicate a proxy or network issue — try again shortly.`);
|
|
51
51
|
}
|
|
52
52
|
}
|
|
53
|
+
// Exact text of the 401 case below — exported so callers can recognize this
|
|
54
|
+
// specific failure (e.g. to rewrite it into "call login again", or to turn a
|
|
55
|
+
// hosted MCP tool response into a real HTTP 401 for OAuth clients) without
|
|
56
|
+
// parsing prose.
|
|
57
|
+
export const AUTH_FAILED_MESSAGE = 'Authentication failed — verify your BRIEFGATE_API_KEY is correct and has not been revoked.';
|
|
53
58
|
async function throwApiError(res) {
|
|
54
59
|
let message = '';
|
|
55
60
|
let retryAfter = '';
|
|
@@ -63,7 +68,7 @@ async function throwApiError(res) {
|
|
|
63
68
|
retryAfter = res.headers.get('Retry-After') ?? '';
|
|
64
69
|
switch (res.status) {
|
|
65
70
|
case 401:
|
|
66
|
-
throw new Error(
|
|
71
|
+
throw new Error(AUTH_FAILED_MESSAGE);
|
|
67
72
|
case 402:
|
|
68
73
|
throw new Error(`Plan limit reached: ${message || 'quota exceeded'} — upgrade your plan or reduce scope.`);
|
|
69
74
|
case 403:
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,0EAA0E;AAC1E,0EAA0E;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,0EAA0E;AAC1E,0EAA0E;AA2I1E,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAuB,EACvB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,YAAqC;IAErC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,MAAM,IAAI,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAgB;QACxB,MAAM;QACN,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,YAAY;SAChB;KACF,CAAC;IACF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,yCAAyC,gBAAgB,GAAG,IAAI,oEAAoE,CACrI,CAAC;QACJ,CAAC;QACD,0FAA0F;QAC1F,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,wDAAwD,CAAC,CAAC;IAChH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAO,CAAC;IACjB,CAAC;IAED,uFAAuF;IACvF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kEAAkE,GAAG,CAAC,MAAM,oEAAoE,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,iBAAiB;AACjB,MAAM,CAAC,MAAM,mBAAmB,GAC9B,4FAA4F,CAAC;AAE/F,KAAK,UAAU,aAAa,CAAC,GAAa;IACxC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyC,CAAC;QACxE,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAElD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,IAAI,gBAAgB,uCAAuC,CAC1F,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;QACJ,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,IAAI,qCAAqC,EAAE,CACvE,CAAC;QACJ,KAAK,GAAG,CAAC,CAAC,CAAC;YACT,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,8BAA8B,KAAK,0DAA0D,CAC9F,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,4CAA4C,EAAE,CAChG,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAuB,EACvB,OAAgB,EAChB,cAAsB;IAEtB,OAAO,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE;QACpE,iBAAiB,EAAE,cAAc;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAuB,EACvB,MAAmF;IAEnF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,YAAY;QAAE,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,UAAU,CAAa,MAAM,EAAE,KAAK,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,QAAgB;IAEhB,OAAO,UAAU,CAAqB,MAAM,EAAE,KAAK,EAAE,YAAY,QAAQ,SAAS,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAuB,EACvB,QAAgB,EAChB,MAAyD;IAEzD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,eAAe;QAAE,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,UAAU,CAAgB,MAAM,EAAE,KAAK,EAAE,YAAY,QAAQ,WAAW,KAAK,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAuB,EACvB,QAAgB,EAChB,KAAuB;IAEvB,OAAO,UAAU,CAAgB,MAAM,EAAE,MAAM,EAAE,YAAY,QAAQ,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAuB,EACvB,QAAgB,EAChB,OAAe,EACf,OAAgC;IAEhC,OAAO,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,QAAQ,UAAU,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,QAAgB,EAChB,OAAe,EACf,IAAY;IAEZ,OAAO,UAAU,CACf,MAAM,EACN,MAAM,EACN,YAAY,QAAQ,WAAW,EAC/B,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAuB,EACvB,QAAgB,EAChB,OAAyB;IAEzB,OAAO,UAAU,CAAiB,MAAM,EAAE,MAAM,EAAE,YAAY,QAAQ,QAAQ,EAAE;QAC9E,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAuB;IAEvB,OAAO,UAAU,CAAkC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAuB,EACvB,OAA2D;IAE3D,OAAO,UAAU,CAAuC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAuB,EACvB,EAAU;IAEV,OAAO,UAAU,CAAoB,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAuB;IACpD,OAAO,UAAU,CAAc,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
export interface StoredCredential {
|
|
2
|
+
api_key: string;
|
|
3
|
+
key_id?: string;
|
|
4
|
+
account_name?: string;
|
|
5
|
+
saved_at: string;
|
|
6
|
+
}
|
|
7
|
+
/** Overridable via BRIEFGATE_CREDENTIALS_FILE so tests never touch ~/.briefgate. */
|
|
8
|
+
export declare function credentialsPath(): string;
|
|
9
|
+
export declare function loadCredential(baseUrl: string): StoredCredential | undefined;
|
|
10
|
+
export declare function saveCredential(baseUrl: string, cred: StoredCredential): void;
|
|
11
|
+
/** Returns true if a credential existed and was removed. */
|
|
12
|
+
export declare function deleteCredential(baseUrl: string): boolean;
|
|
13
|
+
export type ApiKeySource = 'flag' | 'env' | 'header' | 'file' | 'none';
|
|
14
|
+
export interface ResolvedApiKey {
|
|
15
|
+
apiKey: string;
|
|
16
|
+
source: ApiKeySource;
|
|
17
|
+
}
|
|
18
|
+
/**
|
|
19
|
+
* Priority: an explicit key (CLI flag, or a request's Authorization header in
|
|
20
|
+
* HTTP mode) beats the environment, which beats the locally stored one.
|
|
21
|
+
* `allowFileFallback` must be false whenever the server is published — see
|
|
22
|
+
* the module comment.
|
|
23
|
+
*/
|
|
24
|
+
export declare function resolveApiKey(opts: {
|
|
25
|
+
explicitApiKey?: string | undefined;
|
|
26
|
+
explicitSource?: 'flag' | 'header';
|
|
27
|
+
envApiKey?: string | undefined;
|
|
28
|
+
baseUrl: string;
|
|
29
|
+
allowFileFallback: boolean;
|
|
30
|
+
}): ResolvedApiKey;
|
|
31
|
+
//# sourceMappingURL=credentials.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oFAAoF;AACpF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAsCD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAE5E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAMzD;AAID,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,OAAO,CAAC;CAC5B,GAAG,cAAc,CAYjB"}
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
// Local credential store backing the `login`/`logout` tools.
|
|
2
|
+
//
|
|
3
|
+
// Keyed by base URL so a staging BRIEFGATE_BASE_URL and production never
|
|
4
|
+
// collide, and file/dir permissions are forced to 600/700 because this file
|
|
5
|
+
// holds a live API key. Never used when the server is published under
|
|
6
|
+
// BRIEFGATE_MCP_PUBLIC_HOST — that mode is a shared multi-customer process, and
|
|
7
|
+
// a file on that host is not a place to keep any one caller's key.
|
|
8
|
+
import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
|
|
9
|
+
import { dirname } from 'node:path';
|
|
10
|
+
import { homedir } from 'node:os';
|
|
11
|
+
/** Overridable via BRIEFGATE_CREDENTIALS_FILE so tests never touch ~/.briefgate. */
|
|
12
|
+
export function credentialsPath() {
|
|
13
|
+
return process.env['BRIEFGATE_CREDENTIALS_FILE'] ?? `${homedir()}/.briefgate/credentials.json`;
|
|
14
|
+
}
|
|
15
|
+
function readAll() {
|
|
16
|
+
const path = credentialsPath();
|
|
17
|
+
if (!existsSync(path))
|
|
18
|
+
return {};
|
|
19
|
+
try {
|
|
20
|
+
const parsed = JSON.parse(readFileSync(path, 'utf8'));
|
|
21
|
+
if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
|
|
22
|
+
return parsed;
|
|
23
|
+
}
|
|
24
|
+
return {};
|
|
25
|
+
}
|
|
26
|
+
catch (err) {
|
|
27
|
+
// Corrupt or unreadable file — treat as empty rather than crashing the
|
|
28
|
+
// server; the next successful `login` overwrites it with a valid one.
|
|
29
|
+
console.error(`[briefgate] could not read ${path}: ${err.message}`);
|
|
30
|
+
return {};
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
function writeAll(data) {
|
|
34
|
+
const path = credentialsPath();
|
|
35
|
+
const dir = dirname(path);
|
|
36
|
+
mkdirSync(dir, { recursive: true, mode: 0o700 });
|
|
37
|
+
writeFileSync(path, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
|
|
38
|
+
// The `mode` passed to mkdir/writeFile above is masked by the process
|
|
39
|
+
// umask, so force the permissions explicitly rather than merely requesting
|
|
40
|
+
// them — this file is as sensitive as an SSH private key.
|
|
41
|
+
try {
|
|
42
|
+
chmodSync(dir, 0o700);
|
|
43
|
+
chmodSync(path, 0o600);
|
|
44
|
+
}
|
|
45
|
+
catch (err) {
|
|
46
|
+
// Windows has no POSIX mode bits; anywhere else this is worth knowing.
|
|
47
|
+
if (process.platform !== 'win32') {
|
|
48
|
+
console.error(`[briefgate] could not restrict permissions on ${path}: ${err.message}`);
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
export function loadCredential(baseUrl) {
|
|
53
|
+
return readAll()[baseUrl];
|
|
54
|
+
}
|
|
55
|
+
export function saveCredential(baseUrl, cred) {
|
|
56
|
+
const all = readAll();
|
|
57
|
+
all[baseUrl] = cred;
|
|
58
|
+
writeAll(all);
|
|
59
|
+
}
|
|
60
|
+
/** Returns true if a credential existed and was removed. */
|
|
61
|
+
export function deleteCredential(baseUrl) {
|
|
62
|
+
const all = readAll();
|
|
63
|
+
if (!(baseUrl in all))
|
|
64
|
+
return false;
|
|
65
|
+
delete all[baseUrl];
|
|
66
|
+
writeAll(all);
|
|
67
|
+
return true;
|
|
68
|
+
}
|
|
69
|
+
/**
|
|
70
|
+
* Priority: an explicit key (CLI flag, or a request's Authorization header in
|
|
71
|
+
* HTTP mode) beats the environment, which beats the locally stored one.
|
|
72
|
+
* `allowFileFallback` must be false whenever the server is published — see
|
|
73
|
+
* the module comment.
|
|
74
|
+
*/
|
|
75
|
+
export function resolveApiKey(opts) {
|
|
76
|
+
if (opts.explicitApiKey) {
|
|
77
|
+
return { apiKey: opts.explicitApiKey, source: opts.explicitSource ?? 'flag' };
|
|
78
|
+
}
|
|
79
|
+
if (opts.envApiKey) {
|
|
80
|
+
return { apiKey: opts.envApiKey, source: 'env' };
|
|
81
|
+
}
|
|
82
|
+
if (opts.allowFileFallback) {
|
|
83
|
+
const cred = loadCredential(opts.baseUrl);
|
|
84
|
+
if (cred)
|
|
85
|
+
return { apiKey: cred.api_key, source: 'file' };
|
|
86
|
+
}
|
|
87
|
+
return { apiKey: '', source: 'none' };
|
|
88
|
+
}
|
|
89
|
+
//# sourceMappingURL=credentials.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,sEAAsE;AACtE,gFAAgF;AAChF,mEAAmE;AACnE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWlC,oFAAoF;AACpF,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,GAAG,OAAO,EAAE,8BAA8B,CAAC;AACjG,CAAC;AAED,SAAS,OAAO;IACd,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAyB,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,CAAC,KAAK,CAAC,8BAA8B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAqB;IACrC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,iDAAiD,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAsB;IACpE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAM7B;IACC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
export interface DeviceStart {
|
|
2
|
+
device_code: string;
|
|
3
|
+
user_code: string;
|
|
4
|
+
verification_uri: string;
|
|
5
|
+
verification_uri_complete: string;
|
|
6
|
+
expires_in: number;
|
|
7
|
+
interval: number;
|
|
8
|
+
}
|
|
9
|
+
export interface DevicePollSuccess {
|
|
10
|
+
api_key: string;
|
|
11
|
+
key_id: string;
|
|
12
|
+
account_name: string;
|
|
13
|
+
scopes: string[];
|
|
14
|
+
}
|
|
15
|
+
export type DevicePollOutcome = {
|
|
16
|
+
status: 'success';
|
|
17
|
+
result: DevicePollSuccess;
|
|
18
|
+
} | {
|
|
19
|
+
status: 'pending';
|
|
20
|
+
} | {
|
|
21
|
+
status: 'slow_down';
|
|
22
|
+
retryAfterSeconds?: number;
|
|
23
|
+
} | {
|
|
24
|
+
status: 'expired';
|
|
25
|
+
} | {
|
|
26
|
+
status: 'consumed';
|
|
27
|
+
} | {
|
|
28
|
+
status: 'denied';
|
|
29
|
+
} | {
|
|
30
|
+
status: 'unknown_code';
|
|
31
|
+
};
|
|
32
|
+
export declare function startDeviceAuth(baseUrl: string, clientName: string, scopes?: string[]): Promise<DeviceStart>;
|
|
33
|
+
export declare function pollDeviceAuth(baseUrl: string, deviceCode: string): Promise<DevicePollOutcome>;
|
|
34
|
+
export type RevokeOutcome = 'revoked' | 'already_revoked' | 'failed';
|
|
35
|
+
/**
|
|
36
|
+
* Best-effort server-side revocation for `logout`. Never throws — a network
|
|
37
|
+
* failure is reported as 'failed' so the caller can still remove the local
|
|
38
|
+
* credential and tell the user to revoke it from the dashboard instead.
|
|
39
|
+
*/
|
|
40
|
+
export declare function revokeCurrentKey(baseUrl: string, apiKey: string): Promise<RevokeOutcome>;
|
|
41
|
+
//# sourceMappingURL=device-auth.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAGpB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AA2D/B,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,WAAW,CAAC,CAUtB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqBpG;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAErE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAa9F"}
|
|
@@ -0,0 +1,119 @@
|
|
|
1
|
+
// Minimal client for the BriefGate device-authorization endpoints
|
|
2
|
+
// (POST /v1/auth/device/start, POST /v1/auth/device/poll) and key revocation
|
|
3
|
+
// (DELETE /v1/keys/current).
|
|
4
|
+
//
|
|
5
|
+
// Deliberately not routed through client.ts's apiRequest for the device-flow
|
|
6
|
+
// calls: every other call in this package carries a Bearer API key, but these
|
|
7
|
+
// two are how a key is obtained in the first place, so they must never send
|
|
8
|
+
// an Authorization header. revokeCurrentKey does send one — the key being
|
|
9
|
+
// revoked, not the caller's operator config — so it isn't a client.ts call
|
|
10
|
+
// either; a 401 there means "already revoked," not the generic auth failure
|
|
11
|
+
// client.ts's throwApiError reports.
|
|
12
|
+
const FETCH_TIMEOUT_MS = 15_000;
|
|
13
|
+
async function request(baseUrl, path, init) {
|
|
14
|
+
const controller = new AbortController();
|
|
15
|
+
const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
|
|
16
|
+
let res;
|
|
17
|
+
try {
|
|
18
|
+
res = await fetch(`${baseUrl}/v1${path}`, { ...init, signal: controller.signal });
|
|
19
|
+
}
|
|
20
|
+
catch (err) {
|
|
21
|
+
if (err instanceof Error && err.name === 'AbortError') {
|
|
22
|
+
throw new Error(`BriefGate request to ${path} timed out after ${FETCH_TIMEOUT_MS / 1000}s.`);
|
|
23
|
+
}
|
|
24
|
+
const detail = err instanceof Error ? err.message : String(err);
|
|
25
|
+
throw new Error(`BriefGate API unreachable: ${detail}.`);
|
|
26
|
+
}
|
|
27
|
+
finally {
|
|
28
|
+
clearTimeout(timeoutId);
|
|
29
|
+
}
|
|
30
|
+
let body;
|
|
31
|
+
try {
|
|
32
|
+
body = await res.json();
|
|
33
|
+
}
|
|
34
|
+
catch {
|
|
35
|
+
// Non-JSON or empty body (e.g. a 204) — callers validate the fields they
|
|
36
|
+
// need and fail there.
|
|
37
|
+
body = undefined;
|
|
38
|
+
}
|
|
39
|
+
return { status: res.status, body, headers: res.headers };
|
|
40
|
+
}
|
|
41
|
+
function postJson(baseUrl, path, payload) {
|
|
42
|
+
return request(baseUrl, path, {
|
|
43
|
+
method: 'POST',
|
|
44
|
+
headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
|
|
45
|
+
body: JSON.stringify(payload),
|
|
46
|
+
});
|
|
47
|
+
}
|
|
48
|
+
function errorMessage(body, status) {
|
|
49
|
+
const parsed = body;
|
|
50
|
+
return parsed?.message ?? parsed?.reason ?? parsed?.error ?? `HTTP ${status}`;
|
|
51
|
+
}
|
|
52
|
+
/**
|
|
53
|
+
* The server reports which case a non-2xx response is with a `reason` field
|
|
54
|
+
* (some earlier drafts of this contract used `error` for the same purpose) —
|
|
55
|
+
* checked defensively under both names since it costs nothing and the exact
|
|
56
|
+
* key is easy to get wrong across a contract handoff.
|
|
57
|
+
*/
|
|
58
|
+
function reasonOf(body) {
|
|
59
|
+
const parsed = body;
|
|
60
|
+
return parsed?.reason ?? parsed?.error;
|
|
61
|
+
}
|
|
62
|
+
export async function startDeviceAuth(baseUrl, clientName, scopes) {
|
|
63
|
+
const { status, body } = await postJson(baseUrl, '/auth/device/start', {
|
|
64
|
+
client_name: clientName,
|
|
65
|
+
...(scopes ? { scopes } : {}),
|
|
66
|
+
});
|
|
67
|
+
// The API answers 201: a device code is a resource it just created.
|
|
68
|
+
if (status !== 200 && status !== 201) {
|
|
69
|
+
throw new Error(`Could not start sign-in: ${errorMessage(body, status)}`);
|
|
70
|
+
}
|
|
71
|
+
return body;
|
|
72
|
+
}
|
|
73
|
+
export async function pollDeviceAuth(baseUrl, deviceCode) {
|
|
74
|
+
const { status, body, headers } = await postJson(baseUrl, '/auth/device/poll', { device_code: deviceCode });
|
|
75
|
+
if (status === 200)
|
|
76
|
+
return { status: 'success', result: body };
|
|
77
|
+
if (status === 428)
|
|
78
|
+
return { status: 'pending' };
|
|
79
|
+
if (status === 429) {
|
|
80
|
+
const retryAfter = headers.get('Retry-After');
|
|
81
|
+
const retryAfterSeconds = retryAfter ? parseInt(retryAfter, 10) : NaN;
|
|
82
|
+
return { status: 'slow_down', ...(isNaN(retryAfterSeconds) ? {} : { retryAfterSeconds }) };
|
|
83
|
+
}
|
|
84
|
+
if (status === 404)
|
|
85
|
+
return { status: 'unknown_code' };
|
|
86
|
+
if (status === 403)
|
|
87
|
+
return { status: 'denied' };
|
|
88
|
+
if (status === 410) {
|
|
89
|
+
// Distinguishes "expired" from "consumed" by reason; defaults to
|
|
90
|
+
// "expired" for a 410 that doesn't specify one.
|
|
91
|
+
return reasonOf(body) === 'device_code_consumed' || reasonOf(body) === 'consumed'
|
|
92
|
+
? { status: 'consumed' }
|
|
93
|
+
: { status: 'expired' };
|
|
94
|
+
}
|
|
95
|
+
throw new Error(`Unexpected response while checking sign-in status: ${errorMessage(body, status)}`);
|
|
96
|
+
}
|
|
97
|
+
/**
|
|
98
|
+
* Best-effort server-side revocation for `logout`. Never throws — a network
|
|
99
|
+
* failure is reported as 'failed' so the caller can still remove the local
|
|
100
|
+
* credential and tell the user to revoke it from the dashboard instead.
|
|
101
|
+
*/
|
|
102
|
+
export async function revokeCurrentKey(baseUrl, apiKey) {
|
|
103
|
+
try {
|
|
104
|
+
const { status } = await request(baseUrl, '/keys/current', {
|
|
105
|
+
method: 'DELETE',
|
|
106
|
+
headers: { Authorization: `Bearer ${apiKey}` },
|
|
107
|
+
});
|
|
108
|
+
if (status === 204)
|
|
109
|
+
return 'revoked';
|
|
110
|
+
if (status === 401)
|
|
111
|
+
return 'already_revoked'; // the key it would revoke is already gone
|
|
112
|
+
return 'failed';
|
|
113
|
+
}
|
|
114
|
+
catch (err) {
|
|
115
|
+
console.error(`[briefgate] could not revoke the key remotely: ${err.message}`);
|
|
116
|
+
return 'failed';
|
|
117
|
+
}
|
|
118
|
+
}
|
|
119
|
+
//# sourceMappingURL=device-auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,6EAA6E;AAC7E,6BAA6B;AAC7B,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,qCAAqC;AAErC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAmChC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,IAAiB;IACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACzE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,MAAM,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,oBAAoB,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,GAAG,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,uBAAuB;QACvB,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAY,EAAE,OAAgB;IAC/D,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE;QAC5B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,MAAM,MAAM,GAAG,IAAyE,CAAC;IACzF,OAAO,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,QAAQ,MAAM,EAAE,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAG,IAAuD,CAAC;IACvE,OAAO,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,UAAkB,EAClB,MAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE;QACrE,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,oEAAoE;IACpE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,UAAkB;IACtE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAE5G,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAyB,EAAE,CAAC;IACpF,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACtD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,iEAAiE;QACjE,gDAAgD;QAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,sBAAsB,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,UAAU;YAC/E,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;YACxB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,sDAAsD,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACtG,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,eAAe,EAAE;YACzD,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,iBAAiB,CAAC,CAAC,0CAA0C;QACxF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAmD,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}
|