@cjhyy/code-shell-server 0.9.7 → 0.9.9

package/dist/links/device-oauth.js

@@ -0,0 +1,255 @@
+import { randomUUID } from "node:crypto";
+import { createHardenedOAuthFetch } from "@cjhyy/code-shell-core";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const PROVIDERS = {
+    github: {
+        clientIdEnvironmentKey: "CODESHELL_GITHUB_APP_CLIENT_ID",
+        deviceEndpoint: "https://github.com/login/device/code",
+        tokenEndpoint: "https://github.com/login/oauth/access_token",
+        verificationHosts: ["github.com"],
+        // A GitHub App user token uses the App's fine-grained permissions rather
+        // than OAuth scopes, so no scope parameter is sent.
+    },
+    gitlab: {
+        clientIdEnvironmentKey: "CODESHELL_GITLAB_OAUTH_CLIENT_ID",
+        deviceEndpoint: "https://gitlab.com/oauth/authorize_device",
+        tokenEndpoint: "https://gitlab.com/oauth/token",
+        verificationHosts: ["gitlab.com"],
+        scopes: ["read_api"],
+    },
+};
+function abortableSleep(milliseconds, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error("Browser login cancelled"));
+            return;
+        }
+        const timer = setTimeout(done, milliseconds);
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            reject(new Error("Browser login cancelled"));
+        };
+        function done() {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function form(values) {
+    const body = new URLSearchParams();
+    for (const [key, value] of Object.entries(values)) {
+        if (value)
+            body.set(key, value);
+    }
+    return body;
+}
+async function safeJson(response, action, allowOAuthError = false) {
+    const raw = await response.text();
+    if (raw.length > MAX_RESPONSE_BYTES)
+        throw new Error(`${action} response is too large`);
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`${action} returned invalid JSON`, { cause: error });
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${action} returned an invalid response`);
+    }
+    const record = parsed;
+    if (!response.ok && !(allowOAuthError && typeof record.error === "string")) {
+        throw new Error(`${action} failed (${response.status})`);
+    }
+    return record;
+}
+function requiredString(value, field, action, maxLength = 16_384) {
+    if (typeof value !== "string" || !value || value.length > maxLength) {
+        throw new Error(`${action} response is missing ${field}`);
+    }
+    return value;
+}
+function finiteSeconds(value, fallback, maximum) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0
+        ? Math.min(value, maximum)
+        : fallback;
+}
+function verifiedHttpsUrl(raw, field, allowedHosts) {
+    const value = requiredString(raw, field, "Device authorization", 2_048);
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch (error) {
+        throw new Error(`Device authorization returned an invalid ${field}`, { cause: error });
+    }
+    if (url.protocol !== "https:" || !allowedHosts.includes(url.hostname.toLowerCase())) {
+        throw new Error(`Device authorization returned an untrusted ${field}`);
+    }
+    return url.toString();
+}
+export function isLocalBrowserLinkProvider(value) {
+    return value === "github" || value === "gitlab";
+}
+/** Main-process-only broker. Provider tokens never cross the renderer IPC. */
+export class LinkDeviceOAuthBroker {
+    fetchFn;
+    now;
+    sleep;
+    createId;
+    clientIds;
+    environment;
+    attempts = new Map();
+    constructor(options = {}) {
+        this.fetchFn = createHardenedOAuthFetch(options.fetch ?? fetch);
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? abortableSleep;
+        this.createId = options.createId ?? randomUUID;
+        this.clientIds = options.clientIds ?? {};
+        this.environment = options.environment ?? process.env;
+    }
+    status(providerId) {
+        return {
+            providerId,
+            configured: Boolean(this.clientId(providerId)),
+            flow: "device-code",
+            ...(this.clientId(providerId) ? {} : { configurationCode: "client_id_missing" }),
+        };
+    }
+    async start(providerId, signal) {
+        const config = PROVIDERS[providerId];
+        const clientId = this.clientId(providerId);
+        if (!clientId)
+            throw new Error(`${providerId} browser login is not configured in this build`);
+        for (const [attemptId, attempt] of this.attempts) {
+            if (attempt.providerId === providerId)
+                this.cancel(attemptId);
+        }
+        const body = form({
+            client_id: clientId,
+            scope: config.scopes?.join(" "),
+        });
+        const response = await this.fetchFn(config.deviceEndpoint, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+            },
+            body,
+            signal: signal
+                ? AbortSignal.any([signal, AbortSignal.timeout(15_000)])
+                : AbortSignal.timeout(15_000),
+        });
+        const payload = await safeJson(response, "Device authorization");
+        const deviceCode = requiredString(payload.device_code, "device_code", "Device authorization");
+        const userCode = requiredString(payload.user_code, "user_code", "Device authorization", 128);
+        const verificationUri = verifiedHttpsUrl(payload.verification_uri, "verification_uri", config.verificationHosts);
+        const verificationUriComplete = payload.verification_uri_complete
+            ? verifiedHttpsUrl(payload.verification_uri_complete, "verification_uri_complete", config.verificationHosts)
+            : undefined;
+        const expiresIn = finiteSeconds(payload.expires_in, 600, 1_800);
+        const interval = finiteSeconds(payload.interval, 5, 30);
+        const attemptId = this.createId();
+        const expiresAtMs = this.now() + expiresIn * 1_000;
+        this.attempts.set(attemptId, {
+            providerId,
+            clientId,
+            deviceCode,
+            tokenEndpoint: config.tokenEndpoint,
+            expiresAtMs,
+            intervalMs: interval * 1_000,
+            abortController: new AbortController(),
+        });
+        return {
+            attemptId,
+            providerId,
+            userCode,
+            verificationUri,
+            verificationUriComplete,
+            expiresAt: new Date(expiresAtMs).toISOString(),
+        };
+    }
+    async complete(attemptId) {
+        const attempt = this.attempts.get(attemptId);
+        if (!attempt)
+            throw new Error("Browser login attempt is unavailable or expired");
+        let intervalMs = attempt.intervalMs;
+        try {
+            while (this.now() < attempt.expiresAtMs) {
+                await this.sleep(intervalMs, attempt.abortController.signal);
+                const response = await this.fetchFn(attempt.tokenEndpoint, {
+                    method: "POST",
+                    headers: {
+                        Accept: "application/json",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                    },
+                    body: form({
+                        client_id: attempt.clientId,
+                        device_code: attempt.deviceCode,
+                        grant_type: DEVICE_GRANT,
+                    }),
+                    signal: AbortSignal.any([attempt.abortController.signal, AbortSignal.timeout(15_000)]),
+                });
+                const payload = await safeJson(response, "Device token exchange", true);
+                if (typeof payload.access_token === "string" && payload.access_token) {
+                    const tokenType = typeof payload.token_type === "string" ? payload.token_type.toLowerCase() : "bearer";
+                    if (tokenType !== "bearer")
+                        throw new Error("Device token exchange returned non-Bearer token");
+                    return {
+                        providerId: attempt.providerId,
+                        accessToken: requiredString(payload.access_token, "access_token", "Device token exchange"),
+                        refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token
+                            ? requiredString(payload.refresh_token, "refresh_token", "Device token exchange")
+                            : undefined,
+                        expiresIn: typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in)
+                            ? Math.max(0, payload.expires_in)
+                            : undefined,
+                        refreshTokenExpiresIn: typeof payload.refresh_token_expires_in === "number" &&
+                            Number.isFinite(payload.refresh_token_expires_in)
+                            ? Math.max(0, payload.refresh_token_expires_in)
+                            : undefined,
+                        clientId: attempt.clientId,
+                        tokenEndpoint: attempt.tokenEndpoint,
+                        tokenType: "Bearer",
+                        scope: typeof payload.scope === "string" ? payload.scope : undefined,
+                    };
+                }
+                const error = typeof payload.error === "string" ? payload.error : "invalid_response";
+                if (error === "authorization_pending")
+                    continue;
+                if (error === "slow_down") {
+                    intervalMs = Math.min(intervalMs + 5_000, 60_000);
+                    continue;
+                }
+                if (error === "access_denied")
+                    throw new Error("Browser authorization was denied");
+                if (error === "expired_token" || error === "token_expired") {
+                    throw new Error("Browser authorization code expired");
+                }
+                throw new Error(`Browser authorization failed (${error})`);
+            }
+            throw new Error("Browser authorization code expired");
+        }
+        finally {
+            this.attempts.delete(attemptId);
+        }
+    }
+    cancel(attemptId) {
+        const attempt = this.attempts.get(attemptId);
+        if (!attempt)
+            return false;
+        this.attempts.delete(attemptId);
+        attempt.abortController.abort("Browser login cancelled");
+        return true;
+    }
+    clientId(providerId) {
+        const explicit = this.clientIds[providerId]?.trim();
+        if (explicit)
+            return explicit;
+        const environmentValue = this.environment[PROVIDERS[providerId].clientIdEnvironmentKey]?.trim();
+        return environmentValue || undefined;
+    }
+}

package/dist/links/http.d.ts

@@ -0,0 +1,34 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type LinkServiceOptions } from "./service.js";
+import type { LinkConnectionInput, LinkOperationContext, TokenConnectionInput } from "./types.js";
+export interface LinkHttpOptions extends LinkServiceOptions {
+    ownerId: (request: IncomingMessage) => Promise<string | undefined>;
+    isAuthorized: (request: IncomingMessage) => Promise<boolean>;
+}
+/** Host authenticates and validates Origin first; writes independently recheck the same owner. */
+export declare function createLinkHttp(options: LinkHttpOptions): {
+    service: {
+        snapshot: () => import("@cjhyy/code-shell-link").LinkSnapshot;
+        persistValidatedConnection: (context: LinkOperationContext, input: LinkConnectionInput, validation: import("@cjhyy/code-shell-core").LocalLinkValidationResult, authentication: import("./service.js").ValidatedLinkAuthentication) => Promise<import("@cjhyy/code-shell-link").MaskedLinkConnection>;
+        assertAuthorized: (context: LinkOperationContext) => Promise<void>;
+        connectToken: (context: LinkOperationContext, input: TokenConnectionInput) => Promise<import("@cjhyy/code-shell-link").MaskedLinkConnection>;
+        connectCli: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<import("@cjhyy/code-shell-link").MaskedLinkConnection>;
+        cliStatus: (context: LinkOperationContext, rawProviderId: unknown) => Promise<{
+            account?: string | undefined;
+            providerId: import("@cjhyy/code-shell-core").CliLinkProviderId;
+            command: string;
+            installed: boolean;
+            authenticated: boolean;
+        }>;
+        rename: (context: LinkOperationContext, id: string, label: string, expectedRevision: string) => Promise<import("@cjhyy/code-shell-link").MaskedLinkConnection>;
+        disconnect: (context: LinkOperationContext, id: string, expectedRevision: string) => Promise<void>;
+        startDeviceAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
+        authorization: (context: LinkOperationContext, id: string) => Promise<import("@cjhyy/code-shell-link").LinkAuthorization>;
+        cancelAuthorization: (context: LinkOperationContext, id: string) => Promise<void>;
+        cancelOwner: (ownerId: string) => void;
+        close: () => void;
+    };
+    close: () => void;
+    cancelOwner: (ownerId: string) => void;
+    handle(request: IncomingMessage, response: ServerResponse): Promise<boolean>;
+};

package/dist/links/http.js

@@ -0,0 +1,144 @@
+import { createLinkService, LinkServiceError, publicLinkError, } from "./service.js";
+const ROOT = "/api/v1/links";
+const MAX_BODY_BYTES = 32 * 1024;
+function json(response, status, value) {
+    response.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store",
+    });
+    response.end(JSON.stringify(value));
+}
+async function body(request) {
+    if ((request.headers["content-type"] ?? "").split(";", 1)[0].trim().toLowerCase() !==
+        "application/json")
+        throw new LinkServiceError(400, "invalid_request");
+    const declared = Number(request.headers["content-length"] ?? 0);
+    if (!Number.isFinite(declared) || declared < 0 || declared > MAX_BODY_BYTES) {
+        request.resume();
+        throw new LinkServiceError(413, "invalid_request");
+    }
+    const chunks = [];
+    let bytes = 0;
+    for await (const part of request.iterator({ destroyOnReturn: false })) {
+        const chunk = Buffer.from(part);
+        bytes += chunk.length;
+        if (bytes > MAX_BODY_BYTES) {
+            request.resume();
+            throw new LinkServiceError(413, "invalid_request");
+        }
+        chunks.push(chunk);
+    }
+    let value;
+    try {
+        value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        throw new LinkServiceError(400, "invalid_request");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new LinkServiceError(400, "invalid_request");
+    return value;
+}
+function fields(input, allowed) {
+    if (Object.keys(input).some((key) => !allowed.includes(key)))
+        throw new LinkServiceError(400, "invalid_request");
+}
+/** Host authenticates and validates Origin first; writes independently recheck the same owner. */
+export function createLinkHttp(options) {
+    const service = createLinkService(options);
+    async function context(request, abandoned) {
+        const ownerId = await options.ownerId(request);
+        if (!ownerId || !(await options.isAuthorized(request)))
+            throw new LinkServiceError(401, "login_required");
+        return {
+            ownerId,
+            authorize: async () => (await options.isAuthorized(request)) &&
+                (await options.ownerId(request)) === ownerId &&
+                !abandoned(),
+        };
+    }
+    return {
+        service,
+        close: service.close,
+        cancelOwner: service.cancelOwner,
+        async handle(request, response) {
+            const url = new URL(request.url ?? "/", "http://localhost");
+            if (url.pathname !== ROOT && !url.pathname.startsWith(ROOT + "/"))
+                return false;
+            let abandoned = false;
+            const onClose = () => {
+                if (!response.writableEnded)
+                    abandoned = true;
+            };
+            response.once("close", onClose);
+            try {
+                const owner = await context(request, () => abandoned || request.aborted);
+                const method = request.method;
+                let result;
+                if (url.pathname === ROOT && method === "GET")
+                    result = service.snapshot();
+                else {
+                    const cli = /^\/api\/v1\/links\/providers\/([^/]+)\/cli$/.exec(url.pathname);
+                    const connection = /^\/api\/v1\/links\/connections\/([^/]+)$/.exec(url.pathname);
+                    const authorization = /^\/api\/v1\/links\/authorizations\/([^/]+)$/.exec(url.pathname);
+                    if (cli && method === "GET")
+                        result = await service.cliStatus(owner, decodeURIComponent(cli[1]));
+                    else if (authorization && method === "GET")
+                        result = await service.authorization(owner, decodeURIComponent(authorization[1]));
+                    else if (authorization && method === "DELETE") {
+                        await service.cancelAuthorization(owner, decodeURIComponent(authorization[1]));
+                        result = { cancelled: true };
+                    }
+                    else if (method === "POST" &&
+                        [
+                            ROOT + "/connections/token",
+                            ROOT + "/connections/cli",
+                            ROOT + "/authorizations/device",
+                        ].includes(url.pathname)) {
+                        const input = await body(request);
+                        const token = url.pathname.endsWith("/token");
+                        fields(input, [
+                            "providerId",
+                            "methodId",
+                            "label",
+                            "connectionId",
+                            "expectedRevision",
+                            ...(token ? ["token"] : []),
+                        ]);
+                        result = token
+                            ? await service.connectToken(owner, input)
+                            : url.pathname.endsWith("/cli")
+                                ? await service.connectCli(owner, input)
+                                : await service.startDeviceAuth(owner, input);
+                    }
+                    else if (connection && (method === "PATCH" || method === "DELETE")) {
+                        const input = await body(request);
+                        fields(input, method === "PATCH" ? ["label", "expectedRevision"] : ["expectedRevision"]);
+                        const id = decodeURIComponent(connection[1]);
+                        if (method === "PATCH")
+                            result = await service.rename(owner, id, input.label, input.expectedRevision);
+                        else {
+                            await service.disconnect(owner, id, input.expectedRevision);
+                            result = { removed: true };
+                        }
+                    }
+                    else
+                        throw new LinkServiceError(404, "not_found");
+                }
+                await service.assertAuthorized(owner);
+                json(response, 200, result);
+            }
+            catch (error) {
+                const failure = error instanceof URIError
+                    ? new LinkServiceError(400, "invalid_request")
+                    : publicLinkError(error);
+                if (!response.destroyed)
+                    json(response, failure.status, { error: failure.message, code: failure.code });
+            }
+            finally {
+                response.off("close", onClose);
+            }
+            return true;
+        },
+    };
+}

package/dist/links/service.d.ts

@@ -0,0 +1,54 @@
+import { CredentialStore, connectCliLink, getCliLinkStatus, validateLocalLinkToken, type LocalLinkValidationResult } from "@cjhyy/code-shell-core";
+import { LinkDeviceOAuthBroker, type LocalBrowserAuthToken } from "./device-oauth.js";
+import type { LinkAuthorization, LinkConnectionInput, LinkErrorCode, LinkOperationContext, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput } from "./types.js";
+export declare class LinkServiceError extends Error {
+    readonly status: number;
+    readonly code: LinkErrorCode;
+    constructor(status: number, code: LinkErrorCode);
+}
+export declare function publicLinkError(error: unknown): LinkServiceError;
+export interface LinkServiceOptions {
+    cwd?: string;
+    store?: CredentialStore;
+    withMutation?: <T>(write: () => Promise<T>) => Promise<T>;
+    onChanged?: () => void | Promise<void>;
+    now?: () => number;
+    /** Test seams. Production delegates to Core's fixed provider and CLI executors. */
+    validateToken?: typeof validateLocalLinkToken;
+    cliStatus?: typeof getCliLinkStatus;
+    bindCli?: typeof connectCliLink;
+    createDeviceBroker?: () => LinkDeviceOAuthBroker;
+}
+/** Trusted host adapter input; deliberately absent from the HTTP API. */
+export type ValidatedLinkAuthentication = {
+    source: "manual-token";
+    token: string;
+} | {
+    source: "browser-oauth";
+    token: LocalBrowserAuthToken;
+} | {
+    source: "cli-session";
+};
+/** One host/workspace credential domain. Browsers never provide the store or owner identity. */
+export declare function createLinkService(options?: LinkServiceOptions): {
+    snapshot: () => LinkSnapshot;
+    persistValidatedConnection: (context: LinkOperationContext, input: LinkConnectionInput, validation: LocalLinkValidationResult, authentication: ValidatedLinkAuthentication) => Promise<MaskedLinkConnection>;
+    assertAuthorized: (context: LinkOperationContext) => Promise<void>;
+    connectToken: (context: LinkOperationContext, input: TokenConnectionInput) => Promise<MaskedLinkConnection>;
+    connectCli: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<MaskedLinkConnection>;
+    cliStatus: (context: LinkOperationContext, rawProviderId: unknown) => Promise<{
+        account?: string | undefined;
+        providerId: import("@cjhyy/code-shell-core").CliLinkProviderId;
+        command: string;
+        installed: boolean;
+        authenticated: boolean;
+    }>;
+    rename: (context: LinkOperationContext, id: string, label: string, expectedRevision: string) => Promise<MaskedLinkConnection>;
+    disconnect: (context: LinkOperationContext, id: string, expectedRevision: string) => Promise<void>;
+    startDeviceAuth: (context: LinkOperationContext, input: LinkConnectionInput) => Promise<LinkAuthorization>;
+    authorization: (context: LinkOperationContext, id: string) => Promise<LinkAuthorization>;
+    cancelAuthorization: (context: LinkOperationContext, id: string) => Promise<void>;
+    cancelOwner: (ownerId: string) => void;
+    close: () => void;
+};
+export type LinkService = ReturnType<typeof createLinkService>;