@codingame/monaco-vscode-api 33.0.9 → 34.0.0

package/vscode/src/vs/workbench/api/common/extHostTypeConverters.js

@@ -4208,7 +4208,8 @@ var ChatSessionItem;
                 lastRequestEnded
             },
             changes: sessionContent.changes instanceof Array ? sessionContent.changes : undefined,
-            metadata: sessionContent.metadata
+            metadata: sessionContent.metadata,
+            legacyResource: sessionContent.legacyResource
         };
     }
     ChatSessionItem.from = from;

package/vscode/src/vs/workbench/api/common/extHostWorkspace.js

@@ -2,7 +2,7 @@
 import { __decorate, __param } from '../../../../../../external/tslib/tslib.es6.js';
 import { delta as delta$1, mapArrayOrNot } from '../../../base/common/arrays.js';
 import { Barrier, AsyncIterableProducer } from '../../../base/common/async.js';
-import { CancellationToken } from '../../../base/common/cancellation.js';
+import { CancellationToken, CancellationTokenSource } from '../../../base/common/cancellation.js';
 import { Emitter, AsyncEmitter } from '../../../base/common/event.js';
 import { DisposableStore, toDisposable } from '../../../base/common/lifecycle.js';
 import { StopWatch } from '../../../base/common/stopwatch.js';
@@ -344,7 +344,7 @@ let ExtHostWorkspace = class ExtHostWorkspace {
                     }
                 };
                 this._messageService.$showMessage(Severity$1.Error, ( localize(
-                    2823,
+                    2881,
                     "Extension '{0}' failed to update workspace folders: {1}",
                     extName,
                     (error.toString())
@@ -566,10 +566,21 @@ let ExtHostWorkspace = class ExtHostWorkspace {
         }
     }
     async _findFilesBase(queryOptions, token) {
+        let tokenToUse = token;
+        let linkedSource;
+        if (!CancellationToken.isCancellationToken(token)) {
+            linkedSource = ( new CancellationTokenSource());
+            const foreignToken = token;
+            if (typeof foreignToken.onCancellationRequested === "function") {
+                foreignToken.onCancellationRequested(() => linkedSource.cancel());
+            }
+            tokenToUse = linkedSource.token;
+        }
         const result = await Promise.all(queryOptions?.map(
-            option => this._proxy.$startFileSearch(option.folder ?? null, option.options, token).then(data => Array.isArray(data) ? ( data.map(d => URI.revive(d))) : [])
+            option => this._proxy.$startFileSearch(option.folder ?? null, option.options, tokenToUse).then(data => Array.isArray(data) ? ( data.map(d => URI.revive(d))) : [])
         ) ?? []);
         const flatResult = result.flat();
+        linkedSource?.dispose();
         const extUri = ( new ExtUri(uri => ignorePathCasing(uri, this._extHostFileSystemInfo)));
         const uriMap = ( new Map());
         for (const uri of flatResult) {

package/vscode/src/vs/workbench/api/common/extHostXaaAuthProvider.d.ts

@@ -0,0 +1,58 @@
+import { DynamicAuthProvider } from "./extHostAuthentication.js";
+type Ctor<T> = new (...args: any[]) => T;
+/**
+ * Scopes used when bootstrapping the IdP session for an XAA flow.
+ *
+ * `openid` is required because the ID-JAG token exchange uses the IdP-issued
+ * `id_token` as `subject_token` (per draft-ietf-oauth-identity-assertion-authz-grant
+ * section 3.1, the subject token MUST be of type `urn:ietf:params:oauth:token-type:id_token`).
+ * `offline_access` is requested so we get a refresh token for the IdP session.
+ */
+export declare const IDP_SCOPES: readonly string[];
+/** Cache key for resource-scoped tokens. Exported for testing. */
+export declare function cacheKey(resource: string, scopes: readonly string[]): string;
+/**
+ * Returns true if the cached token is past (or within 60s of) its expiry. Pure
+ * and exported for testing.
+ *
+ * Mints fresh ID-JAG assertions are usually short-lived (minutes). We treat tokens as expired
+ * 60s before their nominal expiry to avoid clock skew and in-flight redemptions racing past
+ * `exp`. Tokens without `expires_in` defined are treated as never-expiring (cached
+ * until the process exits); `expires_in: 0` is treated as immediately expired.
+ */
+export declare function isExpired(entry: {
+    token: {
+        expires_in?: number;
+    };
+    created_at: number;
+}, now?: number): boolean;
+/**
+ * (Preview) Mixin that turns a {@link DynamicAuthProvider} subclass into a
+ * Cross App Access (XAA) / enterprise-managed authentication provider, per
+ * `draft-ietf-oauth-identity-assertion-authz-grant`.
+ *
+ * The IdP login leg is identical to the base class — Auth Code + PKCE against
+ * the org-configured issuer, using the pre-registered client credentials. On
+ * top of that:
+ *
+ *   1. `createSession` ensures an IdP session exists (delegated to the base
+ *      class with {@link IDP_SCOPES}).
+ *   2. It POSTs to the IdP token endpoint with `grant_type=token-exchange`,
+ *      `subject_token=<id_token>`, `subject_token_type=id_token`,
+ *      `requested_token_type=id-jag`, `audience=<resource AS>`,
+ *      `resource=<resource indicator>`, `scope=<requested scopes>` to mint an
+ *      ID-JAG.
+ *   3. It discovers the resource's authorization server metadata (the audience
+ *      URL) and POSTs the ID-JAG to its token endpoint with
+ *      `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer`,
+ *      `assertion=<id-jag>`, `resource=<resource indicator>`,
+ *      `scope=<requested scopes>` to obtain a resource-scoped access token.
+ *   4. The resource-scoped token is cached in-memory per `(resource, scopes)`
+ *      and returned as the session's access token.
+ *
+ * The resource indicator is read from `options.resource` (RFC 8707) and the
+ * resource's authorization server URL from `options.audience` on
+ * {@link vscode.AuthenticationProviderSessionOptions}.
+ */
+export declare function XaaifyAuthProvider<TBase extends Ctor<DynamicAuthProvider>>(Base: TBase): TBase;
+export {};

package/vscode/src/vs/workbench/api/common/extHostXaaAuthProvider.js

@@ -0,0 +1,284 @@
+
+import { stringHash } from '../../../base/common/hash.js';
+import { getClaimsFromJWT, buildIdJagExchangeBody, fetchAuthorizationServerMetadata, buildResourceRedemptionBody, isAuthorizationTokenResponse } from '../../../base/common/oauth.js';
+
+const IDP_SCOPES = ["openid", "offline_access"];
+function cacheKey(resource, scopes) {
+    return resource + "|" + [...scopes].sort().join(" ");
+}
+function isExpired(entry, now = Date.now()) {
+    if (entry.token.expires_in === undefined) {
+        return false;
+    }
+    return now > entry.created_at + (entry.token.expires_in * 1000) - 60_000;
+}
+function XaaifyAuthProvider(Base) {
+    return class XaaAuthenticationProvider extends Base {
+        _resourceClientSecretKey(resource, clientId) {
+            return `${resource}|${clientId}`;
+        }
+        constructor(...args) {
+            super(...args);
+            this._resourceTokens = ( new Map());
+            this._resourceClientSecrets = ( new Map());
+            const issuer = this.authorizationServer;
+            this.id = `xaa:${( issuer.toString(true))}`;
+            this._logger.trace(`[XAA] Provider constructed for issuer ${( issuer.toString(true))}. authorization_endpoint=${this._serverMetadata.authorization_endpoint}, token_endpoint=${this._serverMetadata.token_endpoint}`);
+        }
+        async getSessions(scopes, options) {
+            const resource = options.resource;
+            const audience = options.audience;
+            if (!resource || !scopes || !audience) {
+                return [];
+            }
+            const key = cacheKey(resource, scopes);
+            const entry = this._resourceTokens.get(key);
+            if (entry && !isExpired(entry)) {
+                return [toSession(entry.token, entry.scopes)];
+            }
+            if (entry) {
+                this._resourceTokens.delete(key);
+            }
+            const idpSession = await this._tryGetSilentIdpSession();
+            if (!idpSession?.idToken) {
+                return [];
+            }
+            try {
+                const minted = await this._mintResourceToken(idpSession, [...scopes], audience, resource, options,  true);
+                if (!minted) {
+                    return [];
+                }
+                return [toSession(minted.token, minted.scopes)];
+            } catch (err) {
+                this._logger.warn(
+                    `[XAA] Silent token mint failed for resource=${resource}; falling back to interactive. Error: ${err.message}`
+                );
+                return [];
+            }
+        }
+        async createSession(scopes, options) {
+            const audience = options.audience;
+            const resource = options.resource;
+            this._logger.trace(
+                `[XAA] createSession scopes=[${scopes.join(" ")}] audience=${audience} resource=${resource}`
+            );
+            if (!audience) {
+                throw ( new Error(
+                    "Enterprise-managed authentication requires `options.audience` (the resource's authorization server URL) but none was provided."
+                ));
+            }
+            if (!resource) {
+                throw ( new Error(
+                    "Enterprise-managed authentication requires `options.resource` (the resource indicator / MCP server URL) but none was provided."
+                ));
+            }
+            const idpSession = await this._ensureIdpSession();
+            if (!idpSession.idToken) {
+                throw ( new Error(
+                    "IdP session is missing an id_token; the issuer must support OpenID Connect and the `openid` scope."
+                ));
+            }
+            const minted = await this._mintResourceToken(idpSession, scopes, audience, resource, options,  false);
+            if (!minted) {
+                throw ( new Error(
+                    "Failed to mint a resource access token for the enterprise-managed MCP server."
+                ));
+            }
+            return toSession(minted.token, minted.scopes);
+        }
+        async _mintResourceToken(idpSession, scopes, audience, resource, options, silent) {
+            const jag = await this._exchangeForIdJag(idpSession.idToken, audience, resource, scopes);
+            const resourceTokenEndpoint = await this._discoverResourceTokenEndpoint(audience);
+            let resourceClientId = this._clientId;
+            let resourceClientIdFromJag = false;
+            const configuredResourceClientId = typeof options.clientId === "string" && options.clientId.length > 0 ? options.clientId : undefined;
+            if (configuredResourceClientId) {
+                resourceClientId = configuredResourceClientId;
+                resourceClientIdFromJag = resourceClientId !== this._clientId;
+            } else {
+                try {
+                    const jagClaims = getClaimsFromJWT(jag);
+                    if (typeof jagClaims.client_id === "string" && jagClaims.client_id.length > 0) {
+                        resourceClientId = jagClaims.client_id;
+                        resourceClientIdFromJag = resourceClientId !== this._clientId;
+                    }
+                } catch (err) {
+                    this._logger.warn(
+                        `[XAA] Could not decode ID-JAG to read resource client_id; falling back to IdP client_id. Error: ${err.message}`
+                    );
+                }
+            }
+            let resourceClientSecret = this._clientSecret;
+            const configuredResourceClientSecret = typeof options.clientSecret === "string" && options.clientSecret.length > 0 ? options.clientSecret : undefined;
+            const secretCacheKey = this._resourceClientSecretKey(resource, resourceClientId);
+            if (configuredResourceClientSecret) {
+                resourceClientSecret = configuredResourceClientSecret;
+                this._resourceClientSecrets.set(secretCacheKey, configuredResourceClientSecret);
+            } else if (resourceClientIdFromJag) {
+                if (( this._resourceClientSecrets.has(secretCacheKey))) {
+                    resourceClientSecret = this._resourceClientSecrets.get(secretCacheKey);
+                } else if (silent) {
+                    this._logger.info(
+                        `[XAA] Silent mint requires resource client_secret for '${resourceClientId}' but none is cached or configured; deferring to interactive flow.`
+                    );
+                    return undefined;
+                } else {
+                    this._logger.info(
+                        `[XAA] Resource AS requires a distinct client_id '${resourceClientId}' — prompting for matching client_secret.`
+                    );
+                    const promptedSecret = await this._proxy.$promptForResourceClientSecret(resourceClientId, resource);
+                    if (promptedSecret === undefined) {
+                        return undefined;
+                    }
+                    this._resourceClientSecrets.set(secretCacheKey, promptedSecret);
+                    resourceClientSecret = promptedSecret.length > 0 ? promptedSecret : undefined;
+                }
+            }
+            const resourceToken = await this._redeemAtResource(
+                resourceTokenEndpoint,
+                jag,
+                resource,
+                scopes,
+                resourceClientId,
+                resourceClientSecret
+            );
+            const entry = {
+                resource,
+                scopes,
+                token: resourceToken,
+                created_at: Date.now()
+            };
+            this._resourceTokens.set(cacheKey(resource, scopes), entry);
+            return entry;
+        }
+        async _tryGetSilentIdpSession() {
+            const cleanOptions = {};
+            const existing = await super.getSessions(IDP_SCOPES, cleanOptions);
+            return existing.length ? existing[0] : undefined;
+        }
+        async _ensureIdpSession() {
+            this._logger.trace(
+                `[XAA] _ensureIdpSession: scopes=[${IDP_SCOPES.join(" ")}] authorization_endpoint=${this._serverMetadata.authorization_endpoint}`
+            );
+            const silent = await this._tryGetSilentIdpSession();
+            if (silent?.idToken) {
+                this._logger.trace(`[XAA] _ensureIdpSession: reusing existing IdP session`);
+                return silent;
+            }
+            this._logger.trace(
+                `[XAA] _ensureIdpSession: creating new IdP session via super.createSession`
+            );
+            return super.createSession([...IDP_SCOPES], {});
+        }
+        async _exchangeForIdJag(idToken, audience, resource, scopes) {
+            const tokenEndpoint = this._serverMetadata.token_endpoint;
+            if (!tokenEndpoint) {
+                throw ( new Error(
+                    "Issuer metadata is missing token_endpoint; cannot perform XAA token exchange."
+                ));
+            }
+            const body = buildIdJagExchangeBody(this._clientId, this._clientSecret, idToken, audience, resource, scopes);
+            this._logger.trace(
+                `[XAA] POST ${tokenEndpoint} (ID-JAG exchange) audience=${audience} resource=${resource} scope=${scopes.join(" ")}`
+            );
+            const response = await fetch(tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "Accept": "application/json"
+                },
+                body: ( body.toString())
+            });
+            if (!response.ok) {
+                throw ( new Error(
+                    `XAA token exchange (IdP) failed: ${response.status} ${await safeText(response)}`
+                ));
+            }
+            const data = await response.json();
+            const issued = (data && typeof data === "object" && typeof data.access_token === "string") ? data.access_token : undefined;
+            if (!issued) {
+                throw ( new Error(
+                    `XAA token exchange (IdP) returned no access_token. Response: ${JSON.stringify(data)}`
+                ));
+            }
+            return issued;
+        }
+        async _discoverResourceTokenEndpoint(audience) {
+            const {
+                metadata,
+                errors
+            } = await fetchAuthorizationServerMetadata(audience);
+            if (!metadata?.token_endpoint) {
+                throw ( new Error(
+                    `Failed to discover resource authorization server metadata for '${audience}': ${( errors.map(e => e.message)).join("; ") || "no token_endpoint in metadata"}`
+                ));
+            }
+            return metadata.token_endpoint;
+        }
+        async _redeemAtResource(
+            tokenEndpoint,
+            idJag,
+            resource,
+            scopes,
+            resourceClientId,
+            resourceClientSecret
+        ) {
+            const body = buildResourceRedemptionBody(resourceClientId, resourceClientSecret, idJag, resource, scopes);
+            this._logger.trace(
+                `[XAA] POST ${tokenEndpoint} (ID-JAG redemption) client_id=${resourceClientId} resource=${resource} scope=${scopes.join(" ")}`
+            );
+            const response = await fetch(tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    "Accept": "application/json"
+                },
+                body: ( body.toString())
+            });
+            if (!response.ok) {
+                throw ( new Error(
+                    `XAA token exchange (resource) failed: ${response.status} ${await safeText(response)}`
+                ));
+            }
+            const data = await response.json();
+            if (!isAuthorizationTokenResponse(data)) {
+                throw ( new Error(
+                    `XAA token exchange (resource) returned an invalid token response: ${JSON.stringify(data)}`
+                ));
+            }
+            return data;
+        }
+    };
+}
+function toSession(token, scopes) {
+    let claims;
+    if (token.id_token) {
+        try {
+            claims = getClaimsFromJWT(token.id_token);
+        } catch {}
+    }
+    if (!claims) {
+        try {
+            claims = getClaimsFromJWT(token.access_token);
+        } catch {}
+    }
+    return {
+        id: ( stringHash(token.access_token, 0).toString()),
+        accessToken: token.access_token,
+        account: {
+            id: claims?.sub || "unknown",
+            label: claims?.preferred_username || claims?.name || claims?.email || "XAA"
+        },
+        scopes: [...scopes],
+        idToken: token.id_token
+    };
+}
+async function safeText(response) {
+    try {
+        return await response.text();
+    } catch {
+        return response.statusText;
+    }
+}
+
+export { IDP_SCOPES, XaaifyAuthProvider, cacheKey, isExpired };

package/vscode/src/vs/workbench/api/common/jsonValidationExtensionPoint.js

@@ -16,7 +16,7 @@ const configurationExtPoint = ExtensionsRegistry.registerExtensionPoint({
     extensionPoint: "jsonValidation",
     defaultExtensionKind: ["workspace", "web"],
     jsonSchema: {
-        description: ( localize(2824, "Contributes json schema configuration.")),
+        description: ( localize(2882, "Contributes json schema configuration.")),
         type: "array",
         defaultSnippets: [{
             body: [{
@@ -36,7 +36,7 @@ const configurationExtPoint = ExtensionsRegistry.registerExtensionPoint({
                 fileMatch: {
                     type: ["string", "array"],
                     description: ( localize(
-                        2825,
+                        2883,
                         "The file pattern (or an array of patterns) to match, for example \"package.json\" or \"*.launch\". Exclusion patterns start with '!'"
                     )),
                     items: {
@@ -45,7 +45,7 @@ const configurationExtPoint = ExtensionsRegistry.registerExtensionPoint({
                 },
                 url: {
                     description: ( localize(
-                        2826,
+                        2884,
                         "A schema URL ('http:', 'https:') or relative path to the extension folder ('./')."
                     )),
                     type: "string"
@@ -62,20 +62,20 @@ class JSONValidationExtensionPoint {
                 const collector = extension.collector;
                 const extensionLocation = extension.description.extensionLocation;
                 if (!extensionValue || !Array.isArray(extensionValue)) {
-                    collector.error(( localize(2827, "'configuration.jsonValidation' must be a array")));
+                    collector.error(( localize(2885, "'configuration.jsonValidation' must be a array")));
                     return;
                 }
                 extensionValue.forEach(extension => {
                     if (!isString(extension.fileMatch) && !(Array.isArray(extension.fileMatch) && extension.fileMatch.every(isString))) {
                         collector.error(( localize(
-                            2828,
+                            2886,
                             "'configuration.jsonValidation.fileMatch' must be defined as a string or an array of strings."
                         )));
                         return;
                     }
                     const uri = extension.url;
                     if (!isString(uri)) {
-                        collector.error(( localize(2829, "'configuration.jsonValidation.url' must be a URL or relative path")));
+                        collector.error(( localize(2887, "'configuration.jsonValidation.url' must be a URL or relative path")));
                         return;
                     }
                     if (uri.startsWith("./")) {
@@ -83,7 +83,7 @@ class JSONValidationExtensionPoint {
                             const colorThemeLocation = joinPath(extensionLocation, uri);
                             if (!isEqualOrParent(colorThemeLocation, extensionLocation)) {
                                 collector.warn(( localize(
-                                    2830,
+                                    2888,
                                     "Expected `contributes.{0}.url` ({1}) to be included inside extension's folder ({2}). This might make the extension non-portable.",
                                     configurationExtPoint.name,
                                     (colorThemeLocation.toString()),
@@ -92,14 +92,14 @@ class JSONValidationExtensionPoint {
                             }
                         } catch (e) {
                             collector.error(( localize(
-                                2831,
+                                2889,
                                 "'configuration.jsonValidation.url' is an invalid relative URL: {0}",
                                 e.message
                             )));
                         }
                     } else if (!/^[^:/?#]+:\/\//.test(uri)) {
                         collector.error(( localize(
-                            2832,
+                            2890,
                             "'configuration.jsonValidation.url' must be an absolute URL or start with './'  to reference schemas located in the extension."
                         )));
                         return;
@@ -128,7 +128,7 @@ class JSONValidationDataRenderer extends Disposable {
                 dispose: () => {}
             };
         }
-        const headers = [( localize(2833, "File Match")), ( localize(2834, "Schema"))];
+        const headers = [( localize(2891, "File Match")), ( localize(2892, "Schema"))];
         const rows = ( contrib.map(v => {
             return [( new MarkdownString()).appendMarkdown(`\`${Array.isArray(v.fileMatch) ? v.fileMatch.join(", ") : v.fileMatch}\``), v.url];
         }));
@@ -143,7 +143,7 @@ class JSONValidationDataRenderer extends Disposable {
 }
 ( Registry.as(Extensions.ExtensionFeaturesRegistry)).registerExtensionFeature({
     id: "jsonValidation",
-    label: ( localize(2835, "JSON Validation")),
+    label: ( localize(2893, "JSON Validation")),
     access: {
         canToggle: false
     },