@continuous-excellence/ze-great-dashboard-aws 0.22.2 → 0.23.0

package/dist/cli.js

@@ -163,8 +163,23 @@ var azureDevOpsSourceSchema = z2.looseObject({
   project: z2.string().min(1),
   /** The branch whose build health the dashboard represents. */
   branch: z2.string().min(1).optional(),
-  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
-  token_env: z2.string().min(1)
+  /** A PAT environment variable. The adapter sends it with Basic authentication. */
+  token_env: z2.string().min(1).optional(),
+  /** An environment variable naming a local, short-lived delegated-token file. */
+  entra_token_file_env: z2.string().min(1).optional()
+}).superRefine((source, ctx) => {
+  if (source.token_env && source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env, not both"
+    });
+  }
+  if (!source.token_env && !source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env"
+    });
+  }
 });
 var sourceSchema = z2.looseObject({ type: z2.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 var boardSchema = z2.object({
@@ -322,7 +337,7 @@ var pipelineActivitySchema = z4.object({
 });
 var pipelineStatusSchema = z4.object({
   type: z4.literal("pipeline-status"),
-  status: z4.enum(["passed", "failed", "running", "cancelled", "unknown"]),
+  status: z4.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: z4.string(),
   name: z4.string().min(1),

package/dist/index.js

@@ -844,8 +844,23 @@ var azureDevOpsSourceSchema = z2.looseObject({
   project: z2.string().min(1),
   /** The branch whose build health the dashboard represents. */
   branch: z2.string().min(1).optional(),
-  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
-  token_env: z2.string().min(1)
+  /** A PAT environment variable. The adapter sends it with Basic authentication. */
+  token_env: z2.string().min(1).optional(),
+  /** An environment variable naming a local, short-lived delegated-token file. */
+  entra_token_file_env: z2.string().min(1).optional()
+}).superRefine((source, ctx) => {
+  if (source.token_env && source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env, not both"
+    });
+  }
+  if (!source.token_env && !source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env"
+    });
+  }
 });
 var sourceSchema = z2.looseObject({ type: z2.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 var boardSchema = z2.object({
@@ -1003,7 +1018,7 @@ var pipelineActivitySchema = z4.object({
 });
 var pipelineStatusSchema = z4.object({
   type: z4.literal("pipeline-status"),
-  status: z4.enum(["passed", "failed", "running", "cancelled", "unknown"]),
+  status: z4.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: z4.string(),
   name: z4.string().min(1),

package/dist/lambda.mjs

@@ -3851,7 +3851,7 @@ var init_getSSOTokenFilepath = __esm({
 });
 
 // node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFromFile.js
-import { readFile } from "node:fs/promises";
+import { readFile as readFile2 } from "node:fs/promises";
 var tokenIntercept, getSSOTokenFromFile;
 var init_getSSOTokenFromFile = __esm({
   "node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFromFile.js"() {
@@ -3862,7 +3862,7 @@ var init_getSSOTokenFromFile = __esm({
         return tokenIntercept[id];
       }
       const ssoTokenFilepath = getSSOTokenFilepath(id);
-      const ssoTokenText = await readFile(ssoTokenFilepath, "utf8");
+      const ssoTokenText = await readFile2(ssoTokenFilepath, "utf8");
       return JSON.parse(ssoTokenText);
     };
   }
@@ -3979,12 +3979,12 @@ var init_parseIni = __esm({
 
 // node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/readFile.js
 import { readFile as fsReadFile } from "node:fs/promises";
-var filePromises, fileIntercept, readFile2;
+var filePromises, fileIntercept, readFile3;
 var init_readFile = __esm({
   "node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/readFile.js"() {
     filePromises = {};
     fileIntercept = {};
-    readFile2 = (path, options) => {
+    readFile3 = (path, options) => {
       if (fileIntercept[path] !== void 0) {
         return fileIntercept[path];
       }
@@ -4022,10 +4022,10 @@ var init_loadSharedConfigFiles = __esm({
         resolvedConfigFilepath = join4(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
-        readFile2(resolvedConfigFilepath, {
+        readFile3(resolvedConfigFilepath, {
           ignoreCache: init.ignoreCache
         }).then(parseIni).then(getConfigData).catch(swallowError),
-        readFile2(resolvedFilepath, {
+        readFile3(resolvedFilepath, {
           ignoreCache: init.ignoreCache
         }).then(parseIni).catch(swallowError)
       ]);
@@ -4056,7 +4056,7 @@ var init_loadSsoSessionData = __esm({
     init_parseIni();
     init_readFile();
     swallowError2 = () => ({});
-    loadSsoSessionData = async (init = {}) => readFile2(init.configFilepath ?? getConfigFilepath()).then(parseIni).then(getSsoSessionData).catch(swallowError2);
+    loadSsoSessionData = async (init = {}) => readFile3(init.configFilepath ?? getConfigFilepath()).then(parseIni).then(getSsoSessionData).catch(swallowError2);
   }
 });
 
@@ -4701,7 +4701,7 @@ __export(config_exports, {
   nodeFipsConfigSelectors: () => nodeFipsConfigSelectors,
   numberSelector: () => numberSelector,
   parseKnownFiles: () => parseKnownFiles,
-  readFile: () => readFile2,
+  readFile: () => readFile3,
   resolveCustomEndpointsConfig: () => resolveCustomEndpointsConfig,
   resolveDefaultsModeConfig: () => resolveDefaultsModeConfig,
   resolveEndpointsConfig: () => resolveEndpointsConfig,
@@ -64047,8 +64047,23 @@ var azureDevOpsSourceSchema = external_exports.looseObject({
   project: external_exports.string().min(1),
   /** The branch whose build health the dashboard represents. */
   branch: external_exports.string().min(1).optional(),
-  /** Azure DevOps Build API access is authenticated with a read-scoped PAT. */
-  token_env: external_exports.string().min(1)
+  /** A PAT environment variable. The adapter sends it with Basic authentication. */
+  token_env: external_exports.string().min(1).optional(),
+  /** An environment variable naming a local, short-lived delegated-token file. */
+  entra_token_file_env: external_exports.string().min(1).optional()
+}).superRefine((source, ctx) => {
+  if (source.token_env && source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env, not both"
+    });
+  }
+  if (!source.token_env && !source.entra_token_file_env) {
+    ctx.addIssue({
+      code: "custom",
+      message: "configure token_env or entra_token_file_env"
+    });
+  }
 });
 var sourceSchema = external_exports.looseObject({ type: external_exports.string().min(1), ...sourceAuthenticationSchema }).superRefine(exactlyOneGithubAuthenticationMode);
 function credentialEnvironmentNames(source) {
@@ -64217,7 +64232,7 @@ var pipelineActivitySchema = external_exports.object({
 });
 var pipelineStatusSchema = external_exports.object({
   type: external_exports.literal("pipeline-status"),
-  status: external_exports.enum(["passed", "failed", "running", "cancelled", "unknown"]),
+  status: external_exports.enum(["passed", "failed", "warning", "running", "cancelled", "unknown"]),
   /** The source's unmodified status/result vocabulary, for an honest display. */
   rawStatus: external_exports.string(),
   name: external_exports.string().min(1),
@@ -64353,6 +64368,9 @@ function nearestLegalRectangle(desired, accepted) {
   return { x: candidate.x, y: candidate.y, w: candidate.w, h: candidate.h };
 }
 
+// packages/server/src/adapters/azure-devops.ts
+import { readFile } from "node:fs/promises";
+
 // packages/server/src/upstream.ts
 function publicErrorMessage(kind) {
   switch (kind) {
@@ -64469,14 +64487,14 @@ function permittedAzureDevOpsCalls(panel, source) {
 async function fetchAzureDevOpsPipeline(args) {
   const panel = pipelinePanelSchema.parse(args.panel);
   const source = azureDevOpsSourceSchema.parse(args.source);
-  const token = args.credentials.get(source.token_env);
-  if (!token) {
+  const authorization = await azureDevOpsAuthorization(source, args.credentials);
+  if (!authorization) {
     return {
       response: errorResponse(
         errorEnvelope(
           panel.id,
           "unauthorized",
-          `Credential ${source.token_env} is not available.`,
+          "Azure DevOps credentials are not available.",
           sourceLink(panel.pipeline, source)
         )
       ),
@@ -64485,7 +64503,7 @@ async function fetchAzureDevOpsPipeline(args) {
   }
   const call = buildsCall(panel.pipeline, source);
   copyValidators(args.requestHeaders, call.headers);
-  call.headers.set("authorization", `Basic ${btoa(`:${token}`)}`);
+  call.headers.set("authorization", authorization);
   let upstream;
   try {
     upstream = await args.fetcher(call.url, { headers: call.headers });
@@ -64576,6 +64594,27 @@ async function fetchAzureDevOpsPipeline(args) {
     };
   }
 }
+var delegatedTokenFileSchema = external_exports.object({
+  accessToken: external_exports.string().min(1),
+  expiresAt: external_exports.string().min(1)
+});
+async function azureDevOpsAuthorization(source, credentials) {
+  if (source.token_env) {
+    const token = credentials.get(source.token_env);
+    return token ? `Basic ${btoa(`:${token}`)}` : void 0;
+  }
+  if (!source.entra_token_file_env) return void 0;
+  const tokenFile = credentials.get(source.entra_token_file_env);
+  if (!tokenFile) return void 0;
+  try {
+    const token = delegatedTokenFileSchema.parse(JSON.parse(await readFile(tokenFile, "utf8")));
+    const expiresAt = Date.parse(token.expiresAt);
+    if (!Number.isFinite(expiresAt) || expiresAt <= Date.now()) return void 0;
+    return `Bearer ${token.accessToken}`;
+  } catch {
+    return void 0;
+  }
+}
 function buildsCall(definitionId, source) {
   const url2 = apiUrl(source, "build/builds");
   url2.searchParams.set("definitions", String(definitionId));
@@ -64626,6 +64665,7 @@ function normalizeStatus(status, result) {
   if (status !== "completed") return "unknown";
   if (result === "succeeded") return "passed";
   if (result === "failed") return "failed";
+  if (result === "partiallySucceeded") return "warning";
   if (result === "canceled") return "cancelled";
   return "unknown";
 }
@@ -67916,10 +67956,10 @@ function safeDownloadFilename(value) {
 }
 
 // packages/server/src/board-config.ts
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 var import_yaml2 = __toESM(require_dist(), 1);
 async function loadBoardConfig(location, fetcher = globalThis.fetch, expectedSchemaUrl) {
-  const text = isUrl(location) ? await fetchBoardConfig(location, fetcher) : await readFile3(location, "utf-8");
+  const text = isUrl(location) ? await fetchBoardConfig(location, fetcher) : await readFile4(location, "utf-8");
   const authoredSchemaUrl = readBoardSchemaModeline(text, expectedSchemaUrl);
   const result = boardConfigSchema.safeParse((0, import_yaml2.parse)(text));
   if (!result.success) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuous-excellence/ze-great-dashboard-aws",
-  "version": "0.22.2",
+  "version": "0.23.0",
   "type": "module",
   "description": "AWS server runtime and CloudFormation deployment tooling for Ze Great Dashboard.",
   "keywords": [