@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/setup-core/credstore.js

@@ -0,0 +1,415 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientConfiguration = exports.InvalidConfigError = void 0;
+exports.resolveTokens = resolveTokens;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const cli_auth_1 = require("@credibledata/cli-auth");
+const os_1 = __importDefault(require("os"));
+const environments_1 = require("./environments");
+const writefile_1 = require("./writefile");
+/**
+ * Thrown when `.cred` exists but cannot be used: either it does not parse as
+ * JSON or it parses but lacks the required top-level shape. Distinct from fs
+ * errors (ENOENT, EACCES) so callers that want to recover — `cred login` —
+ * can target *only* a corrupt-content failure and leave permission/IO errors
+ * to surface loudly.
+ */
+class InvalidConfigError extends Error {
+}
+exports.InvalidConfigError = InvalidConfigError;
+/**
+ * Sort the stored token fields into access token and id token by audience,
+ * using the rules `cred` and `ms2ad` share (cli-auth/src/index.ts, where each
+ * rule is written down and tested), bound to this deployment's Auth0 values.
+ *
+ * A token it cannot identify comes back `undefined`, so the caller says "run
+ * `cred login`" instead of sending a token the control plane will refuse.
+ */
+function resolveTokens(stored, environment) {
+    return (0, cli_auth_1.resolveTokens)(stored, environments_1.auth0ConfigsByEnv[environment]);
+}
+class ClientConfiguration {
+    /**
+     * Make every default store (`new ClientConfiguration()`, the form the ~40
+     * CLI commands build for themselves) read `scope` instead of the global
+     * `activeEnvironment`, organization and environment, without writing them.
+     *
+     * The CLI calls this once at startup, for a command run in a directory
+     * `cred init` pinned, unless `--cell` names another cell: that
+     * cell's own store applies, and the pin is ignored. Without it those commands read only `~/.cred`, so in
+     * a directory pinned to one organization `cred ls connections` listed
+     * another's, and `cred rm connection` would have deleted from it.
+     *
+     * A store built with an explicit path or deployment is left alone: those
+     * are the callers that already chose where to read, and the specs.
+     */
+    static scopeCommand(scope) {
+        ClientConfiguration.commandScope = scope;
+    }
+    /**
+     * @param customConfigPath an alternate `~/.cred` location, for tests.
+     * @param environmentOverride pin every per-environment read to this
+     *        deployment instead of the file's `activeEnvironment`, without
+     *        writing to disk. `~/.cred` stores credentials per deployment, so a
+     *        caller that targets a deployment other than the active one needs
+     *        its token, organization and environment from that deployment too:
+     *        resolving only the URL would talk to one deployment's control plane
+     *        with another's token.
+     */
+    constructor(customConfigPath, environmentOverride) {
+        var _a;
+        this.configPath = `${os_1.default.homedir()}/.cred`;
+        if (customConfigPath) {
+            this.configPath = customConfigPath;
+        }
+        this.environmentOverride = environmentOverride;
+        if (!customConfigPath && !environmentOverride) {
+            this.scope = ClientConfiguration.commandScope;
+            this.environmentOverride = (_a = this.scope) === null || _a === void 0 ? void 0 : _a.deployment;
+        }
+    }
+    /**
+     * The same file, with every per-deployment read and write pinned to
+     * `environment` — the one this store resolves to now. For an operation that
+     * reads, waits and then writes: without the pin, the write resolves the
+     * deployment again and follows an `activeEnvironment` changed in between.
+     */
+    pinnedToCurrentEnvironment() {
+        return this.pinnedTo(this.getEnvironment());
+    }
+    /** The same file, with every per-deployment read and write pinned to `environment`. */
+    pinnedTo(environment) {
+        return new ClientConfiguration(this.configPath, environment);
+    }
+    /** Where this store lives on disk. The token refresh locks a file beside it. */
+    getConfigPath() {
+        return this.configPath;
+    }
+    loadConfig() {
+        let fileContents;
+        try {
+            fileContents = fs_1.default.readFileSync(this.configPath);
+        }
+        catch (error) {
+            if ((error === null || error === void 0 ? void 0 : error.code) === "ENOENT") {
+                // First-time setup: create a default config on disk.
+                this.config = this.defaultConfig();
+                this.writeConfig();
+                return this.config;
+            }
+            throw error;
+        }
+        try {
+            this.config = JSON.parse(fileContents.toString());
+        }
+        catch (error) {
+            // Non-atomic writes from older binaries, or a manually corrupted file,
+            // can leave `.cred` unparseable. Fail loud rather than silently
+            // overwriting — a silent reset erases the access token for every
+            // subsequent caller on the same machine.
+            throw new InvalidConfigError(`Failed to parse ${this.configPath}: ${error}. The file may be corrupt; re-run \`cred login\` to reset.`);
+        }
+        if (!this.config.activeEnvironment || !this.config.configPerEnvironment) {
+            throw new InvalidConfigError(`Invalid config structure in ${this.configPath}; re-run \`cred login\` to reset.`);
+        }
+        for (const env of environments_1.ALL_ENVIRONMENTS) {
+            if (!this.config.configPerEnvironment[env]) {
+                this.config.configPerEnvironment[env] = {};
+            }
+        }
+        return this.config;
+    }
+    /**
+     * Ensure `.cred` is usable, recovering from a corrupt file if needed.
+     *
+     * `loadConfig` deliberately fails loud on a corrupt/invalid file so a read
+     * path never silently erases tokens. But `cred login` exists precisely to
+     * (re)establish config, so it must be able to get past a bad file — that is
+     * what the "re-run `cred login` to reset" message promises. We make the
+     * message true here: the bad file is renamed aside (never deleted, so a
+     * support engineer can still inspect it) and a fresh default is written.
+     *
+     * Only an {@link InvalidConfigError} triggers recovery. fs errors such as
+     * EACCES are real environment problems and are rethrown — resetting would
+     * just fail to write anyway, and we must not mask a permissions issue as a
+     * successful reset.
+     *
+     * @returns the path the corrupt file was backed up to, or null if the
+     *          existing config was already valid. The caller decides how to
+     *          report it; this module does not own a logger.
+     */
+    recoverIfCorrupt() {
+        try {
+            this.loadConfig();
+            return null;
+        }
+        catch (error) {
+            if (!(error instanceof InvalidConfigError)) {
+                throw error;
+            }
+            const backupPath = `${this.configPath}.corrupt-${crypto_1.default
+                .randomBytes(8)
+                .toString("hex")}`;
+            fs_1.default.renameSync(this.configPath, backupPath);
+            this.config = this.defaultConfig();
+            this.writeConfig();
+            return backupPath;
+        }
+    }
+    defaultConfig() {
+        const configPerEnvironment = {};
+        for (const env of environments_1.ALL_ENVIRONMENTS) {
+            configPerEnvironment[env] = {};
+        }
+        return { configPerEnvironment, activeEnvironment: environments_1.DEFAULT_DEPLOYMENT };
+    }
+    // 0600 because this file holds tokens: the default 0644 is readable by every
+    // other account on the machine. Atomicity and the unguessable temp name are
+    // `writeFileAtomic`'s job — see there for why each matters.
+    writeConfig() {
+        (0, writefile_1.writeFileAtomic)(this.configPath, JSON.stringify(this.config), {
+            mode: 0o600,
+        });
+    }
+    currentEnvConfig() {
+        this.loadConfig();
+        return this.config.configPerEnvironment[this.getEnvironment()];
+    }
+    setOrganization(organizationName) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment].organization =
+            organizationName;
+        this.writeConfig();
+    }
+    // `undefined` clears it: that is what `login.ts` writes when the organization
+    // changes and the old environment no longer applies, and what `cred init`
+    // writes before opening the picker. `cred status` reports an unset
+    // environment with `?? "Not set"`, which only catches null/undefined — so a
+    // clear that wrote `""` would print a blank line instead.
+    setProject(projectName) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment].project = projectName;
+        this.writeConfig();
+    }
+    getOrganization() {
+        var _a, _b;
+        return (_b = (_a = this.scope) === null || _a === void 0 ? void 0 : _a.organization) !== null && _b !== void 0 ? _b : this.currentEnvConfig().organization;
+    }
+    getProject() {
+        var _a, _b;
+        return (_b = (_a = this.scope) === null || _a === void 0 ? void 0 : _a.environment) !== null && _b !== void 0 ? _b : this.currentEnvConfig().project;
+    }
+    setAccessToken(userToken, accessToken) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment].isServiceAccountToken =
+            !userToken;
+        this.config.configPerEnvironment[environment].accessToken = accessToken;
+        this.writeConfig();
+    }
+    /**
+     * Persist a freshly-issued Auth0 token pair.
+     *
+     * Writes the access token to BOTH `accessToken` and `jwtAccessToken`, which
+     * is the shape the CLI has always written and the shape the extension can
+     * still read (it takes the access token from `jwtAccessToken`). `idToken`
+     * gets its own field so it is never confused with the access token again.
+     */
+    setTokenPair(tokens) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        const envConfig = this.config.configPerEnvironment[environment];
+        envConfig.isServiceAccountToken = false;
+        envConfig.accessToken = tokens.accessToken;
+        envConfig.jwtAccessToken = tokens.accessToken;
+        if (tokens.idToken) {
+            envConfig.idToken = tokens.idToken;
+        }
+        if (tokens.refreshToken) {
+            envConfig.refreshToken = tokens.refreshToken;
+        }
+        this.writeConfig();
+    }
+    /**
+     * The token to put in an `Authorization` header, resolved by audience rather
+     * than by field name so it is correct whichever tool wrote the file last.
+     */
+    getApiAccessToken() {
+        const envConfig = this.currentEnvConfig();
+        if (envConfig.isServiceAccountToken) {
+            return envConfig.accessToken;
+        }
+        return resolveTokens(envConfig, this.getEnvironment()).apiAccessToken;
+    }
+    getIdToken() {
+        return resolveTokens(this.currentEnvConfig(), this.getEnvironment())
+            .idToken;
+    }
+    getAuthenticationHeader() {
+        const envConfig = this.currentEnvConfig();
+        const authType = envConfig.isServiceAccountToken ? "ApiKey" : "Bearer";
+        return `${authType} ${this.getApiAccessToken()}`;
+    }
+    /**
+     * @deprecated Ambiguous — returns the raw `accessToken` field, whose meaning
+     * depends on which tool wrote it last. Use {@link getApiAccessToken} for an
+     * `Authorization` header or {@link getIdToken} for profile claims.
+     */
+    getAccessToken() {
+        return this.currentEnvConfig().accessToken;
+    }
+    setJwtAccessToken(jwtAccessToken) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment].jwtAccessToken =
+            jwtAccessToken;
+        this.writeConfig();
+    }
+    getJwtAccessToken() {
+        return this.currentEnvConfig().jwtAccessToken;
+    }
+    setVSCodeUser(username, email) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        if (!this.config.configPerEnvironment[environment]) {
+            this.config.configPerEnvironment[environment] = {};
+        }
+        this.config.configPerEnvironment[environment].vsCodeUser = {
+            username,
+            email,
+        };
+        this.writeConfig();
+    }
+    getVSCodeUser() {
+        return this.currentEnvConfig().vsCodeUser;
+    }
+    setRefreshToken(refreshToken) {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment].refreshToken = refreshToken;
+        this.writeConfig();
+    }
+    getRefreshToken() {
+        return this.currentEnvConfig().refreshToken;
+    }
+    isServiceAccountToken() {
+        return Boolean(this.currentEnvConfig().isServiceAccountToken);
+    }
+    doesConfigExists() {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        return Boolean(this.config.configPerEnvironment[environment]);
+    }
+    getHeaders() {
+        return {
+            Authorization: this.getAuthenticationHeader(),
+        };
+    }
+    /**
+     * Remove this deployment's tokens and keep the rest of its entry: the
+     * organization and environment (`project`) the user chose. For a session
+     * Auth0 has refused, where the next step is signing back in to the same
+     * place. `cred logout` uses `destroyConfig`, which forgets everything.
+     */
+    clearTokens() {
+        // Resolve the deployment first: getEnvironment() reloads `this.config`,
+        // so reading `this.config` before it would edit a stale copy and write
+        // the old tokens back.
+        const environment = this.getEnvironment();
+        this.loadConfig();
+        const envConfig = this.config.configPerEnvironment[environment];
+        if (!envConfig)
+            return;
+        delete envConfig.accessToken;
+        delete envConfig.jwtAccessToken;
+        delete envConfig.idToken;
+        delete envConfig.refreshToken;
+        delete envConfig.isServiceAccountToken;
+        this.writeConfig();
+    }
+    destroyConfig() {
+        this.loadConfig();
+        const environment = this.getEnvironment();
+        this.config.configPerEnvironment[environment] = {};
+        this.writeConfig();
+    }
+    setEnvironment(environment) {
+        this.loadConfig();
+        this.config.activeEnvironment = environment;
+        this.writeConfig();
+    }
+    getEnvironment() {
+        var _a;
+        return (_a = this.environmentOverride) !== null && _a !== void 0 ? _a : this.getGlobalEnvironment();
+    }
+    /** The `activeEnvironment` the file records, whatever `--cell` or a pin says this store acts on. */
+    getGlobalEnvironment() {
+        this.loadConfig();
+        return this.config.activeEnvironment || environments_1.DEFAULT_DEPLOYMENT;
+    }
+    /** The cells whose slot holds a token, in the order the file lists them. */
+    signedInCells() {
+        this.loadConfig();
+        return environments_1.ALL_ENVIRONMENTS.filter((env) => {
+            const slot = this.config.configPerEnvironment[env];
+            return Boolean((slot === null || slot === void 0 ? void 0 : slot.accessToken) || (slot === null || slot === void 0 ? void 0 : slot.jwtAccessToken) || (slot === null || slot === void 0 ? void 0 : slot.refreshToken));
+        });
+    }
+    /**
+     * Seconds until the API access token expires; negative once it has. Returns
+     * `undefined` when there is no decodable expiry — a service-account token or
+     * a malformed one — so callers can tell "no deadline" from "expires soon".
+     */
+    secondsUntilExpiry() {
+        var _a;
+        const token = this.getApiAccessToken();
+        const exp = (_a = (0, cli_auth_1.decodeJwtClaims)(token)) === null || _a === void 0 ? void 0 : _a.exp;
+        if (!exp)
+            return undefined;
+        return exp - Math.floor(Date.now() / 1000);
+    }
+    isTokenValid() {
+        var _a;
+        const envConfig = this.currentEnvConfig();
+        if (!this.getApiAccessToken()) {
+            // "Nothing stored" and "something stored that we cannot use" are
+            // different problems and have different fixes, so they keep different
+            // messages. Since `resolveTokens` stopped falling back to the raw
+            // field, an unusable token reaches here rather than being handed on —
+            // without this branch it would be reported as an empty store, which
+            // sends someone looking for a login that already happened.
+            const stored = (_a = envConfig.accessToken) !== null && _a !== void 0 ? _a : envConfig.jwtAccessToken;
+            return {
+                valid: false,
+                reason: stored
+                    ? "Invalid token format. Please login again."
+                    : "No token found. Please login.",
+            };
+        }
+        if (envConfig.isServiceAccountToken) {
+            return { valid: true };
+        }
+        const remaining = this.secondsUntilExpiry();
+        if (remaining === undefined) {
+            return {
+                valid: false,
+                reason: "Invalid token format. Please login again.",
+            };
+        }
+        if (remaining <= 0) {
+            return {
+                valid: false,
+                reason: "Token expired. Please login again.",
+            };
+        }
+        return { valid: true };
+    }
+}
+exports.ClientConfiguration = ClientConfiguration;
+//# sourceMappingURL=credstore.js.map

package/dist/setup-core/credstore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credstore.js","sourceRoot":"","sources":["../../src/setup-core/credstore.ts"],"names":[],"mappings":";;;;;;AAgGA,sCAKC;AArGD,oDAA4B;AAC5B,4CAAoB;AACpB,qDAIgC;AAChC,4CAAoB;AAGpB,iDAKwB;AACxB,2CAA8C;AA+D9C;;;;;;GAMG;AACH,MAAa,kBAAmB,SAAQ,KAAK;CAAG;AAAhD,gDAAgD;AAEhD;;;;;;;GAOG;AACH,SAAgB,aAAa,CAC1B,MAAuB,EACvB,WAAwB;IAExB,OAAO,IAAA,wBAAmB,EAAC,MAAM,EAAE,gCAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;AACtE,CAAC;AAYD,MAAa,mBAAmB;IAI7B;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,YAAY,CAAC,KAA+B;QACvD,mBAAmB,CAAC,YAAY,GAAG,KAAK,CAAC;IAC5C,CAAC;IAOD;;;;;;;;;OASG;IACH,YAAY,gBAAyB,EAAE,mBAAiC;;QAfhE,eAAU,GAAG,GAAG,YAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAgB1C,IAAI,gBAAgB,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,GAAG,gBAAgB,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,YAAY,CAAC;YAC9C,IAAI,CAAC,mBAAmB,GAAG,MAAA,IAAI,CAAC,KAAK,0CAAE,UAAU,CAAC;QACrD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,0BAA0B;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,uFAAuF;IAChF,QAAQ,CAAC,WAAwB;QACrC,OAAO,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,gFAAgF;IACzE,aAAa;QACjB,OAAO,IAAI,CAAC,UAAU,CAAC;IAC1B,CAAC;IAEM,UAAU;QACd,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACF,YAAY,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,KAA+B,aAA/B,KAAK,uBAAL,KAAK,CAA4B,IAAI,MAAK,QAAQ,EAAE,CAAC;gBACvD,qDAAqD;gBACrD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,MAAM,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACd,uEAAuE;YACvE,gEAAgE;YAChE,iEAAiE;YACjE,yCAAyC;YACzC,MAAM,IAAI,kBAAkB,CACzB,mBAAmB,IAAI,CAAC,UAAU,KAAK,KAAK,4DAA4D,CAC1G,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACvE,MAAM,IAAI,kBAAkB,CACzB,+BAA+B,IAAI,CAAC,UAAU,mCAAmC,CACnF,CAAC;QACL,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,+BAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAC9C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACI,gBAAgB;QACpB,IAAI,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,CAAC;YACf,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,UAAU,YAAY,gBAAM;iBACnD,WAAW,CAAC,CAAC,CAAC;iBACd,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,UAAU,CAAC;QACrB,CAAC;IACJ,CAAC;IAEO,aAAa;QAClB,MAAM,oBAAoB,GAAuC,EAAE,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,+BAAgB,EAAE,CAAC;YAClC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iCAAkB,EAAE,CAAC;IAC1E,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4DAA4D;IACpD,WAAW;QAChB,IAAA,2BAAe,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC3D,IAAI,EAAE,KAAK;SACb,CAAC,CAAC;IACN,CAAC;IAEO,gBAAgB;QACrB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IAEM,eAAe,CAAC,gBAAwB;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,YAAY;YACvD,gBAAgB,CAAC;QACpB,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,mEAAmE;IACnE,4EAA4E;IAC5E,0DAA0D;IACnD,UAAU,CAAC,WAA+B;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,OAAO,GAAG,WAAW,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,eAAe;;QACnB,OAAO,MAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,YAAY,mCAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC;IAC3E,CAAC;IAEM,UAAU;;QACd,OAAO,MAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,WAAW,mCAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC;IACrE,CAAC;IAEM,cAAc,CAAC,SAAkB,EAAE,WAAmB;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,qBAAqB;YAChE,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACI,YAAY,CAAC,MAInB;QACE,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,SAAS,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACxC,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAC3C,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvB,SAAS,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,iBAAiB;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC;QACD,OAAO,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC;IACzE,CAAC;IAEM,UAAU;QACd,OAAO,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;aAChE,OAAO,CAAC;IACf,CAAC;IAEM,uBAAuB;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvE,OAAO,GAAG,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,cAAc;QACX,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,WAAW,CAAC;IAC9C,CAAC;IAEM,iBAAiB,CAAC,cAAsB;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,cAAc;YACzD,cAAc,CAAC;QAClB,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,iBAAiB;QACrB,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,cAAc,CAAC;IACjD,CAAC;IAEM,aAAa,CAAC,QAAgB,EAAE,KAAa;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,UAAU,GAAG;YACxD,QAAQ;YACR,KAAK;SACP,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,aAAa;QACjB,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC;IAC7C,CAAC;IAEM,eAAe,CAAC,YAAoB;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;QAC1E,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,eAAe;QACnB,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC;IAC/C,CAAC;IAEM,qBAAqB;QACzB,OAAO,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,qBAAqB,CAAC,CAAC;IACjE,CAAC;IAEM,gBAAgB;QACpB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IAEM,UAAU;QACd,OAAO;YACJ,aAAa,EAAE,IAAI,CAAC,uBAAuB,EAAE;SAC/C,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,WAAW;QACf,wEAAwE;QACxE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,OAAO,SAAS,CAAC,WAAW,CAAC;QAC7B,OAAO,SAAS,CAAC,cAAc,CAAC;QAChC,OAAO,SAAS,CAAC,OAAO,CAAC;QACzB,OAAO,SAAS,CAAC,YAAY,CAAC;QAC9B,OAAO,SAAS,CAAC,qBAAqB,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,aAAa;QACjB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;QACnD,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,cAAc,CAAC,WAAwB;QAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IAEM,cAAc;;QAClB,OAAO,MAAA,IAAI,CAAC,mBAAmB,mCAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAClE,CAAC;IAED,oGAAoG;IAC7F,oBAAoB;QACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,iCAAkB,CAAC;IAC9D,CAAC;IAED,4EAA4E;IACrE,aAAa;QACjB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,+BAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,OAAO,CACX,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,MAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,cAAc,CAAA,KAAI,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAA,CACjE,CAAC;QACL,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,kBAAkB;;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAA,IAAA,0BAAe,EAAC,KAAK,CAAC,0CAAE,GAAG,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEM,YAAY;;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE1C,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAC7B,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,MAAM,GAAG,MAAA,SAAS,CAAC,WAAW,mCAAI,SAAS,CAAC,cAAc,CAAC;YACjE,OAAO;gBACJ,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM;oBACX,CAAC,CAAC,2CAA2C;oBAC7C,CAAC,CAAC,+BAA+B;aACtC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACJ,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2CAA2C;aACrD,CAAC;QACL,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO;gBACJ,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oCAAoC;aAC9C,CAAC;QACL,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;CACH;AA3aD,kDA2aC"}

package/dist/setup-core/credstore.spec.js

@@ -0,0 +1,238 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = require("path");
+const credstore_1 = require("./credstore");
+const environments_1 = require("./environments");
+const PROD = environments_1.auth0ConfigsByEnv.production;
+/**
+ * Build a decodable (unsigned) JWT. `aud` is the only claim that matters here:
+ * it is what tells an access token from an id token.
+ */
+function jwt(claims) {
+    const part = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    return `${part({ alg: "HS256", typ: "JWT" })}.${part(claims)}.signature`;
+}
+const inOneHour = () => Math.floor(Date.now() / 1000) + 3600;
+// Minted per test, not at load: mocha loads every spec before running any, so
+// a token minted at load has already aged by however long the earlier specs
+// took, which breaks the expiry assertions on a slow CI run.
+/** An Auth0 API access token: audienced to the API. */
+let accessTokenJwt;
+/** An Auth0 id token: audienced to the client id. */
+let idTokenJwt;
+describe("credstore token resolution", () => {
+    beforeEach(() => {
+        accessTokenJwt = jwt({ aud: PROD.audience, exp: inOneHour() });
+        idTokenJwt = jwt({
+            aud: PROD.clientId,
+            exp: inOneHour(),
+            email: "a@b.c",
+        });
+    });
+    describe("resolveTokens", () => {
+        it("reads the CLI's shape: access token in accessToken", () => {
+            const resolved = (0, credstore_1.resolveTokens)({ accessToken: accessTokenJwt, jwtAccessToken: accessTokenJwt }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(accessTokenJwt);
+        });
+        it("reads the extension's shape: id token in accessToken, access token in jwtAccessToken", () => {
+            // This is the case that motivates claim-based resolution. Reading
+            // `accessToken` by name here would hand an id token to the control
+            // plane as a Bearer credential.
+            const resolved = (0, credstore_1.resolveTokens)({ accessToken: idTokenJwt, jwtAccessToken: accessTokenJwt }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(accessTokenJwt);
+            (0, chai_1.expect)(resolved.idToken).to.equal(idTokenJwt);
+        });
+        it("prefers the explicit idToken field when this CLI wrote it", () => {
+            const otherIdToken = jwt({ aud: PROD.clientId, exp: inOneHour() });
+            const resolved = (0, credstore_1.resolveTokens)({
+                accessToken: accessTokenJwt,
+                jwtAccessToken: accessTokenJwt,
+                idToken: otherIdToken,
+            }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(accessTokenJwt);
+            (0, chai_1.expect)(resolved.idToken).to.equal(otherIdToken);
+        });
+        // The CLI wrote `idToken`; the extension then refreshed, putting a new id
+        // token in `accessToken` and leaving the CLI's field behind. The explicit
+        // field used to win, so `getIdToken` returned the stale one.
+        it("prefers an id token the extension wrote after the CLI's explicit field", () => {
+            const staleIdToken = jwt({
+                aud: PROD.clientId,
+                exp: inOneHour() - 60,
+            });
+            const resolved = (0, credstore_1.resolveTokens)({
+                accessToken: idTokenJwt,
+                jwtAccessToken: accessTokenJwt,
+                idToken: staleIdToken,
+            }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(accessTokenJwt);
+            (0, chai_1.expect)(resolved.idToken).to.equal(idTokenJwt);
+        });
+        it("returns nothing for a token whose audience it cannot recognise", () => {
+            // There used to be a `?? stored.accessToken` fallback here, justified
+            // by service-account tokens. `getApiAccessToken` returns those before
+            // it calls this (asserted below), so the fallback could only ever fire
+            // for a *user* token — where an unrecognised `accessToken` is most
+            // likely the extension's id token, which then went into a Bearer
+            // header. Better to say we have nothing than to send the wrong thing.
+            const opaque = jwt({ exp: inOneHour() });
+            const resolved = (0, credstore_1.resolveTokens)({ accessToken: opaque }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(undefined);
+            (0, chai_1.expect)(resolved.idToken).to.equal(undefined);
+        });
+        it("tolerates an undecodable token without throwing", () => {
+            const resolved = (0, credstore_1.resolveTokens)({ accessToken: "not-a-jwt" }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(undefined);
+        });
+        // The exact state the VS Code extension's `clearState()` leaves behind:
+        // `jwtAccessToken` and `refreshToken` blanked, `accessToken` still
+        // holding a stale id token. Returning that as the API token got a 401
+        // from the control plane; returning nothing gets "run `cred login`".
+        it("does not hand back the id token the extension leaves after a sign-out", () => {
+            const staleIdToken = jwt({
+                aud: environments_1.auth0ConfigsByEnv.production.clientId,
+                exp: inOneHour(),
+            });
+            const resolved = (0, credstore_1.resolveTokens)({ accessToken: staleIdToken, jwtAccessToken: "" }, "production");
+            (0, chai_1.expect)(resolved.apiAccessToken).to.equal(undefined);
+            (0, chai_1.expect)(resolved.idToken).to.equal(staleIdToken);
+        });
+        it("resolves against the audience of the deployment env it is given", () => {
+            const devToken = jwt({
+                aud: environments_1.auth0ConfigsByEnv.dev.audience,
+                exp: inOneHour(),
+            });
+            // Audienced to dev, so it is NOT the production API token: production
+            // resolution finds no match and falls back.
+            (0, chai_1.expect)((0, credstore_1.resolveTokens)({ jwtAccessToken: devToken }, "production")
+                .apiAccessToken).to.equal(undefined);
+            (0, chai_1.expect)((0, credstore_1.resolveTokens)({ jwtAccessToken: devToken }, "dev").apiAccessToken).to.equal(devToken);
+        });
+    });
+    describe("ClientConfiguration against a real file", () => {
+        let configPath;
+        beforeEach(() => {
+            configPath = (0, path_1.join)(fs_1.default.mkdtempSync((0, path_1.join)(os_1.default.tmpdir(), "credstore-")), ".cred");
+        });
+        afterEach(() => {
+            fs_1.default.rmSync(configPath, { force: true });
+        });
+        function write(envConfig) {
+            fs_1.default.writeFileSync(configPath, JSON.stringify({
+                configPerEnvironment: { production: envConfig },
+                activeEnvironment: "production",
+            }));
+        }
+        it("sends the access token as Bearer even when the extension wrote the file last", () => {
+            write({ accessToken: idTokenJwt, jwtAccessToken: accessTokenJwt });
+            const config = new credstore_1.ClientConfiguration(configPath);
+            (0, chai_1.expect)(config.getAuthenticationHeader()).to.equal(`Bearer ${accessTokenJwt}`);
+        });
+        it("sends a service-account token as ApiKey and does not classify it", () => {
+            write({ accessToken: "sa-token", isServiceAccountToken: true });
+            const config = new credstore_1.ClientConfiguration(configPath);
+            (0, chai_1.expect)(config.getAuthenticationHeader()).to.equal("ApiKey sa-token");
+            (0, chai_1.expect)(config.isTokenValid().valid).to.equal(true);
+        });
+        it("setTokenPair writes a shape the extension can still read", () => {
+            const config = new credstore_1.ClientConfiguration(configPath);
+            config.setTokenPair({
+                accessToken: accessTokenJwt,
+                idToken: idTokenJwt,
+                refreshToken: "refresh-me",
+            });
+            const onDisk = JSON.parse(fs_1.default.readFileSync(configPath, "utf-8"))
+                .configPerEnvironment.production;
+            // The extension takes the access token from `jwtAccessToken`; keeping
+            // it correct is what makes this change invisible to it.
+            (0, chai_1.expect)(onDisk.jwtAccessToken).to.equal(accessTokenJwt);
+            (0, chai_1.expect)(onDisk.accessToken).to.equal(accessTokenJwt);
+            (0, chai_1.expect)(onDisk.idToken).to.equal(idTokenJwt);
+            (0, chai_1.expect)(onDisk.refreshToken).to.equal("refresh-me");
+            (0, chai_1.expect)(onDisk.isServiceAccountToken).to.equal(false);
+        });
+        it("keeps the stored refresh token when a refresh does not rotate it", () => {
+            const config = new credstore_1.ClientConfiguration(configPath);
+            config.setTokenPair({
+                accessToken: accessTokenJwt,
+                refreshToken: "original",
+            });
+            config.setTokenPair({ accessToken: accessTokenJwt });
+            (0, chai_1.expect)(config.getRefreshToken()).to.equal("original");
+        });
+        it("clearTokens removes the tokens from disk and keeps the organization and environment", () => {
+            write({
+                accessToken: accessTokenJwt,
+                jwtAccessToken: accessTokenJwt,
+                idToken: idTokenJwt,
+                refreshToken: "dead",
+                isServiceAccountToken: false,
+                organization: "acme",
+                project: "sales",
+            });
+            // Not pinned to a deployment, so clearTokens resolves it from the
+            // file, which reloads the config it is about to edit.
+            new credstore_1.ClientConfiguration(configPath).clearTokens();
+            const onDisk = JSON.parse(fs_1.default.readFileSync(configPath, "utf-8"))
+                .configPerEnvironment.production;
+            (0, chai_1.expect)(onDisk).to.eql({ organization: "acme", project: "sales" });
+        });
+        describe("secondsUntilExpiry", () => {
+            it("is positive for a live token and negative for a dead one", () => {
+                write({ jwtAccessToken: accessTokenJwt });
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).secondsUntilExpiry()).to.be.greaterThan(3500);
+                write({
+                    jwtAccessToken: jwt({
+                        aud: PROD.audience,
+                        exp: Math.floor(Date.now() / 1000) - 60,
+                    }),
+                });
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).secondsUntilExpiry()).to.be.lessThan(0);
+            });
+            it("is undefined when there is no decodable expiry", () => {
+                write({ accessToken: "sa-token", isServiceAccountToken: true });
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).secondsUntilExpiry()).to.equal(undefined);
+            });
+        });
+        describe("isTokenValid", () => {
+            it("names the specific problem rather than a generic failure", () => {
+                write({});
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).isTokenValid()).to.eql({
+                    valid: false,
+                    reason: "No token found. Please login.",
+                });
+                write({
+                    jwtAccessToken: jwt({
+                        aud: PROD.audience,
+                        exp: Math.floor(Date.now() / 1000) - 60,
+                    }),
+                });
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).isTokenValid()).to.eql({
+                    valid: false,
+                    reason: "Token expired. Please login again.",
+                });
+                write({ accessToken: "not-a-jwt" });
+                (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).isTokenValid()).to.eql({
+                    valid: false,
+                    reason: "Invalid token format. Please login again.",
+                });
+            });
+            it("reports a non-string token field as an invalid token, not a crash", () => {
+                for (const bad of [42, true, {}, ["a.b.c"]]) {
+                    write({ accessToken: bad });
+                    (0, chai_1.expect)(new credstore_1.ClientConfiguration(configPath).isTokenValid()).to.eql({
+                        valid: false,
+                        reason: "Invalid token format. Please login again.",
+                    });
+                }
+            });
+        });
+    });
+});
+//# sourceMappingURL=credstore.spec.js.map