@datumos/datum-cli 0.0.0 → 0.588.0

package/cli/entraLogin.js

@@ -0,0 +1,254 @@
+import { originOf } from "./credentials.js";
+import { UsageError } from "./invoke.js";
+import { insecureOriginReason } from "./secureOrigin.js";
+import { RESERVED_SPACE_SLUGS } from "../spaces/reservedHostLabels.js";
+export class NotLoggedInError extends Error {
+    constructor(baseUrl) {
+        super(`not signed in to ${baseUrl} — run \`datum login --base-url ${baseUrl}\` (or set DATUM_API_KEY)`);
+    }
+}
+export class LoginFlowError extends Error {
+    code;
+    constructor(message, 
+    /** The OAuth error code when the IdP produced one. */
+    code = "") {
+        super(message);
+        this.code = code;
+    }
+}
+/** Refresh when less than this remains — same skew the server tolerates. */
+export const TOKEN_SKEW_MS = 60_000;
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const form = (o) => new URLSearchParams(o).toString();
+const FORM_HEADERS = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+/** GET /api/auth/cli — translated into actionable CLI errors. */
+export async function fetchCliLoginConfig(baseUrl, io = {}) {
+    // A sign-in's tokens are later sent to this origin — never a plain-http one (#2605).
+    const insecure = insecureOriginReason(baseUrl);
+    if (insecure)
+        throw new UsageError(insecure);
+    const doFetch = io.fetchImpl ?? fetch;
+    const url = `${originOf(baseUrl)}/api/auth/cli`;
+    const res = await doFetch(url, { headers: { accept: "application/json" }, redirect: "manual" });
+    const body = (await res.json().catch(() => ({})));
+    if (res.status === 404 && body.code === "sso_not_configured") {
+        throw new UsageError(`${baseUrl} has no SSO login configured — an org admin sets the OIDC issuer and client id in Settings → Access`);
+    }
+    if (res.status === 404 && body.code === "device_flow_unsupported") {
+        throw new UsageError(`${baseUrl}'s identity provider offers no device-code sign-in`);
+    }
+    if (res.status === 403) {
+        throw new UsageError(`${baseUrl} answers 403 to the CLI login — the SSO login feature is off on that deployment`);
+    }
+    if (!res.ok || !body.issuer || !body.clientId || !body.deviceAuthorizationEndpoint || !body.tokenEndpoint) {
+        throw new UsageError(`${url} did not answer with a CLI login config (HTTP ${res.status}${body.error ? `: ${body.error}` : ""}) — is --base-url the Datum origin, and is this Datum ≥ the version with developer access?`);
+    }
+    return {
+        issuer: body.issuer,
+        clientId: body.clientId,
+        scope: body.scope ?? "",
+        deviceAuthorizationEndpoint: body.deviceAuthorizationEndpoint,
+        tokenEndpoint: body.tokenEndpoint,
+    };
+}
+/** Step 1 of RFC 8628: ask the IdP for a user code. */
+export async function startDeviceFlow(cfg, io = {}) {
+    const doFetch = io.fetchImpl ?? fetch;
+    const now = io.now ?? Date.now;
+    const res = await doFetch(cfg.deviceAuthorizationEndpoint, {
+        method: "POST",
+        headers: FORM_HEADERS,
+        body: form({ client_id: cfg.clientId, scope: cfg.scope }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok || typeof data.device_code !== "string" || typeof data.user_code !== "string") {
+        throw new LoginFlowError(`the identity provider refused to start the device sign-in (HTTP ${res.status}${describeOauthError(data)})`, typeof data.error === "string" ? data.error : "");
+    }
+    const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 900;
+    const interval = typeof data.interval === "number" ? data.interval : 5;
+    return {
+        deviceCode: data.device_code,
+        userCode: data.user_code,
+        verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+        ...(typeof data.verification_uri_complete === "string"
+            ? { verificationUriComplete: data.verification_uri_complete }
+            : {}),
+        expiresAt: now() + expiresIn * 1000,
+        intervalMs: Math.max(interval, 0) * 1000,
+    };
+}
+/** Step 2: poll the token endpoint until the person finishes (or the code
+ * dies). `authorization_pending` keeps polling; `slow_down` backs off by
+ * 5 s (the RFC's rule); anything else ends the flow. */
+export async function pollDeviceFlow(cfg, device, io = {}) {
+    const doFetch = io.fetchImpl ?? fetch;
+    const sleep = io.sleep ?? defaultSleep;
+    const now = io.now ?? Date.now;
+    let interval = device.intervalMs;
+    while (now() < device.expiresAt) {
+        if (io.signal?.aborted)
+            throw new LoginFlowError("sign-in cancelled", "cancelled");
+        const res = await doFetch(cfg.tokenEndpoint, {
+            method: "POST",
+            headers: FORM_HEADERS,
+            body: form({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                client_id: cfg.clientId,
+                device_code: device.deviceCode,
+            }),
+        });
+        const data = (await res.json().catch(() => ({})));
+        if (res.ok && typeof data.access_token === "string")
+            return toTokenSet(data, now());
+        const error = typeof data.error === "string" ? data.error : "";
+        if (error === "authorization_pending") {
+            await sleep(interval);
+            continue;
+        }
+        if (error === "slow_down") {
+            interval += 5000;
+            await sleep(interval);
+            continue;
+        }
+        if (error === "authorization_declined" || error === "access_denied") {
+            throw new LoginFlowError("the sign-in was declined", error);
+        }
+        if (error === "expired_token") {
+            throw new LoginFlowError("the device code expired before the sign-in completed — run `datum login` again", error);
+        }
+        throw new LoginFlowError(`the identity provider rejected the sign-in (HTTP ${res.status}${describeOauthError(data)})`, error);
+    }
+    throw new LoginFlowError("the device code expired before the sign-in completed — run `datum login` again", "expired_token");
+}
+/** The refresh-token grant — rotates the refresh token when the IdP does. */
+export async function refreshTokenSet(cfg, refreshToken, io = {}) {
+    const doFetch = io.fetchImpl ?? fetch;
+    const now = io.now ?? Date.now;
+    const res = await doFetch(cfg.tokenEndpoint, {
+        method: "POST",
+        headers: FORM_HEADERS,
+        body: form({
+            grant_type: "refresh_token",
+            client_id: cfg.clientId,
+            refresh_token: refreshToken,
+            ...(cfg.scope ? { scope: cfg.scope } : {}),
+        }),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok || typeof data.access_token !== "string") {
+        throw new LoginFlowError(`the session could not be refreshed (HTTP ${res.status}${describeOauthError(data)}) — run \`datum login\` again`, typeof data.error === "string" ? data.error : "");
+    }
+    return { ...toTokenSet(data, now()), refreshToken: typeof data.refresh_token === "string" ? data.refresh_token : refreshToken };
+}
+function toTokenSet(data, nowMs) {
+    const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 3600;
+    return {
+        accessToken: data.access_token,
+        expiresAt: nowMs + expiresIn * 1000,
+        ...(typeof data.refresh_token === "string" ? { refreshToken: data.refresh_token } : {}),
+        ...(typeof data.scope === "string" ? { scope: data.scope } : {}),
+    };
+}
+function describeOauthError(data) {
+    const error = typeof data.error === "string" ? data.error : "";
+    const description = typeof data.error_description === "string" ? data.error_description.split("\n")[0].slice(0, 200) : "";
+    return error ? `: ${error}${description ? ` — ${description}` : ""}` : "";
+}
+/** Payload of a JWT WITHOUT verification — display only (the account name,
+ * expiry). The server verifies; the CLI merely shows. */
+export function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return {};
+    try {
+        return JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function accountNameOf(tokens) {
+    const payload = decodeJwtPayload(tokens.accessToken);
+    for (const k of ["preferred_username", "upn", "email"]) {
+        if (typeof payload[k] === "string")
+            return payload[k];
+    }
+    return "";
+}
+/** The whole `datum login`: config → device code → (caller shows it) →
+ * poll → store. `onCode` runs the moment the code exists. */
+export async function deviceLogin(baseUrl, store, onCode, io = {}) {
+    const cfg = await fetchCliLoginConfig(baseUrl, io);
+    const device = await startDeviceFlow(cfg, io);
+    onCode(device);
+    const tokens = await pollDeviceFlow(cfg, device, io);
+    const login = {
+        baseUrl: originOf(baseUrl),
+        issuer: cfg.issuer,
+        clientId: cfg.clientId,
+        scope: cfg.scope,
+        tokenEndpoint: cfg.tokenEndpoint,
+        account: accountNameOf(tokens),
+        accessToken: tokens.accessToken,
+        expiresAt: tokens.expiresAt,
+        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+        signedInAt: new Date((io.now ?? Date.now)()).toISOString(),
+    };
+    store.set(login);
+    return login;
+}
+/**
+ * A currently valid access token for `baseUrl` — refreshed (and re-stored)
+ * when it is about to expire. Throws NotLoggedInError when there is no
+ * login, LoginFlowError when the refresh is refused (the person must sign
+ * in again).
+ */
+export async function ensureAccessToken(baseUrl, store, io = {}) {
+    const now = io.now ?? Date.now;
+    // Every caller sends the token to `baseUrl` next (the MCP shim, a2a, whoami).
+    const insecure = insecureOriginReason(baseUrl);
+    if (insecure)
+        throw new UsageError(insecure);
+    const login = store.get(baseUrl);
+    if (!login)
+        throw new NotLoggedInError(originOf(baseUrl));
+    if (now() < login.expiresAt - TOKEN_SKEW_MS)
+        return login.accessToken;
+    if (!login.refreshToken)
+        throw new NotLoggedInError(originOf(baseUrl));
+    const fresh = await refreshTokenSet(login, login.refreshToken, io);
+    store.set({
+        ...login,
+        accessToken: fresh.accessToken,
+        expiresAt: fresh.expiresAt,
+        ...(fresh.refreshToken ? { refreshToken: fresh.refreshToken } : {}),
+        account: accountNameOf(fresh) || login.account,
+    });
+    return fresh.accessToken;
+}
+/** Turns an org base URL into the SPACE host's URL: `https://datum.example`
+ * + `adops` → `https://adops.datum.example` (spaces-multitenancy: one
+ * subdomain label per space). Idempotent when the host already starts
+ * with the slug. An organisation ENTRY host — a reserved label of the
+ * space family, `auth.` / `api.` / `www.` … — sits BESIDE the spaces, not
+ * above them: `https://auth.datum.example` + `adops` →
+ * `https://adops.datum.example`, never `adops.auth.datum.example`, a name
+ * nothing serves (#2792: a run's DATUM_BASE_URL is such a host). */
+export function spaceBaseUrl(baseUrl, space) {
+    const url = new URL(baseUrl);
+    const slug = space.trim().toLowerCase();
+    if (!slug)
+        return url.origin;
+    if (url.hostname === slug || url.hostname.startsWith(`${slug}.`))
+        return url.origin;
+    // An IP literal takes no subdomain label (the URL parser would silently
+    // drop the assignment) — say so instead of quietly hitting the org host.
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(url.hostname) || url.hostname.startsWith("[")) {
+        throw new UsageError(`--space needs a DNS-name base URL (a space is a subdomain); ${url.hostname} is an IP address`);
+    }
+    const [first, ...rest] = url.hostname.split(".");
+    const entry = rest.length >= 2 && RESERVED_SPACE_SLUGS.includes(first ?? "");
+    url.hostname = entry ? `${slug}.${rest.join(".")}` : `${slug}.${url.hostname}`;
+    return url.origin;
+}
+//# sourceMappingURL=entraLogin.js.map