@deerdesign/deertools 1.2.6 → 1.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deerdesign/deertools",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"

package/src/login.js

@@ -33,9 +33,9 @@ function normalizeScope(input) {
   return VALID_SCOPES.filter((s) => set.has(s)).join(' ');
 }
 
-function buildAuthorizeUrl(authorizationEndpoint, { redirectUri, state, scope, clientName, challenge }) {
+function buildAuthorizeUrl(authorizationEndpoint, { redirectUri, state, scope, clientName, challenge, clientId = CLIENT_ID }) {
   const u = new URL(authorizationEndpoint);
-  u.searchParams.set('client_id', CLIENT_ID);
+  u.searchParams.set('client_id', clientId);
   u.searchParams.set('redirect_uri', redirectUri);
   u.searchParams.set('response_type', 'code');
   u.searchParams.set('code_challenge', challenge);
@@ -67,13 +67,13 @@ function evaluateCallback(query, { expectedState }) {
 }
 
 /** Wymiana kodu na klucz: bezpośrednie zapytanie CLI -> serwer (klucz nigdy nie przechodzi przez przeglądarkę). */
-async function exchangeCode(product, tokenEndpoint, { code, verifier, redirectUri, fetchImpl = fetch }) {
+async function exchangeCode(product, tokenEndpoint, { code, verifier, redirectUri, clientId = CLIENT_ID, fetchImpl = fetch }) {
   let res;
   try {
     res = await fetchImpl(tokenEndpoint, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-      body: JSON.stringify({ grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: redirectUri, client_id: CLIENT_ID }),
+      body: JSON.stringify({ grant_type: 'authorization_code', code, code_verifier: verifier, redirect_uri: redirectUri, client_id: clientId }),
     });
   } catch (e) {
     throw new Error(`Nie udało się połączyć z serwerem produktu ${product.name}: ${e.message}`);
@@ -162,6 +162,28 @@ function openBrowser(url) {
   exec(cmd, () => { /* gdy się nie uda, użytkownik ma adres wypisany w terminalu */ });
 }
 
+async function registerDynamicClient(registrationEndpoint, { redirectUri, clientName, fetchImpl = fetch }) {
+  if (!registrationEndpoint) return null;
+  try {
+    const res = await fetchImpl(registrationEndpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({
+        client_name: clientName || 'DeerTools CLI',
+        redirect_uris: [redirectUri],
+        token_endpoint_auth_method: 'none',
+        grant_types: ['authorization_code', 'refresh_token'],
+        response_types: ['code'],
+      }),
+    });
+    if (!res.ok) return null;
+    const json = await res.json();
+    return json.client_id || null;
+  } catch (_) {
+    return null;
+  }
+}
+
 /**
  * Logowanie OAuth 2.1 dla aplikacji natywnej (RFC 8252): kod autoryzacyjny + PKCE, powrót na 127.0.0.1 (losowy port).
  * opts.metadata pozwala podać adresy bez pobierania (testy). Zwraca wpis poświadczeń zapisany na dysku.
@@ -179,6 +201,7 @@ async function login(product, opts = {}) {
   return new Promise((resolve, reject) => {
     let finished = false;
     let redirectUri = null;
+    let activeClientId = CLIENT_ID;
 
     const server = http.createServer(async (req, res) => {
       const url = new URL(req.url, 'http://127.0.0.1');
@@ -192,7 +215,7 @@ async function login(product, opts = {}) {
         return;
       }
       try {
-        const entry = await exchangeCode(product, meta.token_endpoint, { code: result.code, verifier: pkce.verifier, redirectUri, fetchImpl: opts.fetchImpl });
+        const entry = await exchangeCode(product, meta.token_endpoint, { code: result.code, verifier: pkce.verifier, redirectUri, clientId: activeClientId, fetchImpl: opts.fetchImpl });
         credentials.saveProduct(product.id, entry);
         res.writeHead(200, headers);
         res.end(page('Zalogowano', `Klucz do produktu ${product.name} został zapisany w terminalu. Możesz zamknąć to okno.`, true));
@@ -215,9 +238,17 @@ async function login(product, opts = {}) {
     }
 
     server.on('error', (e) => done(e));
-    server.listen(opts.port || 0, '127.0.0.1', () => {
+    server.listen(opts.port || 0, '127.0.0.1', async () => {
       redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
-      const url = buildAuthorizeUrl(meta.authorization_endpoint, { redirectUri, state, scope, clientName, challenge: pkce.challenge });
+      let authScope = scope;
+      if (meta.registration_endpoint) {
+        const dynId = await registerDynamicClient(meta.registration_endpoint, { redirectUri, clientName, fetchImpl: opts.fetchImpl });
+        if (dynId) {
+          activeClientId = dynId;
+          authScope = 'openid email profile offline_access';
+        }
+      }
+      const url = buildAuthorizeUrl(meta.authorization_endpoint, { redirectUri, state, scope: authScope, clientName, challenge: pkce.challenge, clientId: activeClientId });
       log(`Zakres: ${scope}. Otwieram przeglądarkę — zaloguj się w produkcie ${product.name} i kliknij „Zezwól na dostęp”.`);
       log(`Jeśli przeglądarka się nie otworzy, wejdź na:\n${url}\n`);
       if (open) open(url);
@@ -225,4 +256,4 @@ async function login(product, opts = {}) {
   });
 }
 
-module.exports = { CLIENT_ID, createPkce, normalizeScope, buildAuthorizeUrl, evaluateCallback, exchangeCode, discoverOAuth, login };
+module.exports = { CLIENT_ID, createPkce, normalizeScope, buildAuthorizeUrl, evaluateCallback, exchangeCode, discoverOAuth, login, registerDynamicClient };