@deque/axe-auth 1.4.0-next.368f781b → 1.4.0-next.38d92946
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -17
- package/dist/oauth/keyringBinding.d.ts +1 -1
- package/dist/oauth/keyringBinding.js +3 -4
- package/docs/callback-server.md +9 -9
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -22,12 +22,12 @@ axe-auth <command> [options]
|
|
|
22
22
|
|
|
23
23
|
Commands:
|
|
24
24
|
|
|
25
|
-
| Command
|
|
26
|
-
|
|
|
27
|
-
| `login`
|
|
28
|
-
| `logout` | Revoke the stored refresh token server-side and clear the local keychain entry.
|
|
29
|
-
| `token`
|
|
30
|
-
| `run`
|
|
25
|
+
| Command | Description |
|
|
26
|
+
| --- | --- |
|
|
27
|
+
| `login` | Open a browser, complete the OAuth flow, persist tokens to the OS keychain. |
|
|
28
|
+
| `logout` | Revoke the stored refresh token server-side and clear the local keychain entry. |
|
|
29
|
+
| `token` | Print a currently-valid access token to stdout, refreshing silently if needed. |
|
|
30
|
+
| `run` | Launch and supervise the axe MCP server, keeping its OAuth token fresh with no restart. |
|
|
31
31
|
|
|
32
32
|
Run `axe-auth <command> --help` for command-specific options.
|
|
33
33
|
|
|
@@ -35,11 +35,11 @@ Run `axe-auth <command> --help` for command-specific options.
|
|
|
35
35
|
|
|
36
36
|
`axe-auth` discovers its OAuth coordinates by calling `<server>/api/sso-config` on the axe server. Users only supply (or default to) the axe server URL — never the underlying Keycloak URL, realm, or client ID.
|
|
37
37
|
|
|
38
|
-
| Flag
|
|
39
|
-
|
|
|
40
|
-
| `--server`
|
|
41
|
-
| `--allow-insecure-issuer`
|
|
42
|
-
| `--no-allow-insecure-issuer` | —
|
|
38
|
+
| Flag | Env var | Notes |
|
|
39
|
+
| --- | --- | --- |
|
|
40
|
+
| `--server` | `AXE_SERVER_URL` | axe server URL. Defaults to `https://axe.deque.com` (SaaS prod) when neither flag nor env var is set, so SaaS users pass no flags at all. Customers on other deployments override with their own axe server URL. |
|
|
41
|
+
| `--allow-insecure-issuer` | — | Permit non-loopback http URLs (default is https only; loopback http is always allowed). Applies to `login` only; `token` and `logout` use the policy persisted at login. |
|
|
42
|
+
| `--no-allow-insecure-issuer` | — | Force `allowInsecureIssuer=false` for the new `login` (and the entry it persists). Mutually exclusive with `--allow-insecure-issuer`. `token` and `logout` ignore this flag. |
|
|
43
43
|
|
|
44
44
|
`axe-auth` stores one set of credentials per machine. On a successful `login`, the discovered issuer / client / insecure-issuer values are persisted alongside the tokens, so subsequent `axe-auth token` and `axe-auth logout` invocations work flag-free — a typical scripted call is just `$(axe-auth token)`.
|
|
45
45
|
|
|
@@ -47,12 +47,12 @@ There is no concurrent multi-issuer support. Logging in to a second deployment o
|
|
|
47
47
|
|
|
48
48
|
### Exit codes
|
|
49
49
|
|
|
50
|
-
| Code | Meaning
|
|
51
|
-
|
|
|
52
|
-
| `0`
|
|
53
|
-
| `1`
|
|
54
|
-
| `2`
|
|
55
|
-
| `3`
|
|
50
|
+
| Code | Meaning |
|
|
51
|
+
| --- | --- |
|
|
52
|
+
| `0` | Success. |
|
|
53
|
+
| `1` | Not authenticated: `axe-auth token` with no stored credentials, or stored credentials are unusable (corrupt, version-mismatch, expired without a usable refresh token, or refresh rejected by the server). Branch on this in scripts that need to trigger a `login`. |
|
|
54
|
+
| `2` | Usage or runtime error: unknown command, bad flag, missing required configuration, OAuth flow failure, or keychain failure. Details written to stderr. |
|
|
55
|
+
| `3` | Cancelled: `axe-auth login` declined at the re-authentication prompt. Distinct from `1` so scripts can tell "needs login" from "user bailed." |
|
|
56
56
|
|
|
57
57
|
### Examples
|
|
58
58
|
|
|
@@ -19,4 +19,4 @@ export type KeyringEntryFactory = (service: string, account: string) => KeyringE
|
|
|
19
19
|
* `KEYRING_UNAVAILABLE` on first store construction, not on module
|
|
20
20
|
* import.
|
|
21
21
|
*/
|
|
22
|
-
export declare
|
|
22
|
+
export declare function defaultEntryFactory(service: string, account: string): KeyringEntry;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.defaultEntryFactory =
|
|
3
|
+
exports.defaultEntryFactory = defaultEntryFactory;
|
|
4
4
|
const node_module_1 = require("node:module");
|
|
5
5
|
const errors_1 = require("./errors");
|
|
6
6
|
const requireFromHere = (0, node_module_1.createRequire)(__filename);
|
|
@@ -34,8 +34,7 @@ function resolveEntryCtor() {
|
|
|
34
34
|
* `KEYRING_UNAVAILABLE` on first store construction, not on module
|
|
35
35
|
* import.
|
|
36
36
|
*/
|
|
37
|
-
|
|
37
|
+
function defaultEntryFactory(service, account) {
|
|
38
38
|
const Ctor = resolveEntryCtor();
|
|
39
39
|
return new Ctor(service, account);
|
|
40
|
-
}
|
|
41
|
-
exports.defaultEntryFactory = defaultEntryFactory;
|
|
40
|
+
}
|
package/docs/callback-server.md
CHANGED
|
@@ -10,12 +10,12 @@ Request handling additionally rejects non-loopback `remoteAddress` values with `
|
|
|
10
10
|
|
|
11
11
|
## RFC 8252 conformance
|
|
12
12
|
|
|
13
|
-
| Clause | Requirement
|
|
14
|
-
|
|
|
15
|
-
| §7.3
|
|
16
|
-
| §7.3
|
|
17
|
-
| §7.3
|
|
18
|
-
| §8.3
|
|
19
|
-
| §8.3
|
|
20
|
-
| §8.1
|
|
21
|
-
| §8.1
|
|
13
|
+
| Clause | Requirement | Handled by |
|
|
14
|
+
| --- | --- | --- |
|
|
15
|
+
| §7.3 | IP literal, not `localhost` | Binds `127.0.0.1` or `[::1]`; redirect URI uses the literal. |
|
|
16
|
+
| §7.3 | Ephemeral OS-assigned port | `listen(0, ...)`; port read from `listening` event. |
|
|
17
|
+
| §7.3 | Attempt both IPv4 and IPv6 | IPv4-first, IPv6 fallback when the IPv4 family is unavailable. |
|
|
18
|
+
| §8.3 | Open the port only during the auth request | One-shot: closed on first consuming request, timeout, or abort. |
|
|
19
|
+
| §8.3 | Listen on loopback only | IP literal only; `remoteAddress` check as defense in depth. |
|
|
20
|
+
| §8.1 | PKCE | Out of scope — owned by the auth-URL + token-exchange layer. |
|
|
21
|
+
| §8.1 | Auth code interception mitigation | Success HTML does not echo `code`; CSP locks the page down (see [`callback-page.md`](./callback-page.md)). |
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@deque/axe-auth",
|
|
3
|
-
"version": "1.4.0-next.
|
|
3
|
+
"version": "1.4.0-next.38d92946",
|
|
4
4
|
"description": "CLI authentication utility for Deque services",
|
|
5
5
|
"license": "SEE LICENSE IN LICENSE",
|
|
6
6
|
"repository": {
|
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
"ts-dedent": "^2.2.0"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
|
-
"@hono/node-server": "^2.0.
|
|
40
|
+
"@hono/node-server": "^2.0.11",
|
|
41
41
|
"@types/cross-spawn": "^6.0.6",
|
|
42
42
|
"@types/node": "^24.13.2",
|
|
43
43
|
"c8": "^11.0.0",
|