@faable/faable 3.1.1 → 3.3.0

package/dist/api/auth.js

@@ -1,8 +1,41 @@
-import axios from 'axios';
+import { FaableAuthApi, authBearer } from '@faable/auth-sdk';
 import os from 'os';
+import { version } from '../config.js';
 
-const api = axios.create({ baseURL: "https://faable.auth.faable.link" });
+// The CLI talks to the Faable tenant's auth server through the same SDK the
+// rest of the platform uses. It used to be a bare axios instance, which meant
+// every call landed in the tenant's traffic as "not identified" — the SDK
+// stamps `x-faable-client`, and the value below makes it say who this really
+// is instead of `auth-sdk`.
+//
+// Two clients, because there are two kinds of call:
+//  - anonymous: the device flow and the refresh grant. A public client, no
+//    secret, no token yet. POSTs are never retried by the fetcher, which is
+//    what the device polling needs — every `authorization_pending` is an
+//    error the loop expects, not one to replay.
+//  - bearer: `/me` and everything `faable auth` does, with the token the user
+//    already holds. The strategy asks for the token on every request, so
+//    whatever `loadLiveCredentials` refreshed is what goes on the wire.
+const AUTH_DOMAIN = "https://faable.auth.faable.link";
 const CLIENT_ID = "c879023b-e34f-4b0c-a262-210e556bc2e4";
+// `<name>/<version>`. No commit: the CLI has no release SHA constant, and a
+// dev build (`0.0.0-development`) is identifiable as such by the version
+// alone. auth caps this segment at 32 chars.
+const CLI_CLIENT = `faable-cli/${version}`;
+// No `x-faable-instance`: the SDK's default is `${HOSTNAME}:${pid}`, which on
+// a laptop is the user's machine name in our audit log. An empty string
+// suppresses the header (the helper drops falsy parts).
+const clientInfo = { client: CLI_CLIENT, instance: "" };
+const createAnonymousAuthApi = ({ domain = AUTH_DOMAIN, fetcher, } = {}) => FaableAuthApi.create({ domain, clientInfo, ...(fetcher ? { fetcher } : {}) });
+const createBearerAuthApi = (token, { domain = AUTH_DOMAIN, account, fetcher } = {}) => FaableAuthApi.create({
+    domain,
+    ...(account ? { headers: { account_id: account } } : {}),
+    authStrategy: authBearer,
+    auth: { token },
+    clientInfo,
+    ...(fetcher ? { fetcher } : {}),
+});
+const anonymous = createAnonymousAuthApi();
 const PLATFORM_LABELS = {
     darwin: "macOS",
     win32: "Windows",
@@ -15,35 +48,33 @@ function deviceName() {
     return `${os.hostname()} (${platform})`;
 }
 async function getDeviceCode() {
-    const res = await api.post(`/oauth/device/code`, {
+    return anonymous.fetcher.post(`/oauth/device/code`, {
         client_id: CLIENT_ID,
         scope: "openid email profile offline_access",
         device_name: deviceName(),
     });
-    return res.data;
 }
 async function getDeviceToken(device_code) {
-    const res = await api.post(`/oauth/token`, { device_code, client_id: CLIENT_ID, grant_type: "urn:ietf:params:oauth:grant-type:device_code" });
-    return res.data;
+    return anonymous.fetcher.post(`/oauth/token`, {
+        device_code,
+        client_id: CLIENT_ID,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+    });
 }
 // Validate a device-flow access token against the Faable Auth server. The token
 // is issued by the auth server, so it must be introspected there — NOT against
 // the deploy API (api.faable.com), which has no /me route and would 404.
 async function getMe(access_token) {
-    const res = await api.get(`/me`, {
-        headers: { Authorization: `Bearer ${access_token}` },
-    });
-    return res.data;
+    return createBearerAuthApi(access_token).fetcher.get(`/me`);
 }
 // Exchange a refresh token for a fresh access token (and a rotated refresh
 // token). The CLI is a public client, so no client_secret is required.
 async function refreshToken(refresh_token) {
-    const res = await api.post(`/oauth/token`, {
+    return anonymous.fetcher.post(`/oauth/token`, {
         grant_type: "refresh_token",
         client_id: CLIENT_ID,
         refresh_token,
     });
-    return res.data;
 }
 
-export { getDeviceCode, getDeviceToken, getMe, refreshToken };
+export { AUTH_DOMAIN, CLIENT_ID, CLI_CLIENT, createAnonymousAuthApi, createBearerAuthApi, getDeviceCode, getDeviceToken, getMe, refreshToken };

package/dist/api/auth_admin.js

@@ -1,6 +1,6 @@
-import { FaableAuthApi } from '@faable/auth-sdk';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { log } from '../log.js';
+import { createBearerAuthApi } from './auth.js';
 import { loadLiveCredentials } from './session.js';
 
 // Default tenant host. `faable auth` is customer-facing: a customer targets
@@ -31,13 +31,10 @@ const requireAuthAdmin = async (opts = {}) => {
     }
     const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
     const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
-    return new FaableAuthApi({
-        domain,
-        ...(account ? { headers: { account_id: account } } : {}),
-        // Static bearer: passing no `auth` keeps sdk-base from attaching any token
-        // strategy, so this header is used verbatim on every request.
-        fetcher: { headers: { Authorization: `Bearer ${token}` } }
-    });
+    // The session's bearer as a strategy — with the CLI's own identity on the
+    // wire instead of `auth-sdk` — scoped to the target tenant when one was
+    // named. The server decides whether this token may manage that tenant.
+    return createBearerAuthApi(token, { domain, account });
 };
 // Translate raw management-API failures into actionable CLI errors. Everything
 // else is rethrown untouched (FaableApiError messages already carry

package/dist/api/session.js

@@ -49,7 +49,10 @@ const loadLiveCredentials = async (store = new CredentialsStore()) => {
             // token endpoint's RFC 6749 error body. "Run `faable login` again"
             // would be a lie here — login is denied too — so say what actually
             // happened and stop instead of letting a generic 401 mislead.
-            const body = e?.response?.data;
+            // The SDK's error keeps the HTTP body under `response.data`, like the
+            // axios error it replaced.
+            const body = e
+                ?.response?.data;
             if (body?.error_code === "user_suspended") {
                 log.error("❌ Your account has been suspended. Contact support@faable.com.");
                 process.exit(1);

package/dist/commands/deploy/waf/add_rule.js

@@ -5,45 +5,59 @@ const describe_selector = (s) => {
     if (s.pattern && s.user_agent) {
         return `requests for ${s.pattern} from user-agents matching ${s.user_agent}`;
     }
+    if (s.pattern && s.query) {
+        return `requests for ${s.pattern} carrying ?${s.query}`;
+    }
     if (s.user_agent)
         return `requests from user-agents matching ${s.user_agent}`;
+    if (s.query)
+        return `requests carrying ?${s.query}`;
     return `requests for ${s.pattern}`;
 };
 /** Does this returned rule carry everything we asked for? */
 const rule_matches_request = (rule, want, action) => rule.action === action &&
     (rule.pattern ?? '') === (want.pattern ?? '') &&
-    (rule.user_agent ?? '') === (want.user_agent ?? '');
+    (rule.user_agent ?? '') === (want.user_agent ?? '') &&
+    (rule.query ?? '') === (want.query ?? '');
 /**
  * Shared handler for `block` and `sink` — the two differ only in the action
  * they store and in what the edge answers, so the flow (resolve app, write,
  * verify, explain, tell the user how to check) lives here once.
  */
 const add_rule = async (opts) => {
-    const { api, app_id, app_name, app_url, pattern, user_agent, action, description, force } = opts;
-    const want = { pattern, user_agent };
+    const { api, app_id, app_name, app_url, pattern, user_agent, query, action, description, force } = opts;
+    const want = { pattern, user_agent, query };
     const waf = await api.addAppWafRule(app_id, {
         pattern,
         user_agent,
+        query,
         action,
         description,
         force
     });
     // Read the rule back before telling the user it worked.
     //
-    // An older Faable server has no `user_agent` on this endpoint and drops it
-    // silently, storing the path half on its own — which turns "block /login for
-    // this bot" into "block /login for everyone". No server-side schema can
-    // prevent that (the old server is the old code), so the client checks that
-    // what came back is what it asked for, and undoes the write if it is not.
-    if (user_agent &&
+    // An older Faable server has no `user_agent` (or no `query`) on this endpoint
+    // and drops it silently, storing the path half on its own — which turns
+    // "block /login for this bot" into "block /login for everyone", or "block /
+    // when it carries ?rest_route" into "block /", which is the entire app. No
+    // server-side schema can prevent that (the old server is the old code), so
+    // the client checks that what came back is what it asked for, and undoes the
+    // write if it is not.
+    //
+    // The query half is the more dangerous of the two, because the api LIFTS the
+    // site-root guard for a path that is ANDed with a parameter: `^/$` is a legal
+    // pattern to send, and an old server that drops the parameter stores exactly
+    // the rule the guard exists to refuse.
+    if ((user_agent || query) &&
         !waf.rules.some(r => rule_matches_request(r, want, action))) {
         await api
-            .removeAppWafRule(app_id, { pattern, user_agent, action })
+            .removeAppWafRule(app_id, { pattern, user_agent, query, action })
             // If the rollback itself is unsupported, fall back to the path-only
             // shape the old server actually stored.
             .catch(() => api.removeAppWafRule(app_id, { pattern, action }))
             .catch(() => undefined);
-        throw new Error(`This Faable server does not support user-agent rules yet, so the rule was not created.\n` +
+        throw new Error(`This Faable server does not support ${query ? 'query-parameter' : 'user-agent'} rules yet, so the rule was not created.\n` +
             `  Update the CLI and try again, or ask support to upgrade the platform.`);
     }
     const answer = action === 'deny' ? '403' : '404';
@@ -75,7 +89,8 @@ const add_rule = async (opts) => {
 /** The exact arguments that reverse this rule. */
 const undo_args = (s) => [
     s.pattern ? `'${s.pattern}'` : '',
-    s.user_agent ? `--user-agent '${s.user_agent}'` : ''
+    s.user_agent ? `--user-agent '${s.user_agent}'` : '',
+    s.query ? `--query '${s.query}'` : ''
 ]
     .filter(Boolean)
     .join(' ');

package/dist/commands/deploy/waf/block.js

@@ -14,6 +14,11 @@ const waf_block = {
         alias: 'u',
         type: 'string',
         description: 'RE2 fragment matched against User-Agent, e.g. YisouSpider. With a path, BOTH must match.'
+    })
+        .option('query', {
+        alias: 'q',
+        type: 'string',
+        description: 'Literal query parameter name, e.g. rest_route (not a regex). With a path, BOTH must match.'
     })
         .option('app', {
         alias: 'a',
@@ -28,19 +33,24 @@ const waf_block = {
         .option('force', {
         type: 'boolean',
         default: false,
-        description: 'Accept a user-agent that also matches a known search/AI crawler or uptime monitor'
+        description: 'Accept a user-agent that also matches a known search/AI crawler or uptime monitor, or a query parameter that carries an auth flow'
     })
-        .check(({ pattern, userAgent }) => {
-        if (!pattern && !userAgent) {
-            throw new Error('Give a path pattern, --user-agent, or both.\n' +
+        .check(({ pattern, userAgent, query }) => {
+        if (userAgent && query) {
+            throw new Error('A rule can combine a path with --user-agent OR with --query, not both.');
+        }
+        if (!pattern && !userAgent && !query) {
+            throw new Error('Give a path pattern, --user-agent, --query, or a path with one of them.\n' +
                 "  e.g. faable deploy waf block '^/wp-admin'\n" +
-                '       faable deploy waf block --user-agent YisouSpider');
+                '       faable deploy waf block --user-agent YisouSpider\n' +
+                '       faable deploy waf block --query rest_route');
         }
         return true;
     })
         .example("$0 deploy waf block '^/\\.well-known/'", 'Stop scanner probes under /.well-known from waking the app')
         .example('$0 deploy waf block --user-agent YisouSpider', 'Refuse one crawler outright, on every path')
         .example("$0 deploy waf block '^/api/' --user-agent curl", 'Refuse /api/ to that user-agent only, leaving browsers untouched')
+        .example('$0 deploy waf block --query rest_route', 'Stop WordPress REST probes, whose payload rides in the query string')
         .showHelpOnFail(false),
     handler: async (args) => {
         const ctx = await requireApi();
@@ -53,6 +63,7 @@ const waf_block = {
             app_url: app.url,
             pattern: args.pattern,
             user_agent: args.userAgent,
+            query: args.query,
             action: 'deny',
             description: args.description,
             force: args.force

package/dist/commands/deploy/waf/format.js

@@ -26,10 +26,18 @@ const format_waf = (waf) => {
     for (const p of waf.platform_profiles) {
         // Say what the ruleset matches ON, not just what it answers: without it a
         // `probe` profile of user-agents reads as if it blocked paths.
-        const on = p.match === 'user_agent' ? ' by user-agent' : '';
+        const on = p.match === 'user_agent'
+            ? ' by user-agent'
+            : p.match === 'query'
+                ? ' by query parameter'
+                : '';
         out.push(`  • ${p.name} — ${p.rule_count} rule(s)${on}, ${action_label(p.action)}`);
         for (const r of p.rules ?? []) {
-            const what = p.match === 'user_agent' ? `UA ~ ${r.pattern}` : r.pattern;
+            const what = p.match === 'user_agent'
+                ? `UA ~ ${r.pattern}`
+                : p.match === 'query'
+                    ? `?${r.pattern}`
+                    : r.pattern;
             out.push(`      ${what}${r.description ? `  # ${r.description}` : ''}`);
         }
     }
@@ -48,16 +56,22 @@ const format_waf = (waf) => {
 /**
  * What a rule selects, in one line.
  *
- * The three shapes have to be visibly different here: a user-agent rule has no
- * path restriction (it applies to the whole app) and a combined one is an AND,
- * so printing either as a bare pattern would misrepresent its reach.
+ * The five shapes have to be visibly different here: a user-agent or query rule
+ * has no path restriction (it applies to the whole app) and the combined ones
+ * are ANDs, so printing any of them as a bare pattern would misrepresent its
+ * reach. The `?` prefix marks a query parameter — `rest_route` on its own would
+ * read like a path.
  */
 const rule_subject = (r) => {
     if (r.pattern && r.user_agent) {
         return `${r.pattern} + UA ~ ${r.user_agent}`;
     }
+    if (r.pattern && r.query)
+        return `${r.pattern} + ?${r.query}`;
     if (r.user_agent)
         return `UA ~ ${r.user_agent} (any path)`;
+    if (r.query)
+        return `?${r.query} (any path)`;
     return r.pattern ?? '(unknown)';
 };
 

package/dist/commands/deploy/waf/rm.js

@@ -18,6 +18,11 @@ const waf_rm = {
         alias: 'u',
         type: 'string',
         description: 'The user-agent of the rule to remove'
+    })
+        .option('query', {
+        alias: 'q',
+        type: 'string',
+        description: 'The query parameter of the rule to remove'
     })
         .option('action', {
         type: 'string',
@@ -29,9 +34,9 @@ const waf_rm = {
         type: 'string',
         description: 'App Identifier (defaults to the linked app)'
     })
-        .check(({ pattern, userAgent }) => {
-        if (!pattern && !userAgent) {
-            throw new Error('Give the path pattern, --user-agent, or both.');
+        .check(({ pattern, userAgent, query }) => {
+        if (!pattern && !userAgent && !query) {
+            throw new Error('Give the path pattern, --user-agent, --query, or a path with one of them.');
         }
         return true;
     })
@@ -45,11 +50,13 @@ const waf_rm = {
         await ctx.api.removeAppWafRule(app_id, {
             pattern: args.pattern,
             user_agent: args.userAgent,
+            query: args.query,
             action: args.action
         });
         log.info(`🗑️  Removed ${describe_selector({
             pattern: args.pattern,
-            user_agent: args.userAgent
+            user_agent: args.userAgent,
+            query: args.query
         })} from ${app.name} (${app_id}).`);
         log.info(`They reach your app again within ~20s, once the edge picks up the change.`);
     }

package/dist/commands/deploy/waf/sink.js

@@ -14,6 +14,11 @@ const waf_sink = {
         alias: 'u',
         type: 'string',
         description: 'RE2 fragment matched against User-Agent, e.g. YisouSpider. With a path, BOTH must match.'
+    })
+        .option('query', {
+        alias: 'q',
+        type: 'string',
+        description: 'Literal query parameter name, e.g. rest_route (not a regex). With a path, BOTH must match.'
     })
         .option('app', {
         alias: 'a',
@@ -28,13 +33,17 @@ const waf_sink = {
         .option('force', {
         type: 'boolean',
         default: false,
-        description: 'Accept a user-agent that also matches a known search/AI crawler or uptime monitor'
+        description: 'Accept a user-agent that also matches a known search/AI crawler or uptime monitor, or a query parameter that carries an auth flow'
     })
-        .check(({ pattern, userAgent }) => {
-        if (!pattern && !userAgent) {
-            throw new Error('Give a path pattern, --user-agent, or both.\n' +
+        .check(({ pattern, userAgent, query }) => {
+        if (userAgent && query) {
+            throw new Error('A rule can combine a path with --user-agent OR with --query, not both.');
+        }
+        if (!pattern && !userAgent && !query) {
+            throw new Error('Give a path pattern, --user-agent, --query, or a path with one of them.\n' +
                 "  e.g. faable deploy waf sink '^/wp-admin'\n" +
-                '       faable deploy waf sink --user-agent YisouSpider');
+                '       faable deploy waf sink --user-agent YisouSpider\n' +
+                '       faable deploy waf sink --query rest_route');
         }
         return true;
     })
@@ -55,6 +64,7 @@ const waf_sink = {
             app_url: app.url,
             pattern: args.pattern,
             user_agent: args.userAgent,
+            query: args.query,
             action: 'sink',
             description: args.description,
             force: args.force

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "3.1.1",
+  "version": "3.3.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "@actions/core": "^3.0.0",
-    "@faable/auth-sdk": "^2.5.39",
+    "@faable/auth-sdk": "^2.6.0",
     "axios": "^1.18.1",
     "fs-extra": "^11.3.2",
     "open": "^11.0.0",