@faable/faable 3.2.0 → 3.3.0

package/dist/api/auth.js

@@ -1,8 +1,41 @@
-import axios from 'axios';
+import { FaableAuthApi, authBearer } from '@faable/auth-sdk';
 import os from 'os';
+import { version } from '../config.js';
 
-const api = axios.create({ baseURL: "https://faable.auth.faable.link" });
+// The CLI talks to the Faable tenant's auth server through the same SDK the
+// rest of the platform uses. It used to be a bare axios instance, which meant
+// every call landed in the tenant's traffic as "not identified" — the SDK
+// stamps `x-faable-client`, and the value below makes it say who this really
+// is instead of `auth-sdk`.
+//
+// Two clients, because there are two kinds of call:
+//  - anonymous: the device flow and the refresh grant. A public client, no
+//    secret, no token yet. POSTs are never retried by the fetcher, which is
+//    what the device polling needs — every `authorization_pending` is an
+//    error the loop expects, not one to replay.
+//  - bearer: `/me` and everything `faable auth` does, with the token the user
+//    already holds. The strategy asks for the token on every request, so
+//    whatever `loadLiveCredentials` refreshed is what goes on the wire.
+const AUTH_DOMAIN = "https://faable.auth.faable.link";
 const CLIENT_ID = "c879023b-e34f-4b0c-a262-210e556bc2e4";
+// `<name>/<version>`. No commit: the CLI has no release SHA constant, and a
+// dev build (`0.0.0-development`) is identifiable as such by the version
+// alone. auth caps this segment at 32 chars.
+const CLI_CLIENT = `faable-cli/${version}`;
+// No `x-faable-instance`: the SDK's default is `${HOSTNAME}:${pid}`, which on
+// a laptop is the user's machine name in our audit log. An empty string
+// suppresses the header (the helper drops falsy parts).
+const clientInfo = { client: CLI_CLIENT, instance: "" };
+const createAnonymousAuthApi = ({ domain = AUTH_DOMAIN, fetcher, } = {}) => FaableAuthApi.create({ domain, clientInfo, ...(fetcher ? { fetcher } : {}) });
+const createBearerAuthApi = (token, { domain = AUTH_DOMAIN, account, fetcher } = {}) => FaableAuthApi.create({
+    domain,
+    ...(account ? { headers: { account_id: account } } : {}),
+    authStrategy: authBearer,
+    auth: { token },
+    clientInfo,
+    ...(fetcher ? { fetcher } : {}),
+});
+const anonymous = createAnonymousAuthApi();
 const PLATFORM_LABELS = {
     darwin: "macOS",
     win32: "Windows",
@@ -15,35 +48,33 @@ function deviceName() {
     return `${os.hostname()} (${platform})`;
 }
 async function getDeviceCode() {
-    const res = await api.post(`/oauth/device/code`, {
+    return anonymous.fetcher.post(`/oauth/device/code`, {
         client_id: CLIENT_ID,
         scope: "openid email profile offline_access",
         device_name: deviceName(),
     });
-    return res.data;
 }
 async function getDeviceToken(device_code) {
-    const res = await api.post(`/oauth/token`, { device_code, client_id: CLIENT_ID, grant_type: "urn:ietf:params:oauth:grant-type:device_code" });
-    return res.data;
+    return anonymous.fetcher.post(`/oauth/token`, {
+        device_code,
+        client_id: CLIENT_ID,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+    });
 }
 // Validate a device-flow access token against the Faable Auth server. The token
 // is issued by the auth server, so it must be introspected there — NOT against
 // the deploy API (api.faable.com), which has no /me route and would 404.
 async function getMe(access_token) {
-    const res = await api.get(`/me`, {
-        headers: { Authorization: `Bearer ${access_token}` },
-    });
-    return res.data;
+    return createBearerAuthApi(access_token).fetcher.get(`/me`);
 }
 // Exchange a refresh token for a fresh access token (and a rotated refresh
 // token). The CLI is a public client, so no client_secret is required.
 async function refreshToken(refresh_token) {
-    const res = await api.post(`/oauth/token`, {
+    return anonymous.fetcher.post(`/oauth/token`, {
         grant_type: "refresh_token",
         client_id: CLIENT_ID,
         refresh_token,
     });
-    return res.data;
 }
 
-export { getDeviceCode, getDeviceToken, getMe, refreshToken };
+export { AUTH_DOMAIN, CLIENT_ID, CLI_CLIENT, createAnonymousAuthApi, createBearerAuthApi, getDeviceCode, getDeviceToken, getMe, refreshToken };

package/dist/api/auth_admin.js

@@ -1,6 +1,6 @@
-import { FaableAuthApi } from '@faable/auth-sdk';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { log } from '../log.js';
+import { createBearerAuthApi } from './auth.js';
 import { loadLiveCredentials } from './session.js';
 
 // Default tenant host. `faable auth` is customer-facing: a customer targets
@@ -31,13 +31,10 @@ const requireAuthAdmin = async (opts = {}) => {
     }
     const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
     const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
-    return new FaableAuthApi({
-        domain,
-        ...(account ? { headers: { account_id: account } } : {}),
-        // Static bearer: passing no `auth` keeps sdk-base from attaching any token
-        // strategy, so this header is used verbatim on every request.
-        fetcher: { headers: { Authorization: `Bearer ${token}` } }
-    });
+    // The session's bearer as a strategy — with the CLI's own identity on the
+    // wire instead of `auth-sdk` — scoped to the target tenant when one was
+    // named. The server decides whether this token may manage that tenant.
+    return createBearerAuthApi(token, { domain, account });
 };
 // Translate raw management-API failures into actionable CLI errors. Everything
 // else is rethrown untouched (FaableApiError messages already carry

package/dist/api/session.js

@@ -49,7 +49,10 @@ const loadLiveCredentials = async (store = new CredentialsStore()) => {
             // token endpoint's RFC 6749 error body. "Run `faable login` again"
             // would be a lie here — login is denied too — so say what actually
             // happened and stop instead of letting a generic 401 mislead.
-            const body = e?.response?.data;
+            // The SDK's error keeps the HTTP body under `response.data`, like the
+            // axios error it replaced.
+            const body = e
+                ?.response?.data;
             if (body?.error_code === "user_suspended") {
                 log.error("❌ Your account has been suspended. Contact support@faable.com.");
                 process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "@actions/core": "^3.0.0",
-    "@faable/auth-sdk": "^2.5.39",
+    "@faable/auth-sdk": "^2.6.0",
     "axios": "^1.18.1",
     "fs-extra": "^11.3.2",
     "open": "^11.0.0",