@factorialco/fcode-cli 1.4.0 → 2.0.0

package/dist/services/fcode-graphql-client.js

@@ -21,15 +21,10 @@ const PROCESS_FIELDS = `
   triggers {
     webhook {
       enabled
+      authMode
       auth {
-        basicAuth {
-          username
-          password
-          expression {
-            username
-            password
-          }
-        }
+        headerName
+        variableKey
       }
     }
   }
@@ -44,9 +39,7 @@ const PROCESS_FIELDS = `
     formSettings {
       enabled
       appRole
-    }
-    publicationConfig {
-      isPublic
+      authMode
     }
     dependencies {
       scopedToProcess
@@ -280,9 +273,9 @@ class FcodeGraphQLClient {
             if (process.form.appRole) {
                 settings.formSettings.appRole = process.form.appRole;
             }
-        }
-        if (process.visibility) {
-            settings.publicationConfig = { isPublic: process.visibility.isPublic };
+            if (process.form.authMode) {
+                settings.formSettings.authMode = process.form.authMode;
+            }
         }
         const input = {
             name: process.name,
@@ -298,11 +291,17 @@ class FcodeGraphQLClient {
         }
         if (process.webhook) {
             const webhook = { enabled: process.webhook.enabled };
-            if (process.webhook.username !== undefined) {
-                webhook.username = process.webhook.username;
-            }
-            if (process.webhook.password !== undefined) {
-                webhook.password = process.webhook.password;
+            // Forwarded including an explicit NONE, so a webhook can be un-protected from
+            // metadata.json; omitting the mode leaves the stored one in place.
+            if (process.webhook.authMode !== undefined) {
+                webhook.authMode = process.webhook.authMode;
+                if (process.webhook.auth) {
+                    const auth = { variableKey: process.webhook.auth.variableKey };
+                    if (process.webhook.auth.headerName !== undefined) {
+                        auth.headerName = process.webhook.auth.headerName;
+                    }
+                    webhook.auth = auth;
+                }
             }
             input.webhook = webhook;
         }
@@ -538,23 +537,24 @@ class FcodeGraphQLClient {
     inheritedTeam(resolvingTeamSlug) {
         return resolvingTeamSlug && resolvingTeamSlug !== this.teamSlug ? resolvingTeamSlug : undefined;
     }
+    /**
+     * The public mode and the default header name are left out, so a public webhook — or one
+     * using the default header — keeps the metadata.json it already had on disk.
+     */
     mapWebhook(triggers) {
         const webhookTrigger = triggers?.webhook;
         if (!webhookTrigger) {
             return undefined;
         }
         const webhook = { enabled: Boolean(webhookTrigger.enabled) };
-        const basicAuth = webhookTrigger.auth?.basicAuth;
-        if (basicAuth) {
-            // Prefer the expression form (env-var placeholders like $WEBHOOK_PASSWORD)
-            // over the resolved literal so placeholders round-trip on pull.
-            const username = basicAuth.expression?.username ?? basicAuth.username;
-            const password = basicAuth.expression?.password ?? basicAuth.password;
-            if (username != null) {
-                webhook.username = username;
-            }
-            if (password != null) {
-                webhook.password = password;
+        if (webhookTrigger.authMode && webhookTrigger.authMode !== 'NONE') {
+            webhook.authMode = webhookTrigger.authMode;
+            if (webhookTrigger.auth?.variableKey) {
+                const auth = { variableKey: webhookTrigger.auth.variableKey };
+                if (webhookTrigger.auth.headerName && webhookTrigger.auth.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+                    auth.headerName = webhookTrigger.auth.headerName;
+                }
+                webhook.auth = auth;
             }
         }
         return webhook;
@@ -576,12 +576,33 @@ class FcodeGraphQLClient {
             if (settings.formSettings.appRole && settings.formSettings.appRole !== 'NONE') {
                 metadata.form.appRole = settings.formSettings.appRole;
             }
-        }
-        if (settings?.publicationConfig) {
-            metadata.visibility = { isPublic: Boolean(settings.publicationConfig.isPublic) };
+            if (settings.formSettings.authMode && settings.formSettings.authMode !== 'NONE') {
+                metadata.form.authMode = settings.formSettings.authMode;
+            }
         }
         return new types_1.Process(id, slug, script, readme, { dependencies }, settings, metadata, this.inheritedTeam(resolvingTeamSlug));
     }
+    /**
+     * GraphQL nests the webhook configuration under `settings`, while team.json and the REST API
+     * keep it flat. Mapping it explicitly is what keeps that mismatch from silently reading as
+     * undefined.
+     */
+    mapTeamSettings(team) {
+        const settings = {
+            slug: team.slug,
+            zoneId: team.zoneId,
+            errorHandlerConfig: team.errorHandlerConfig,
+            parentTeamSlugs: team.parentTeamSlugs ?? [],
+        };
+        const webhookAuth = team.settings?.webhookAuth;
+        if (webhookAuth?.variableKey) {
+            settings.webhookAuth = { variableKey: webhookAuth.variableKey };
+            if (webhookAuth.headerName && webhookAuth.headerName !== types_1.DEFAULT_WEBHOOK_AUTH_HEADER) {
+                settings.webhookAuth.headerName = webhookAuth.headerName;
+            }
+        }
+        return settings;
+    }
     team() {
         return this.client
             .request((0, graphql_request_1.gql) `
@@ -594,10 +615,16 @@ class FcodeGraphQLClient {
                 tag
               }
               parentTeamSlugs
+              settings {
+                webhookAuth {
+                  headerName
+                  variableKey
+                }
+              }
             }
           }
         `, { slug: this.teamSlug })
-            .then(({ team }) => team)
+            .then(({ team }) => this.mapTeamSettings(team))
             .catch((error) => {
             return Promise.reject(this.cleanError(error));
         });
@@ -614,10 +641,16 @@ class FcodeGraphQLClient {
                 tag
               }
               parentTeamSlugs
+              settings {
+                webhookAuth {
+                  headerName
+                  variableKey
+                }
+              }
             }
           }
         `, { slug: this.teamSlug, update })
-            .then(({ updateTeam: team }) => team)
+            .then(({ updateTeam: team }) => this.mapTeamSettings(team))
             .catch((error) => {
             return Promise.reject(this.cleanError(error));
         });

package/dist/services/oauth-browser-service.js

@@ -144,6 +144,7 @@ async function loginViaBrowser(url, authUrl, clientId) {
         const token = {
             access_token: tokenSet.access_token ?? '',
             refresh_token: tokenSet.refresh_token ?? '',
+            expires_at: tokenSet.expires_at,
         };
         const userInfo = await auth_service_1.default.getUserInfo(normalizedAuthUrl, token);
         const authInfo = {

package/dist/services/webhook-auth.d.ts

@@ -0,0 +1,21 @@
+import type * as http from 'node:http';
+import { ProcessWebhook, WebhookAuth } from '../core/types';
+export type WebhookAuthResult = {
+    authorized: true;
+} | {
+    authorized: false;
+    reason: string;
+};
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+export declare function findHeader(headers: http.IncomingHttpHeaders, name: string): string | undefined;
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+export declare function resolveEffectiveAuth(webhook: ProcessWebhook | undefined, teamWebhookAuth: WebhookAuth | undefined): WebhookAuth | null;
+export declare function checkWebhookAuth(effectiveAuth: WebhookAuth | null, headers: http.IncomingHttpHeaders, variableValue: string | undefined): WebhookAuthResult;

package/dist/services/webhook-auth.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findHeader = findHeader;
+exports.resolveEffectiveAuth = resolveEffectiveAuth;
+exports.checkWebhookAuth = checkWebhookAuth;
+const crypto = require("node:crypto");
+const types_1 = require("../core/types");
+/**
+ * Mirrors the cloud's webhook authentication so `fcode http` accepts and rejects exactly what the
+ * platform does. The scheme in the default Authorization header is case-insensitive per RFC 7235;
+ * the token is not. A custom header carries the raw value, with no scheme to parse.
+ */
+const BEARER_PATTERN = /^Bearer[ \t]+(\S+)[ \t]*$/i;
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+function findHeader(headers, name) {
+    const lowerCased = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lowerCased) {
+            return typeof value === 'string' ? value : undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+function resolveEffectiveAuth(webhook, teamWebhookAuth) {
+    const authMode = webhook?.authMode;
+    if (!authMode || authMode === 'NONE') {
+        return null;
+    }
+    if (authMode === 'TEAM') {
+        if (!teamWebhookAuth) {
+            throw new Error('this webhook inherits the workspace webhook auth, which is not set in team.json');
+        }
+        return teamWebhookAuth;
+    }
+    if (!webhook?.auth?.variableKey) {
+        throw new Error('this webhook uses the CUSTOM auth mode but names no variable in metadata.json');
+    }
+    return webhook.auth;
+}
+/** Constant-time over equal-length digests, so neither the token nor its length leaks. */
+function matches(expectedToken, givenToken) {
+    const digest = (value) => crypto.createHash('sha256').update(value, 'utf8').digest();
+    return crypto.timingSafeEqual(digest(expectedToken), digest(givenToken));
+}
+function checkWebhookAuth(effectiveAuth, headers, variableValue) {
+    if (effectiveAuth === null) {
+        return { authorized: true };
+    }
+    const headerName = effectiveAuth.headerName ?? types_1.DEFAULT_WEBHOOK_AUTH_HEADER;
+    const headerValue = findHeader(headers, headerName);
+    if (headerValue === undefined || headerValue.trim().length === 0) {
+        return { authorized: false, reason: `the ${headerName} header is missing` };
+    }
+    let givenToken = headerValue;
+    if (headerName.toLowerCase() === types_1.DEFAULT_WEBHOOK_AUTH_HEADER.toLowerCase()) {
+        givenToken = BEARER_PATTERN.exec(headerValue)?.[1];
+        if (givenToken === undefined) {
+            return { authorized: false, reason: `the ${headerName} header is not a bearer token` };
+        }
+    }
+    if (variableValue === undefined) {
+        return { authorized: false, reason: `the ${effectiveAuth.variableKey} variable is not defined` };
+    }
+    if (!matches(variableValue, givenToken)) {
+        return { authorized: false, reason: `the value sent in ${headerName} does not match ${effectiveAuth.variableKey}` };
+    }
+    return { authorized: true };
+}