@factorialco/fcode-cli 1.5.0 → 2.0.0

package/dist/services/oauth-browser-service.js

@@ -144,6 +144,7 @@ async function loginViaBrowser(url, authUrl, clientId) {
         const token = {
             access_token: tokenSet.access_token ?? '',
             refresh_token: tokenSet.refresh_token ?? '',
+            expires_at: tokenSet.expires_at,
         };
         const userInfo = await auth_service_1.default.getUserInfo(normalizedAuthUrl, token);
         const authInfo = {

package/dist/services/webhook-auth.d.ts

@@ -0,0 +1,21 @@
+import type * as http from 'node:http';
+import { ProcessWebhook, WebhookAuth } from '../core/types';
+export type WebhookAuthResult = {
+    authorized: true;
+} | {
+    authorized: false;
+    reason: string;
+};
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+export declare function findHeader(headers: http.IncomingHttpHeaders, name: string): string | undefined;
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+export declare function resolveEffectiveAuth(webhook: ProcessWebhook | undefined, teamWebhookAuth: WebhookAuth | undefined): WebhookAuth | null;
+export declare function checkWebhookAuth(effectiveAuth: WebhookAuth | null, headers: http.IncomingHttpHeaders, variableValue: string | undefined): WebhookAuthResult;

package/dist/services/webhook-auth.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findHeader = findHeader;
+exports.resolveEffectiveAuth = resolveEffectiveAuth;
+exports.checkWebhookAuth = checkWebhookAuth;
+const crypto = require("node:crypto");
+const types_1 = require("../core/types");
+/**
+ * Mirrors the cloud's webhook authentication so `fcode http` accepts and rejects exactly what the
+ * platform does. The scheme in the default Authorization header is case-insensitive per RFC 7235;
+ * the token is not. A custom header carries the raw value, with no scheme to parse.
+ */
+const BEARER_PATTERN = /^Bearer[ \t]+(\S+)[ \t]*$/i;
+/**
+ * Node lower-cases incoming header names, while a configured name is stored as the user typed it,
+ * so the lookup has to be case-insensitive. A repeated header arrives as an array and is rejected
+ * rather than joined: a spliced value must never authenticate.
+ */
+function findHeader(headers, name) {
+    const lowerCased = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === lowerCased) {
+            return typeof value === 'string' ? value : undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * The configuration a webhook actually enforces: its own when CUSTOM, the workspace's when TEAM.
+ * Returns null only when the webhook is public — TEAM without a workspace configuration throws,
+ * because treating it as public would silently unprotect a webhook its owner chose to protect.
+ */
+function resolveEffectiveAuth(webhook, teamWebhookAuth) {
+    const authMode = webhook?.authMode;
+    if (!authMode || authMode === 'NONE') {
+        return null;
+    }
+    if (authMode === 'TEAM') {
+        if (!teamWebhookAuth) {
+            throw new Error('this webhook inherits the workspace webhook auth, which is not set in team.json');
+        }
+        return teamWebhookAuth;
+    }
+    if (!webhook?.auth?.variableKey) {
+        throw new Error('this webhook uses the CUSTOM auth mode but names no variable in metadata.json');
+    }
+    return webhook.auth;
+}
+/** Constant-time over equal-length digests, so neither the token nor its length leaks. */
+function matches(expectedToken, givenToken) {
+    const digest = (value) => crypto.createHash('sha256').update(value, 'utf8').digest();
+    return crypto.timingSafeEqual(digest(expectedToken), digest(givenToken));
+}
+function checkWebhookAuth(effectiveAuth, headers, variableValue) {
+    if (effectiveAuth === null) {
+        return { authorized: true };
+    }
+    const headerName = effectiveAuth.headerName ?? types_1.DEFAULT_WEBHOOK_AUTH_HEADER;
+    const headerValue = findHeader(headers, headerName);
+    if (headerValue === undefined || headerValue.trim().length === 0) {
+        return { authorized: false, reason: `the ${headerName} header is missing` };
+    }
+    let givenToken = headerValue;
+    if (headerName.toLowerCase() === types_1.DEFAULT_WEBHOOK_AUTH_HEADER.toLowerCase()) {
+        givenToken = BEARER_PATTERN.exec(headerValue)?.[1];
+        if (givenToken === undefined) {
+            return { authorized: false, reason: `the ${headerName} header is not a bearer token` };
+        }
+    }
+    if (variableValue === undefined) {
+        return { authorized: false, reason: `the ${effectiveAuth.variableKey} variable is not defined` };
+    }
+    if (!matches(variableValue, givenToken)) {
+        return { authorized: false, reason: `the value sent in ${headerName} does not match ${effectiveAuth.variableKey}` };
+    }
+    return { authorized: true };
+}