@gitkraken/core-gitlens 0.3.1 → 0.4.100

package/src/plus/integrations/authentication/integrationAuthenticationProvider.ts

@@ -0,0 +1,363 @@
+import { trace } from '../../../utils/decorators/log.js';
+import type { Disposable } from '../../../utils/disposable.js';
+import type { Event } from '../../../utils/event.js';
+import { Emitter } from '../../../utils/event.js';
+import type { IntegrationIds } from '../constants.js';
+import type { Sources } from '../telemetry.js';
+import { areDomainsOnSameHost } from '../utils/domain.utils.js';
+import { isGitSelfManagedHostIntegrationId, isNonExpiringZeroTokenIntegrationId } from '../utils/integration.utils.js';
+import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
+import type { IntegrationAuthenticationService } from './integrationAuthenticationService.js';
+import type { ProviderAuthenticationSession } from './models.js';
+import { isSupportedCloudIntegrationId } from './models.js';
+
+const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
+
+export interface IntegrationAuthenticationProviderDescriptor {
+	id: IntegrationIds;
+	scopes: string[];
+}
+
+export interface IntegrationAuthenticationSessionDescriptor {
+	domain: string;
+	scopes: string[];
+	/** When set, reads/deletes only the matching storage variant. */
+	cloud?: boolean;
+	/**
+	 * Targets a specific connection when a provider has multiple accounts connected. When omitted,
+	 * operations resolve to the provider's primary connection (see
+	 * {@link ConfiguredIntegrationService.resolveConnectionId}).
+	 */
+	connectionId?: string;
+	[key: string]: unknown;
+}
+
+export interface IntegrationAuthenticationProvider extends Disposable {
+	/**
+	 * Clears the stored secret for one connection only (never the whole provider). Unlike
+	 * {@link deleteAllSessions}, this by default leaves the descriptor in `integrations:configured` — its
+	 * primary caller is a forced re-sync, which needs `getConfigured()` to keep reporting the connection
+	 * while a fresh session is fetched to replace the deleted secret. Implementers should not treat this as
+	 * a full disconnect. Pass `preserveConfigured: false` to also drop the descriptor (e.g. when the
+	 * re-sync's replacement fetch failed and the connection should no longer be reported as connected).
+	 */
+	deleteSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { preserveConfigured?: boolean },
+	): Promise<void>;
+	deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
+	getSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?:
+			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
+			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+	): Promise<ProviderAuthenticationSession | undefined>;
+	get onDidChange(): Event<void>;
+}
+
+abstract class IntegrationAuthenticationProviderBase<
+	ID extends IntegrationIds = IntegrationIds,
+> implements IntegrationAuthenticationProvider {
+	protected readonly disposables: Disposable[] = [];
+
+	constructor(
+		protected readonly authenticationService: IntegrationAuthenticationService,
+		protected readonly configuredIntegrationService: ConfiguredIntegrationService,
+	) {}
+
+	dispose(): void {
+		this.disposables.forEach(d => d.dispose());
+	}
+
+	private readonly _onDidChange = new Emitter<void>();
+	get onDidChange(): Event<void> {
+		return this._onDidChange.event;
+	}
+
+	protected abstract get authProviderId(): ID;
+
+	@trace()
+	async deleteSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { preserveConfigured?: boolean },
+	): Promise<void> {
+		const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
+		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+			domain: domain,
+		});
+
+		// Scope the descriptor to cloud so resolveConnectionId targets the cloud variant's id: this is a
+		// cloud-only delete, and a mixed local+cloud connection whose local descriptor is primary would
+		// otherwise resolve the local id and leave the cloud secret intact.
+		await this.configuredIntegrationService.deleteStoredSessions(
+			this.authProviderId,
+			{ ...descriptor, cloud: true },
+			true,
+			{ preserveConfigured: options?.preserveConfigured ?? true },
+		);
+
+		if (configured?.length) {
+			this.fireChange();
+		}
+	}
+
+	@trace()
+	async deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void> {
+		// Self-managed providers group every host under one provider id, so scope the clear to this
+		// descriptor's host when given; for cloud providers the domain stays undefined here, clearing every account.
+		const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
+		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+			domain: domain,
+		});
+
+		await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined, domain);
+
+		if (configured?.length) {
+			this.fireChange();
+		}
+	}
+
+	@trace()
+	async getSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?:
+			| { createIfNeeded?: boolean; forceNewSession?: boolean; sync?: never; source?: Sources }
+			| { createIfNeeded?: never; forceNewSession?: never; sync: boolean; source?: Sources },
+	): Promise<ProviderAuthenticationSession | undefined> {
+		let session;
+		let previousToken;
+		if (options?.forceNewSession) {
+			// Cloud-only delete (see deleteSession): scope to cloud so the cloud variant's id is cleared even
+			// when a mixed local+cloud connection's local descriptor is primary.
+			await this.configuredIntegrationService.deleteStoredSessions(
+				this.authProviderId,
+				{ ...descriptor, cloud: true },
+				true,
+			);
+		} else {
+			session = await this.configuredIntegrationService.getStoredSession(
+				this.authProviderId,
+				options?.sync ? { ...descriptor, cloud: true } : descriptor,
+			);
+			previousToken = session?.accessToken;
+		}
+
+		const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
+		if (session == null || isExpiredSession) {
+			session = await this.getNewSession(descriptor, {
+				...options,
+				refreshIfExpired: isExpiredSession,
+			});
+
+			if (session != null) {
+				await this.configuredIntegrationService.storeSession(this.authProviderId, session);
+			}
+		}
+
+		if (previousToken !== session?.accessToken) {
+			this.fireChange();
+		}
+
+		return session;
+	}
+
+	protected abstract getNewSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?:
+			| {
+					createIfNeeded?: boolean;
+					forceNewSession?: boolean;
+					sync?: never;
+					refreshIfExpired?: boolean;
+					source?: Sources;
+			  }
+			| {
+					createIfNeeded?: never;
+					forceNewSession?: never;
+					sync: boolean;
+					refreshIfExpired?: boolean;
+					source?: Sources;
+			  },
+	): Promise<ProviderAuthenticationSession | undefined>;
+
+	protected fireChange(): void {
+		queueMicrotask(() => this._onDidChange.fire());
+	}
+}
+
+export class CloudIntegrationAuthenticationProvider<
+	ID extends IntegrationIds = IntegrationIds,
+> extends IntegrationAuthenticationProviderBase<ID> {
+	constructor(
+		authenticationService: IntegrationAuthenticationService,
+		configuredIntegrationService: ConfiguredIntegrationService,
+		private readonly _authProviderId: ID,
+	) {
+		super(authenticationService, configuredIntegrationService);
+	}
+
+	protected get authProviderId(): ID {
+		return this._authProviderId;
+	}
+
+	protected override async getNewSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?:
+			| {
+					createIfNeeded?: boolean;
+					forceNewSession?: boolean;
+					sync?: never;
+					refreshIfExpired?: boolean;
+					source?: Sources;
+			  }
+			| {
+					createIfNeeded?: never;
+					forceNewSession?: never;
+					sync: boolean;
+					refreshIfExpired?: boolean;
+					source?: Sources;
+			  },
+	): Promise<ProviderAuthenticationSession | undefined> {
+		if (options?.forceNewSession) {
+			if ((await this.disconnectCloudSession()) === 'failure') {
+				return undefined;
+			}
+
+			void this.connectCloudSession(false, options?.source);
+			return undefined;
+		}
+
+		// TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
+		// Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
+		// make the call or not.
+		let session =
+			options?.refreshIfExpired || options?.createIfNeeded || options?.forceNewSession || options?.sync
+				? await this.getCloudSession(descriptor)
+				: undefined;
+
+		const shouldCreateSession = options?.createIfNeeded && session == null;
+		if (shouldCreateSession) {
+			const connected = await this.connectCloudSession(true, options?.source);
+			if (!connected) return undefined;
+
+			// This should get us the session we just created with connectCloudSession, because a syncCloudIntegrations run from
+			// integration service should have resulted in it being created and stored by this provider
+			session = await this.getSession(descriptor, { source: options?.source });
+		}
+		return session;
+	}
+
+	private connectCloudSession(skipIfConnected: boolean, source: Sources | undefined): Promise<boolean> {
+		// Capture in a const so the type guard narrows it to `SupportedCloudIntegrationIds` (a getter
+		// access wouldn't narrow), letting us call the service directly without a cast.
+		const id = this.authProviderId;
+		if (isSupportedCloudIntegrationId(id)) {
+			return this.authenticationService.connectCloudIntegrations(
+				{ integrationIds: [id], skipIfConnected: skipIfConnected, skipPreSync: true },
+				{
+					source: source ?? 'integrations',
+					detail: {
+						action: 'connect',
+						integration: id,
+					},
+				},
+			);
+		}
+
+		return Promise.resolve(false);
+	}
+
+	private async getCloudSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+	): Promise<ProviderAuthenticationSession | undefined> {
+		const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+		if (!loggedIn) return undefined;
+
+		const cloudIntegrations = this.authenticationService.cloudIntegrations;
+		// An unscoped descriptor (no explicit connectionId) would fetch the provider-global primary via
+		// `v1/provider-tokens/<provider>`. For a self-managed provider spanning multiple hosts that primary
+		// can belong to a different host, so a forced sync of host A would hydrate host B's token here (before
+		// reconcile corrects storage). Scope to this host's own configured connection when we have one; fall
+		// through to the provider-scoped path only when nothing is configured yet (legacy/first sync).
+		const connectionId =
+			descriptor.connectionId ??
+			(isGitSelfManagedHostIntegrationId(this.authProviderId)
+				? this.configuredIntegrationService.getConfiguredConnectionId(
+						this.authProviderId,
+						descriptor.domain,
+						true,
+					)
+				: undefined);
+		let session = await cloudIntegrations.getConnectionSession(this.authProviderId, undefined, connectionId);
+		if (
+			session != null &&
+			isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+			!areDomainsOnSameHost(session.domain, descriptor.domain)
+		) {
+			return undefined;
+		}
+
+		// GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a token that never
+		// expires; left as 0 the session would be built with `expiresAt = now` and rejected as expired on the
+		// next resolution. Map it to the maximum expiry so it isn't refreshed frequently.
+		if (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) {
+			session.expiresIn = maxSmallIntegerV8; // maximum expiration length
+		}
+
+		if (session != null && session.expiresIn < 60) {
+			session = await cloudIntegrations.getConnectionSession(
+				this.authProviderId,
+				session.accessToken,
+				connectionId,
+			);
+			if (
+				session != null &&
+				isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+				!areDomainsOnSameHost(session.domain, descriptor.domain)
+			) {
+				return undefined;
+			}
+		}
+
+		if (!session) return undefined;
+
+		let sessionProtocol;
+		// Only derive a protocol from a domain carrying an explicit scheme; a bare `host:port` (e.g. a
+		// self-managed `ghe.example.com:8443`) parses the host as the protocol, corrupting the value.
+		if (/^[a-z][a-z\d+\-.]*:\/\//i.test(session.domain)) {
+			try {
+				sessionProtocol = new URL(session.domain).protocol;
+			} catch {
+				sessionProtocol = undefined;
+			}
+		}
+
+		return {
+			// Prefer the backend's per-connection token id (multi-account); fall back to the resolved
+			// primary/legacy connection id so existing single-connection storage keys are preserved.
+			id: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),
+			accessToken: session.accessToken,
+			scopes: descriptor.scopes,
+			account: {
+				id: '',
+				label: '',
+			},
+			cloud: true,
+			type: session.type,
+			expiresAt: new Date(session.expiresIn * 1000 + Date.now()),
+			// Note: do not use the session's domain, because the format is different than in our model
+			domain: descriptor.domain,
+			protocol: sessionProtocol ?? undefined,
+			// Carried for providers whose client needs an app key alongside the token (e.g. Trello).
+			appKey: session.appKey,
+		};
+	}
+
+	private async disconnectCloudSession(): Promise<'skip' | 'success' | 'failure'> {
+		const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+		if (!loggedIn) return 'skip';
+
+		const cloudIntegrations = this.authenticationService.cloudIntegrations;
+		return (await cloudIntegrations.disconnect(this.authProviderId)) ? 'success' : 'failure';
+	}
+}

package/src/plus/integrations/authentication/integrationAuthenticationService.ts

@@ -0,0 +1,148 @@
+import type { GitRemote } from '../../../git/models/remote.js';
+import { gate } from '../../../utils/decorators/gate.js';
+import { debug } from '../../../utils/decorators/log.js';
+import type { Disposable } from '../../../utils/disposable.js';
+import type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';
+import {
+	GitCloudHostIntegrationId,
+	GitSelfManagedHostIntegrationId,
+	IssuesCloudHostIntegrationId,
+} from '../constants.js';
+import type { IntegrationServiceContext } from '../context.js';
+import type { IntegrationService } from '../integrationService.js';
+import type { GitHostIntegration } from '../models/gitHostIntegration.js';
+import type { ApiClients } from '../providers/apiClients.js';
+import type { Source } from '../telemetry.js';
+import { supportedIntegrationIds } from '../utils/integration.utils.js';
+import type { CloudIntegrationService } from './cloudIntegrationService.js';
+import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
+import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+import { CloudIntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+
+export class IntegrationAuthenticationService implements Disposable {
+	private readonly providers = new Map<IntegrationIds, IntegrationAuthenticationProvider>();
+
+	constructor(
+		private readonly configuredIntegrationService: ConfiguredIntegrationService,
+		readonly ctx: IntegrationServiceContext,
+		/**
+		 * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+		 * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+		 * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+		 */
+		private readonly getIntegrationService: () => IntegrationService,
+		/** The package's cloud token-exchange client, constructed by the composition root. */
+		readonly cloudIntegrations: CloudIntegrationService,
+	) {}
+
+	dispose(): void {
+		this.providers.forEach(p => p.dispose());
+		this.providers.clear();
+	}
+
+	/**
+	 * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+	 * this when they need a session that doesn't exist yet (see
+	 * {@link CloudIntegrationAuthenticationProvider}).
+	 */
+	connectCloudIntegrations(
+		connect: { integrationIds: SupportedCloudIntegrationIds[]; skipIfConnected?: boolean; skipPreSync?: boolean },
+		source?: Source,
+	): Promise<boolean> {
+		return this.getIntegrationService().connectCloudIntegrations(connect, source);
+	}
+
+	/**
+	 * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+	 * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+	 * host round-trip.
+	 */
+	getByRemote(remote: GitRemote): Promise<GitHostIntegration | undefined> {
+		return this.getIntegrationService().getByRemote(remote);
+	}
+
+	/** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+	ignoreSSLErrors(integration: GitHostIntegration | { id: IntegrationIds; domain?: string }): boolean | 'force' {
+		return this.getIntegrationService().ignoreSSLErrors(integration);
+	}
+
+	/** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+	get apis(): ApiClients {
+		return this.getIntegrationService().apis;
+	}
+
+	async get(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider> {
+		return this.ensureProvider(providerId);
+	}
+
+	@debug()
+	async reset(): Promise<void> {
+		// TODO: This really isn't ideal, since it will only work for "cloud" providers as we won't have any more specific descriptors
+		await Promise.allSettled(
+			supportedIntegrationIds.map(async providerId =>
+				(await this.ensureProvider(providerId)).deleteAllSessions(),
+			),
+		);
+	}
+
+	supports(providerId: string): boolean {
+		// Linear and Trello are cloud-backed issue integrations (same as Jira): `ensureProvider` registers a
+		// cloud auth provider for them, so a disconnect must offer to sign out of the cloud token too —
+		// otherwise the backend token and configured connection survive the disable.
+		switch (providerId) {
+			case GitCloudHostIntegrationId.AzureDevOps:
+			case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+			case GitCloudHostIntegrationId.Bitbucket:
+			case GitCloudHostIntegrationId.GitLab:
+			case IssuesCloudHostIntegrationId.Jira:
+			case IssuesCloudHostIntegrationId.Linear:
+			case IssuesCloudHostIntegrationId.Trello:
+			case GitCloudHostIntegrationId.GitHub:
+				return true;
+			default:
+				return false;
+		}
+	}
+
+	@gate()
+	private async ensureProvider(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider> {
+		let provider = this.providers.get(providerId);
+		if (provider != null) return provider;
+
+		// Optional consumer override for custom auth (e.g. a manual-token provider). GitLens omits it —
+		// the package constructs its own cloud providers below (so GitLens's cloud auth needs no host hook).
+		const hostProvider = await this.ctx.hooks?.createAuthenticationProvider?.({
+			id: providerId,
+		});
+		if (hostProvider != null) {
+			this.providers.set(providerId, hostProvider);
+			return hostProvider;
+		}
+
+		// Every cloud integration shares one provider, parameterized by id (cloud-only).
+		switch (providerId) {
+			case GitCloudHostIntegrationId.GitHub:
+			case GitSelfManagedHostIntegrationId.CloudGitHubEnterprise:
+			case GitCloudHostIntegrationId.GitLab:
+			case GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:
+			case GitCloudHostIntegrationId.AzureDevOps:
+			case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+			case GitCloudHostIntegrationId.Bitbucket:
+			case GitSelfManagedHostIntegrationId.BitbucketServer:
+			case IssuesCloudHostIntegrationId.Jira:
+			case IssuesCloudHostIntegrationId.Linear:
+			case IssuesCloudHostIntegrationId.Trello:
+				provider = new CloudIntegrationAuthenticationProvider(
+					this,
+					this.configuredIntegrationService,
+					providerId,
+				);
+				break;
+			default:
+				throw new Error(`No authentication provider registered for integration '${String(providerId)}'`);
+		}
+
+		this.providers.set(providerId, provider);
+		return provider;
+	}
+}

package/src/plus/integrations/authentication/manualTokenProvider.ts

@@ -0,0 +1,79 @@
+// Convenience for "manual token" auth — when a consumer already has an access
+// token (CLI flag, env var, secret manager) and just wants the package to use
+// it without an OAuth dance. Wire it into the manager via the
+// `createAuthenticationProvider` hook:
+//
+//   const manager = createIntegrationManager({
+//       ...runtime,
+//       hooks: {
+//           createAuthenticationProvider: async ({ id }) =>
+//               id === GitCloudHostIntegrationId.GitHub
+//                   ? createManualTokenAuthProvider({
+//                         id: id,
+//                         token: process.env.GITHUB_TOKEN!,
+//                         account: { id: 'me', label: 'CLI Token' },
+//                     })
+//                   : undefined,
+//       },
+//   });
+//
+// The provider is intentionally minimal — sessions are non-cancellable, never
+// expire, and persist for the lifetime of the manager. For OAuth flows or
+// refreshable tokens, implement `IntegrationAuthenticationProvider` yourself.
+
+import type { Event } from '../../../utils/event.js';
+import { Emitter } from '../../../utils/event.js';
+import type { IntegrationIds } from '../constants.js';
+import type {
+	IntegrationAuthenticationProvider,
+	IntegrationAuthenticationSessionDescriptor,
+} from './integrationAuthenticationProvider.js';
+import type { ProviderAuthenticationSession } from './models.js';
+
+export interface ManualTokenAuthProviderOptions {
+	readonly id: IntegrationIds;
+	readonly token: string;
+	readonly account: { readonly id: string; readonly label: string };
+	readonly scopes?: readonly string[];
+	readonly domain?: string;
+	readonly cloud?: boolean;
+	readonly appKey?: string;
+}
+
+export function createManualTokenAuthProvider(
+	options: ManualTokenAuthProviderOptions,
+): IntegrationAuthenticationProvider {
+	const onDidChange = new Emitter<void>();
+	const session: ProviderAuthenticationSession = {
+		id: `manual:${options.id}`,
+		accessToken: options.token,
+		account: options.account,
+		scopes: options.scopes ?? [],
+		cloud: options.cloud ?? true,
+		type: undefined,
+		domain: options.domain ?? '',
+		appKey: options.appKey,
+	};
+
+	return {
+		get onDidChange(): Event<void> {
+			return onDidChange.event;
+		},
+		getSession: (
+			descriptor: IntegrationAuthenticationSessionDescriptor,
+			options?: Parameters<IntegrationAuthenticationProvider['getSession']>[1],
+		) =>
+			// A manual token represents only the implicit primary connection. It cannot prove that an
+			// arbitrary connection selector owns the token, so fail closed instead of leaking it across
+			// accounts. Empty legacy selectors still resolve as primary.
+			//
+			// It also can't be refreshed; on a forced new session, return undefined rather than handing
+			// back the same likely-rejected token and looping a reauthenticate-on-failure flow.
+			Promise.resolve(
+				options?.forceNewSession || (descriptor.connectionId?.length ?? 0) > 0 ? undefined : session,
+			),
+		deleteSession: () => Promise.resolve(),
+		deleteAllSessions: () => Promise.resolve(),
+		dispose: () => onDidChange.dispose(),
+	};
+}