@hardfin/cli 0.1.0-dev.30 → 0.1.0-dev.31

package/README.md

@@ -159,8 +159,18 @@ hardfin status           # what the CLI is configured with and signed in as
 hardfin logout           # forget this machine, and ask Hardfin to revoke it
 ```
 
-An API key is still the way to run unattended. `HARDFIN_API_KEY` wins over a stored sign in,
-so CI and an agent sandbox need no browser.
+An API key is still the way to run unattended. `--api-key`, or `HARDFIN_API_KEY`, wins over
+a stored sign in, so CI and an agent sandbox need no browser. The flag beats the variable.
+
+An API key is held to two rules before it is sent:
+
+| Rule                                                                                                                                    | Why                                                                     |
+| --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| It goes only over https, or to this machine                                                                                             | Anything between here and the host could read it                        |
+| A key you set, by flag or exported variable, never goes to an API URL that `config.local.json` or `.env` in the working directory chose | A repository you cloned could otherwise send your key to its own server |
+
+A key and an API URL that come from the same folder's files still work together, which is
+how a local build is set up. Pass `--api-url` to send a key you set to that folder's address.
 
 ### What login does
 
@@ -373,7 +383,7 @@ settings, and the one nearest the top wins.
 
 | Layer       | Where                                                                 | Beats            |
 | ----------- | --------------------------------------------------------------------- | ---------------- |
-| Flag        | `--api-url`                                                           | everything below |
+| Flag        | `--api-url`, `--api-key`, `--issuer-url`                              | everything below |
 | Environment | an exported `HARDFIN_*` variable                                      | the files below  |
 | Env file    | `.env` in the working directory, or the file `HARDFIN_ENV_FILE` names | the config file  |
 | Config file | `config.local.json` in the working directory                          | the defaults     |

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29560915-e7ae-5a74-b5f6-f4a6988e1b43")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bb3026cb-ab06-5af0-9743-290b61ec91a3")}catch(e){}}();
 import module from "node:module";
 //#region src/cli.ts
 module.enableCompileCache?.();
@@ -14,7 +14,7 @@ process.on("unhandledRejection", (error) => void toCrash(error));
 try {
 	const answer = await toQuickAnswer(process.argv.slice(2));
 	if (answer === void 0) {
-		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-BZW_50HP.js");
+		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-B0vISolG.js");
 		try {
 			await toCli().parseAsync(process.argv);
 		} catch (error) {
@@ -33,7 +33,7 @@ async function toCrash(error) {
 	isCrashing = true;
 	process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
 	try {
-		const { toReported } = await import("./program-BZW_50HP.js");
+		const { toReported } = await import("./program-B0vISolG.js");
 		await toReported(error, false, void 0, "fatal");
 	} finally {
 		process.exit(1);
@@ -51,4 +51,4 @@ async function toQuickAnswer(args) {
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=29560915-e7ae-5a74-b5f6-f4a6988e1b43
+//# debugId=bb3026cb-ab06-5af0-9743-290b61ec91a3

package/dist/completion-tree.json

@@ -5,6 +5,11 @@
       "description": "The API to call, whose host also holds the authorization server",
       "valueName": "url"
     },
+    {
+      "name": "api-key",
+      "description": "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+      "valueName": "key"
+    },
     {
       "name": "issuer-url",
       "description": "The authorization server, when it does not sit at the API's host",

package/dist/{program-BZW_50HP.js → program-B0vISolG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5c189832-33ce-5032-b0e0-fc3a33cf5b1d")}catch(e){}}();
-import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-VtQmxap1.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ab584cf3-443f-569e-8167-fa0cbab9ab68")}catch(e){}}();
+import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BN3gyBpR.js";
 import { n as toCompletion, t as toAnswer$1 } from "./completion-tree-rR_Rmeij.js";
 import { createRequire } from "node:module";
 import { Command, CommanderError, Option } from "commander";
@@ -694,12 +694,15 @@ const held = /* @__PURE__ */ new Map();
 * unattended caller sets it deliberately, and otherwise the stored refresh token buys an
 * access token that lives only in memory.
 */
-async function toRequestCredential(settings) {
-	if (settings.apiKey) return {
-		header: "X-API-Key",
-		value: settings.apiKey,
-		kind: "api key"
-	};
+async function toRequestCredential(settings, sources) {
+	if (settings.apiKey) {
+		refuseForeignKey(settings, sources);
+		return {
+			header: "X-API-Key",
+			value: settings.apiKey,
+			kind: "api key"
+		};
+	}
 	refuseForeignHost(settings);
 	const stored = toCredential(settings.issuerUrl);
 	if (!stored) throw new NoCredential("not authenticated. Run hardfin login, or set HARDFIN_API_KEY");
@@ -775,6 +778,20 @@ function refuseForeignHost(settings) {
 	if (api.host !== issuer.host) throw new NoCredential(`this sign in belongs to ${issuer.host}, so it is not sent to ${api.host}. Set HARDFIN_API_KEY to call another host, or point --issuer-url at the server that signs you in`);
 	if (api.protocol !== "https:" && !isLoopback(api.hostname)) throw new NoCredential(`${settings.apiUrl} is not https, so a sign in is not sent to it`);
 }
+/** The layers a file in the working directory sets, which a cloned repository can carry. */
+const DIRECTORY_SOURCES = /* @__PURE__ */ new Set(["config file", "env file"]);
+/** refuseForeignKey keeps an API key off plain connections and off hosts a stray file chose. */
+function refuseForeignKey(settings, sources) {
+	const api = toHost$1(settings.apiUrl);
+	if (api === void 0) throw new NoCredential(`${settings.apiUrl} is not a URL this CLI can call`);
+	if (api.protocol !== "https:" && !isLoopback(api.hostname)) throw new NoCredential(`Your API key was not sent, because ${api.host} does not use a secure connection.`);
+	const isKeyChosen = sources?.apiKey !== void 0 && !DIRECTORY_SOURCES.has(sources.apiKey);
+	const isUrlFromFolder = sources?.apiUrl !== void 0 && DIRECTORY_SOURCES.has(sources.apiUrl);
+	if (isKeyChosen && isUrlFromFolder) {
+		const file = sources.apiUrl === "config file" ? CONFIG_FILE : ".env";
+		throw new NoCredential(`Your API key was not sent to ${api.host}, because that address comes from a file in this folder, not from you.\nDetails: the API URL is set in ${file}. Pass --api-url to use it anyway`);
+	}
+}
 function toHost$1(url) {
 	try {
 		return new URL(url);
@@ -790,12 +807,15 @@ function isLoopback(hostname) {
 * an access token this process already holds. An error report uses it, because a refresh
 * cut short by the process ending would spend the refresh token and sign the person out.
 */
-function toHeldCredential(settings) {
-	if (settings.apiKey) return {
-		header: "X-API-Key",
-		value: settings.apiKey,
-		kind: "api key"
-	};
+function toHeldCredential(settings, sources) {
+	if (settings.apiKey) {
+		refuseForeignKey(settings, sources);
+		return {
+			header: "X-API-Key",
+			value: settings.apiKey,
+			kind: "api key"
+		};
+	}
 	const current = held.get(settings.issuerUrl);
 	if (!current || (current.expiresAt ?? 0) - EXPIRY_MARGIN_MS <= Date.now()) return;
 	return {
@@ -966,7 +986,7 @@ function toGuide(commands, version) {
 		"",
 		"## Before calling",
 		"",
-		"- Authenticate by setting `HARDFIN_API_KEY`, or by running `hardfin login`",
+		"- Authenticate with `--api-key`, by setting `HARDFIN_API_KEY`, or by running `hardfin login`",
 		"- Every command prints JSON on stdout and diagnostics on stderr",
 		"- Output is JSON whenever stdout is not a terminal, so no flag is needed when calling from code",
 		"",
@@ -1131,7 +1151,7 @@ async function runApi(input) {
 	try {
 		writeData((await request$1({
 			apiUrl: input.resolved.settings.apiUrl,
-			credential: await toRequestCredential(input.resolved.settings),
+			credential: await toRequestCredential(input.resolved.settings, input.resolved.sources),
 			method: toText(input.flags["method"] ?? "GET").toUpperCase(),
 			path,
 			query,
@@ -2543,7 +2563,7 @@ function toServerReport(metadata) {
 async function toApiReport(resolved, options) {
 	const settings = resolved.settings;
 	try {
-		const credential = options.isHeldOnly ? toHeldCredential(settings) : await toRequestCredential(settings);
+		const credential = options.isHeldOnly ? toHeldCredential(settings, resolved.sources) : await toRequestCredential(settings, resolved.sources);
 		if (!credential) return {
 			checked: false,
 			url: settings.apiUrl,
@@ -2675,7 +2695,7 @@ async function report(error, occasion, resolved) {
 		const settings = resolved ?? toResolved();
 		const status = settings ? await toStatus(settings) : void 0;
 		const secrets = [settings?.settings.apiKey, settings ? toCredential(settings.settings.issuerUrl)?.refreshToken : void 0];
-		return await (await import("./sentry-D5lKx0nm.js")).send({
+		return await (await import("./sentry-CLaeAWNa.js")).send({
 			error,
 			occasion,
 			telemetry,
@@ -2867,7 +2887,7 @@ const REFUSED_COMMANDS = /* @__PURE__ */ new Set([
 	"mcp"
 ]);
 /** The global options, which sit before a command and take a value of their own. */
-const GLOBAL_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set(["--api-url", "--issuer-url"]);
+const GLOBAL_OPTIONS_WITH_VALUES = new Set(GLOBAL_FLAGS.filter((flag) => flag.valueName).map((flag) => `--${flag.name}`));
 /**
 * toCommandName reads which command a call names. A global option sits before it, so
 * reading the first argument alone would let --issuer-url x logout through.
@@ -3153,7 +3173,7 @@ async function runOperation(operation, input) {
 	try {
 		const envelope = await request$1({
 			apiUrl: input.resolved.settings.apiUrl,
-			credential: await toRequestCredential(input.resolved.settings),
+			credential: await toRequestCredential(input.resolved.settings, input.resolved.sources),
 			method: operation.method,
 			path,
 			query: toQuery(operation, input.flags),
@@ -6060,6 +6080,7 @@ async function toExitCode(root, command, args, flags) {
 	try {
 		resolved = toSettings({
 			apiUrl: root.opts()["apiUrl"],
+			apiKey: root.opts()["apiKey"],
 			issuerUrl: root.opts()["issuerUrl"]
 		});
 		return await command.run?.({
@@ -6101,5 +6122,5 @@ async function toReported(error, isJSON, resolved, level = "error") {
 //#endregion
 export { toCli, toParseExitCode, toReported, wasReportAttempted };
 
-//# sourceMappingURL=program-BZW_50HP.js.map
-//# debugId=5c189832-33ce-5032-b0e0-fc3a33cf5b1d
+//# sourceMappingURL=program-B0vISolG.js.map
+//# debugId=ab584cf3-443f-569e-8167-fa0cbab9ab68

package/dist/{scrub-VtQmxap1.js → scrub-BN3gyBpR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9fab3688-8d6c-599c-94b2-64daa75cd233")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3af5060a-b6fe-5f2e-9661-01f4460a7b04")}catch(e){}}();
 import { z } from "zod";
 import { homedir } from "node:os";
 //#region src/command/registry.ts
@@ -17,17 +17,26 @@ function defineCommand(command) {
 	return command;
 }
 /** GLOBAL_FLAGS are the options the CLI takes before any command. */
-const GLOBAL_FLAGS = [{
-	name: "api-url",
-	description: "The API to call, whose host also holds the authorization server",
-	valueName: "url",
-	schema: z.string()
-}, {
-	name: "issuer-url",
-	description: "The authorization server, when it does not sit at the API's host",
-	valueName: "url",
-	schema: z.string()
-}];
+const GLOBAL_FLAGS = [
+	{
+		name: "api-url",
+		description: "The API to call, whose host also holds the authorization server",
+		valueName: "url",
+		schema: z.string()
+	},
+	{
+		name: "api-key",
+		description: "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+		valueName: "key",
+		schema: z.string()
+	},
+	{
+		name: "issuer-url",
+		description: "The authorization server, when it does not sit at the API's host",
+		valueName: "url",
+		schema: z.string()
+	}
+];
 //#endregion
 //#region src/report/scrub.ts
 const REDACTED = "[redacted]";
@@ -109,5 +118,5 @@ function toFlag(flags, word) {
 //#endregion
 export { defineCommand as a, GLOBAL_FLAGS as i, toScrubbed as n, ExitCode as r, toInvocation as t };
 
-//# sourceMappingURL=scrub-VtQmxap1.js.map
-//# debugId=9fab3688-8d6c-599c-94b2-64daa75cd233
+//# sourceMappingURL=scrub-BN3gyBpR.js.map
+//# debugId=3af5060a-b6fe-5f2e-9661-01f4460a7b04

package/dist/{sentry-D5lKx0nm.js → sentry-CLaeAWNa.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a251c173-a448-5d16-93ea-bc9547e82365")}catch(e){}}();
-import { n as toScrubbed } from "./scrub-VtQmxap1.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="853940c3-9e72-566b-ad70-9f043e6aba8d")}catch(e){}}();
+import { n as toScrubbed } from "./scrub-BN3gyBpR.js";
 import { dirname } from "node:path";
 import { request } from "node:http";
 import { fileURLToPath } from "node:url";
@@ -4385,5 +4385,5 @@ function toTags(delivery) {
 //#endregion
 export { send };
 
-//# sourceMappingURL=sentry-D5lKx0nm.js.map
-//# debugId=a251c173-a448-5d16-93ea-bc9547e82365
+//# sourceMappingURL=sentry-CLaeAWNa.js.map
+//# debugId=853940c3-9e72-566b-ad70-9f043e6aba8d

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.1.0-dev.30",
+    "version": "0.1.0-dev.31",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",