@impeccable/reviews 0.1.19 → 0.1.20

package/dist/host-questions.js

@@ -228,6 +228,18 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
+/** On a second Netlify site behind a password, the offer to use the one the person typed for another site of this run (#384); on Skip, the paste screen. */
+export function netlifySamePassword(site, other) {
+    return {
+        id: 'netlify-password-same',
+        kind: 'confirm',
+        title: 'Your Netlify previews are protected',
+        hint: `The previews of the Netlify site ${site} are behind its site password too. The run tries the password you typed for ${other} on ${site}'s preview first, and saves it for ${site} only if it opens.`,
+        prompt: `Use the same password for ${site}?`,
+        confirmLabel: 'Use it',
+        skipLabel: 'Type another',
+    };
+}
 /** The consent to a Vercel bypass secret, naming the project that holds it and, on a repository with several apps, the app whose previews it opens (#358). */
 export function vercelBypassConsent(project, app) {
     const screen = HOST_SCREENS['vercel-bypass'];

package/dist/playbook/cases/preview-protection.md

@@ -13,7 +13,7 @@ impeccable_prove_preview answered a `gate`: the host's own lock stands in front
    - Any other `refused` on Netlify whose `reason` says to prove or try a page a visitor opens, or that the page asks for the app's own sign-in past the lock: the site password (Netlify's own, or the one typed) got past the lock to the app's own sign-in on the page you proved, or Netlify's form did not take it, or Netlify did not answer. Prove a page a visitor opens without signing in, as netlify-previews' step 1 says, and call the tool again; the consent is not asked a second time. Refused again, step 3.
    - Any other `skipped` or `refused`: nothing was saved; `reason` says what stopped it. Step 3.
    - `save-failed`: the setup API did not take it all; `reason` says how far it got. Call the tool once more; when it fails again, step 3, with "Save the Vercel bypass secret on the setup page", "Type the Netlify site password in the app's Settings, under "A way past your host's lock"" or "Save the Cloudflare service token on the setup page" in `left`.
-2. **Check it from Impeccable's side**: impeccable_write to `connection-check` with `{"appKey": "main"}` (on a repository with several apps, the app's own key: the tool saved the key for that app), and report what it answered. Then go on with the case that sent you here: the proof stands, so save the method as vercel-previews', netlify-previews' or cloudflare-previews' step 2 says, Cloudflare's with the tool's `pattern`. Done when the method is saved.
+2. **Check it from Impeccable's side**: impeccable_write to `connection-check` with `{"appKey": "main"}` (on a repository with several apps, the app's own key: the tool saved the key for that app), and report what it answered. A check that answers `access: "auth-wall"` met the lock all the same: say so under "What is not verified", with its `detail`, and never as verified; the last screen does not call the app set up while it stands. Then go on with the case that sent you here: the proof stands, so save the method as vercel-previews', netlify-previews' or cloudflare-previews' step 2 says, Cloudflare's with the tool's `pattern`. Done when the method is saved.
 3. **When nothing was saved**, save no method and set up no other preview, whatever the checkup's `next` says, and open no test drive (pull-requests' "No preview, no test drive"). Say under "What is not verified" that the previews are behind the host's lock, with the tool's `reason`, and name the settings page where the person makes the key, or makes the Netlify site public (the report's bullet below); put the person's one step in `left`, the settings action alone and never running the setup again (for Netlify's site password: "Type the Netlify site password in the app's Settings, under "A way past your host's lock"", and, with the draft test drive open, "Then mark draft #<n> ready", never a bypass key, which Netlify has none of; for Netlify's team login, none: the person was asked in this run, so `left` stays empty and the report names the Visitor access page); end the report's "Not part of this setup" line with the lock the tool met: "Vercel's Deployment Protection in front of the previews", "Netlify's password in front of the previews", "Netlify's team login in front of the previews", or "Cloudflare Access in front of the previews". Done when the report says so.
 
 ### Reference

package/dist/tools.js

@@ -10,7 +10,7 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifySamePassword, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, vercelDeploymentOf } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
@@ -142,7 +142,8 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
-    const lead = !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = report.walled ? `Impeccable's own check of the preview met a wall (${report.walled}), so the test drive's review can't see its pages yet. The report, printed here when this screen closes, says what the run found.`
+        : !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Why a run opened no test drive, as far as what it saved and met tells. */
@@ -159,9 +160,12 @@ export function ending(report) {
     // On a repository with several apps, each locked app's own line says it.
     const step = !report.apps && !report.methodSaved && report.lock ? [LOCKS[report.lock].left] : [];
     const todo = [...new Set([...step, ...apps.todo, ...report.left])];
-    if (report.testPr && !apps.notReady.length)
+    if (report.testPr && !apps.notReady.length && !report.walled)
         return { outcome: 'done', title: "You're all set up", todo, code: 0 };
     const outcome = report.methodSaved ? 'partial' : 'stopped';
+    // Impeccable's own check said it can't get in: whatever the run saved, reviews will meet the same wall (#383).
+    if (report.walled)
+        return { outcome, title: "Not set up: Impeccable's check can't get past the preview's wall", todo: [...new Set([`Open the app's Settings: Impeccable's check met ${report.walled}`, ...todo])], code: 1 };
     if (apps.notReady.length)
         return { outcome, title: `${apps.notReady.join(' and ')} ${apps.notReady.length === 1 ? 'is' : 'are'} not set up`, todo, code: 1 };
     const title = report.methodSaved ? 'No test drive opened' : `Not set up: ${report.lock ? `the previews are behind ${LOCKS[report.lock].lock}` : 'no preview method was saved'}`;
@@ -1692,15 +1696,16 @@ export function createTools(ctx) {
     const bypassOutcomes = new Map();
     /** The stores whose consent was given before the test drive's push, each with the project it named (`<store>/<projectId>`): the call once the gate is met asks no second time for that project alone. */
     const bypassConsented = new Set();
-    /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
-    let sitePassword;
-    const passwordSites = new Set();
+    /**
+     * The Netlify site passwords saved in this run, by site, for the proof of that site's addresses to send; never for the
+     * model. Each is one site's, so it goes only to that site's deploy previews, and a monorepo's sites keep theirs side by
+     * side (#384): with what the tool answered, whether the person typed it, and the apps it is saved for.
+     */
+    const sitePasswords = new Map();
     /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, the team login kept after the retries stays, and a site made public stays public. Another site of the repository is read on its own. */
     const passwordStands = new Map();
     /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
     const passwordConsented = new Set();
-    /** The saved answer, what an address the password opens later gets. */
-    let passwordSaved;
     /** The sites whose last typed password did not open the preview: the paste screen, asked again, says so first (#375). */
     const passwordRefused = new Set();
     /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
@@ -1808,6 +1813,8 @@ export function createTools(ctx) {
     const provenApps = new Set();
     /** The apps whose preview check (connection-check or latest-pull-check) the setup API answered in this run ('' for the repository): a ready app missing here is named on the last screen (#338). */
     const checkedApps = new Set();
+    /** What Impeccable's own last check of each app's preview met where it did not get in ('' for the repository's), until a later check gets in (#383). */
+    const checkWalls = new Map();
     /** On a repository with several apps (#286): the method each app's preview write saved; the host's lock a proof of each app's preview met; and the apps whose lock was met with no key tool called for them since, which holds every other app's steps until it is. */
     const appMethods = new Map();
     const lockMet = new Map();
@@ -2230,6 +2237,9 @@ export function createTools(ctx) {
             const proven = provenApps.has(key);
             if (!pickedApps?.has(key))
                 return { key, name, folder, state: 'unpicked' };
+            // Impeccable's own last check of its preview met a wall: its reviews will meet it too (#383).
+            if (method !== undefined && checkWalls.has(key))
+                return { key, name, folder, state: 'walled', left: `${name}: Impeccable's check of its preview met ${checkWalls.get(key)}; open its Settings.` };
             if (method !== undefined && (method !== 'preview-deploy' || proven)) {
                 // With a test drive open, each app's preview is checked once (pull-requests' step 6): one the setup API never answered is named (#338).
                 return ctx.sync.payload.test_pr && !checkedApps.has(key)
@@ -2251,6 +2261,8 @@ export function createTools(ctx) {
             return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
         if (a.state === 'unset')
             return `- ${where}: not set up. No preview method was saved for it.`;
+        if (a.state === 'walled')
+            return `- ${where}: not set up. Method: ${appMethods.get(a.key)}, but Impeccable's own check of its preview met ${checkWalls.get(a.key)}.`;
         return `- ${where}: not set up this run.`;
     }).join('\n')}`;
     /** Each app's Vercel project, found once a run (a failure is read again, the CLI may have signed in since). */
@@ -2444,6 +2456,16 @@ export function createTools(ctx) {
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
+            if (check && response.ok) {
+                // A login wall the check met is the one the review meets: the run is not called set up while it stands (#383).
+                const key = typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '';
+                const result = object(object(response.data)?.result), pulled = object(object(response.data)?.check);
+                const walled = result?.access === 'auth-wall' || pulled?.outcome === 'sign-in';
+                if (walled)
+                    checkWalls.set(key, typeof result?.detail === 'string' && plainText(result.detail) === result.detail && result.detail.length <= 120 ? `a ${result.detail}` : 'a login wall');
+                else if (result?.access === 'ok' || pulled?.outcome === 'reached')
+                    checkWalls.delete(key);
+            }
             if (target.url.endsWith('/apps') && response.ok && object(p.body)?.action === 'confirm')
                 confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
@@ -2673,7 +2695,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(hosts.length ? { hosts } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -2912,7 +2934,7 @@ export function createTools(ctx) {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
                 ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
-                ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
+                ...(site && sitePasswords.has(site) ? { password: sitePasswords.get(site).value } : {}),
                 ...(token ? { access: token } : {}),
             });
             // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
@@ -2923,6 +2945,14 @@ export function createTools(ctx) {
             }
             // On a repository with several apps, the app the address was listed for: its proof, its lock and its key are that app's alone (#281).
             const app = listedApps.get(origin);
+            // A site's password opened the preview of an app it was not saved for (another app built from the same site): it is saved as that app's own before the proof stands, since that app's reviews read its own (#384).
+            const held = site ? sitePasswords.get(site) : undefined;
+            if (proof.proven && held && app && !held.apps.has(app.appKey)) {
+                const saved = await saveLock(pi, 'password', { method: 'password', site: site }, held.value, app.appKey);
+                if (saved.failed)
+                    return JSON.stringify({ proven: false, status: proof.status, appKey: app.appKey, reason: `The site's password opened the preview, but it is not saved for this app: ${saved.failed} Prove this address again to save it.` });
+                held.apps.add(app.appKey);
+            }
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
@@ -3279,7 +3309,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(outcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, signed in with Netlify\'s site password on Netlify\'s own form, as reviews sign in (no request header carries it). It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, signed in with Netlify\'s site password on Netlify\'s own form, as reviews sign in (no request header carries it). It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one (after one offering the password the person typed for another site of this run, where there is one); opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
@@ -3307,12 +3337,20 @@ export function createTools(ctx) {
             }
             else if (stands)
                 return JSON.stringify(stands);
-            // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
-            if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
+            // A password in hand already: another deploy preview of the same site opens with it, and another app built from the same site gets it saved as its own. Another site's lock is read for that site.
+            const held = sitePasswords.get(site);
+            if (held && (await prove(held.value)).proven) {
+                const store = at.app?.appKey ?? '';
+                if (!held.apps.has(store)) {
+                    const saved = await saveLock(pi, 'password', { method: 'password', site }, held.value, at.app?.appKey);
+                    if (saved.failed)
+                        return JSON.stringify({ status: 'save-failed', site, protection: 'password', reason: saved.failed });
+                    held.apps.add(store);
+                }
                 provePattern(pattern, at.app?.appKey);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
-                return JSON.stringify(passwordSaved);
+                return JSON.stringify(held.saved);
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
@@ -3342,6 +3380,12 @@ export function createTools(ctx) {
                     return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
                 },
                 paste: async () => {
+                    // One password for several sites is common: the one typed for another site of this run is offered first, once, never after it was refused here (#384).
+                    const other = passwordRefused.has(site) ? undefined : [...sitePasswords].find(([name, h]) => name !== site && h.typed);
+                    if (other && !(await ask(netlifySamePassword(site, other[0]))).skipped) {
+                        typed = true;
+                        return other[1].value;
+                    }
                     const screen = sentTo(HOST_SCREENS['netlify-password-key'], at.url);
                     const answer = await ask(passwordRefused.has(site) ? { ...screen, prompt: `The password typed last didn't open the preview on Netlify's form, so nothing was saved. Check it and type it again. ${screen.prompt}` } : screen);
                     typed = !answer.skipped;
@@ -3378,23 +3422,18 @@ export function createTools(ctx) {
                 provePattern(pattern, at.app?.appKey);
             }
             if (value) {
-                // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
-                sitePassword = value;
-                passwordSites.clear();
-                passwordSites.add(site);
+                // What is in hand follows the store: the password saved now is this site's, beside every other site's.
+                sitePasswords.set(site, { value, saved: passwordOutcome, typed: told.password === 'typed', apps: new Set([at.app?.appKey ?? '']) });
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
                 usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 provePattern(pattern, at.app?.appKey);
-                passwordSaved = passwordOutcome;
             }
             else if (told.status === 'save-failed' && stored) {
-                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through.
-                sitePassword = undefined;
-                passwordSites.clear();
-                passwordSaved = undefined;
+                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands for this site until a save goes through.
+                sitePasswords.delete(site);
             }
             return JSON.stringify(passwordOutcome);
         }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,