@itphx/synth-core 0.2.0 → 0.4.4

package/dist/remote/connection.js

@@ -0,0 +1,298 @@
+// RemoteConnection — менеджер runtime-подключения к удалённому backend для гибридного режима.
+//
+// Отличие от RemoteSession (который при отсутствии credentials уходит в интерактивный
+// device flow): сервер стартует «холодным», без подключения, а пользователь логинится
+// в UI (connectByPassword, ROPC). OIDC-параметры локальный core узнаёт с самого сервера
+// (GET {server}/auth/oidc-meta); для старых серверов без эндпоинта есть fallback на
+// deps.defaultIssuer/defaultClientId.
+//
+// Никакого device flow в этом модуле нет: только логин/пароль и сохранённые credentials.
+import { RemoteError } from './types.js';
+import { loadCredentials, saveCredentials, listCredentials } from './credentials.js';
+import { refreshAccessToken } from './device-flow.js';
+import { RemoteSession } from './session.js';
+/** Таймаут GET {server}/auth/oidc-meta по умолчанию. */
+const DEFAULT_OIDC_META_TIMEOUT_MS = 15_000;
+/** Обрезать завершающие слэши у адреса сервера. */
+function normalizeBaseUrl(url) {
+    return url.trim().replace(/\/+$/, '');
+}
+/** Токен протух, если expiresAt задан и не позже текущего момента. */
+function isTokenExpired(expiresAt) {
+    if (!expiresAt)
+        return false;
+    const ts = Date.parse(expiresAt);
+    if (Number.isNaN(ts))
+        return false;
+    return ts <= Date.now();
+}
+export class RemoteConnection {
+    deps;
+    _backendUrl = null;
+    _session = null;
+    _user = null;
+    /** Последний использованный issuer (для UI/логов). */
+    _issuer = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    // ── Состояние ──
+    /** true когда есть валидная сессия (токен получен). */
+    get connected() {
+        return this._session !== null;
+    }
+    get backendUrl() {
+        return this._backendUrl;
+    }
+    get client() {
+        return this._session?.getClient() ?? null;
+    }
+    get getToken() {
+        return this._session ? () => this._session.getToken() : null;
+    }
+    get user() {
+        return this._user;
+    }
+    get issuer() {
+        return this._issuer;
+    }
+    // ── Дискавери ──
+    /**
+     * Спросить у сервера его OIDC issuer + public client_id (GET {server}/auth/oidc-meta).
+     * - enabled:false → RemoteError('AUTH') — сервер не принимает вход по логину/паролю;
+     * - эндпоинт отсутствует (404/5xx) → fallback на deps.defaultIssuer/defaultClientId,
+     *   при их отсутствии — RemoteError('AUTH');
+     * - сеть недоступна → fallback на deps.defaultIssuer/defaultClientId,
+     *   при их отсутствии — RemoteError('OFFLINE').
+     */
+    async discoverOidc(serverUrl) {
+        const base = normalizeBaseUrl(serverUrl);
+        const fallback = this.deps.defaultIssuer && this.deps.defaultClientId
+            ? { issuer: this.deps.defaultIssuer, clientId: this.deps.defaultClientId }
+            : null;
+        let res;
+        try {
+            res = await fetch(`${base}/auth/oidc-meta`, {
+                signal: AbortSignal.timeout(this.deps.timeoutMs ?? DEFAULT_OIDC_META_TIMEOUT_MS),
+            });
+        }
+        catch {
+            if (fallback)
+                return { ...fallback };
+            throw new RemoteError(`Сервер недоступен: не удалось получить OIDC-параметры (${base})`, 'OFFLINE');
+        }
+        let body = {};
+        try {
+            body = (await res.json());
+        }
+        catch {
+            // не-JSON тело — ошибку сформируем по статусу ниже
+        }
+        if (body.enabled === false) {
+            throw new RemoteError('Сервер не поддерживает вход по логину/паролю', 'AUTH');
+        }
+        if (!res.ok) {
+            // Старый сервер без эндпоинта (404) или ошибка сервера — fallback на дефолты.
+            if (fallback)
+                return { ...fallback };
+            throw new RemoteError(`Сервер не отдал OIDC-параметры (HTTP ${res.status})`, 'AUTH');
+        }
+        const issuer = typeof body.issuer === 'string' ? body.issuer : undefined;
+        const clientId = typeof body.clientId === 'string' ? body.clientId : undefined;
+        if (!issuer || !clientId) {
+            throw new RemoteError('Сервер вернул некорректные OIDC-параметры', 'AUTH');
+        }
+        return { issuer, clientId };
+    }
+    // ── Подключение ──
+    /**
+     * Полное подключение: serverUrl → discoverOidc → RemoteSession.loginWithPassword.
+     * Обновляет _backendUrl/_session/_user/_issuer только после успешного входа,
+     * так что наружу не уходят частичные состояния. Ошибки пароля приходят из
+     * loginWithPassword как RemoteError('AUTH') и пробрасываются с русским сообщением.
+     */
+    async connectByPassword(serverUrl, username, password) {
+        const backendUrl = normalizeBaseUrl(serverUrl);
+        const { issuer, clientId } = await this.discoverOidc(backendUrl);
+        const session = await RemoteSession.loginWithPassword({
+            backendUrl,
+            issuer,
+            clientId,
+            credentialsPath: this.deps.credentialsPath,
+            timeoutMs: this.deps.timeoutMs,
+        }, username, password);
+        // loginWithPassword уже пробовал получить user из /auth/status; если сервер не
+        // ответил — делаем ещё одну попытку. Без профиля (id/roles) RemoteUser не собрать,
+        // поэтому соединение не фиксируем.
+        const user = session.user ?? (await this._fetchUserBestEffort(session));
+        if (!user) {
+            throw new RemoteError('Удалённый сервер не ответил профилем пользователя после входа', 'AUTH');
+        }
+        this._backendUrl = backendUrl;
+        this._session = session;
+        this._user = user;
+        this._issuer = issuer;
+        return user;
+    }
+    /**
+     * Подключение по API-ключу (authType='api_key', без дискавери OIDC).
+     * Используется для машинного входа (`serve --token` / CLI-автоматизация):
+     * никакого device flow, issuer не нужен. Сессия строится сразу, после чего
+     * best-effort запрашивается серверный пользователь (GET /auth/status).
+     * Если профиль не получить — подключение не фиксируется.
+     */
+    async connectWithApiKey(serverUrl, apiKey) {
+        const backendUrl = normalizeBaseUrl(serverUrl);
+        if (!apiKey) {
+            throw new RemoteError('Для подключения по API-ключу укажите ключ (--token)', 'AUTH');
+        }
+        const session = await RemoteSession.ensureAuthenticated({
+            backendUrl,
+            authType: 'api_key',
+            apiKey,
+            credentialsPath: this.deps.credentialsPath,
+            timeoutMs: this.deps.timeoutMs,
+        });
+        const user = session.user ?? (await this._fetchUserBestEffort(session));
+        if (!user) {
+            throw new RemoteError('Удалённый сервер не ответил профилем пользователя после подключения', 'AUTH');
+        }
+        this._backendUrl = backendUrl;
+        this._session = session;
+        this._user = user;
+        this._issuer = null;
+        return user;
+    }
+    /**
+     * Неинтерактивное подключение по сохранённым credentials (старт/авто-логин).
+     * Не запускает device flow! Если credentials нет или протухли без refresh —
+     * возвращает null (не бросает). Если backendUrl не передан — ищет по всем
+     * сохранённым credentials (порядок файла).
+     */
+    async connectFromSaved(backendUrl) {
+        const candidates = [];
+        if (backendUrl) {
+            candidates.push(normalizeBaseUrl(backendUrl));
+        }
+        else if (this._backendUrl) {
+            candidates.push(this._backendUrl);
+        }
+        else {
+            candidates.push(...(await listCredentials(this.deps.credentialsPath)));
+        }
+        for (const url of candidates) {
+            const user = await this._tryConnectFromSaved(url);
+            if (user)
+                return user;
+        }
+        return null;
+    }
+    /** Полный сброс runtime-состояния (провайдер/event bridge чистит вызывающий). */
+    disconnect() {
+        this._session = null;
+        this._user = null;
+        this._backendUrl = null;
+        this._issuer = null;
+    }
+    // ── Приватные помощники ──
+    /** Попытка подключиться к одному backendUrl по сохранённым credentials. */
+    async _tryConnectFromSaved(backendUrl) {
+        let creds = null;
+        try {
+            creds = await loadCredentials(backendUrl, this.deps.credentialsPath);
+        }
+        catch {
+            return null;
+        }
+        if (!creds?.accessToken)
+            return null;
+        const expired = isTokenExpired(creds.expiresAt);
+        let issuer;
+        let clientId;
+        if (expired) {
+            // Протух + есть refreshToken → дискавери (или deps.default*) и refresh.
+            if (!creds.refreshToken)
+                return null;
+            try {
+                const meta = await this.discoverOidc(backendUrl);
+                issuer = meta.issuer;
+                clientId = meta.clientId;
+                const refreshed = await refreshAccessToken(issuer, clientId, creds.refreshToken);
+                const updated = {
+                    backendUrl,
+                    accessToken: refreshed.accessToken,
+                    refreshToken: refreshed.refreshToken ?? creds.refreshToken,
+                    expiresAt: refreshed.expiresIn
+                        ? new Date(Date.now() + refreshed.expiresIn * 1000).toISOString()
+                        : undefined,
+                    user: creds.user,
+                };
+                await saveCredentials(updated, this.deps.credentialsPath);
+            }
+            catch {
+                // дискавери/refresh не удались (сеть, OIDC выключен, invalid_grant) — не авто-логинимся
+                return null;
+            }
+        }
+        else {
+            // Валидный accessToken: issuer/clientId нужны для runtime-refresh (getToken).
+            // Дискавери best-effort (внутри — fallback на deps.default*); при неудаче сессия
+            // всё равно строится, но авто-refresh в рантайме будет недоступен.
+            try {
+                const meta = await this.discoverOidc(backendUrl);
+                issuer = meta.issuer;
+                clientId = meta.clientId;
+            }
+            catch {
+                issuer = this.deps.defaultIssuer;
+                clientId = this.deps.defaultClientId;
+            }
+        }
+        // На диске теперь валидные credentials → ensureAuthenticated выйдет на ветке
+        // «сохранённый accessToken действителен» и НЕ запустит device flow.
+        let session;
+        try {
+            session = await RemoteSession.ensureAuthenticated({
+                backendUrl,
+                issuer,
+                clientId,
+                credentialsPath: this.deps.credentialsPath,
+                timeoutMs: this.deps.timeoutMs,
+            });
+        }
+        catch {
+            return null;
+        }
+        // Обновить _user из /auth/status (best-effort; при недоступности сервера
+        // getAuthStatus сам возвращает connected:false).
+        let user = session.user ?? null;
+        try {
+            const status = await session.getAuthStatus();
+            if (status.connected && status.user) {
+                user = { id: status.user.id, username: status.user.username, roles: status.user.roles };
+            }
+        }
+        catch {
+            // оставляем user из credentials
+        }
+        this._backendUrl = backendUrl;
+        this._session = session;
+        this._user = user;
+        this._issuer = issuer ?? null;
+        return user;
+    }
+    /** Единичная best-effort попытка получить серверного пользователя. */
+    async _fetchUserBestEffort(session) {
+        try {
+            const status = await session.getClient().getAuthStatus();
+            if (status.user) {
+                return { id: status.user.id, username: status.user.username, roles: status.user.roles };
+            }
+        }
+        catch {
+            // best-effort
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=connection.js.map

package/dist/remote/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/remote/connection.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,EAAE;AACF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,oFAAoF;AACpF,sCAAsC;AACtC,EAAE;AACF,yFAAyF;AAIzF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,wDAAwD;AACxD,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,mDAAmD;AACnD,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,sEAAsE;AACtE,SAAS,cAAc,CAAC,SAAkB;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC1B,CAAC;AAUD,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAuB;IAE5B,WAAW,GAAkB,IAAI,CAAC;IAClC,QAAQ,GAAyB,IAAI,CAAC;IACtC,KAAK,GAAsB,IAAI,CAAC;IACxC,sDAAsD;IAC9C,OAAO,GAAkB,IAAI,CAAC;IAEtC,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,kBAAkB;IAElB,uDAAuD;IACvD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,kBAAkB;IAElB;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe;YAClD,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAC1E,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,iBAAiB,EAAE;gBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,4BAA4B,CAAC;aACjF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,QAAQ;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,WAAW,CAAC,0DAA0D,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CAAC,8CAA8C,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,8EAA8E;YAC9E,IAAI,QAAQ;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,WAAW,CAAC,wCAAwC,GAAG,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CAAC,2CAA2C,EAAE,MAAM,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,oBAAoB;IAEpB;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,QAAgB,EAAE,QAAgB;QAC3E,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,iBAAiB,CACnD;YACE,UAAU;YACV,MAAM;YACN,QAAQ;YACR,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;SAC/B,EACD,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,+EAA+E;QAC/E,mFAAmF;QACnF,mCAAmC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,+DAA+D,EAAE,MAAM,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,MAAc;QACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,WAAW,CAAC,qDAAqD,EAAE,MAAM,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC;YACtD,UAAU;YACV,QAAQ,EAAE,SAAS;YACnB,MAAM;YACN,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;SAC/B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,WAAW,CAAC,qEAAqE,EAAE,MAAM,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAmB;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,UAAU;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,4BAA4B;IAE5B,2EAA2E;IACnE,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QACnD,IAAI,KAAK,GAA6B,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,WAAW;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAA4B,CAAC;QAEjC,IAAI,OAAO,EAAE,CAAC;YACZ,wEAAwE;YACxE,IAAI,CAAC,KAAK,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACzB,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;gBACjF,MAAM,OAAO,GAAsB;oBACjC,UAAU;oBACV,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY;oBAC1D,SAAS,EAAE,SAAS,CAAC,SAAS;wBAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;wBACjE,CAAC,CAAC,SAAS;oBACb,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB,CAAC;gBACF,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,wFAAwF;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,iFAAiF;YACjF,mEAAmE;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBACjC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YACvC,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC;gBAChD,UAAU;gBACV,MAAM;gBACN,QAAQ;gBACR,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;aACA,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,IAAI,GAAsB,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,oBAAoB,CAAC,OAAsB;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/remote/connection.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connection.test.d.ts.map

package/dist/remote/connection.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.test.d.ts","sourceRoot":"","sources":["../../src/remote/connection.test.ts"],"names":[],"mappings":""}

package/dist/remote/connection.test.js

@@ -0,0 +1,323 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { RemoteConnection } from './connection.js';
+import { saveCredentials, loadCredentials } from './credentials.js';
+import { RemoteError } from './types.js';
+function jsonResponse(data, status = 200) {
+    return new Response(JSON.stringify(data), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+const BACKEND = 'https://backend.test';
+const ISSUER = 'https://kc.test/realms/synth';
+const CLIENT_ID = 'synth-cli';
+const OIDC_DISCOVERY = {
+    issuer: ISSUER,
+    token_endpoint: `${ISSUER}/protocol/openid-connect/token`,
+    device_authorization_endpoint: `${ISSUER}/protocol/openid-connect/auth/device`,
+};
+const SERVER_USER = { id: 'u-1', username: 'lucky', roles: ['ADMIN', 'USER'] };
+/**
+ * fetch-мок успешного ROPC-входа: дискавери OIDC-меты на backend, token-грант
+ * (grant_type=password) на Keycloak, /auth/status с серверным пользователем.
+ */
+function passwordFlowFetchMock(overrides = {}) {
+    const { tokenStatus = 200, tokenBody } = overrides;
+    return vi.fn((url) => {
+        const u = String(url);
+        if (u.includes('/auth/oidc-meta')) {
+            return Promise.resolve(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        }
+        if (u.includes('/protocol/openid-connect/token')) {
+            if (tokenStatus !== 200) {
+                return Promise.resolve(jsonResponse(tokenBody ?? { error: 'invalid_grant' }, tokenStatus));
+            }
+            return Promise.resolve(jsonResponse(tokenBody ?? {
+                access_token: 'at-ropc',
+                refresh_token: 'rt-ropc',
+                expires_in: 300,
+            }));
+        }
+        if (u.includes('/auth/status')) {
+            return Promise.resolve(jsonResponse({ authenticated: true, oidc_enabled: true, user: SERVER_USER }));
+        }
+        return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+    });
+}
+/** fetch-мок для connectFromSaved по протухшим credentials: oidc-meta + refresh-грант + status. */
+function refreshFlowFetchMock() {
+    return vi.fn((url, init) => {
+        const u = String(url);
+        if (u.includes('/auth/oidc-meta')) {
+            return Promise.resolve(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        }
+        if (u.includes('.well-known/openid-configuration')) {
+            return Promise.resolve(jsonResponse(OIDC_DISCOVERY));
+        }
+        if (u.includes('/protocol/openid-connect/token')) {
+            const body = init?.body instanceof URLSearchParams ? init.body : null;
+            if (body?.get('grant_type') === 'refresh_token') {
+                return Promise.resolve(jsonResponse({
+                    access_token: 'at-refreshed',
+                    refresh_token: 'rt-refreshed',
+                    expires_in: 3600,
+                }));
+            }
+        }
+        if (u.includes('/auth/status')) {
+            return Promise.resolve(jsonResponse({ authenticated: true, oidc_enabled: true, user: SERVER_USER }));
+        }
+        return Promise.resolve(jsonResponse({ error: 'not_found' }, 404));
+    });
+}
+afterEach(() => {
+    vi.unstubAllGlobals();
+});
+describe('RemoteConnection.discoverOidc', () => {
+    it('сервер вернул {enabled:true, issuer, clientId} → возвращает их; адрес без завершающего /', async () => {
+        const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ enabled: true, issuer: ISSUER, clientId: CLIENT_ID }));
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({});
+        const meta = await conn.discoverOidc('https://backend.test/');
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+        expect(fetchMock).toHaveBeenCalledWith('https://backend.test/auth/oidc-meta', expect.objectContaining({ signal: expect.anything() }));
+    });
+    it('enabled:false → RemoteError(AUTH) с русским сообщением', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ enabled: false })));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(err.message).toContain('не поддерживает вход по логину/паролю');
+    });
+    it('404 + deps.defaultIssuer/defaultClientId → fallback на дефолты', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ error: 'not_found' }, 404)));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const meta = await conn.discoverOidc(BACKEND);
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+    });
+    it('404 без fallback → RemoteError(AUTH)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ error: 'not_found' }, 404)));
+        const conn = new RemoteConnection({});
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+    });
+    it('сеть недоступна + fallback есть → возвращает дефолты', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({ defaultIssuer: ISSUER, defaultClientId: CLIENT_ID });
+        const meta = await conn.discoverOidc(BACKEND);
+        expect(meta).toEqual({ issuer: ISSUER, clientId: CLIENT_ID });
+    });
+    it('сеть недоступна без fallback → RemoteError(OFFLINE)', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({});
+        const err = await conn.discoverOidc(BACKEND).catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('OFFLINE');
+    });
+});
+describe('RemoteConnection.connectByPassword', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    function credsPath() {
+        return join(dir, 'credentials.json');
+    }
+    it('успех: connected, user из /auth/status, client не null, backendUrl без завершающего /', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectByPassword('https://backend.test/', 'lucky', 'secret');
+        expect(user).toEqual(SERVER_USER);
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.user?.username).toBe('lucky');
+        expect(conn.issuer).toBe(ISSUER);
+        expect(conn.getToken).not.toBeNull();
+        expect(await conn.getToken?.()).toBe('at-ropc');
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-ropc');
+        expect(saved?.user?.username).toBe('lucky');
+    });
+    it('неверный пароль → RemoteError(AUTH), connected:false, состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock({
+            tokenStatus: 401,
+            tokenBody: { error: 'invalid_grant', error_description: 'Invalid user credentials' },
+        }));
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const err = await conn.connectByPassword(BACKEND, 'lucky', 'wrong').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(err.message).toContain('Неверный логин или пароль');
+        expect(conn.connected).toBe(false);
+        expect(conn.user).toBeNull();
+        expect(conn.backendUrl).toBeNull();
+        expect(conn.client).toBeNull();
+        // credentials не сохраняются при ошибке
+        expect(await loadCredentials(BACKEND, credsPath())).toBeNull();
+    });
+});
+describe('RemoteConnection.connectWithApiKey', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-apikey-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it('успех: connected, user из /auth/status, issuer null (без дискавери)', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: join(dir, 'credentials.json') });
+        const user = await conn.connectWithApiKey('https://backend.test/', 'api-key-1');
+        expect(user).toEqual(SERVER_USER);
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.user?.username).toBe('lucky');
+        expect(conn.issuer).toBeNull();
+        expect(await conn.getToken?.()).toBe('api-key-1');
+        // api_key-сессия ничего не пишет в credentials (это не OAuth-токен)
+        expect(await loadCredentials(BACKEND, join(dir, 'credentials.json'))).toBeNull();
+    });
+    it('пустой ключ → RemoteError(AUTH)', async () => {
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, '').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(conn.connected).toBe(false);
+    });
+    it('backend не отдаёт профиль (/auth/status без user) → RemoteError(AUTH), состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue(jsonResponse({ authenticated: true, oidc_enabled: true, user: null })));
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, 'api-key-1').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(err.code).toBe('AUTH');
+        expect(conn.connected).toBe(false);
+        expect(conn.backendUrl).toBeNull();
+    });
+    it('backend недоступен (сеть) → RemoteError(AUTH), состояние не фиксируется', async () => {
+        vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new TypeError('Failed to fetch')));
+        const conn = new RemoteConnection({});
+        const err = await conn.connectWithApiKey(BACKEND, 'api-key-1').catch((e) => e);
+        expect(err).toBeInstanceOf(RemoteError);
+        expect(conn.connected).toBe(false);
+        expect(conn.client).toBeNull();
+    });
+});
+describe('RemoteConnection.connectFromSaved', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-saved-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    function credsPath() {
+        return join(dir, 'credentials.json');
+    }
+    function validCreds(overrides = {}) {
+        return {
+            backendUrl: BACKEND,
+            accessToken: 'at-valid',
+            refreshToken: 'rt-1',
+            expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+            user: { id: 'u-saved', username: 'admin', roles: ['ADMIN'] },
+            ...overrides,
+        };
+    }
+    it('без credentials → null, connected:false, fetch не вызывался (нет device flow)', async () => {
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user).toBeNull();
+        expect(conn.connected).toBe(false);
+        expect(conn.user).toBeNull();
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('валидный accessToken в credentials → connected, user обновлён с /auth/status', async () => {
+        await saveCredentials(validCreds(), credsPath());
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+        expect(conn.client).not.toBeNull();
+        expect(conn.issuer).toBe(ISSUER);
+        // токен не обновлялся — в файле остался исходный
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-valid');
+    });
+    it('протухший accessToken + refreshToken → дискавери + refresh, connected, credentials обновлены', async () => {
+        await saveCredentials(validCreds({
+            accessToken: 'at-old',
+            refreshToken: 'rt-old',
+            expiresAt: '2020-01-01T00:00:00.000Z',
+            user: { id: 'u-saved', username: 'admin', roles: ['ADMIN'] },
+        }), credsPath());
+        vi.stubGlobal('fetch', refreshFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.issuer).toBe(ISSUER);
+        const saved = await loadCredentials(BACKEND, credsPath());
+        expect(saved?.accessToken).toBe('at-refreshed');
+        expect(saved?.refreshToken).toBe('rt-refreshed');
+    });
+    it('backendUrl не передан → берёт сохранённые credentials из файла', async () => {
+        await saveCredentials(validCreds(), credsPath());
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved();
+        expect(user?.username).toBe('lucky');
+        expect(conn.connected).toBe(true);
+        expect(conn.backendUrl).toBe(BACKEND);
+    });
+    it('протух без refreshToken → null, connected:false', async () => {
+        await saveCredentials(validCreds({
+            accessToken: 'at-old',
+            expiresAt: '2020-01-01T00:00:00.000Z',
+            refreshToken: undefined,
+        }), credsPath());
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+        const conn = new RemoteConnection({ credentialsPath: credsPath() });
+        const user = await conn.connectFromSaved(BACKEND);
+        expect(user).toBeNull();
+        expect(conn.connected).toBe(false);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+});
+describe('RemoteConnection.disconnect', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-conn-disc-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it('сбрасывает состояние: connected:false, client null, user null, backendUrl null', async () => {
+        vi.stubGlobal('fetch', passwordFlowFetchMock());
+        const conn = new RemoteConnection({ credentialsPath: join(dir, 'credentials.json') });
+        await conn.connectByPassword(BACKEND, 'lucky', 'secret');
+        expect(conn.connected).toBe(true);
+        conn.disconnect();
+        expect(conn.connected).toBe(false);
+        expect(conn.client).toBeNull();
+        expect(conn.getToken).toBeNull();
+        expect(conn.user).toBeNull();
+        expect(conn.backendUrl).toBeNull();
+        expect(conn.issuer).toBeNull();
+    });
+});
+//# sourceMappingURL=connection.test.js.map