@jacebenson/jsn 4.2.3 → 4.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {

package/src/auth.js

@@ -271,6 +271,25 @@ function askHidden(promptText) {
   return passwordPrompt({ message: promptText });
 }
 
+/**
+ * Extract the browser session token and cookies from pasted DevTools headers
+ * or a "Copy as cURL" command. Only these two values are retained.
+ */
+export function parseBrowserSessionInput(input) {
+  const text = String(input || '');
+  const tokenMatch = text.match(/(?:x-usertoken|x-user-token)\s*:\s*([^\s'";,]+)/i);
+  const cookieArgMatch = text.match(/(?:^|\s)(?:-b|--cookie)\s+(['"])(.*?)\1/s);
+  const quotedCookieMatch = text.match(/cookie\s*:\s*(['"])(.*?)\1/i);
+  const plainCookieMatch = text.match(/cookie\s*:\s*([^\r\n]+)/i);
+  const token = tokenMatch?.[1]?.trim() || '';
+  const cookies = (cookieArgMatch?.[2] || quotedCookieMatch?.[2] || plainCookieMatch?.[1] || '')
+    .trim()
+    .replace(/['"`]\s*(?:\\\s*)?$/, '');
+  if (!token) throw errAuth('No X-UserToken header found');
+  if (!cookies) throw errAuth('No Cookie header found. Paste the complete request headers or cURL command.');
+  return { auth_method: 'gck', access_token: token, cookies, auth_source: 'gck' };
+}
+
 export class AuthManager {
   /**
    * @param {object} identity — the resolved-identity provider. Production
@@ -369,6 +388,9 @@ export class AuthManager {
     if (creds.auth_method === 'basic') {
       return Boolean(creds.username && creds.password);
     }
+    if (creds.auth_method === 'gck') {
+      return Boolean(creds.access_token && creds.cookies);
+    }
     if (creds.expires_at && Date.now() >= creds.expires_at * 1000) return false;
     return !!creds.access_token;
   }
@@ -510,6 +532,13 @@ export class AuthManager {
    * Complete login using an authorization code obtained from a prior buildAuthURL() call.
    * The PKCE state must have been saved by an earlier buildAuthURL() call.
    */
+  async loginWithGck(instanceURL, input, username = this._activeUsername()) {
+    instanceURL = normalizeInstanceURL(instanceURL);
+    const creds = parseBrowserSessionInput(input);
+    saveCredentials(instanceURL, { ...creds, username: username || undefined }, username || undefined);
+    return { ...creds, username: username || undefined };
+  }
+
   async loginWithCode(instanceURL, code) {
     instanceURL = normalizeInstanceURL(instanceURL);
     const clientID = getOAuthClientID();

package/src/commands/auth.js

@@ -94,6 +94,13 @@ export function shouldUseBasicAuth(argv = {}, cfg = {}, instanceURL = '') {
   );
 }
 
+export function shouldUseGckAuth(argv = {}, cfg = {}, instanceURL = '') {
+  if (argv.gck || argv.headers) return true;
+  return Object.values(cfg.profiles || {}).some(profile =>
+    profile.instance_url === instanceURL && profile.auth_method === 'gck'
+  );
+}
+
 /**
  * Pick a profile by name — interactive search picker when ambiguous,
  * auto-selects when there's exactly one, throws when none configured.
@@ -129,6 +136,46 @@ export function resolveWizardInstance(app, argv = {}) {
   return process.env.SERVICENOW_INSTANCE_URL || app._overrideInstance || argv.instance || '';
 }
 
+export async function readBrowserSessionInput() {
+  const stdin = process.stdin;
+  console.log('Paste the complete cURL command, then press Ctrl+D:');
+  if (!stdin.isTTY || typeof stdin.setRawMode !== 'function') {
+    const chunks = [];
+    for await (const chunk of stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString();
+  }
+
+  return new Promise((resolve, reject) => {
+    let pasted = '';
+    const finish = () => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.removeListener('data', onData);
+      stdin.removeListener('error', onError);
+      process.stdout.write('\n');
+    };
+    const onError = (err) => { finish(); reject(err); };
+    const onData = (chunk) => {
+      const text = chunk.toString();
+      const eof = text.indexOf('\x04');
+      if (eof !== -1) {
+        pasted += text.slice(0, eof);
+        finish();
+        resolve(pasted);
+      } else if (text.includes('\x03')) {
+        finish();
+        reject(new Error('Browser session input cancelled'));
+      } else {
+        pasted += text;
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on('data', onData);
+    stdin.on('error', onError);
+  });
+}
+
 /**
  * Interactive first-run wizard (formerly `jsn setup`).
  *
@@ -139,7 +186,7 @@ export function resolveWizardInstance(app, argv = {}) {
  */
 export async function loginWizard(app, argv = {}) {
   const readline = (await import('node:readline')).default;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
 
   console.log('Welcome to JSN - ServiceNow CLI');
@@ -174,8 +221,9 @@ export async function loginWizard(app, argv = {}) {
     profile.skip_confirmations = true;
   }
 
-  const authMethod = await ask('Authentication method (OAuth/Basic) [OAuth]: ');
-  const useBasic = authMethod.toLowerCase().startsWith('b');
+  const authMethod = await ask('Authentication method (OAuth/Basic/Browser session) [OAuth]: ');
+  const useGck = authMethod.toLowerCase().startsWith('g') || authMethod.toLowerCase().startsWith('browser');
+  const useBasic = !useGck && authMethod.toLowerCase().startsWith('b');
 
   let loggedIn = false;
   if (useBasic) {
@@ -192,6 +240,12 @@ export async function loginWizard(app, argv = {}) {
     }
     profile.username = username;
     profile.auth_method = 'basic';
+  } else if (useGck) {
+    rl.close();
+    const input = await readBrowserSessionInput();
+    await app.auth.loginWithGck(instance, input);
+    profile.auth_method = 'gck';
+    loggedIn = true;
   } else {
     profile.auth_method = 'oauth';
   }
@@ -205,6 +259,11 @@ export async function loginWizard(app, argv = {}) {
   // so a piped/scripted call never blocks on prompts.
   const { canPrompt } = await import('../helpers.js');
   if (canPrompt()) {
+    // @inquirer/prompts owns stdin while these confirmations run. Close the
+    // older readline interface before handing stdin to Inquirer. This matters
+    // on Windows Git Bash: leaving both readers attached can make the later
+    // OAuth question see EOF and let Node exit instead of waiting for input.
+    rl.close();
     const { confirm } = await import('@inquirer/prompts');
     profile.read_only = await confirm({ message: 'Read-only profile (blocks mutation commands)?', default: profile.read_only || false });
     profile.skip_confirmations = await confirm({ message: 'Skip confirmations (deletes run without prompting)?', default: profile.skip_confirmations || false });
@@ -214,7 +273,10 @@ export async function loginWizard(app, argv = {}) {
 
   await saveConfig(app.config);
 
-  if (!useBasic) {
+  if (!useBasic && !useGck) {
+    // Recreate readline after Inquirer has released stdin. Do not reuse the
+    // interface that was open before the confirmation prompts.
+    rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const loginNow = await ask('Login now? [Y/n]: ');
     rl.close();
     if (!loginNow || loginNow.toLowerCase() !== 'n') {

package/src/sdk.js

@@ -47,6 +47,10 @@ export class SDKClient {
       case 'oauth':
         req.headers.set('Authorization', `Bearer ${creds.access_token}`);
         break;
+      case 'gck':
+        req.headers.set('X-UserToken', creds.access_token);
+        if (creds.cookies) req.headers.set('Cookie', creds.cookies);
+        break;
       default:
         if (creds.username && creds.password) {
           req.headers.set('Authorization', 'Basic ' + Buffer.from(`${creds.username}:${creds.password}`).toString('base64'));