@jacebenson/jsn 4.3.10 → 4.3.11-dev.69

package/bin/jsn.js

@@ -21,4 +21,10 @@ process.emitWarning = function emitWarning(warning, ...args) {
   return originalEmitWarning.apply(this, [warning, ...args]);
 };
 
-import('../src/cli.js').then((m) => m.cli.parse());
+import('../src/cli.js').then(async (m) => {
+  try {
+    await m.cli.parse();
+  } finally {
+    m.cancelBackgroundChecks();
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "4.3.10",
+  "version": "4.3.11-dev.69",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "main": "src/cli.js",
   "scripts": {
-    "test": "node --experimental-test-module-mocks --test --test-concurrency=4 $(find test -name '*.test.js')",
+    "test": "node scripts/test.mjs",
     "test:mutation": "stryker run",
     "lint": "npx eslint src/ bin/ test/",
     "start": "node bin/jsn.js",
@@ -31,7 +31,7 @@
     "@inquirer/core": "^10.1.0",
     "@inquirer/prompts": "^7.5.1",
     "better-sqlite3": "^13.0.3",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.5.0",
     "turndown": "^7.2.4"
   },
   "devDependencies": {

package/src/app.js

@@ -98,30 +98,17 @@ export class App {
       displayUserName = displayUserName.slice(0, 6) + '...';
     }
 
-    let scope = 'global';
-    if (userSysID) {
-      try {
-        const app = await getCurrentApplication(this.sdk, userSysID);
-        if (app && app.scope) scope = app.scope;
-      } catch {
-        // ignore
-      }
-    }
+    // Both lookups depend on the user, but not on one another.
+    const [application, selectedUpdateSet] = userSysID ? await Promise.all([
+      getCurrentApplication(this.sdk, userSysID).catch(() => null),
+      getCurrentUpdateSet(this.sdk, userSysID).catch(() => null),
+    ]) : [null, null];
+    const scope = application?.scope || 'global';
+    const updateSet = selectedUpdateSet?.name && selectedUpdateSet.name !== '-'
+      ? selectedUpdateSet.name : 'Default';
+    const updateSetSysID = selectedUpdateSet?.name && selectedUpdateSet.name !== '-'
+      ? selectedUpdateSet.sys_id : '';
     this.context.scope = scope;
-
-    let updateSet = 'Default';
-    let updateSetSysID = '';
-    if (userSysID) {
-      try {
-        const us = await getCurrentUpdateSet(this.sdk, userSysID);
-        if (us && us.name && us.name !== '-') {
-          updateSet = us.name;
-          updateSetSysID = us.sys_id;
-        }
-      } catch {
-        // ignore
-      }
-    }
     this.context.updateSet = updateSet;
 
     const instance = this.getEffectiveInstance();

package/src/auth/browser-session.js

@@ -0,0 +1,21 @@
+import { errAuth } from '../errors.js';
+
+/**
+ * Extract the browser session token and cookies from pasted DevTools headers
+ * or a "Copy as cURL" command. Only these two values are retained.
+ */
+export function parseBrowserSessionInput(input) {
+  const text = String(input || '');
+  const tokenMatch = text.match(/(?:x-usertoken|x-user-token)\s*:\s*([^\s'";,]+)/i);
+  const cookieArgMatch = text.match(/(?:^|\s)(?:-b|--cookie)\s+(['"])(.*?)\1/s);
+  const quotedCookieMatch = text.match(/cookie\s*:\s*(['"])(.*?)\1/i);
+  const plainCookieMatch = text.match(/cookie\s*:\s*([^\r\n]+)/i);
+  const token = tokenMatch?.[1]?.trim() || '';
+  const cookies = (cookieArgMatch?.[2] || quotedCookieMatch?.[2] || plainCookieMatch?.[1] || '')
+    .trim()
+    .replace(/['"`]\s*(?:\\\s*)?$/, '');
+  if (!token) throw errAuth('No X-UserToken header found');
+  if (!cookies) throw errAuth('No Cookie header found. Paste the complete request headers or cURL command.');
+  return { auth_method: 'gck', access_token: token, cookies, auth_source: 'gck' };
+}
+

package/src/auth/credential-state.js

@@ -0,0 +1,124 @@
+const AUTH_METHODS = new Set(['oauth', 'basic', 'gck']);
+const AUTH_SOURCES = new Set(['env_token', 'env_basic', 'gck', 'keyring', 'file', 'unavailable']);
+
+export function normalizeAuthMethod(value, fallback = 'unconfigured') {
+  return AUTH_METHODS.has(value) ? value : fallback;
+}
+
+export function normalizeAuthSource(value, fallback = 'unavailable') {
+  return AUTH_SOURCES.has(value) ? value : fallback;
+}
+
+export function sourceMethod(source) {
+  return { env_token: 'oauth', env_basic: 'basic', gck: 'gck' }[source] || null;
+}
+
+const PROBE_FAILURES = {
+  missing_credentials: {
+    message: 'Credentials are not available for this profile.',
+    hint: 'Run: jsn auth login',
+  },
+  credentials_expired: {
+    message: 'Credentials have expired and cannot be refreshed.',
+    hint: 'Run: jsn auth login',
+  },
+  refresh_required: {
+    message: 'Credentials require refresh before probing.',
+    hint: 'Run: jsn auth refresh',
+  },
+  refresh_failed: {
+    message: 'Credential refresh failed before the authenticated probe.',
+    hint: 'Run: jsn auth login',
+  },
+  invalid_browser_session: {
+    message: 'Browser session credentials are incomplete or invalid.',
+    hint: 'Capture a fresh ServiceNow browser request and run: jsn auth login --gck',
+  },
+  malformed_credentials: {
+    message: 'Credentials are malformed for the selected authentication method.',
+    hint: 'Run: jsn auth login',
+  },
+  permission_denied: {
+    message: 'The authenticated user lacks permission for the current-user probe.',
+    hint: 'Ask an administrator to grant access to the sys_user table/API.',
+  },
+  unauthorized: {
+    message: 'The instance rejected the selected credentials.',
+    hint: 'Run: jsn auth login',
+  },
+  network: {
+    message: 'The authenticated probe could not reach the instance.',
+    hint: 'Check your internet connection and instance URL.',
+  },
+  unknown: {
+    message: 'The authenticated probe failed for an unknown reason.',
+    hint: 'Retry the probe; if it persists, check the instance logs.',
+  },
+  missing_instance: {
+    message: 'No instance is configured for this profile.',
+    hint: 'Set an instance URL and run: jsn auth login',
+  },
+  sdk_construction_failed: {
+    message: 'The authenticated probe could not be initialized for this profile.',
+    hint: 'Check the profile configuration and run: jsn auth status again',
+  },
+};
+
+const PROBE_CLASSIFICATIONS = {
+  missing_credentials: 'unavailable', credentials_expired: 'expired', refresh_required: 'refresh_required',
+  refresh_failed: 'refresh_failed', invalid_browser_session: 'browser_session_invalid',
+  malformed_credentials: 'malformed', permission_denied: 'permission_denied', unauthorized: 'unauthorized',
+  network: 'network_error', unknown: 'unknown',
+  missing_instance: 'unavailable', sdk_construction_failed: 'configuration_error',
+};
+
+export function probeFailure(code, status = 'failed') {
+  return { status, code, classification: PROBE_CLASSIFICATIONS[code] || 'unknown', ...PROBE_FAILURES[code] };
+}
+
+export function classifyProbeError(error, method) {
+  if (error?.status === 401 || error?.status === 403) {
+    return error.status === 403 ? 'permission_denied' : 'unauthorized';
+  }
+  if (error?.code === 'network_error' || ['ECONNREFUSED', 'ENOTFOUND', 'ETIMEDOUT'].includes(error?.code)) {
+    return 'network';
+  }
+  const text = String(error?.message || '').toLowerCase();
+  if (error?.code === 'auth_error' && text.includes('refresh')) return 'refresh_failed';
+  if (method === 'gck' && error?.code === 'auth_error') return 'invalid_browser_session';
+  return 'unknown';
+}
+
+/**
+ * Classify credentials without returning or logging any credential material.
+ * This is deliberately pure so diagnostics cannot refresh, persist, or probe.
+ */
+export function classifyCredentialState(credentials, method, now = Date.now()) {
+  if (!credentials) return 'missing';
+  if (!AUTH_METHODS.has(method)) return 'malformed';
+
+  if (method === 'basic') {
+    const hasUser = typeof credentials.username === 'string' && credentials.username.length > 0;
+    const hasPassword = typeof credentials.password === 'string' && credentials.password.length > 0;
+    return hasUser && hasPassword ? 'available' : 'malformed';
+  }
+
+  if (method === 'gck') {
+    const hasToken = typeof credentials.access_token === 'string' && credentials.access_token.length > 0;
+    const hasCookies = typeof credentials.cookies === 'string' && credentials.cookies.length > 0;
+    return hasToken && hasCookies ? 'available' : 'malformed';
+  }
+
+  if (credentials.access_token !== undefined && typeof credentials.access_token !== 'string') return 'malformed';
+  if (credentials.refresh_token !== undefined && typeof credentials.refresh_token !== 'string') return 'malformed';
+
+  const hasToken = typeof credentials.access_token === 'string' && credentials.access_token.length > 0;
+  if (!hasToken) return credentials.refresh_token ? 'refreshable' : 'missing';
+  if (credentials.expires_at !== undefined && credentials.expires_at !== null && credentials.expires_at !== 0) {
+    const expiresAt = Number(credentials.expires_at);
+    if (!Number.isFinite(expiresAt)) return 'malformed';
+    if (now >= (expiresAt - 300) * 1000) return credentials.refresh_token ? 'refreshable' : 'expired';
+  }
+  return 'available';
+}
+

package/src/auth/credential-store.js

@@ -0,0 +1,177 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { globalConfigDir } from '../config.js';
+
+// ─── Credential key helpers ───
+
+/**
+ * Sanitize an instance URL into a filesystem/arg-safe key part.
+ *
+ * Whitelist approach (issue #143 findings #2/#3): first map the `://`
+ * protocol separator to `_` exactly as the Go version's encoding does
+ * (so existing keyring keys like `https_dev437538.service-now.com` keep
+ * matching), then drop everything outside [a-zA-Z0-9._-]. Blacklist
+ * stripping of just `/` and `:` left quotes, `$()`, backticks, `;`,
+ * spaces, and backslashes — which broke out of double-quoted shell args
+ * in keyring calls and, on Windows, out of path.join() credential dirs.
+ */
+export function sanitizeKeyPart(instance) {
+  return instance.replace(/:\/\//g, '_').replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+
+/**
+ * Build a compound key for credential storage: <username>@<instance>
+ * When username is omitted (legacy), just the normalized instance URL is used.
+ */
+export function credKey(instance, username) {
+  const normalized = sanitizeKeyPart(instance);
+  if (!username) return normalized;
+  return `${username.replace(/[^a-zA-Z0-9._@-]/g, '_')}@${normalized}`;
+}
+
+// Keychain constants — same as Go version (internal/auth/store.go)
+const KEYRING_SERVICE = 'servicenow-cli';
+const KEYRING_ATTR_SERVICE = 'service';
+const KEYRING_ATTR_USERNAME = 'username';
+
+function credentialsFilePath(key) {
+  const dir = path.join(globalConfigDir(), 'credentials');
+  // Match Go's filename encoding: replace :// and / and : with _
+  const filename = key + '.json';
+  return path.join(dir, filename);
+}
+
+function credentialsPath(key) {
+  const filePath = credentialsFilePath(key);
+  fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
+  return filePath;
+}
+
+// ─── Keyring via secret-tool (libsecret, same backend as Go's go-keyring) ───
+
+function keyringLookup(key) {
+  try {
+    // execFileSync with an arg array — no shell, so `key` can never
+    // break out into command injection (issue #143 finding #2).
+    const result = execFileSync(
+      'secret-tool',
+      ['lookup', KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
+      { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' }
+    );
+    const trimmed = result.trim();
+    if (!trimmed) return null;
+    const parsed = JSON.parse(trimmed);
+    // Spread all fields from keyring first, then normalize known fields
+    // so username, password, and other extras are preserved.
+    return {
+      ...parsed,
+      auth_method: parsed.auth_method || 'oauth',
+      access_token: parsed.access_token || parsed.AccessToken || '',
+      refresh_token: parsed.refresh_token || parsed.RefreshToken || '',
+      expires_at: parsed.expires_at || parsed.ExpiresAt || 0,
+      created_at: parsed.created_at || parsed.CreatedAt || 0,
+      auth_source: ['oauth', 'env_token', 'env_basic', undefined].includes(parsed.auth_source)
+        ? (parsed.auth_method === 'gck' ? 'gck' : 'keyring')
+        : parsed.auth_source,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function keyringStore(key, creds) {
+  try {
+    execFileSync(
+      'secret-tool',
+      ['store', `--label=Password for '${key}' on '${KEYRING_SERVICE}'`,
+        KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
+      { stdio: ['pipe', 'ignore', 'ignore'], input: JSON.stringify(creds) }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function keyringDelete(key) {
+  try {
+    execFileSync(
+      'secret-tool',
+      ['clear', KEYRING_ATTR_SERVICE, KEYRING_SERVICE, KEYRING_ATTR_USERNAME, key],
+      { stdio: 'ignore' }
+    );
+  } catch {
+    // ignore
+  }
+}
+
+// ─── File-based storage (fallback) ───
+
+/**
+ * Load credentials for an instance keyed by <username>@<instance>.
+ * When username is omitted (legacy configs without profile user), uses
+ * bare instance key for lookup.
+ */
+export function loadCredentials(instance, username, injectedStore) {
+  if (injectedStore) return injectedStore.load(instance, username);
+  const key = username ? credKey(instance, username) : credKey(instance);
+  const keyringCreds = keyringLookup(key);
+  if (keyringCreds) {
+    return {
+      ...keyringCreds,
+      auth_source: keyringCreds.auth_source || (keyringCreds.auth_method === 'gck' ? 'gck' : 'keyring'),
+    };
+  }
+  try {
+    const data = fs.readFileSync(credentialsFilePath(key), 'utf-8');
+    const creds = JSON.parse(data);
+    return {
+      ...creds,
+      auth_source: ['oauth', 'env_token', 'env_basic', undefined].includes(creds.auth_source)
+        ? (creds.auth_method === 'gck' ? 'gck' : 'file')
+        : creds.auth_source,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Save credentials for an instance.
+ * Uses <username>@<instance> key when username is available.
+ */
+export function saveCredentials(instance, creds, username, injectedStore) {
+  if (injectedStore) {
+    creds.last_seen = creds.last_seen || Math.floor(Date.now() / 1000);
+    return injectedStore.save(instance, creds, username);
+  }
+  const key = username ? credKey(instance, username) : credKey(instance);
+  // Stamp last_seen on every credential save
+  creds.last_seen = creds.last_seen || Math.floor(Date.now() / 1000);
+  // Try keyring first, fall back to file
+  if (!keyringStore(key, creds)) {
+    fs.writeFileSync(credentialsPath(key), JSON.stringify(creds, null, 2), { mode: 0o600 });
+  }
+}
+
+/**
+ * Delete credentials for an instance keyed by <username>@<instance>.
+ */
+export function deleteCredentials(instance, username, injectedStore) {
+  if (injectedStore) return injectedStore.delete(instance, username);
+  const key = username ? credKey(instance, username) : credKey(instance);
+  keyringDelete(key);
+  try {
+    fs.unlinkSync(credentialsPath(key));
+  } catch {
+    // ignore
+  }
+}
+
+export const defaultCredentialStore = {
+  load: loadCredentials,
+  save: saveCredentials,
+  delete: deleteCredentials,
+};
+

package/src/auth/oauth.js

@@ -0,0 +1,66 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { globalConfigDir } from '../config.js';
+import { credKey } from './credential-store.js';
+
+// ─── PKCE state persistence (shared with Go version) ───
+
+function pkceStatePath(instance, username) {
+  const dir = path.join(globalConfigDir(), 'pkce');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // A known profile identity gets its own pending-login slot. Keep the bare
+  // instance slot for legacy/no-profile flows, where no identity exists yet.
+  const filename = credKey(instance, username) + '.json';
+  return path.join(dir, filename);
+}
+
+export function savePKCEState(instance, pkce, username) {
+  const filePath = pkceStatePath(instance, username);
+  fs.writeFileSync(filePath, JSON.stringify(pkce, null, 2), { mode: 0o600 });
+}
+
+export function loadPKCEState(instance, username) {
+  try {
+    const data = fs.readFileSync(pkceStatePath(instance, username), 'utf-8');
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+
+export function removePKCEState(instance, username) {
+  try {
+    fs.unlinkSync(pkceStatePath(instance, username));
+  } catch {
+    // ignore
+  }
+}
+
+const DEFAULT_OAUTH_CLIENT_ID = '543e5655f77746a28228c6009a599dfb';
+export const REDIRECT_URI = '/sdk-oauth.do';
+
+export function getOAuthClientID() {
+  return process.env.SERVICENOW_OAUTH_CLIENT_ID || DEFAULT_OAUTH_CLIENT_ID;
+}
+
+export function generatePKCE() {
+  const verifier = crypto.randomBytes(32).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  const state = crypto.randomBytes(16).toString('base64url');
+  return { code_verifier: verifier, code_challenge: challenge, state };
+}
+
+export function buildAuthURL(instanceURL, clientID, pkce) {
+  const u = new URL('/oauth_auth.do', instanceURL);
+  u.searchParams.set('response_type', 'code');
+  u.searchParams.set('client_id', clientID);
+  u.searchParams.set('redirect_uri', REDIRECT_URI);
+  u.searchParams.set('state', pkce.state);
+  u.searchParams.set('code_challenge', pkce.code_challenge);
+  u.searchParams.set('code_challenge_method', 'S256');
+  u.searchParams.set('scope', 'openid');
+  u.searchParams.set('approval_prompt', 'force');
+  return u.toString();
+}
+