@kora-platform/cli 0.8.0-rc3 → 0.8.0-rc7

package/dist/transport.js

@@ -1,5 +1,8 @@
+import { normalizePublicErrorCode, readPublicErrorCodeFromType } from "./error-code.js";
 import { extractRefreshTokenFromHeaders } from "./session.js";
+import { refreshSessionWithCoordination, resolveEffectiveSession } from "./transport-refresh.js";
 export class ApiError extends Error {
+    code;
     detail;
     details;
     instance;
@@ -10,6 +13,7 @@ export class ApiError extends Error {
     constructor(input) {
         super(input.detail);
         this.name = "ApiError";
+        this.code = normalizePublicErrorCode(input.code ?? readPublicErrorCodeFromType(input.type));
         this.detail = input.detail;
         if (input.details) {
             this.details = input.details;
@@ -25,6 +29,13 @@ export class ApiError extends Error {
 }
 export function createPlatformTransport(input) {
     const now = input.now ?? Date.now;
+    const refreshSession = async (session) => refreshSessionWithCoordination({
+        isRefreshTokenInvalidError,
+        refreshSessionDirect: async (effectiveSession) => refreshSessionDirect(input.sessionStore, effectiveSession),
+        session,
+        sessionStore: input.sessionStore,
+        shouldRefresh: (effectiveSession) => shouldRefresh(effectiveSession, now)
+    });
     return {
         async getAuthSettings(baseUrl) {
             const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
@@ -66,19 +77,54 @@ export function createPlatformTransport(input) {
             await input.sessionStore.write(session);
             return session;
         },
-        async refreshSession(session) {
-            const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
+        async startDeviceLogin(baseUrl) {
+            const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+            const path = "/api/v1/auth/device/start";
+            const response = await fetch(joinBaseUrl(normalizedBaseUrl, path), {
+                method: "POST"
+            });
+            return handleJsonResponse(response, path);
+        },
+        async claimDeviceLogin(claim) {
+            const normalizedBaseUrl = normalizeBaseUrl(claim.baseUrl);
+            const path = "/api/v1/auth/device/claim";
+            const response = await fetch(joinBaseUrl(normalizedBaseUrl, path), {
                 body: JSON.stringify({
-                    refreshToken: session.refreshToken
+                    deviceCode: claim.deviceCode
                 }),
                 headers: {
                     "content-type": "application/json"
                 },
                 method: "POST"
             });
-            const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
-            await input.sessionStore.write(nextSession);
-            return nextSession;
+            if (!response.ok) {
+                throw await toApiError(response, path);
+            }
+            const payload = await response.json();
+            if (payload.status !== "approved") {
+                return { status: payload.status };
+            }
+            if (!payload.tokens || !payload.user) {
+                throw new Error("Device login approval response did not include a session.");
+            }
+            const refreshToken = extractRefreshTokenFromHeaders(response.headers);
+            if (!refreshToken) {
+                throw new Error("Refresh token cookie was not returned by the Platform API.");
+            }
+            const session = {
+                accessToken: payload.tokens.accessToken,
+                accessTokenPayload: payload.tokens.accessTokenPayload,
+                activeOrg: null,
+                baseUrl: normalizedBaseUrl,
+                refreshToken,
+                refreshTokenExpiresAt: payload.tokens.refreshTokenExpiresAt,
+                user: payload.user
+            };
+            await input.sessionStore.write(session);
+            return { session, status: "approved" };
+        },
+        async refreshSession(session) {
+            return refreshSession(session);
         },
         async requestJson(request) {
             let session = await resolveEffectiveSession(request.session, input.sessionStore);
@@ -92,11 +138,11 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleJsonResponse(await authenticatedFetch(session, request), request.path);
             }
             return handleJsonResponse(firstResponse, request.path);
@@ -113,17 +159,36 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleBytesResponse(await authenticatedFetch(session, request), request);
             }
             return handleBytesResponse(firstResponse, request);
         }
     };
 }
+async function refreshSessionDirect(sessionStore, session) {
+    const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
+        body: JSON.stringify({
+            refreshToken: session.refreshToken
+        }),
+        headers: {
+            "content-type": "application/json"
+        },
+        method: "POST"
+    });
+    const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
+    await sessionStore.write(nextSession);
+    return nextSession;
+}
+function isRefreshTokenInvalidError(error) {
+    return error instanceof ApiError &&
+        error.code === "auth/token_invalid" &&
+        error.instance === "/api/v1/auth/refresh";
+}
 async function authenticatedFetch(session, request) {
     const body = resolveRequestBody(request.body, session);
     const hasJsonBody = body !== undefined;
@@ -243,11 +308,12 @@ async function readResponseBytes(response, request) {
 }
 function createMaxBytesError(request, actualBytes, maxBytes) {
     return request.createMaxBytesError?.({ actualBytes, maxBytes }) ?? new ApiError({
+        code: "request/too_large",
         detail: `Response body is ${String(actualBytes)} bytes, which exceeds the limit of ${String(maxBytes)} bytes.`,
         instance: request.path,
         status: 413,
         title: "Payload Too Large",
-        type: "https://errors.kora.dev/request/too-large"
+        type: "https://errors.kora.dev/request/too_large"
     });
 }
 function concatBytes(chunks, totalBytes) {
@@ -271,10 +337,11 @@ async function toApiError(response, path) {
     if (contentType.includes("application/json")) {
         const rawBody = await response.text();
         const parsed = tryParseJsonErrorBody(rawBody);
-        const code = parsed?.error?.code ?? "internal/error";
+        const code = normalizePublicErrorCode(parsed?.error?.code ?? "internal/error");
         const rawDetail = (parsed?.error?.message ?? rawBody) || response.statusText;
         const detail = relabelBackendText(rawDetail || response.statusText);
         return new ApiError({
+            code,
             detail,
             ...(parsed?.error?.details ? { details: parsed.error.details } : {}),
             instance: path,
@@ -286,6 +353,7 @@ async function toApiError(response, path) {
     }
     const rawDetail = await response.text();
     return new ApiError({
+        code: "internal/error",
         detail: relabelBackendText(rawDetail),
         instance: path,
         ...(rawDetail ? { rawDetail } : {}),
@@ -337,27 +405,3 @@ function shouldRefresh(session, now) {
 function canRefresh(session) {
     return session.refreshToken.trim().length > 0;
 }
-async function resolveEffectiveSession(requestSession, sessionStore) {
-    if (!requestSession) {
-        return null;
-    }
-    const storedSession = await sessionStore.read();
-    if (!storedSession || !isSameSessionIdentity(storedSession, requestSession)) {
-        return requestSession;
-    }
-    return isSessionNewer(storedSession, requestSession) ? storedSession : requestSession;
-}
-function isSameSessionIdentity(candidate, current) {
-    return candidate.baseUrl === current.baseUrl
-        && candidate.user.id === current.user.id
-        && candidate.accessTokenPayload.sub === current.accessTokenPayload.sub;
-}
-function isSessionNewer(candidate, current) {
-    if (candidate.accessToken === current.accessToken && candidate.refreshToken === current.refreshToken) {
-        return false;
-    }
-    if (candidate.accessTokenPayload.exp !== current.accessTokenPayload.exp) {
-        return candidate.accessTokenPayload.exp > current.accessTokenPayload.exp;
-    }
-    return candidate.accessTokenPayload.iat >= current.accessTokenPayload.iat;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kora-platform/cli",
-  "version": "0.8.0-rc3",
+  "version": "0.8.0-rc7",
   "private": false,
   "type": "module",
   "main": "dist/library.js",