@lightdash/cli 2.562.0 → 2.563.0

package/dist/agentConnections/configLock.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.atomicWrite = exports.acquireLock = exports.readPrivateFile = exports.privateDirectory = exports.isFsError = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = tslib_1.__importDefault(require("path"));
+const isFsError = (error, code) => error instanceof Error && 'code' in error && error.code === code;
+exports.isFsError = isFsError;
+const privateDirectory = async (directory) => {
+    await fs_1.promises.mkdir(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32')
+        await fs_1.promises.chmod(directory, 0o700);
+};
+exports.privateDirectory = privateDirectory;
+const readPrivateFile = async (file) => {
+    try {
+        if (process.platform !== 'win32')
+            await fs_1.promises.chmod(file, 0o600);
+        return await fs_1.promises.readFile(file, 'utf8');
+    }
+    catch (error) {
+        if ((0, exports.isFsError)(error, 'ENOENT'))
+            return null;
+        throw new Error('Cannot read the agent connection file.');
+    }
+};
+exports.readPrivateFile = readPrivateFile;
+const readOwner = async (file) => {
+    const contents = await (0, exports.readPrivateFile)(file);
+    if (contents === null)
+        return null;
+    try {
+        const value = JSON.parse(contents);
+        if (typeof value !== 'object' ||
+            value === null ||
+            !('ownerId' in value) ||
+            typeof value.ownerId !== 'string' ||
+            !value.ownerId ||
+            !('pid' in value) ||
+            typeof value.pid !== 'number' ||
+            !Number.isInteger(value.pid) ||
+            value.pid <= 0 ||
+            !('host' in value) ||
+            typeof value.host !== 'string' ||
+            !('startedAt' in value) ||
+            typeof value.startedAt !== 'string' ||
+            !Number.isFinite(Date.parse(value.startedAt)))
+            return null;
+        return {
+            ownerId: value.ownerId,
+            pid: value.pid,
+            host: value.host,
+            startedAt: value.startedAt,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const isDeadLocalOwner = (owner) => {
+    if (owner.host !== (0, os_1.hostname)())
+        return false;
+    try {
+        process.kill(owner.pid, 0);
+        return false;
+    }
+    catch (error) {
+        return (0, exports.isFsError)(error, 'ESRCH');
+    }
+};
+const exists = async (file) => {
+    try {
+        await fs_1.promises.stat(file);
+        return true;
+    }
+    catch (error) {
+        if ((0, exports.isFsError)(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+};
+const releaseOwner = async (file, ownerId) => {
+    if ((await readOwner(file))?.ownerId === ownerId)
+        await fs_1.promises.unlink(file);
+};
+const createOwner = async (file) => {
+    let handle;
+    try {
+        handle = await fs_1.promises.open(file, 'wx', 0o600);
+    }
+    catch (error) {
+        if ((0, exports.isFsError)(error, 'EEXIST'))
+            return null;
+        throw new Error('Cannot lock the agent connection file.');
+    }
+    const owner = {
+        ownerId: (0, crypto_1.randomUUID)(),
+        pid: process.pid,
+        host: (0, os_1.hostname)(),
+        startedAt: new Date().toISOString(),
+    };
+    try {
+        await handle.writeFile(JSON.stringify(owner));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    return owner;
+};
+const acquireLock = async (file, options = {
+    waitMs: 30_000,
+    pollMs: 25,
+}) => {
+    await (0, exports.privateDirectory)(path_1.default.dirname(file));
+    const recovery = `${file}.recovery`;
+    const deadline = performance.now() + options.waitMs;
+    const attempt = async () => {
+        if (!(await exists(recovery))) {
+            const owner = await createOwner(file);
+            if (owner) {
+                if (!(await exists(recovery)))
+                    return () => releaseOwner(file, owner.ownerId);
+                await releaseOwner(file, owner.ownerId);
+            }
+            else {
+                const stale = await readOwner(file);
+                if (stale && isDeadLocalOwner(stale)) {
+                    const sentinel = await createOwner(recovery);
+                    if (sentinel) {
+                        try {
+                            const current = await readOwner(file);
+                            if (current?.ownerId === stale.ownerId &&
+                                isDeadLocalOwner(current))
+                                await fs_1.promises.unlink(file);
+                        }
+                        finally {
+                            await releaseOwner(recovery, sentinel.ownerId);
+                        }
+                    }
+                }
+            }
+        }
+        await new Promise((resolve) => {
+            setTimeout(resolve, options.pollMs + Math.floor(Math.random() * options.pollMs));
+        });
+        return performance.now() < deadline ? attempt() : null;
+    };
+    const release = await attempt();
+    if (release !== null)
+        return release;
+    if (await exists(recovery))
+        throw new Error('Interrupted config lock recovery. Confirm no CLI process is using this config before removing the recovery sentinel.');
+    throw new Error('Another CLI process is updating this connection. Try again shortly.');
+};
+exports.acquireLock = acquireLock;
+const atomicWrite = async (file, contents, commit = {}) => {
+    await (0, exports.privateDirectory)(path_1.default.dirname(file));
+    const temporary = `${file}.${(0, crypto_1.randomUUID)()}.tmp`;
+    const handle = await fs_1.promises.open(temporary, 'wx', 0o600);
+    try {
+        try {
+            await handle.writeFile(contents);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        commit.beforeCommit?.();
+        await fs_1.promises.rename(temporary, file);
+        commit.onCommitted?.();
+        if (process.platform !== 'win32') {
+            const directory = await fs_1.promises.open(path_1.default.dirname(file), 'r');
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+    }
+    finally {
+        await fs_1.promises.unlink(temporary).catch((error) => {
+            if (!(0, exports.isFsError)(error, 'ENOENT'))
+                throw new Error('Cannot clean up the agent connection file.');
+        });
+    }
+};
+exports.atomicWrite = atomicWrite;

package/dist/agentConnections/connectInputs.d.ts

@@ -0,0 +1,20 @@
+import { AgentCapability } from '@lightdash/common';
+export type ConnectionConnectOptions = {
+    verbose: boolean;
+    name?: string;
+    projects?: string[];
+    capabilities?: string;
+    expiresIn?: string;
+    oauthPort?: string;
+    timeout?: number;
+};
+export declare const connectionConnectInputs: (options: ConnectionConnectOptions) => {
+    name: string;
+    projects: string[] | null;
+    capabilities: AgentCapability[];
+    expiresInSeconds: number;
+    port: number;
+    timeout: number;
+};
+export type ConnectionConnectInputs = ReturnType<typeof connectionConnectInputs>;
+//# sourceMappingURL=connectInputs.d.ts.map

package/dist/agentConnections/connectInputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectInputs.d.ts","sourceRoot":"","sources":["../../src/agentConnections/connectInputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGpD,MAAM,MAAM,wBAAwB,GAAG;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AACF,eAAO,MAAM,uBAAuB,YAAa,wBAAwB;;;;;;;CA+DxE,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,UAAU,CAC5C,OAAO,uBAAuB,CACjC,CAAC"}

package/dist/agentConnections/connectInputs.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionConnectInputs = void 0;
+const common_1 = require("@lightdash/common");
+const credentials_1 = require("../credentials");
+const connectionConnectInputs = (options) => {
+    const name = options.name ?? 'default';
+    (0, credentials_1.validateAgentConnectionSelection)(name);
+    const projects = options.projects === undefined ? null : [...new Set(options.projects)];
+    if (projects?.some((project) => !project ||
+        project !== project.trim() ||
+        /[/\\?#\x00-\x1f\x7f]/.test(project)) ||
+        projects?.length === 0)
+        throw new Error('Specify a non-empty project UUID or slug without URL or path separators.');
+    const known = Object.values(common_1.AgentCapability);
+    const requested = options.capabilities === undefined
+        ? known
+        : options.capabilities.split(',');
+    const capabilities = [...new Set(requested)].map((value) => {
+        const capability = known.find((key) => key === value);
+        if (capability === undefined)
+            throw new Error(`Invalid capability. Valid keys: ${known.join(', ')}.`);
+        return capability;
+    });
+    const duration = /^(\d+)(s|m|h|d)$/.exec(options.expiresIn ?? '24h');
+    const units = { s: 1, m: 60, h: 3600, d: 86400 };
+    const expiresInSeconds = duration
+        ? Number(duration[1]) * units[duration[2]]
+        : NaN;
+    if (!Number.isSafeInteger(expiresInSeconds) ||
+        expiresInSeconds < 1 ||
+        expiresInSeconds > 604800)
+        throw new Error('Expiry must be a positive integer duration in s, m, h or d, no greater than 7d.');
+    const rawPort = options.oauthPort ?? process.env.LIGHTDASH_OAUTH_PORT;
+    const port = rawPort === undefined ? 0 : Number(rawPort);
+    if (rawPort !== undefined &&
+        (!/^\d+$/.test(rawPort) ||
+            !Number.isInteger(port) ||
+            port < 1 ||
+            port > 65535))
+        throw new Error('Port must be a number between 1 and 65535');
+    const timeout = options.timeout ?? 180;
+    if (!Number.isFinite(timeout) ||
+        timeout <= 0 ||
+        timeout * 1000 > 2147483647)
+        throw new Error('Timeout must be a positive number of seconds no greater than 2147483.647');
+    return { name, projects, capabilities, expiresInSeconds, port, timeout };
+};
+exports.connectionConnectInputs = connectionConnectInputs;

package/dist/agentConnections/fixtures.d.ts

@@ -0,0 +1,3 @@
+import type { AgentConnectionSlot } from './schema';
+export declare const slotFixture: () => AgentConnectionSlot;
+//# sourceMappingURL=fixtures.d.ts.map

package/dist/agentConnections/fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../../src/agentConnections/fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,eAAO,MAAM,WAAW,QAAO,mBA+B7B,CAAC"}

package/dist/agentConnections/fixtures.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.slotFixture = void 0;
+const slotFixture = () => ({
+    instanceUrl: 'https://example.com',
+    organizationUuid: '11111111-1111-4111-8111-111111111111',
+    personUuid: '22222222-2222-4222-8222-222222222222',
+    name: 'default',
+    clientId: 'lightdash-cli',
+    resource: 'https://example.com',
+    grantUuid: '33333333-3333-4333-8333-333333333333',
+    grantRevision: null,
+    approvedAt: new Date(Date.now() - 3_600_000).toISOString(),
+    grantExpiresAt: new Date(Date.now() + 86_400_000).toISOString(),
+    tokens: {
+        accessToken: 'private-access',
+        accessTokenExpiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+        refreshToken: 'private-refresh',
+        refreshTokenExpiresAt: null,
+        scopes: ['read', 'write'],
+        generation: 1,
+        lastRefreshAttemptUuid: null,
+    },
+    lastReported: {
+        checkedAt: new Date().toISOString(),
+        limitsStatus: 'ok',
+        approvedProjects: [],
+        effectiveProjects: [],
+        status: 'active',
+        lastUsedAt: null,
+        revokedAt: null,
+    },
+    refreshState: { kind: 'idle' },
+    revokeState: { kind: 'none' },
+});
+exports.slotFixture = slotFixture;

package/dist/agentConnections/initialToken.d.ts

@@ -0,0 +1,26 @@
+export declare const unboundConnection = "The server returned a token that is not bound to this agent connection. No credential was saved.";
+export declare class ConnectionProofError extends Error {
+    constructor(message?: string);
+}
+export declare const exchangeInitialConnectionToken: ({ instanceUrl, code, verifier, redirectUri, grantUuid, signal, proxyAuthorization, }: {
+    instanceUrl: string;
+    code: string;
+    verifier: string;
+    redirectUri: string;
+    grantUuid: string | null;
+    signal: AbortSignal;
+    proxyAuthorization: string | null;
+}) => Promise<{
+    grantUuid: string;
+    grantRevision: number | null;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        accessTokenExpiresAt: string;
+        refreshTokenExpiresAt: string | null;
+        scopes: string[];
+        generation: number;
+        lastRefreshAttemptUuid: null;
+    };
+}>;
+//# sourceMappingURL=initialToken.d.ts.map

package/dist/agentConnections/initialToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initialToken.d.ts","sourceRoot":"","sources":["../../src/agentConnections/initialToken.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,iBAAiB,qGACwE,CAAC;AACvG,qBAAa,oBAAqB,SAAQ,KAAK;IAC3C,YAAY,OAAO,SAAoB,EAEtC;CACJ;AACD,eAAO,MAAM,8BAA8B,yFAQxC;IACC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;;;;QAyEW,WAAW;QACX,YAAY;QACZ,oBAAoB;QAGpB,qBAAqB;QAMrB,MAAM;QACN,UAAU;QACV,sBAAsB;;EAGjC,CAAC"}

package/dist/agentConnections/initialToken.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeInitialConnectionToken = exports.ConnectionProofError = exports.unboundConnection = void 0;
+const uuid_1 = require("uuid");
+const apiUrl_1 = require("./apiUrl");
+const statusResponse_1 = require("./statusResponse");
+exports.unboundConnection = 'The server returned a token that is not bound to this agent connection. No credential was saved.';
+class ConnectionProofError extends Error {
+    constructor(message = exports.unboundConnection) {
+        super(message);
+    }
+}
+exports.ConnectionProofError = ConnectionProofError;
+const exchangeInitialConnectionToken = async ({ instanceUrl, code, verifier, redirectUri, grantUuid, signal, proxyAuthorization, }) => {
+    const fetch = (0, apiUrl_1.createAgentConnectionFetch)(instanceUrl);
+    const startedAt = Date.now();
+    const response = await fetch('/api/v1/oauth/token', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            ...(proxyAuthorization === null
+                ? {}
+                : { 'Proxy-Authorization': proxyAuthorization }),
+        },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            code_verifier: verifier,
+            redirect_uri: redirectUri,
+            client_id: 'lightdash-cli',
+            resource: instanceUrl,
+        }),
+        redirect: 'error',
+        signal,
+    });
+    if (!response.ok)
+        throw new ConnectionProofError();
+    const value = await response.json();
+    const token = (0, statusResponse_1.responseRecord)(value);
+    const metadata = token.agent_connection === undefined
+        ? null
+        : (0, statusResponse_1.responseRecord)(token.agent_connection);
+    const hint = metadata?.grant_uuid ?? grantUuid;
+    if (hint === null || hint === undefined)
+        throw new ConnectionProofError('The server did not identify an agent connection. No credential was saved.');
+    const revision = metadata?.grant_revision ?? null;
+    const lifetime = token.expires_in;
+    const refreshLifetime = token.refresh_expires_in ?? null;
+    if (typeof hint !== 'string' ||
+        !(0, uuid_1.validate)(hint) ||
+        (grantUuid !== null && (!(0, uuid_1.validate)(grantUuid) || grantUuid !== hint)) ||
+        (metadata !== null && metadata.grant_uuid !== hint) ||
+        (revision !== null &&
+            (typeof revision !== 'number' ||
+                !Number.isSafeInteger(revision) ||
+                revision < 1)) ||
+        typeof token.access_token !== 'string' ||
+        !token.access_token ||
+        typeof token.refresh_token !== 'string' ||
+        !token.refresh_token ||
+        typeof token.token_type !== 'string' ||
+        token.token_type.toLowerCase() !== 'bearer' ||
+        typeof lifetime !== 'number' ||
+        !Number.isSafeInteger(lifetime) ||
+        lifetime < 1 ||
+        lifetime > 2147483647 ||
+        (refreshLifetime !== null &&
+            (typeof refreshLifetime !== 'number' ||
+                !Number.isSafeInteger(refreshLifetime) ||
+                refreshLifetime < 1 ||
+                refreshLifetime > 2147483647)) ||
+        typeof token.scope !== 'string' ||
+        !/^[\x21\x23-\x5b\x5d-\x7e]+(?: [\x21\x23-\x5b\x5d-\x7e]+)*$/.test(token.scope) ||
+        (token.resource !== undefined && token.resource !== instanceUrl) ||
+        (token.issuer !== undefined && token.issuer !== instanceUrl))
+        throw new ConnectionProofError();
+    return {
+        grantUuid: hint,
+        grantRevision: revision,
+        tokens: {
+            accessToken: token.access_token,
+            refreshToken: token.refresh_token,
+            accessTokenExpiresAt: new Date(startedAt + lifetime * 1000).toISOString(),
+            refreshTokenExpiresAt: refreshLifetime === null
+                ? null
+                : new Date(startedAt + refreshLifetime * 1000).toISOString(),
+            scopes: [...new Set(token.scope.split(' '))],
+            generation: 1,
+            lastRefreshAttemptUuid: null,
+        },
+    };
+};
+exports.exchangeInitialConnectionToken = exchangeInitialConnectionToken;

package/dist/agentConnections/lifecycle.d.ts

@@ -0,0 +1,17 @@
+import { type Config } from '../config';
+import { type AgentConnectionSlot, type SlotKey } from './schema';
+export type LifecycleOperation = {
+    kind: 'status' | 'revoke';
+    grantUuid: string;
+    generation: number;
+};
+export declare class AgentConnectionRequestError extends Error {
+    readonly state: 'rejected' | 'unreachable';
+    constructor(state: 'rejected' | 'unreachable');
+}
+export declare const selectLifecycleSlot: (name: string | undefined) => string;
+export declare const connectionKey: (config: Config, name: string) => SlotKey | null;
+export declare const sameGeneration: (current: AgentConnectionSlot | null, slot: AgentConnectionSlot) => current is AgentConnectionSlot;
+export declare const settingsUrl: (instanceUrl: string) => string;
+export declare const revocationRecovery = "This credential cannot confirm revocation. Revoke the connection in the app, or use agent revoke --name <slot> --human with a matching personal login.";
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/agentConnections/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/agentConnections/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAEH,KAAK,mBAAmB,EACxB,KAAK,OAAO,EACf,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,kBAAkB,GAAG;IAC7B,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AACF,qBAAa,2BAA4B,SAAQ,KAAK;aACtB,KAAK,EAAE,UAAU,GAAG,aAAa;IAA7D,YAA4B,KAAK,EAAE,UAAU,GAAG,aAAa,EAM5D;CACJ;AACD,eAAO,MAAM,mBAAmB,SAAU,MAAM,GAAG,SAAS,KAAG,MAW9D,CAAC;AACF,eAAO,MAAM,aAAa,WAAY,MAAM,QAAQ,MAAM,KAAG,OAAO,GAAG,IAUzD,CAAC;AACf,eAAO,MAAM,cAAc,YACd,mBAAmB,GAAG,IAAI,QAC7B,mBAAmB,KAC1B,OAAO,IAAI,mBAG0C,CAAC;AACzD,eAAO,MAAM,WAAW,gBAAiB,MAAM,KAAG,MACK,CAAC;AACxD,eAAO,MAAM,kBAAkB,2JAC6H,CAAC"}

package/dist/agentConnections/lifecycle.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revocationRecovery = exports.settingsUrl = exports.sameGeneration = exports.connectionKey = exports.selectLifecycleSlot = exports.AgentConnectionRequestError = void 0;
+const credentials_1 = require("../credentials");
+const schema_1 = require("./schema");
+class AgentConnectionRequestError extends Error {
+    state;
+    constructor(state) {
+        super(state === 'rejected'
+            ? 'The server rejected this connection credential. Reconnect or check its status in the app.'
+            : 'Could not reach the server. Connection status is unconfirmed.');
+        this.state = state;
+    }
+}
+exports.AgentConnectionRequestError = AgentConnectionRequestError;
+const selectLifecycleSlot = (name) => {
+    const selection = (0, credentials_1.getAgentConnectionSelection)();
+    if (name !== undefined && selection !== null && name !== selection)
+        throw new Error('The connection name and global agent selection conflict.');
+    const selected = name ?? selection;
+    if (selected === null)
+        throw new Error('Specify an agent connection with --name <slot>.');
+    (0, credentials_1.validateAgentConnectionSelection)(selected);
+    return selected;
+};
+exports.selectLifecycleSlot = selectLifecycleSlot;
+const connectionKey = (config, name) => config.context?.serverUrl &&
+    config.user?.userUuid &&
+    config.user.organizationUuid
+    ? {
+        instanceUrl: (0, schema_1.canonicalInstanceUrl)(config.context.serverUrl),
+        personUuid: config.user.userUuid,
+        organizationUuid: config.user.organizationUuid,
+        name,
+    }
+    : null;
+exports.connectionKey = connectionKey;
+const sameGeneration = (current, slot) => current !== null &&
+    current.grantUuid === slot.grantUuid &&
+    current.tokens.generation === slot.tokens.generation;
+exports.sameGeneration = sameGeneration;
+const settingsUrl = (instanceUrl) => `${instanceUrl}/generalSettings/myAgentConnections`;
+exports.settingsUrl = settingsUrl;
+exports.revocationRecovery = 'This credential cannot confirm revocation. Revoke the connection in the app, or use agent revoke --name <slot> --human with a matching personal login.';

package/dist/agentConnections/personalRecovery.d.ts

@@ -0,0 +1,27 @@
+import fetch from 'node-fetch';
+import { type Config } from '../config';
+import { type AgentConnectionSlot } from './schema';
+export declare class PersonalRecoveryError extends Error {
+    constructor(mode?: 'recovery' | 'bootstrap');
+}
+export declare const capturePersonalBootstrap: (config: Config) => {
+    instanceUrl: string;
+    proxyAuthorization: string | null;
+    publicTextIsSafe: (value: string, extraSecrets?: readonly string[]) => boolean;
+    publicSecrets: (string | undefined)[];
+    fetch: ({ method, url, signal, body, }: {
+        method: 'GET' | 'DELETE' | 'POST';
+        url: string;
+        signal: AbortSignal;
+        body: string | undefined;
+    }) => Promise<fetch.Response>;
+};
+export declare const capturePersonalRecovery: (config: Config) => (slot: AgentConnectionSlot) => {
+    fetch: (request: {
+        method: 'GET' | 'DELETE';
+        url: string;
+        signal: AbortSignal;
+        body: undefined;
+    }) => Promise<fetch.Response>;
+};
+//# sourceMappingURL=personalRecovery.d.ts.map

package/dist/agentConnections/personalRecovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"personalRecovery.d.ts","sourceRoot":"","sources":["../../src/agentConnections/personalRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAIxC,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAG1E,qBAAa,qBAAsB,SAAQ,KAAK;IAC5C,YAAY,IAAI,GAAE,UAAU,GAAG,WAAwB,EAMtD;CACJ;AAqDD,eAAO,MAAM,wBAAwB,WAAY,MAAM;;;8BA9BhC,MAAM,iBACC,SAAS,MAAM,EAAE;;4CAahC;QACC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,WAAW,CAAC;QACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;KAC5B;CAmBZ,CAAC;AAEF,eAAO,MAAM,uBAAuB,WAAY,MAAM,YAEpC,mBAAmB;IAGzB,KAAK,YAAkB;QACnB,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,WAAW,CAAC;QACpB,IAAI,EAAE,SAAS,CAAC;KACnB;CAQZ,CAAC"}

package/dist/agentConnections/personalRecovery.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capturePersonalRecovery = exports.capturePersonalBootstrap = exports.PersonalRecoveryError = void 0;
+const tslib_1 = require("tslib");
+const node_fetch_1 = tslib_1.__importDefault(require("node-fetch"));
+const credentials_1 = require("../credentials");
+const utils_1 = require("../handlers/utils");
+const apiUrl_1 = require("./apiUrl");
+const schema_1 = require("./schema");
+const statusResponse_1 = require("./statusResponse");
+class PersonalRecoveryError extends Error {
+    constructor(mode = 'recovery') {
+        super(mode === 'bootstrap'
+            ? 'Agent connection approval requires a personal CLI login. Service account credentials cannot start approval.'
+            : 'The personal CLI login does not match this connection person and organisation.');
+    }
+}
+exports.PersonalRecoveryError = PersonalRecoveryError;
+const capturePersonalTransport = (config) => {
+    const instanceUrl = config.context?.serverUrl;
+    const token = config.context?.apiKey;
+    const headers = token ? (0, utils_1.buildRequestHeaders)(token) : null;
+    if (headers && config.context?.proxyAuthorization)
+        headers['Proxy-Authorization'] = config.context.proxyAuthorization;
+    return (expectedInstance) => {
+        if (!instanceUrl ||
+            !token ||
+            !headers ||
+            (0, credentials_1.humanCredential)(token).kind !== 'human_api_key' ||
+            (expectedInstance !== null &&
+                (0, schema_1.canonicalInstanceUrl)(instanceUrl) !== expectedInstance))
+            throw new PersonalRecoveryError();
+        const canonical = (0, schema_1.canonicalInstanceUrl)(instanceUrl);
+        return {
+            instanceUrl: canonical,
+            proxyAuthorization: headers['Proxy-Authorization'] ?? null,
+            publicTextIsSafe: (value, extraSecrets = []) => (0, statusResponse_1.publicTextIsSafe)(value, [token, headers['Proxy-Authorization'], ...extraSecrets], 8192),
+            publicSecrets: [token, headers['Proxy-Authorization']],
+            fetch: async ({ method, url, signal, body, }) => {
+                const response = await (0, node_fetch_1.default)((0, apiUrl_1.agentConnectionApiUrl)(instanceUrl, url), { method, headers, signal, body, redirect: 'error' });
+                return response;
+            },
+        };
+    };
+};
+const capturePersonalBootstrap = (config) => {
+    try {
+        return capturePersonalTransport(config)(null);
+    }
+    catch (error) {
+        if (error instanceof PersonalRecoveryError)
+            throw new PersonalRecoveryError('bootstrap');
+        throw error;
+    }
+};
+exports.capturePersonalBootstrap = capturePersonalBootstrap;
+const capturePersonalRecovery = (config) => {
+    const capture = capturePersonalTransport(config);
+    return (slot) => {
+        const transport = capture(slot.instanceUrl);
+        return {
+            fetch: async (request) => {
+                const response = await transport.fetch(request);
+                if (!response.ok)
+                    throw new Error('Personal recovery was not confirmed.');
+                return response;
+            },
+        };
+    };
+};
+exports.capturePersonalRecovery = capturePersonalRecovery;

package/dist/agentConnections/projectSelection.d.ts

@@ -0,0 +1,4 @@
+import { type Config } from '../config';
+export declare const resolveAgentConnectionProject: (value?: string) => Promise<string>;
+export declare const configWithAgentProject: (config: Config) => Promise<Config>;
+//# sourceMappingURL=projectSelection.d.ts.map

package/dist/agentConnections/projectSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectSelection.d.ts","sourceRoot":"","sources":["../../src/agentConnections/projectSelection.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAInD,eAAO,MAAM,6BAA6B,WAC9B,MAAM,KACf,OAAO,CAAC,MAAM,CAyChB,CAAC;AAEF,eAAO,MAAM,sBAAsB,WACvB,MAAM,KACf,OAAO,CAAC,MAAM,CAUf,CAAC"}

package/dist/agentConnections/projectSelection.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configWithAgentProject = exports.resolveAgentConnectionProject = void 0;
+const common_1 = require("@lightdash/common");
+const config_1 = require("../config");
+const credentials_1 = require("../credentials");
+const apiClient_1 = require("../handlers/dbt/apiClient");
+const resolveAgentConnectionProject = async (value) => {
+    if (value &&
+        /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value))
+        return value;
+    const credential = await (0, credentials_1.resolveCredential)(await (0, config_1.getConfig)({ readOnly: true }));
+    if (credential.kind !== 'agent_connection')
+        throw new Error('An agent connection credential is required.');
+    const approved = credential.slot.lastReported.approvedProjects;
+    if (value === undefined) {
+        if (approved.length === 1)
+            return approved[0].projectUuid;
+        throw new common_1.ParameterError('This agent connection needs an explicit project. Pass --project on a command that supports it, or select a connection with one approved project.');
+    }
+    const matches = await approved.reduce(async (pending, { projectUuid }) => {
+        const found = await pending;
+        const project = await (0, apiClient_1.lightdashApi)({
+            method: 'GET',
+            url: `/api/v1/projects/${projectUuid}`,
+            body: undefined,
+        });
+        if (project.projectUuid !== projectUuid)
+            throw new Error('The server returned a different project for this agent connection.');
+        return project.slug === value ? [...found, projectUuid] : found;
+    }, Promise.resolve([]));
+    if (matches.length !== 1)
+        throw new common_1.ParameterError('The project slug must match exactly one approved, accessible project for this agent connection. Pass --project with its UUID.');
+    return matches[0];
+};
+exports.resolveAgentConnectionProject = resolveAgentConnectionProject;
+const configWithAgentProject = async (config) => ({
+    ...config,
+    context: {
+        ...config.context,
+        project: await (0, exports.resolveAgentConnectionProject)(),
+        projectName: undefined,
+        previewProject: undefined,
+        previewName: undefined,
+        source: undefined,
+    },
+});
+exports.configWithAgentProject = configWithAgentProject;