@lightdash/cli 2.562.0 → 2.563.0

package/dist/agentConnections/providerProcess.fixture.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=providerProcess.fixture.d.ts.map

package/dist/agentConnections/providerProcess.fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerProcess.fixture.d.ts","sourceRoot":"","sources":["../../src/agentConnections/providerProcess.fixture.ts"],"names":[],"mappings":""}

package/dist/agentConnections/providerProcess.fixture.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const agentTokenProvider_1 = require("./agentTokenProvider");
+const fixtures_1 = require("./fixtures");
+const store_1 = require("./store");
+const run = async () => {
+    const store = new store_1.AgentConnectionStore(process.argv[2]);
+    const slot = { ...(0, fixtures_1.slotFixture)(), instanceUrl: process.argv[3] };
+    const result = await new agentTokenProvider_1.AgentTokenProvider(store).getToken(slot);
+    process.stdout.write(JSON.stringify({
+        generation: result.tokens.generation,
+        rotated: result.tokens.accessToken === 'new-access' &&
+            result.tokens.refreshToken === 'new-refresh',
+    }));
+};
+void run().catch((error) => {
+    process.stderr.write(error.message);
+    process.exitCode = 1;
+});

package/dist/agentConnections/requestPolicy.d.ts

@@ -0,0 +1,11 @@
+type RequestPolicy = {
+    method: string;
+    path: string;
+    operation: string;
+    safeRead: boolean;
+};
+export declare const REQUEST_POLICY: readonly RequestPolicy[];
+export declare const isAgentRequestAllowed: (method: string, url: string) => boolean;
+export declare const assertAgentRequestAllowed: (method: string, url: string) => void;
+export {};
+//# sourceMappingURL=requestPolicy.d.ts.map

package/dist/agentConnections/requestPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestPolicy.d.ts","sourceRoot":"","sources":["../../src/agentConnections/requestPolicy.ts"],"names":[],"mappings":"AAAA,KAAK,aAAa,GAAG;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACrB,CAAC;AAOF,eAAO,MAAM,cAAc,EAAE,SAAS,aAAa,EAgPlD,CAAC;AAEF,eAAO,MAAM,qBAAqB,WAAY,MAAM,OAAO,MAAM,KAAG,OAenE,CAAC;AAEF,eAAO,MAAM,yBAAyB,WAC1B,MAAM,OACT,MAAM,KACZ,IAKF,CAAC"}

package/dist/agentConnections/requestPolicy.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertAgentRequestAllowed = exports.isAgentRequestAllowed = exports.REQUEST_POLICY = void 0;
+const route = (method, path, operation) => ({ method, path, operation, safeRead: method === 'GET' });
+exports.REQUEST_POLICY = [
+    route('GET', '/api/v1/user', 'UserController.getAuthenticatedUser'),
+    route('GET', '/api/v1/health', 'apiV1Router GET /health'),
+    route('GET', '/api/v2/user/agent-connections/:grant/status', 'AgentConnectionController.getConnectionStatus'),
+    route('DELETE', '/api/v2/user/agent-connections/:grant', 'AgentConnectionController.revoke'),
+    route('GET', '/api/v2/projects/:project/ai-access/me', 'AiAccessController.getMyAccess'),
+    route('GET', '/api/v1/projects/:project', 'ProjectController.getProject'),
+    route('GET', '/api/v1/projects/:project/dbt/manifest', 'ProjectController.getMergedManifest'),
+    route('GET', '/api/v1/projects/:project/dbt-exposures', 'ProjectController.GetDbtExposures'),
+    route('GET', '/api/v1/projects/:project/explores', 'ExploreController.GetExplores'),
+    route('GET', '/api/v1/projects/:project/explores/:explore', 'ExploreController.GetExplore'),
+    route('GET', '/api/v2/projects/:project/query/:query', 'QueryController.getAsyncQueryResults'),
+    route('POST', '/api/v2/projects/:project/query/sql', 'QueryController.executeAsyncSqlQuery'),
+    route('POST', '/api/v2/projects/:project/query/metric-query', 'QueryController.executeAsyncMetricQuery'),
+    route('GET', '/api/v1/projects/:project/sqlRunner/fields', 'SqlRunnerController.getTableFields'),
+    route('GET', '/api/v1/projects/:project/sqlRunner/tables', 'SqlRunnerController.getTables'),
+    route('POST', '/api/v1/projects/:project/sqlRunner/refresh-catalog', 'SqlRunnerController.refreshSqlRunnerCatalog'),
+    route('POST', '/api/v1/projects/:project/refresh', 'ProjectController.refresh'),
+    route('PUT', '/api/v1/projects/:project/tags/yaml', 'ProjectController.replaceYamlTags'),
+    route('PUT', '/api/v2/projects/:project/parameters', 'ParametersController.replaceParameters'),
+    route('PUT', '/api/v2/projects/:project/defaults', 'ProjectDefaultsController.replaceProjectDefaults'),
+    route('PUT', '/api/v1/projects/:project/table-groups', 'ProjectController.replaceProjectTableGroups'),
+    route('POST', '/api/v2/projects/:project/deploy', 'DeployController.startDeploySession'),
+    route('POST', '/api/v2/projects/:project/deploy/:session/batch', 'DeployController.addDeployBatch'),
+    route('POST', '/api/v2/projects/:project/deploy/:session/finalize', 'DeployController.finalizeDeploySession'),
+    route('PUT', '/api/v2/projects/:project/deploy', 'DeployController.deployExplores'),
+    route('PUT', '/api/v1/projects/:project/explores', 'ExploreController.SetExplores'),
+    route('GET', '/api/v2/content', 'ContentController.listContent'),
+    route('GET', '/api/v1/ee/projects/:project/apps', 'AppGenerateController.listProjectApps'),
+    route('GET', '/api/v1/ee/projects/:project/apps/chart-types', 'AppGenerateController.listProjectChartTypes'),
+    route('GET', '/api/v1/ee/projects/:project/apps/:app/download', 'AppGenerateController.getAppCode'),
+    route('GET', '/api/v1/projects/:project/spaces', 'ProjectController.getSpacesInProject'),
+    route('GET', '/api/v1/projects/:project/dashboards', 'ProjectController.getDashboards'),
+    route('GET', '/api/v1/projects/:project/dbt-sources', 'ProjectDbtSourcesController.listProjectDbtSources'),
+    route('GET', '/api/v1/projects/:project/validate', 'ValidationController.get'),
+    route('GET', '/api/v1/projects/:project/code/charts', 'ProjectCoderController.getChartsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/dashboards', 'ProjectCoderController.getDashboardsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/sqlCharts', 'ProjectCoderController.getSqlChartsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/virtualViews', 'ProjectCoderController.getVirtualViewsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/externalConnections', 'ProjectCoderController.getExternalConnectionsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/documents', 'ProjectCoderController.getDocumentsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/aiAgents', 'ProjectCoderController.getAiAgentsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/alerts', 'ProjectCoderController.getAlertsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/googleSheets', 'ProjectCoderController.getGoogleSheetsSyncsAsCode'),
+    route('GET', '/api/v1/projects/:project/code/scheduledDeliveries', 'ProjectCoderController.getScheduledDeliveriesAsCode'),
+    route('GET', '/api/v1/projects/:project/code/homepages', 'ProjectCoderController.getHomepagesAsCode'),
+    route('GET', '/api/v1/projects/:project/code/spaces', 'ProjectCoderController.getCodeSpaces'),
+    route('GET', '/api/v1/projects/:project/code/upload-advisory', 'ProjectCoderController.getContentAsCodeUploadAdvisory'),
+    route('POST', '/api/v1/projects/:project/code/charts/:slug', 'ProjectCoderController.upsertChartAsCode'),
+    route('POST', '/api/v1/projects/:project/code/dashboards/:slug', 'ProjectCoderController.upsertDashboardAsCode'),
+    route('POST', '/api/v1/projects/:project/code/sqlCharts/:slug', 'ProjectCoderController.upsertSqlChartAsCode'),
+    route('POST', '/api/v1/projects/:project/code/virtualViews/:slug', 'ProjectCoderController.upsertVirtualViewAsCode'),
+];
+const isAgentRequestAllowed = (method, url) => {
+    const path = url.split(/[?#]/, 1)[0];
+    const parts = path.split('/');
+    return exports.REQUEST_POLICY.some((entry) => {
+        if (entry.method !== method)
+            return false;
+        const pattern = entry.path.split('/');
+        return (parts.length === pattern.length &&
+            pattern.every((part, index) => part.startsWith(':')
+                ? parts[index].length > 0
+                : part === parts[index]));
+    });
+};
+exports.isAgentRequestAllowed = isAgentRequestAllowed;
+const assertAgentRequestAllowed = (method, url) => {
+    if (!(0, exports.isAgentRequestAllowed)(method, url))
+        throw new Error('This request is not available with an agent connection. No request was sent.');
+};
+exports.assertAgentRequestAllowed = assertAgentRequestAllowed;

package/dist/agentConnections/schema.d.ts

@@ -0,0 +1,66 @@
+import { AgentCapability } from '@lightdash/common';
+export type SlotKey = {
+    instanceUrl: string;
+    organizationUuid: string;
+    personUuid: string;
+    name: string;
+};
+export type AgentConnectionStatusReason = 'invalid_grant' | 'not_supported' | 'revoked' | 'expired' | 'agent_identity_disabled' | 'project_access' | 'person_permission' | 'agent_policy';
+export type AgentConnectionSlot = SlotKey & {
+    clientId: 'lightdash-cli';
+    resource: string;
+    grantUuid: string;
+    grantRevision: number | null;
+    approvedAt: string;
+    grantExpiresAt: string;
+    tokens: {
+        accessToken: string;
+        accessTokenExpiresAt: string;
+        refreshToken: string;
+        refreshTokenExpiresAt: string | null;
+        scopes: string[];
+        generation: number;
+        lastRefreshAttemptUuid: string | null;
+    };
+    lastReported: {
+        checkedAt: string;
+        limitsStatus: 'ok' | 'invalid';
+        approvedProjects: {
+            projectUuid: string;
+            name: string | null;
+            approvedCapabilities: AgentCapability[];
+        }[];
+        effectiveProjects: {
+            projectUuid: string;
+            capabilities: {
+                capability: AgentCapability;
+                allowed: boolean;
+                reason: AgentConnectionStatusReason | null;
+            }[];
+        }[];
+        status: 'active' | 'expired' | 'revoked';
+        lastUsedAt: string | null;
+        revokedAt: string | null;
+    };
+    refreshState: {
+        kind: 'idle';
+    } | {
+        kind: 'in_progress';
+        attemptUuid: string;
+        startedAt: string;
+    } | {
+        kind: 'reconnect_required';
+        since: string;
+    };
+    revokeState: {
+        kind: 'none';
+    } | {
+        kind: 'unconfirmed';
+        attemptedAt: string;
+    };
+};
+export declare const invalidConnection: () => Error;
+export declare const canonicalInstanceUrl: (input: string) => string;
+export declare const slotValidator: (value: unknown) => value is AgentConnectionSlot;
+export declare const validateSlot: (value: unknown, key: SlotKey) => AgentConnectionSlot;
+//# sourceMappingURL=schema.d.ts.map

package/dist/agentConnections/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/agentConnections/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAIpD,MAAM,MAAM,OAAO,GAAG;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CAChB,CAAC;AACF,MAAM,MAAM,2BAA2B,GACjC,eAAe,GACf,eAAe,GACf,SAAS,GACT,SAAS,GACT,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,CAAC;AACrB,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG;IACxC,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,YAAY,EAAE,MAAM,CAAC;QACrB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;KACzC,CAAC;IACF,YAAY,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,IAAI,GAAG,SAAS,CAAC;QAC/B,gBAAgB,EAAE;YACd,WAAW,EAAE,MAAM,CAAC;YACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,oBAAoB,EAAE,eAAe,EAAE,CAAC;SAC3C,EAAE,CAAC;QACJ,iBAAiB,EAAE;YACf,WAAW,EAAE,MAAM,CAAC;YACpB,YAAY,EAAE;gBACV,UAAU,EAAE,eAAe,CAAC;gBAC5B,OAAO,EAAE,OAAO,CAAC;gBACjB,MAAM,EAAE,2BAA2B,GAAG,IAAI,CAAC;aAC9C,EAAE,CAAC;SACP,EAAE,CAAC;QACJ,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,YAAY,EACN;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAChB;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC/D;QAAE,IAAI,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,WAAW,EACL;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAChB;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD,CAAC;AACF,eAAO,MAAM,iBAAiB,QAAO,KAGhC,CAAC;AACN,eAAO,MAAM,oBAAoB,UAAW,MAAM,KAAG,MAmBpD,CAAC;AAsHF,eAAO,MAAM,aAAa,UAAW,OAAO,KAAG,KAAK,IAAI,mBAGvD,CAAC;AACF,eAAO,MAAM,YAAY,UACd,OAAO,OACT,OAAO,KACb,mBAuDF,CAAC"}

package/dist/agentConnections/schema.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSlot = exports.slotValidator = exports.canonicalInstanceUrl = exports.invalidConnection = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const ajv_1 = tslib_1.__importDefault(require("ajv"));
+const ajv_formats_1 = tslib_1.__importDefault(require("ajv-formats"));
+const invalidConnection = () => new Error('Invalid agent connection data. Reconnect before using this slot.');
+exports.invalidConnection = invalidConnection;
+const canonicalInstanceUrl = (input) => {
+    try {
+        const url = new URL(input);
+        if (url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            (url.protocol !== 'https:' &&
+                !(url.protocol === 'http:' &&
+                    ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))))
+            throw (0, exports.invalidConnection)();
+        return url.href.replace(/\/+$/, '');
+    }
+    catch {
+        throw (0, exports.invalidConnection)();
+    }
+};
+exports.canonicalInstanceUrl = canonicalInstanceUrl;
+const text = { type: 'string', minLength: 1 };
+const uuid = { type: 'string', format: 'uuid' };
+const date = {
+    type: 'string',
+    format: 'date-time',
+    pattern: '^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
+};
+const nullable = (schema) => ({ anyOf: [schema, { type: 'null' }] });
+const object = (properties) => ({
+    type: 'object',
+    properties,
+    required: Object.keys(properties),
+});
+const array = (items) => ({ type: 'array', items, uniqueItems: true });
+const capability = { enum: Object.values(common_1.AgentCapability) };
+const createSlotValidator = () => {
+    const ajv = new ajv_1.default();
+    (0, ajv_formats_1.default)(ajv);
+    return ajv.compile(object({
+        instanceUrl: text,
+        organizationUuid: uuid,
+        personUuid: uuid,
+        name: {
+            type: 'string',
+            pattern: '^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$',
+        },
+        clientId: { const: 'lightdash-cli' },
+        resource: text,
+        grantUuid: uuid,
+        grantRevision: nullable({ type: 'integer', minimum: 1 }),
+        approvedAt: date,
+        grantExpiresAt: date,
+        tokens: object({
+            accessToken: text,
+            accessTokenExpiresAt: date,
+            refreshToken: text,
+            refreshTokenExpiresAt: nullable(date),
+            scopes: {
+                ...array({
+                    type: 'string',
+                    pattern: '^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$',
+                }),
+                minItems: 1,
+            },
+            generation: {
+                type: 'integer',
+                minimum: 1,
+                maximum: Number.MAX_SAFE_INTEGER,
+            },
+            lastRefreshAttemptUuid: nullable(uuid),
+        }),
+        lastReported: object({
+            checkedAt: date,
+            limitsStatus: { enum: ['ok', 'invalid'] },
+            approvedProjects: array(object({
+                projectUuid: uuid,
+                name: nullable({ type: 'string' }),
+                approvedCapabilities: array(capability),
+            })),
+            effectiveProjects: array(object({
+                projectUuid: uuid,
+                capabilities: array(object({
+                    capability,
+                    allowed: { type: 'boolean' },
+                    reason: {
+                        enum: [
+                            null,
+                            'invalid_grant',
+                            'not_supported',
+                            'revoked',
+                            'expired',
+                            'agent_identity_disabled',
+                            'project_access',
+                            'person_permission',
+                            'agent_policy',
+                        ],
+                    },
+                })),
+            })),
+            status: { enum: ['active', 'expired', 'revoked'] },
+            lastUsedAt: nullable(date),
+            revokedAt: nullable(date),
+        }),
+        refreshState: {
+            oneOf: [
+                object({ kind: { const: 'idle' } }),
+                object({
+                    kind: { const: 'in_progress' },
+                    attemptUuid: uuid,
+                    startedAt: date,
+                }),
+                object({
+                    kind: { const: 'reconnect_required' },
+                    since: date,
+                }),
+            ],
+        },
+        revokeState: {
+            oneOf: [
+                object({ kind: { const: 'none' } }),
+                object({
+                    kind: { const: 'unconfirmed' },
+                    attemptedAt: date,
+                }),
+            ],
+        },
+    }));
+};
+let validator = null;
+const slotValidator = (value) => {
+    validator ??= createSlotValidator();
+    return validator(value);
+};
+exports.slotValidator = slotValidator;
+const validateSlot = (value, key) => {
+    if (!(0, exports.slotValidator)(value))
+        throw (0, exports.invalidConnection)();
+    if (value.instanceUrl !== (0, exports.canonicalInstanceUrl)(value.instanceUrl) ||
+        value.resource !== value.instanceUrl ||
+        value.instanceUrl !== key.instanceUrl ||
+        value.organizationUuid !== key.organizationUuid ||
+        value.personUuid !== key.personUuid ||
+        value.name !== key.name ||
+        Date.parse(value.approvedAt) >= Date.parse(value.grantExpiresAt) ||
+        Date.parse(value.tokens.accessTokenExpiresAt) >
+            Date.parse(value.grantExpiresAt) ||
+        (value.tokens.refreshTokenExpiresAt !== null &&
+            Date.parse(value.tokens.refreshTokenExpiresAt) >
+                Date.parse(value.grantExpiresAt)))
+        throw (0, exports.invalidConnection)();
+    const approved = new Map(value.lastReported.approvedProjects.map((p) => [
+        p.projectUuid,
+        p.approvedCapabilities,
+    ]));
+    const effective = new Set(value.lastReported.effectiveProjects.map((p) => p.projectUuid));
+    if (approved.size !== value.lastReported.approvedProjects.length ||
+        effective.size !== value.lastReported.effectiveProjects.length ||
+        approved.size !== effective.size)
+        throw (0, exports.invalidConnection)();
+    for (const project of value.lastReported.effectiveProjects) {
+        const capabilities = approved.get(project.projectUuid);
+        if (!capabilities ||
+            new Set(project.capabilities.map((c) => c.capability)).size !==
+                project.capabilities.length ||
+            (value.lastReported.limitsStatus === 'ok' &&
+                project.capabilities.length !== capabilities.length) ||
+            (value.lastReported.limitsStatus === 'invalid' &&
+                (capabilities.length !== 0 ||
+                    project.capabilities.some((c) => c.allowed || c.reason !== 'invalid_grant'))) ||
+            project.capabilities.some((c) => (value.lastReported.limitsStatus === 'ok' &&
+                !capabilities.includes(c.capability)) ||
+                c.allowed !== (c.reason === null)))
+            throw (0, exports.invalidConnection)();
+    }
+    return value;
+};
+exports.validateSlot = validateSlot;

package/dist/agentConnections/statusResponse.d.ts

@@ -0,0 +1,10 @@
+import { type AgentConnectionSlot, type AgentConnectionStatusReason } from './schema';
+export declare class ConnectionMismatchError extends Error {
+    constructor();
+}
+export declare const responseRecord: (value: unknown) => Record<string, unknown>;
+export declare const publicTextIsSafe: (value: string, secrets: readonly (string | null | undefined)[], maxLength?: number) => boolean;
+export declare const publicConnectionReport: (slot: AgentConnectionSlot, extraSecrets?: readonly (string | null | undefined)[]) => AgentConnectionSlot['lastReported'];
+export declare const connectionResponse: (value: unknown, slot: AgentConnectionSlot, requireEffective: boolean, extraSecrets?: readonly (string | null | undefined)[]) => AgentConnectionSlot;
+export declare const statusReasonMessage: (reason: AgentConnectionStatusReason | null) => string | null;
+//# sourceMappingURL=statusResponse.d.ts.map

package/dist/agentConnections/statusResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statusResponse.d.ts","sourceRoot":"","sources":["../../src/agentConnections/statusResponse.ts"],"names":[],"mappings":"AACA,OAAO,EAEH,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EACnC,MAAM,UAAU,CAAC;AAElB,qBAAa,uBAAwB,SAAQ,KAAK;IAC9C,cAEC;CACJ;AACD,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAIrE,CAAC;AACF,eAAO,MAAM,gBAAgB,UAClB,MAAM,WACJ,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,yBAEhD,OAwBF,CAAC;AACF,eAAO,MAAM,sBAAsB,SACzB,mBAAmB,iBACX,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,KACrD,mBAAmB,CAAC,cAAc,CA2BnC,CAAC;AACH,eAAO,MAAM,kBAAkB,UACpB,OAAO,QACR,mBAAmB,oBACP,OAAO,iBACV,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,KACtD,mBA0EF,CAAC;AACF,eAAO,MAAM,mBAAmB,WACpB,2BAA2B,GAAG,IAAI,KAC3C,MAAM,GAAG,IA0BX,CAAC"}

package/dist/agentConnections/statusResponse.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statusReasonMessage = exports.connectionResponse = exports.publicConnectionReport = exports.publicTextIsSafe = exports.responseRecord = exports.ConnectionMismatchError = void 0;
+const common_1 = require("@lightdash/common");
+const schema_1 = require("./schema");
+class ConnectionMismatchError extends Error {
+    constructor() {
+        super('The server returned a different connection.');
+    }
+}
+exports.ConnectionMismatchError = ConnectionMismatchError;
+const responseRecord = (value) => {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error('The server returned invalid connection data.');
+    return Object.fromEntries(Object.entries(value));
+};
+exports.responseRecord = responseRecord;
+const publicTextIsSafe = (value, secrets, maxLength = 2048) => {
+    if (value.length > maxLength)
+        return false;
+    const containsSecret = (text) => secrets.some((secret) => secret && text.includes(secret));
+    let decoded = value;
+    while (true) {
+        if (containsSecret(decoded))
+            return false;
+        if (URL.canParse(decoded)) {
+            const url = new URL(decoded);
+            if (containsSecret(url.href) ||
+                [...url.searchParams].some(([key, item]) => containsSecret(key) || containsSecret(item)))
+                return false;
+        }
+        const next = decoded.replace(/(?:%[0-9a-f]{2})+/gi, (encoded) => Buffer.from(encoded.replaceAll('%', ''), 'hex').toString('utf8'));
+        if (next === decoded)
+            return true;
+        decoded = next;
+    }
+};
+exports.publicTextIsSafe = publicTextIsSafe;
+const publicConnectionReport = (slot, extraSecrets = []) => ({
+    checkedAt: slot.lastReported.checkedAt,
+    status: slot.lastReported.status,
+    limitsStatus: slot.lastReported.limitsStatus,
+    lastUsedAt: slot.lastReported.lastUsedAt,
+    revokedAt: slot.lastReported.revokedAt,
+    approvedProjects: slot.lastReported.approvedProjects.map((project) => ({
+        projectUuid: project.projectUuid,
+        name: project.name !== null &&
+            !(0, exports.publicTextIsSafe)(project.name, [
+                slot.tokens.accessToken,
+                slot.tokens.refreshToken,
+                ...extraSecrets,
+            ])
+            ? null
+            : project.name,
+        approvedCapabilities: project.approvedCapabilities,
+    })),
+    effectiveProjects: slot.lastReported.effectiveProjects.map((project) => ({
+        projectUuid: project.projectUuid,
+        capabilities: project.capabilities.map((action) => ({
+            capability: action.capability,
+            allowed: action.allowed,
+            reason: action.reason,
+        })),
+    })),
+});
+exports.publicConnectionReport = publicConnectionReport;
+const connectionResponse = (value, slot, requireEffective, extraSecrets) => {
+    const envelope = (0, exports.responseRecord)(value);
+    if (envelope.status !== 'ok')
+        throw new Error('The server returned invalid connection data.');
+    const record = (0, exports.responseRecord)(envelope.results);
+    if (['grantUuid', 'name', 'clientId', 'approvedAt', 'expiresAt'].some((field) => typeof record[field] !== 'string'))
+        throw new Error('The server returned invalid connection data.');
+    if (record.grantUuid !== slot.grantUuid ||
+        record.name !== slot.name ||
+        record.clientId !== slot.clientId ||
+        record.approvedAt !== slot.approvedAt ||
+        record.expiresAt !== slot.grantExpiresAt)
+        throw new ConnectionMismatchError();
+    const revokedProjects = !requireEffective && Array.isArray(record.approvedProjects)
+        ? record.approvedProjects.map((entry) => {
+            const project = (0, exports.responseRecord)(entry);
+            return {
+                projectUuid: project.projectUuid,
+                capabilities: Array.isArray(project.approvedCapabilities)
+                    ? project.approvedCapabilities.map((capability) => ({
+                        capability,
+                        allowed: false,
+                        reason: 'revoked',
+                    }))
+                    : null,
+            };
+        })
+        : null;
+    const checked = (0, schema_1.validateSlot)({
+        ...slot,
+        lastReported: {
+            checkedAt: new Date().toISOString(),
+            limitsStatus: record.limitsStatus,
+            approvedProjects: record.approvedProjects,
+            effectiveProjects: requireEffective
+                ? record.effectiveProjects
+                : revokedProjects,
+            status: record.status,
+            lastUsedAt: record.lastUsedAt,
+            revokedAt: record.revokedAt,
+        },
+    }, slot);
+    if (checked.lastReported.status === 'revoked' &&
+        checked.lastReported.revokedAt === null)
+        throw new Error('The server returned invalid revocation data.');
+    if (extraSecrets === undefined &&
+        checked.lastReported.approvedProjects.some((project) => project.name !== null &&
+            [slot.tokens.accessToken, slot.tokens.refreshToken].some((secret) => project.name?.includes(secret))))
+        throw new Error('The server returned unsafe connection data.');
+    return {
+        ...checked,
+        lastReported: (0, exports.publicConnectionReport)(checked, extraSecrets),
+    };
+};
+exports.connectionResponse = connectionResponse;
+const statusReasonMessage = (reason) => {
+    switch (reason) {
+        case null:
+            return null;
+        case 'invalid_grant':
+            return 'Connection limits are invalid.';
+        case 'not_supported':
+            return 'This action is not available to agent connections.';
+        case 'revoked':
+            return 'This connection was revoked.';
+        case 'expired':
+            return 'This connection expired.';
+        case 'agent_identity_disabled':
+            return 'Agent identity is disabled.';
+        case 'project_access':
+            return 'You no longer have access to this project.';
+        case 'person_permission':
+            return 'Your role does not allow this action.';
+        case 'agent_policy':
+            return "Your organisation's agent permissions do not allow this action.";
+        default:
+            return (0, common_1.assertUnreachable)(reason, 'Unknown connection status reason');
+    }
+};
+exports.statusReasonMessage = statusReasonMessage;

package/dist/agentConnections/store.d.ts

@@ -0,0 +1,36 @@
+import { type AgentConnectionSlot, type SlotKey } from './schema';
+export declare const getAgentConnectionsFilePath: () => string;
+export type RefreshJournal = {
+    grantUuid: string;
+    attemptUuid: string;
+    generation: number;
+};
+export type LockedStore = {
+    readSlot: (key: SlotKey) => Promise<AgentConnectionSlot | null>;
+    saveSlot: (slot: AgentConnectionSlot) => Promise<void>;
+    readJournal: (key: SlotKey) => Promise<RefreshJournal | null>;
+    writeJournal: (key: SlotKey, journal: RefreshJournal) => Promise<void>;
+    clearJournal: (key: SlotKey) => Promise<void>;
+    discardStaleJournal: (slot: AgentConnectionSlot) => Promise<void>;
+};
+export declare class AgentConnectionStore {
+    readonly filePath: string;
+    constructor(filePath?: string);
+    private readRoot;
+    readSlot(key: SlotKey): Promise<AgentConnectionSlot | null>;
+    private saveUnlocked;
+    private journalPath;
+    private journalIsStale;
+    readLifecycleSlot(key: SlotKey): Promise<AgentConnectionSlot | null>;
+    withLock<T>(callback: (locked: LockedStore) => Promise<T>): Promise<T>;
+    saveSlot(slot: AgentConnectionSlot, precondition?: (previous: AgentConnectionSlot | null) => void): Promise<{
+        cleanupIncomplete: boolean;
+    }>;
+    private update;
+    updateTokens(key: SlotKey, tokens: AgentConnectionSlot['tokens']): Promise<void>;
+    setRefreshState(key: SlotKey, refreshState: AgentConnectionSlot['refreshState']): Promise<void>;
+    setRevokeState(key: SlotKey, revokeState: AgentConnectionSlot['revokeState']): Promise<void>;
+    removeSlot(key: SlotKey): Promise<void>;
+    removeSlotIfUnchanged(slot: AgentConnectionSlot): Promise<boolean>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/agentConnections/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/agentConnections/store.ts"],"names":[],"mappings":"AAWA,OAAO,EAGH,KAAK,mBAAmB,EACxB,KAAK,OAAO,EACf,MAAM,UAAU,CAAC;AAElB,eAAO,MAAM,2BAA2B,QAAO,MACsB,CAAC;AA4CtE,MAAM,MAAM,cAAc,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACtB,CAAC;AACF,MAAM,MAAM,WAAW,GAAG;IACtB,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAChE,QAAQ,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,mBAAmB,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE,CAAC;AAEF,qBAAa,oBAAoB;aAET,QAAQ,EAAE,MAAM;IADpC,YACoB,QAAQ,GAAE,MAAsC,EAChE;YAEU,QAAQ;IAchB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAIhE;YAEa,YAAY;IA+C1B,OAAO,CAAC,WAAW;YAcL,cAAc;IAkBtB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAQzE;IAEK,QAAQ,CAAC,CAAC,EACZ,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9C,OAAO,CAAC,CAAC,CAAC,CAqDZ;IAEK,QAAQ,CACV,IAAI,EAAE,mBAAmB,EACzB,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,KAAK,IAAI,GAC9D,OAAO,CAAC;QAAE,iBAAiB,EAAE,OAAO,CAAA;KAAE,CAAC,CAmBzC;YAEa,MAAM;IAcd,YAAY,CACd,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAKf;IACK,eAAe,CACjB,GAAG,EAAE,OAAO,EACZ,YAAY,EAAE,mBAAmB,CAAC,cAAc,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,CAEf;IACK,cAAc,CAChB,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,mBAAmB,CAAC,aAAa,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAEf;IACK,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5C;IACK,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBvE;CACJ"}