@lightdash/cli 3.86.0 → 3.88.0

package/dist/personalLogin/store.d.ts

@@ -0,0 +1,24 @@
+import { type PersonalLogin } from './schema';
+export type RefreshJournal = {
+    attemptUuid: string;
+    generation: number;
+};
+export type LockedPersonalLoginStore = {
+    read: (instanceUrl: string) => Promise<PersonalLogin | null>;
+    save: (instanceUrl: string, login: PersonalLogin) => Promise<void>;
+    remove: (instanceUrl: string) => Promise<void>;
+    readJournal: (instanceUrl: string) => Promise<RefreshJournal | null>;
+    writeJournal: (instanceUrl: string, journal: RefreshJournal) => Promise<void>;
+    clearJournal: (instanceUrl: string) => Promise<void>;
+};
+export declare class PersonalLoginStore {
+    readonly filePath: string;
+    constructor(filePath?: string);
+    private readRoot;
+    read(instanceUrl: string): Promise<PersonalLogin | null>;
+    private journalPath;
+    withLock<T>(callback: (locked: LockedPersonalLoginStore) => Promise<T>): Promise<T>;
+    save(instanceUrl: string, login: PersonalLogin): Promise<void>;
+    remove(instanceUrl: string): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/personalLogin/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/personalLogin/store.ts"],"names":[],"mappings":"AAaA,OAAO,EAGH,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,cAAc,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7D,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrE,YAAY,EAAE,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,KACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD,CAAC;AACF,qBAAa,kBAAkB;aAEP,QAAQ,EAAE,MAAM;IADpC,YACoB,QAAQ,GAAE,MAGzB,EACD;YAEU,QAAQ;IA8BhB,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAK7D;IAED,OAAO,CAAC,WAAW;IAOb,QAAQ,CAAC,CAAC,EACZ,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAmEZ;IAEK,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnE;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/C;CACJ"}

package/dist/personalLogin/store.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PersonalLoginStore = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const yaml = tslib_1.__importStar(require("js-yaml"));
+const path_1 = tslib_1.__importDefault(require("path"));
+const configLock_1 = require("../agentConnections/configLock");
+const config_1 = require("../config");
+const instanceKey_1 = require("./instanceKey");
+const schema_1 = require("./schema");
+class PersonalLoginStore {
+    filePath;
+    constructor(filePath = path_1.default.join(path_1.default.dirname(config_1.configFilePath), 'personal-logins.yaml')) {
+        this.filePath = filePath;
+    }
+    async readRoot() {
+        const contents = await (0, configLock_1.readPrivateFile)(this.filePath);
+        if (contents === null)
+            return new Map();
+        try {
+            const root = yaml.load(contents);
+            if (typeof root !== 'object' ||
+                root === null ||
+                !('version' in root) ||
+                root.version !== 1 ||
+                !('instances' in root) ||
+                typeof root.instances !== 'object' ||
+                root.instances === null ||
+                Array.isArray(root.instances) ||
+                Object.keys(root).some((key) => !['version', 'instances'].includes(key)))
+                throw (0, schema_1.invalidLogin)();
+            return new Map(Object.entries(root.instances).map(([url, login]) => {
+                if ((0, instanceKey_1.personalInstanceKey)(url) !== url)
+                    throw (0, schema_1.invalidLogin)();
+                return [url, (0, schema_1.validatePersonalLogin)(login)];
+            }));
+        }
+        catch {
+            throw (0, schema_1.invalidLogin)();
+        }
+    }
+    async read(instanceUrl) {
+        return ((await this.readRoot()).get((0, instanceKey_1.personalInstanceKey)(instanceUrl)) ??
+            null);
+    }
+    journalPath(instanceUrl) {
+        const hash = (0, crypto_1.createHash)('sha256')
+            .update((0, instanceKey_1.personalInstanceKey)(instanceUrl))
+            .digest('hex');
+        return `${this.filePath}.${hash}.journal`;
+    }
+    async withLock(callback) {
+        await (0, configLock_1.privateDirectory)(path_1.default.dirname(this.filePath));
+        const release = await (0, configLock_1.acquireLock)(`${this.filePath}.lock`);
+        const writeRoot = async (root) => (0, configLock_1.atomicWrite)(this.filePath, yaml.dump({ version: 1, instances: Object.fromEntries(root) }));
+        try {
+            return await callback({
+                read: (url) => this.read(url),
+                save: async (url, login) => {
+                    const root = await this.readRoot();
+                    root.set((0, instanceKey_1.personalInstanceKey)(url), (0, schema_1.validatePersonalLogin)(login));
+                    await writeRoot(root);
+                },
+                remove: async (url) => {
+                    const root = await this.readRoot();
+                    if (root.delete((0, instanceKey_1.personalInstanceKey)(url)))
+                        await writeRoot(root);
+                },
+                readJournal: async (url) => {
+                    const contents = await (0, configLock_1.readPrivateFile)(this.journalPath(url));
+                    if (contents === null)
+                        return null;
+                    try {
+                        const journal = JSON.parse(contents);
+                        if (typeof journal !== 'object' ||
+                            journal === null ||
+                            !('attemptUuid' in journal) ||
+                            typeof journal.attemptUuid !== 'string' ||
+                            !/^[a-f0-9-]{36}$/i.test(journal.attemptUuid) ||
+                            !('generation' in journal) ||
+                            typeof journal.generation !== 'number' ||
+                            !Number.isSafeInteger(journal.generation) ||
+                            journal.generation < 1)
+                            throw (0, schema_1.invalidLogin)();
+                        return {
+                            attemptUuid: journal.attemptUuid,
+                            generation: journal.generation,
+                        };
+                    }
+                    catch {
+                        throw (0, schema_1.invalidLogin)();
+                    }
+                },
+                writeJournal: (url, journal) => (0, configLock_1.atomicWrite)(this.journalPath(url), JSON.stringify(journal)),
+                clearJournal: async (url) => {
+                    await fs_1.promises
+                        .unlink(this.journalPath(url))
+                        .catch((error) => {
+                        if (!(0, configLock_1.isFsError)(error, 'ENOENT'))
+                            throw new Error('Cannot clear the personal login refresh journal.');
+                    });
+                },
+            });
+        }
+        finally {
+            await release();
+        }
+    }
+    async save(instanceUrl, login) {
+        await this.withLock(async (locked) => {
+            await locked.save(instanceUrl, login);
+            await locked.clearJournal(instanceUrl);
+        });
+    }
+    async remove(instanceUrl) {
+        await this.withLock(async (locked) => {
+            await locked.remove(instanceUrl);
+            await locked.clearJournal(instanceUrl);
+        });
+    }
+}
+exports.PersonalLoginStore = PersonalLoginStore;

package/dist/personalLogin/tokenProvider.d.ts

@@ -0,0 +1,31 @@
+import { type PersonalLogin } from './schema';
+import { PersonalLoginStore } from './store';
+export declare const freshLoginRequired = "Your CLI login needs a fresh `lightdash login`: the last token refresh did not complete.";
+export declare const sessionExpired = "Your CLI session expired. Run `lightdash login` again.";
+export declare const oauthHeaders: () => {
+    'Content-Type': string;
+    'User-Agent': string;
+    'Proxy-Authorization'?: string | undefined;
+};
+type TokenResponse = {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    scope: string;
+    session_expires_in?: number;
+};
+export declare const parseTokenResponse: (value: unknown) => TokenResponse;
+export declare const tokenExpiry: (response: TokenResponse, startedAt: number, dateHeader: string | null, deadline: number | null) => {
+    accessTokenIssuedAt: string;
+    accessTokenExpiresAt: string;
+    sessionExpiresAt: string;
+};
+export declare class PersonalLoginTokenProvider {
+    private readonly store;
+    constructor(store?: PersonalLoginStore);
+    getToken(instanceUrl: string, rejectedGeneration?: number | null): Promise<PersonalLogin>;
+    private markLoginRequired;
+}
+export {};
+//# sourceMappingURL=tokenProvider.d.ts.map

package/dist/personalLogin/tokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenProvider.d.ts","sourceRoot":"","sources":["../../src/personalLogin/tokenProvider.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAiC,MAAM,SAAS,CAAC;AAE5E,eAAO,MAAM,kBAAkB,6FAC+D,CAAC;AAC/F,eAAO,MAAM,cAAc,2DACiC,CAAC;AAC7D,eAAO,MAAM,YAAY;;;;CAMvB,CAAC;AACH,KAAK,aAAa,GAAG;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAoBF,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,aAWnD,CAAC;AACF,eAAO,MAAM,WAAW,aACV,aAAa,aACZ,MAAM,cACL,MAAM,GAAG,IAAI,YACf,MAAM,GAAG,IAAI;IAkBnB,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;CAEvB,CAAC;AAEF,qBAAa,0BAA0B;IAE/B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAD1B,YACqB,KAAK,GAAE,kBAA6C,EACrE;IAEE,QAAQ,CACV,WAAW,EAAE,MAAM,EACnB,kBAAkB,GAAE,MAAM,GAAG,IAAW,GACzC,OAAO,CAAC,aAAa,CAAC,CAuGxB;YAEa,iBAAiB;CAalC"}

package/dist/personalLogin/tokenProvider.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PersonalLoginTokenProvider = exports.tokenExpiry = exports.parseTokenResponse = exports.oauthHeaders = exports.sessionExpired = exports.freshLoginRequired = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@lightdash/common");
+const ajv_1 = tslib_1.__importDefault(require("ajv"));
+const crypto_1 = require("crypto");
+const node_fetch_1 = tslib_1.__importDefault(require("node-fetch"));
+const env_1 = require("../env");
+const instanceKey_1 = require("./instanceKey");
+const store_1 = require("./store");
+exports.freshLoginRequired = 'Your CLI login needs a fresh `lightdash login`: the last token refresh did not complete.';
+exports.sessionExpired = 'Your CLI session expired. Run `lightdash login` again.';
+const oauthHeaders = () => ({
+    'Content-Type': 'application/x-www-form-urlencoded',
+    'User-Agent': `lightdash-cli/${env_1.CLI_VERSION}`,
+    ...(process.env.LIGHTDASH_PROXY_AUTHORIZATION
+        ? { 'Proxy-Authorization': process.env.LIGHTDASH_PROXY_AUTHORIZATION }
+        : {}),
+});
+exports.oauthHeaders = oauthHeaders;
+const seconds = { type: 'integer', minimum: 1, maximum: 2_147_483_647 };
+const validateResponse = new ajv_1.default().compile({
+    type: 'object',
+    required: [
+        'access_token',
+        'refresh_token',
+        'token_type',
+        'expires_in',
+        'scope',
+    ],
+    properties: {
+        access_token: { type: 'string', minLength: 1, maxLength: 16384 },
+        refresh_token: { type: 'string', minLength: 1, maxLength: 16384 },
+        token_type: { type: 'string', pattern: '^[Bb][Ee][Aa][Rr][Ee][Rr]$' },
+        expires_in: seconds,
+        session_expires_in: seconds,
+        scope: { type: 'string', maxLength: 16384 },
+    },
+});
+const parseTokenResponse = (value) => {
+    if (!validateResponse(value))
+        throw new Error(exports.freshLoginRequired);
+    const scopes = value.scope.split(' ');
+    if (scopes.length !== 2 ||
+        new Set(scopes).size !== 2 ||
+        !scopes.includes('read') ||
+        !scopes.includes('write'))
+        throw new Error(exports.freshLoginRequired);
+    return value;
+};
+exports.parseTokenResponse = parseTokenResponse;
+const tokenExpiry = (response, startedAt, dateHeader, deadline) => {
+    const serverTime = dateHeader === null ? startedAt : Date.parse(dateHeader);
+    if (!Number.isFinite(serverTime))
+        throw new Error(exports.freshLoginRequired);
+    const issuedAt = Math.min(startedAt, serverTime);
+    const sessionExpiresAt = Math.min(deadline ?? Infinity, response.session_expires_in === undefined && deadline !== null
+        ? deadline
+        : issuedAt + (response.session_expires_in ?? 8 * 3600) * 1000);
+    const accessTokenExpiresAt = Math.min(issuedAt + response.expires_in * 1000, sessionExpiresAt);
+    if (Math.min(sessionExpiresAt, accessTokenExpiresAt) <= Date.now())
+        throw new Error(exports.sessionExpired);
+    return {
+        accessTokenIssuedAt: new Date(issuedAt).toISOString(),
+        accessTokenExpiresAt: new Date(accessTokenExpiresAt).toISOString(),
+        sessionExpiresAt: new Date(sessionExpiresAt).toISOString(),
+    };
+};
+exports.tokenExpiry = tokenExpiry;
+class PersonalLoginTokenProvider {
+    store;
+    constructor(store = new store_1.PersonalLoginStore()) {
+        this.store = store;
+    }
+    async getToken(instanceUrl, rejectedGeneration = null) {
+        const instance = (0, instanceKey_1.personalInstanceKey)(instanceUrl);
+        return this.store.withLock(async (locked) => {
+            let login = await locked.read(instance);
+            if (login === null)
+                throw new common_1.AuthorizationError("Not logged in. Run 'lightdash login --help'");
+            const requireLogin = async (current) => {
+                await this.markLoginRequired(locked, instance, current);
+                throw new Error(exports.freshLoginRequired);
+            };
+            let journal;
+            try {
+                journal = await locked.readJournal(instance);
+            }
+            catch {
+                return requireLogin(login);
+            }
+            if (journal !== null) {
+                if (login.refreshState.kind === 'idle' &&
+                    journal.attemptUuid ===
+                        login.tokens.lastRefreshAttemptUuid &&
+                    journal.generation + 1 === login.tokens.generation)
+                    await locked.clearJournal(instance);
+                else
+                    return requireLogin(login);
+            }
+            if (login.refreshState.kind !== 'idle')
+                return requireLogin(login);
+            if (Date.parse(login.sessionExpiresAt) <= Date.now())
+                throw new Error(exports.sessionExpired);
+            const remaining = Date.parse(login.tokens.accessTokenExpiresAt) - Date.now();
+            const lifetime = Date.parse(login.tokens.accessTokenExpiresAt) -
+                Date.parse(login.tokens.accessTokenIssuedAt);
+            if (remaining > Math.min(60_000, lifetime / 10) &&
+                rejectedGeneration !== login.tokens.generation)
+                return login;
+            const attemptUuid = (0, crypto_1.randomUUID)();
+            const startedAt = Date.now();
+            const pending = {
+                ...login,
+                refreshState: {
+                    kind: 'in_progress',
+                    attemptUuid,
+                    startedAt: new Date(startedAt).toISOString(),
+                },
+            };
+            await locked.writeJournal(instance, {
+                attemptUuid,
+                generation: login.tokens.generation,
+            });
+            await locked.save(instance, pending);
+            try {
+                const response = await (0, node_fetch_1.default)(`${instance}/api/v1/oauth/token`, {
+                    method: 'POST',
+                    headers: (0, exports.oauthHeaders)(),
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(15_000),
+                    body: new URLSearchParams({
+                        grant_type: 'refresh_token',
+                        client_id: 'lightdash-cli',
+                        refresh_token: login.tokens.refreshToken,
+                        scope: login.tokens.scopes.join(' '),
+                    }),
+                });
+                if (!response.ok)
+                    throw new Error(exports.freshLoginRequired);
+                const value = await response.json();
+                const token = (0, exports.parseTokenResponse)(value);
+                if (token.refresh_token === login.tokens.refreshToken)
+                    throw new Error(exports.freshLoginRequired);
+                const expiry = (0, exports.tokenExpiry)(token, startedAt, response.headers.get('date'), Date.parse(login.sessionExpiresAt));
+                login = {
+                    ...login,
+                    tokens: {
+                        accessToken: token.access_token,
+                        refreshToken: token.refresh_token,
+                        accessTokenIssuedAt: expiry.accessTokenIssuedAt,
+                        accessTokenExpiresAt: expiry.accessTokenExpiresAt,
+                        scopes: token.scope.split(' '),
+                        generation: login.tokens.generation + 1,
+                        lastRefreshAttemptUuid: attemptUuid,
+                    },
+                    sessionExpiresAt: expiry.sessionExpiresAt,
+                    refreshState: { kind: 'idle' },
+                };
+                await locked.save(instance, login);
+            }
+            catch {
+                return requireLogin(pending);
+            }
+            await locked.clearJournal(instance);
+            return login;
+        });
+    }
+    async markLoginRequired(locked, instance, login) {
+        await locked.save(instance, {
+            ...login,
+            refreshState: {
+                kind: 'login_required',
+                since: new Date().toISOString(),
+            },
+        });
+    }
+}
+exports.PersonalLoginTokenProvider = PersonalLoginTokenProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightdash/cli",
-  "version": "3.86.0",
+  "version": "3.88.0",
   "description": "Lightdash CLI tool",
   "license": "MIT",
   "repository": {
@@ -22,8 +22,8 @@
     "@actions/core": "1.11.1",
     "@aws-sdk/credential-providers": "3.995.0",
     "@casl/ability": "6.8.0",
-    "@lightdash/common": "3.86.0",
-    "@lightdash/warehouses": "3.86.0",
+    "@lightdash/common": "3.88.0",
+    "@lightdash/warehouses": "3.88.0",
     "@sidvind/better-ajv-errors": "7.0.0",
     "@types/columnify": "1.5.1",
     "ajv": "8.18.0",