@loopress/cli 0.24.0 → 0.24.1

package/dist/lib/sentry.js

@@ -31,3 +31,33 @@ export function redactArgv(argv) {
         return eqIndex === -1 ? arg : arg.slice(0, eqIndex);
     });
 }
+// The site origin in front of a `/wp-json/` REST path: collapse it but keep the path, which is
+// Loopress's own API surface (identical on every site, no user data) and useful for triage.
+const SITE_PREFIX = /\bhttps?:\/\/[^\s"'<>)]*?\/wp-json\//gi;
+// Any other absolute URL (bare site root, a package URL on the summary line): blank it whole.
+const ANY_URL = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+// A WordPress request failure (`formatWpError`) puts the site URL on the first line and, for a
+// 4xx/5xx, appends the server's raw response body after a newline: a Composer trace, a WP fatal,
+// sometimes absolute server paths, package URLs or a connection string. None of that should
+// leave the user's machine. Keep the first line (the "which endpoint, which status" summary)
+// with the site host blanked, and drop everything after it. The terminal still prints the
+// full, unmodified message.
+export function scrubErrorMessage(value) {
+    const firstLine = value.split('\n', 1)[0] ?? '';
+    return firstLine.replaceAll(SITE_PREFIX, '<site>/wp-json/').replaceAll(ANY_URL, '<site>').slice(0, 300);
+}
+// Sentry `beforeSend`: runs on every event before it is sent. Scrubs the exception message(s)
+// (including chained `cause` errors, which the linkedErrors integration copies in) and drops
+// any request context. `extra.argv` is already redacted upstream by `redactArgv`.
+export function scrubEvent(event) {
+    if (typeof event.message === 'string') {
+        event.message = scrubErrorMessage(event.message);
+    }
+    for (const exception of event.exception?.values ?? []) {
+        if (typeof exception.value === 'string') {
+            exception.value = scrubErrorMessage(exception.value);
+        }
+    }
+    delete event.request;
+    return event;
+}

package/dist/lib/wp-authorize-flow.d.ts

@@ -18,5 +18,9 @@ export type AuthorizeResult = {
  *   5. The API callback returns an HTML page that POSTs a form with the
  *      Application Password to the local callback server.
  *   6. The local server extracts the credentials and resolves the promise.
+ *
+ * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
+ * form's POST target), so it comes back as a query param on the credential POST and
+ * `waitForLocalCallback` can match it before this handler runs.
  */
 export declare function authorizeWithBrowser(siteUrl: string, log: (message: string) => void): Promise<AuthorizeResult>;

package/dist/lib/wp-authorize-flow.js

@@ -15,13 +15,18 @@ import { renderResultPage, waitForLocalCallback } from './local-callback-server.
  *   5. The API callback returns an HTML page that POSTs a form with the
  *      Application Password to the local callback server.
  *   6. The local server extracts the credentials and resolves the promise.
+ *
+ * The `state` value is threaded through `callbackUrl` (the relay copies it verbatim into the
+ * form's POST target), so it comes back as a query param on the credential POST and
+ * `waitForLocalCallback` can match it before this handler runs.
  */
 export async function authorizeWithBrowser(siteUrl, log) {
     return waitForLocalCallback({
-        buildUrl(callbackBaseUrl) {
+        allowedOrigins: ['https://api.loopress.dev'],
+        buildUrl(callbackBaseUrl, state) {
             const relayUrl = 'https://api.loopress.dev/auth/wp-authorize';
             const params = new URLSearchParams({
-                callbackUrl: callbackBaseUrl,
+                callbackUrl: `${callbackBaseUrl}?state=${state}`,
                 wpUrl: siteUrl,
             });
             return `${relayUrl}?${params}`;
@@ -31,12 +36,9 @@ export async function authorizeWithBrowser(siteUrl, log) {
                 rejectWithPage(REJECTED_PAGE, new Error('Authorization rejected in WordPress.'));
                 return;
             }
-            // `||`, not `??`: an empty-string field counts as absent here, same as the `!password`
-            // check below, so falls through to the query-param fallback instead of stopping at "".
-            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-            const password = body.password || url.searchParams.get('password') || '';
-            // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-            const userLogin = body.user_login || url.searchParams.get('user_login') || '';
+            // Credentials come from the relay's form POST only. Reading them from the query string
+            // would let them land in shell history, proxy logs and the browser address bar (F24).
+            const { password, user_login: userLogin } = body;
             if (!password || !userLogin) {
                 respondBadRequest('Missing password or user_login');
                 return;

package/dist/utils/option-format.d.ts

@@ -1,7 +1,7 @@
 export declare const OPTIONS_ENDPOINT = "loopress/v1/options";
 export declare function optionEndpoint(name: string): string;
 export declare const RESERVED_OPTION_NAMES: readonly ["active_plugins", "stylesheet", "template"];
-export declare const READONLY_BY_DEFAULT_OPTION_NAMES: readonly ["siteurl", "home", "db_version", "cron", "rewrite_rules", "WPLANG"];
+export declare const READONLY_BY_DEFAULT_OPTION_NAMES: readonly ["siteurl", "home", "db_version", "initial_db_version", "cron", "rewrite_rules", "WPLANG", "default_role", "users_can_register", "uninstall_plugins", "mailserver_url", "mailserver_login", "mailserver_pass", "mailserver_port"];
 export type LocalOption = {
     autoload: string;
     name: string;

package/dist/utils/option-format.js

@@ -6,11 +6,29 @@ export function optionEndpoint(name) {
 // enforcement lives there). Checked here too so `option add` fails fast with a clear pointer to
 // the right command, instead of a round trip just to hit the server's 409.
 export const RESERVED_OPTION_NAMES = ['active_plugins', 'stylesheet', 'template'];
-// Options WordPress core owns or regenerates itself: legitimate to track for visibility (`diff`
-// still shows drift), but never something `push` should overwrite by default. siteurl/home in
+// Options WordPress core owns or regenerates itself, plus the ones OptionsService::
+// DENY_WRITE_NAMES refuses server-side (behaviour-changing core options: default_role,
+// users_can_register, mailserver_*, ...). Legitimate to track for visibility (`diff` still
+// shows drift), but never something `push` should overwrite by default. siteurl/home in
 // particular: pushing a value copied from another environment would repoint the target site's
-// own URLs, potentially locking out wp-admin.
-export const READONLY_BY_DEFAULT_OPTION_NAMES = ['siteurl', 'home', 'db_version', 'cron', 'rewrite_rules', 'WPLANG'];
+// own URLs, potentially locking out wp-admin. Flip `readonly` in the file to push one anyway;
+// for the server-denied names that then needs the `loopress_option_writable` filter too.
+export const READONLY_BY_DEFAULT_OPTION_NAMES = [
+    'siteurl',
+    'home',
+    'db_version',
+    'initial_db_version',
+    'cron',
+    'rewrite_rules',
+    'WPLANG',
+    'default_role',
+    'users_can_register',
+    'uninstall_plugins',
+    'mailserver_url',
+    'mailserver_login',
+    'mailserver_pass',
+    'mailserver_port',
+];
 export function isReservedOptionName(name) {
     return RESERVED_OPTION_NAMES.includes(name);
 }

package/dist/utils/plugin-sync.d.ts

@@ -9,9 +9,15 @@ export type SyncPayload = {
     intent: SyncIntent;
     lock: null | string;
 };
+export type LockDriftEntry = {
+    from: null | string;
+    name: string;
+    to: null | string;
+};
 export type SyncResponse = {
     composerJson: string;
     composerLock: string;
+    lockDrift?: LockDriftEntry[];
     message: string;
     output: string;
     removed: string[];