@m1a0rz/agent-identity 0.1.2

package/dist/src/actions/identity-actions.js

@@ -0,0 +1,429 @@
+/**
+ * Shared identity actions: pure logic returning structured data.
+ * Used by both commands (format to text) and tools (return jsonResult).
+ */
+import { fetchOIDCDiscovery, buildAuthorizationUrl, generateState, } from "../services/oidc-client.js";
+import { loadCredentialEnvBindings, loadAllCredentialEnvBindings, setCredentialEnvBinding, deleteCredentialEnvBinding, } from "../store/credential-env-bindings.js";
+import { loadCredentials, setCredential, getCredential, deleteCredentialsForSession, } from "../store/credential-store.js";
+import { getSession, deleteSession } from "../store/session-store.js";
+import { createState } from "../store/oidc-state-store.js";
+import { getTIPToken, setTIPToken, loadTIPTokens, saveTIPTokens } from "../store/tip-store.js";
+import { extractDelegationChainFromJwt } from "../utils/auth.js";
+import { resolveAgentId, } from "../utils/derive-session-key.js";
+function inferFlowFromProvider(info) {
+    if (info.Type === "api_key")
+        return "apikey";
+    if (info.Type === "oauth2" && info.Flow === "M2M")
+        return "oauth2-m2m";
+    return "oauth2-user";
+}
+const OAUTH_POLL_INTERVAL_MS = 2500;
+const OAUTH_POLL_TIMEOUT_MS = 10 * 60 * 1000;
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** Poll GetResourceOauth2Token until accessToken or timeout; store credential and notify. */
+async function pollOAuthAndNotify(params) {
+    const { identityClient, provider, identityToken, flow, redirectUrl, scopes, sessionKey, storeDir, deliveryTarget, sendCredentialMessage, logger, } = params;
+    const start = Date.now();
+    while (Date.now() - start < OAUTH_POLL_TIMEOUT_MS) {
+        await sleep(OAUTH_POLL_INTERVAL_MS);
+        try {
+            const result = await identityClient.getResourceOauth2Token({
+                providerName: provider,
+                identityToken,
+                flow,
+                redirectUrl,
+                scopes: scopes?.length ? scopes : undefined,
+            });
+            if (result.accessToken) {
+                await setCredential(storeDir, sessionKey, provider, {
+                    type: "oauth2",
+                    status: "authenticated",
+                    accessToken: result.accessToken,
+                    expiresAt: Date.now() + 3600 * 1000,
+                });
+                const target = deliveryTarget ?? sessionKey;
+                await sendCredentialMessage?.(target, `✓ Credential for \`${provider}\` added.`);
+                return;
+            }
+        }
+        catch (err) {
+            logger?.debug?.(`[identity fetch] poll attempt failed: ${String(err)}`);
+        }
+    }
+    const target = deliveryTarget ?? sessionKey;
+    await sendCredentialMessage?.(target, `⚠️ Authorization timed out for \`${provider}\`. Run \`/identity fetch ${provider}\` again.`);
+}
+export async function runStatus(deps, sessionKey, config) {
+    const { storeDir, identityService, logger } = deps;
+    const session = await getSession(storeDir, sessionKey);
+    let tip = await getTIPToken(storeDir, sessionKey);
+    if (session && identityService.parseUserToken(session.userToken).valid && !tip) {
+        try {
+            const agentId = resolveAgentId({ sessionKey, config: config });
+            const fresh = await identityService.getWorkloadAccessToken({
+                agentId,
+                userToken: session.userToken,
+                sub: session.sub,
+            });
+            await setTIPToken(storeDir, sessionKey, fresh);
+            tip = fresh;
+        }
+        catch (err) {
+            logger?.debug?.(`[identity status] TIP refresh failed: ${err.message}`);
+        }
+    }
+    else if (session && tip && tip.expiresAt - Date.now() < 5 * 60 * 1000) {
+        try {
+            const agentId = resolveAgentId({ sessionKey, config: config });
+            const fresh = await identityService.getWorkloadAccessToken({
+                agentId,
+                userToken: session.userToken,
+                sub: session.sub,
+            });
+            await setTIPToken(storeDir, sessionKey, fresh);
+            tip = fresh;
+        }
+        catch (err) {
+            logger?.debug?.(`[identity status] TIP refresh failed: ${err.message}`);
+        }
+    }
+    const credentials = await loadCredentials(storeDir, sessionKey);
+    const bindings = await loadCredentialEnvBindings(storeDir, sessionKey);
+    return {
+        loggedIn: !!(session && identityService.parseUserToken(session.userToken).valid),
+        sub: session?.sub ?? null,
+        hasTip: Boolean(tip),
+        sessionLoginAt: session?.loginAt,
+        sessionExpiresAt: session?.expiresAt ?? null,
+        tipIssuedAt: tip?.issuedAt,
+        tipExpiresAt: tip?.expiresAt,
+        tipChain: tip?.chain,
+        credentials,
+        bindings,
+    };
+}
+export async function runLogin(deps, sessionKey, options) {
+    const { storeDir, identityService, getOidcConfig, logger } = deps;
+    const config = options?.config;
+    const deliveryTarget = options?.deliveryTarget ?? null;
+    const session = await getSession(storeDir, sessionKey);
+    const hasValidCred = session && identityService.parseUserToken(session.userToken).valid;
+    if (hasValidCred && session) {
+        try {
+            const agentId = resolveAgentId({ sessionKey, config: config });
+            const tip = await identityService.getWorkloadAccessToken({
+                agentId,
+                userToken: session.userToken,
+                sub: session.sub,
+            });
+            await setTIPToken(storeDir, sessionKey, tip);
+            return { kind: "already_logged_in", sub: session.sub };
+        }
+        catch (err) {
+            return {
+                kind: "error",
+                message: `Session valid but TIP refresh failed: ${err.message}`,
+            };
+        }
+    }
+    try {
+        const oidcConfig = await getOidcConfig();
+        const discovery = await fetchOIDCDiscovery(oidcConfig.discoveryUrl);
+        const state = await generateState();
+        await createState(storeDir, sessionKey, "", state, deliveryTarget);
+        const authUrl = buildAuthorizationUrl({
+            authorizationEndpoint: discovery.authorization_endpoint,
+            clientId: oidcConfig.clientId,
+            redirectUri: oidcConfig.callbackUrl,
+            scope: oidcConfig.scope ?? "openid profile email",
+            state,
+        });
+        logger?.info?.(`[identity login] returning IdP URL for sessionKey=${sessionKey.slice(0, 24)}...`);
+        return { kind: "auth_url", authUrl };
+    }
+    catch (err) {
+        logger?.warn?.(`[identity login] error: ${String(err)}`);
+        return {
+            kind: "error",
+            message: `${err.message}. Ensure userpool is configured (discoveryUrl+clientId+callbackUrl or userPoolName+clientName+callbackUrl).`,
+        };
+    }
+}
+export async function runLogout(deps, sessionKey) {
+    const { storeDir, logger } = deps;
+    logger?.debug?.(`[identity logout] sessionKey=${sessionKey.slice(0, 24)}...`);
+    await deleteSession(storeDir, sessionKey);
+    const tokens = await loadTIPTokens(storeDir);
+    delete tokens[sessionKey];
+    await saveTIPTokens(storeDir, tokens);
+    deleteCredentialsForSession(storeDir, sessionKey);
+    return { ok: true };
+}
+const LIST_PAGE_SIZE = 10;
+export async function runListCredentials(deps, sessionKey, page = 1) {
+    const { storeDir, identityClient, logger } = deps;
+    const creds = await loadCredentials(storeDir, sessionKey);
+    const bindings = await loadCredentialEnvBindings(storeDir, sessionKey);
+    let providers = [];
+    let totalCount = 0;
+    if (identityClient) {
+        try {
+            const result = await identityClient.listCredentialProviders({
+                PageNumber: page,
+                PageSize: LIST_PAGE_SIZE,
+            });
+            providers = result.CredentialProviders ?? result.Data ?? [];
+            totalCount = result.TotalCount ?? 0;
+        }
+        catch (e) {
+            logger?.warn?.(`[identity list] API error: ${String(e)}`);
+        }
+    }
+    const providerNames = new Set(providers.map((p) => p.Name));
+    const storedNames = Object.keys(creds);
+    const providerRows = providers.map((p) => {
+        const c = creds[p.Name];
+        const bind = bindings[p.Name];
+        const typeLabel = p.Type === "api_key" ? "api_key" : `oauth2${p.Flow === "M2M" ? " (m2m)" : ""}`;
+        const status = c?.type === "oauth2"
+            ? c.status
+            : c?.type === "api_key"
+                ? c.valueFromEnv
+                    ? `from \`${c.valueFromEnv}\``
+                    : c.value
+                        ? "✓"
+                        : "empty"
+                : "—";
+        return {
+            name: p.Name,
+            type: typeLabel,
+            flow: p.Flow,
+            status,
+            binding: bind,
+        };
+    });
+    const storedOnly = storedNames
+        .filter((n) => !providerNames.has(n))
+        .sort()
+        .map((name) => {
+        const c = creds[name];
+        const bind = bindings[name];
+        const status = c.type === "oauth2"
+            ? c.status
+            : c.type === "api_key"
+                ? c.valueFromEnv
+                    ? `from \`${c.valueFromEnv}\``
+                    : c.value
+                        ? "✓"
+                        : "empty"
+                : "—";
+        return { name, status, binding: bind };
+    });
+    return {
+        providers: providerRows,
+        storedOnly,
+        page,
+        hasMore: totalCount > page * LIST_PAGE_SIZE,
+        totalCount,
+    };
+}
+export async function runListTips(deps) {
+    const { storeDir } = deps;
+    const tokens = await loadTIPTokens(storeDir);
+    const bindingsBySession = await loadAllCredentialEnvBindings(storeDir);
+    const now = Date.now();
+    const tips = [];
+    for (const [key, entry] of Object.entries(tokens)) {
+        if (entry.expiresAt < now)
+            continue;
+        const chain = extractDelegationChainFromJwt(entry.token);
+        tips.push({
+            sessionKey: key,
+            sub: entry.sub,
+            chain: chain ? [chain.principalId, ...chain.actors] : [],
+            expiresAt: entry.expiresAt,
+            ttlSec: Math.floor((entry.expiresAt - now) / 1000),
+        });
+    }
+    return { tips, bindingsBySession };
+}
+export async function runConfig(deps) {
+    const cfg = deps.pluginConfig;
+    if (!cfg)
+        return {};
+    const out = {};
+    const id = cfg.identity ?? cfg.cis;
+    if (id) {
+        out.identity = {
+            endpoint: id.endpoint,
+            accessKeyId: id.accessKeyId ? "***" : undefined,
+            secretAccessKey: id.secretAccessKey ? "***" : undefined,
+            credentialsFile: id.credentialsFile,
+            roleTrn: id.roleTrn,
+            workloadPoolName: id.workloadPoolName,
+            workloadName: id.workloadName,
+            audience: id.audience,
+            durationSeconds: id.durationSeconds,
+        };
+    }
+    if (cfg.userpool) {
+        out.userpool = {
+            discoveryUrl: cfg.userpool.discoveryUrl,
+            clientId: cfg.userpool.clientId,
+            clientSecret: cfg.userpool.clientSecret ? "***" : undefined,
+            callbackUrl: cfg.userpool.callbackUrl,
+            scope: cfg.userpool.scope,
+            userPoolName: cfg.userpool.userPoolName,
+            clientName: cfg.userpool.clientName,
+            autoCreate: cfg.userpool.autoCreate,
+        };
+    }
+    if (cfg.authz) {
+        out.authz = {
+            enable: cfg.authz.enable,
+            namespaceName: cfg.authz.namespaceName,
+        };
+    }
+    return out;
+}
+export async function runFetch(deps, sessionKey, params) {
+    const { identityClient, storeDir, sendCredentialMessage, logger } = deps;
+    const { provider, flow, flowExplicit, redirectUrl, scopes, deliveryTarget, config } = params;
+    if (!identityClient) {
+        return { kind: "error", message: "Identity service not configured. Cannot add credentials." };
+    }
+    let effectiveFlow = flow;
+    if (!flowExplicit) {
+        try {
+            const listResult = await identityClient.listCredentialProviders({
+                PageNumber: 1,
+                PageSize: 20,
+                Filter: { Name: provider },
+            });
+            const list = listResult.CredentialProviders ?? listResult.Data ?? [];
+            const info = list.find((p) => p.Name === provider);
+            if (info)
+                effectiveFlow = inferFlowFromProvider(info);
+        }
+        catch {
+            // keep default
+        }
+    }
+    const tip = await getTIPToken(storeDir, sessionKey);
+    if (!tip) {
+        return {
+            kind: "error",
+            message: "Login first with `/identity login` to establish identity before adding credentials.",
+        };
+    }
+    try {
+        if (effectiveFlow === "apikey") {
+            const result = await identityClient.getResourceApiKey({
+                providerName: provider,
+                identityToken: tip.token,
+            });
+            await setCredential(storeDir, sessionKey, provider, {
+                type: "api_key",
+                key: provider,
+                value: result.apiKey,
+            });
+            return { kind: "success", message: `✓ API key for \`${provider}\` added.` };
+        }
+        const oauth2Flow = effectiveFlow === "oauth2-m2m" ? "M2M" : "USER_FEDERATION";
+        const oauthResult = await identityClient.getResourceOauth2Token({
+            providerName: provider,
+            identityToken: tip.token,
+            flow: oauth2Flow,
+            redirectUrl: redirectUrl,
+            scopes: scopes?.length ? scopes : undefined,
+        });
+        if (oauthResult.accessToken) {
+            await setCredential(storeDir, sessionKey, provider, {
+                type: "oauth2",
+                status: "authenticated",
+                accessToken: oauthResult.accessToken,
+                expiresAt: Date.now() + 3600 * 1000,
+            });
+            return { kind: "success", message: `✓ Credential for \`${provider}\` added (direct token).` };
+        }
+        if (oauthResult.authorizationUrl) {
+            logger?.info?.(`[identity fetch] returning auth URL for provider=${provider}, starting poll`);
+            const target = deliveryTarget ?? sessionKey;
+            pollOAuthAndNotify({
+                identityClient,
+                provider,
+                identityToken: tip.token,
+                flow: oauth2Flow,
+                redirectUrl,
+                scopes,
+                sessionKey,
+                storeDir,
+                deliveryTarget: deliveryTarget ?? null,
+                sendCredentialMessage,
+                logger,
+            }).catch((err) => {
+                logger?.warn?.(`[identity fetch] poll error: ${String(err)}`);
+                void sendCredentialMessage?.(target, `⚠️ Credential fetch failed: ${err.message}`).catch(() => { });
+            });
+            return {
+                kind: "auth_url",
+                authUrl: oauthResult.authorizationUrl,
+                message: `Open this URL to authorize \`${provider}\`. After authorization, a success message will be sent to this chat.`,
+            };
+        }
+        return {
+            kind: "error",
+            message: `Provider \`${provider}\` returned neither token nor authorization URL.`,
+        };
+    }
+    catch (err) {
+        logger?.warn?.(`[identity fetch] error: ${String(err)}`);
+        return {
+            kind: "error",
+            message: `Credential setup failed: ${err.message}`,
+        };
+    }
+}
+export async function runSetBinding(deps, sessionKey, params) {
+    const { storeDir } = deps;
+    const { provider, envVar } = params;
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envVar)) {
+        return {
+            ok: false,
+            error: `Invalid env var name: \`${envVar}\`. Use letters, numbers, underscores.`,
+        };
+    }
+    const cred = await getCredential(storeDir, sessionKey, provider);
+    if (cred) {
+        await setCredentialEnvBinding(storeDir, sessionKey, provider, envVar);
+        return { ok: true, message: `✓ Bound \`${provider}\` → \`${envVar}\`.` };
+    }
+    if (process.env[envVar] === undefined || process.env[envVar] === "") {
+        return {
+            ok: false,
+            error: `No credential for \`${provider}\` and env var \`${envVar}\` is not set. Add credential with \`/identity fetch ${provider}\` or set \`${envVar}\` in the gateway environment.`,
+        };
+    }
+    await setCredential(storeDir, sessionKey, provider, {
+        type: "api_key",
+        key: envVar,
+        valueFromEnv: envVar,
+    });
+    await setCredentialEnvBinding(storeDir, sessionKey, provider, envVar);
+    return {
+        ok: true,
+        message: `✓ Bound \`${provider}\` to \`${envVar}\` (resolved from gateway env).`,
+    };
+}
+export async function runUnsetBinding(deps, sessionKey, params) {
+    const { storeDir } = deps;
+    const { provider } = params;
+    const bindings = await loadCredentialEnvBindings(storeDir, sessionKey);
+    if (!bindings[provider]) {
+        return { ok: false, error: `No env binding for \`${provider}\`. Nothing to unset.` };
+    }
+    await deleteCredentialEnvBinding(storeDir, sessionKey, provider);
+    return { ok: true, message: `✓ Unset env binding for \`${provider}\`.` };
+}

package/dist/src/commands/identity-commands.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Unified /identity command: login, status, logout, list-credentials, fetch, set.
+ * UserPool OIDC + credential hosting. Uses shared identity-actions for logic.
+ */
+import type { PluginCommandContext } from "../types.js";
+import { type IdentityActionsDeps, type OIDCConfigForCommand, type FetchFlow } from "../actions/identity-actions.js";
+export type { OIDCConfigForCommand, FetchFlow };
+export type IdentityCommandsLogger = {
+    info?: (msg: string) => void;
+    warn?: (msg: string) => void;
+    debug?: (msg: string) => void;
+};
+export type IdentityCommandsDeps = IdentityActionsDeps;
+export declare function createIdentityCommand(deps: IdentityCommandsDeps): {
+    name: string;
+    description: string;
+    acceptsArgs: boolean;
+    requireAuth: boolean;
+    handler: (ctx: PluginCommandContext) => Promise<{
+        text: string;
+    }>;
+};
+/** Alias command /id same as /identity */
+export declare function createIdCommand(deps: IdentityCommandsDeps): {
+    name: string;
+    description: string;
+    acceptsArgs: boolean;
+    requireAuth: boolean;
+    handler: (ctx: PluginCommandContext) => Promise<{
+        text: string;
+    }>;
+};
+//# sourceMappingURL=identity-commands.d.ts.map

package/dist/src/commands/identity-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-commands.d.ts","sourceRoot":"","sources":["../../../src/commands/identity-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAUL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACf,MAAM,gCAAgC,CAAC;AAUxC,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC;AAEhD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAioBvD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA9e3C,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAufpE;AAED,0CAA0C;AAC1C,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB;;;;;mBA1frC,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EAmgBpE"}