@mcpher/gas-fakes 1.2.32 → 2.0.1

package/src/support/auth.js

@@ -1,20 +1,28 @@
-import { GoogleAuth } from "google-auth-library";
+import { GoogleAuth, JWT, Impersonated, OAuth2Client } from "google-auth-library";
 import is from "@sindresorhus/is";
 import { createHash } from "node:crypto";
-import { syncLog } from "./workersync/synclogger.js";
+import { syncLog, syncError } from "./workersync/synclogger.js";
+import fs from "node:fs";
 
 const _authScopes = new Set([]);
 
 // all this stuff gets populated by the initial synced fxInit
 let _auth = null;
 let _projectId = null;
-let _tokenInfo = null;
 let _accessToken = null;
 let _tokenExpiresAt = null;
 let _manifest = null;
 let _clasp = null;
+let _activeUser = null;
+let _effectiveUser = null;
+let _tokenScopes = null;
+
 
 let _settings = null;
+const getActiveUser = () => _activeUser
+const getEffectiveUser = () => _effectiveUser
+const setActiveUser = (user) => (_activeUser = user);
+const setEffectiveUser = (user) => (_effectiveUser = user)
 const setManifest = (manifest) => (_manifest = manifest);
 const setClasp = (clasp) => (_clasp = clasp);
 const getManifest = () => _manifest;
@@ -27,75 +35,227 @@ const setAccessToken = (accessToken) => (_accessToken = accessToken);
 const setSettings = (settings) => (_settings = settings);
 const getCachePath = () => getSettings().cache;
 const getPropertiesPath = () => getSettings().properties;
-const setTokenExpiresAt = (expiresAt) => (_tokenExpiresAt = expiresAt);
-const setTokenInfo = (tokenInfo) => {
-  _tokenInfo = tokenInfo;
-  // set expiry time with a 60 second buffer
-  if (tokenInfo && tokenInfo.expires_in) {
-    setTokenExpiresAt(Date.now() + (tokenInfo.expires_in - 60) * 1000);
-  } else {
-    // no expiry info, so we'll have to fetch a new one next time
-    setTokenExpiresAt(0);
-  }
-};
-const getTokenInfo = () => {
-  if (!_tokenInfo) throw `token info isnt set yet`;
-  return _tokenInfo;
-};
+
 
 const getTimeZone = () => getManifest().timeZone;
-const getUserId = () => getTokenInfo().sub;
-const getTokenScopes = () => getTokenInfo().scope;
+const getUserId = () => getEffectiveUser().id;
+const setTokenScopes = (scopes) => (_tokenScopes = Array.isArray(scopes) ? scopes.join(" ") : scopes);
+const getTokenScopes = () => {
+  if (_tokenScopes) return _tokenScopes;
+  // If not cached, we have to return the promise (which might break synchronous callers like ScriptApp)
+  return getAccessTokenInfo().then(info => {
+    _tokenScopes = info.tokenInfo.scope;
+    return _tokenScopes;
+  });
+};
 const getHashedUserId = () =>
   createHash("md5")
     .update(getUserId() + "hud")
     .digest()
     .toString("hex");
 
-const getAccessToken = () => _accessToken;
+const _getTokenInfo = async (client) => {
+  const tokenResponse = await client.getAccessToken();
+  const token = tokenResponse.token;
+  const tokenInfo = await client.getTokenInfo(token);
+  return {
+    tokenInfo,
+    token
+  }
+}
+// this is the effective user's token info
+// - In DWD: The impersonated user (the one we are acting as)
+// - In ADC: The actual signed-in user
+const getAccessTokenInfo = async () => {
+  if (!hasAuth()) throw `auth isnt set yet`;
+  return _getTokenInfo(_authClient);
+}
+
+// this is the active identity's token info
+// - In DWD: The service account itself
+// - In ADC: Same as the effective user
+const getSourceAccessTokenInfo = async () => {
+  if (!_sourceClient) throw `source auth isnt set yet`;
+  return _getTokenInfo(_sourceClient);
+}
+
+
+// this is the access token allowed to do the work - the one for the effective user
+// - In DWD: The impersonated user
+// - In ADC: The actual signed-in user
+const getAccessToken = async () => {
+  if (!hasAuth()) throw `auth isnt set yet`;
+  return (await getAccessTokenInfo()).token;
+}
+
 
 const isTokenExpired = () =>
   !_accessToken || !_tokenExpiresAt || Date.now() >= _tokenExpiresAt;
-/**
- * we'll be using adc credentials so no need for any special auth here
- * the idea here is to keep addign scopes to any auth so we have them all
- * @param {string[]} [scopes=[]] the required scopes will be added to existing scopes already asked for
- * @param {string} [keyFile=null]
- * @param {boolean} [mcpLoading=false] When the MCP server is loading, this value is true. By this, the invalid values can be hidden while the MCP server is loading. This is important for using Google Antigravity.
- * @returns {GoogleAuth.auth}
- */
+
+// the auth client is the one that has the scopes to do the work 
+// under adc, this is the source client
+// under service account, this is the impersonated client
 let _authClient = null;
+let _sourceClient = null;
 const getAuthClient = () => _authClient;
-const setAuth = async (scopes = [], keyFile = null, mcpLoading = false) => {
-  const hasCurrentAuth = hasAuth() && scopes.every((s) => _authScopes.has(s));
+const getSourceClient = () => _sourceClient;
 
-  if (!hasCurrentAuth) {
-    if (!mcpLoading) {
-      syncLog(`...initializing auth and discovering project ID`);
-    }
 
-    // 1. Create the GoogleAuth manager instance (this instance has getProjectId)
-    _auth = new GoogleAuth({ scopes });
+// We'll support ADC, or workload identity
+// and the service account must be allowed to impersonate the user
+const setAuth = async (scopes = [], mcpLoading = false) => {
+  const mayLog = mcpLoading ? () => null : syncLog;
+  mayLog(`...initializing auth`)
+
+  try {
+    _auth = new GoogleAuth()
+    _projectId = await _auth.getProjectId()
+    mayLog(`...discovered project ID: ${_projectId}`)
+
+    // steering for auth type
+    // 1. if AUTH_TYPE is DWD, use DWD
+    // 2. if AUTH_TYPE is ADC, use ADC
+    // 3. if AUTH_TYPE is not set, use DWD if saName is present, else ADC
+    const saName = process.env.GOOGLE_SERVICE_ACCOUNT_NAME
+    const authType = process.env.AUTH_TYPE?.toLowerCase() || 'dwd'
+    const useDwd = authType === 'dwd' || (authType !== 'adc' && saName)
+
+    if (!useDwd) {
+      mayLog(`...using ADC`)
+      _authClient = await _auth.getClient({
+        scopes
+      })
+      _sourceClient = _authClient
+    } else {
+      mayLog(`...using service account: ${saName}`)
+      const targetPrincipal = `${saName}@${_projectId}.iam.gserviceaccount.com`
+      mayLog(`...attempting to use service account: ${targetPrincipal}`)
+
+      /// _sourceClient is the identity of the person/thing running the code
+      _sourceClient = await _auth.getClient()
+
+      // now to get who the real user is
+      const { tokenInfo: userInfo } = await getSourceAccessTokenInfo()
+      mayLog(`...user verified as: ${userInfo.email}`);
+
+      // DWD Subject priority:
+      // 1. GOOGLE_WORKSPACE_SUBJECT
+      // 2. Caller identity (from getSourceAccessTokenInfo)
+      const saEmail = targetPrincipal
+      const userEmail = process.env.GOOGLE_WORKSPACE_SUBJECT || userInfo.email
+
+      const dwdClient = new OAuth2Client()
+      dwdClient._token = null
+      dwdClient._expiresAt = 0
+
+      dwdClient.getAccessToken = async function () {
+        if (this._token && Date.now() < this._expiresAt - 60000) {
+          return { token: this._token }
+        }
 
-    // 2. Use the manager to get the authenticated client (this is passed to API methods)
-    _authClient = await _auth.getClient();
+        const iat = Math.floor(Date.now() / 1000)
+        const exp = iat + 3600
+        const payload = {
+          iss: saEmail,
+          sub: userEmail,
+          aud: "https://oauth2.googleapis.com/token",
+          iat,
+          exp,
+          scope: scopes.join(' ')
+        }
 
-    // 3. Use the manager to reliably get the project ID
-    _projectId = await _auth.getProjectId();
+        //mayLog(`[Auth] DWD Scopes: ${payload.scope}`)
 
-    if (!_projectId) {
-      throw new Error(
-        "Failed to get project ID from Application Default Credentials."
-      );
+        // Sign the JWT via IAM API
+        // Note: The caller must have 'Service Account Token Creator' role on the target SA
+        const signUrl = `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${saEmail}:signJwt`
+        const signResponse = await _sourceClient.request({
+          url: signUrl,
+          method: 'POST',
+          data: {
+            payload: JSON.stringify(payload)
+          }
+        })
+
+        const { signedJwt } = signResponse.data
+
+        // Exchange JWT for access token
+        const tokenUrl = "https://oauth2.googleapis.com/token"
+        const tokenResponse = await fetch(tokenUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion: signedJwt
+          })
+        })
+
+        if (!tokenResponse.ok) {
+          const errorText = await tokenResponse.text()
+          throw new Error(`Failed to exchange JWT for token: ${errorText}`)
+        }
+
+        const tokenData = await tokenResponse.json()
+        this._token = tokenData.access_token
+        this._expiresAt = Date.now() + (tokenData.expires_in * 1000)
+        this.credentials = { access_token: this._token, expiry_date: this._expiresAt }
+
+        return { token: this._token }
+      }
+
+      // override request to ensure we use our token but leverage the existing transporter
+      const originalRequest = dwdClient.request.bind(dwdClient)
+      dwdClient.request = async function (options) {
+        // Ensure token is fresh
+        await this.getAccessToken()
+        return originalRequest(options)
+      }
+
+      _authClient = dwdClient
+      _authClient.targetPrincipal = saEmail
+      _authClient.invalidateToken = function () {
+        this._token = null
+        this._expiresAt = 0
+        this.credentials = null
+      }
+
+      mayLog(`...using Domain-Wide Delegation for user: ${userEmail}`)
+
+      // check we can get an access token - this will trigger the signJwt flow
+      const { tokenInfo } = await getAccessTokenInfo()
+      mayLog(`...sa (acting as user) verified as: ${tokenInfo.email}`);
     }
 
-    if (!mcpLoading) {
-      syncLog(`...discovered and set projectId to ${_projectId}`);
+
+  } catch (error) {
+    mayLog(`...auth failed - check you are logged in with 'gcloud auth login' and have enabled workload identity: ${error}`)
+    throw error
+  }
+  return getAuth()
+}
+
+/**
+ * force a token refresh on next request
+ */
+const invalidateToken = () => {
+  if (hasAuth()) {
+    const client = getAuthClient();
+    if (client.invalidateToken) {
+      client.invalidateToken();
+    } else {
+      client.credentials = null;
     }
-    scopes.forEach((s) => _authScopes.add(s));
   }
-  return getAuth();
-};
+}
+/**
+ * we'll be using adc credentials so no need for any special auth here
+ * the idea here is to keep addign scopes to any auth so we have them all
+ * @param {string[]} [scopes=[]] the required scopes will be added to existing scopes already asked for
+ * @param {string} [keyFile=null]
+ * @param {boolean} [mcpLoading=false] When the MCP server is loading, this value is true. By this, the invalid values can be hidden while the MCP server is loading. This is important for using Google Antigravity.
+ * @returns {GoogleAuth.auth}
+ */
+
 
 /**
  * if we're doing a fetch on drive API we need a special header
@@ -139,17 +299,22 @@ const getProjectId = () => {
 /**
  * @returns {Boolean} checks to see if auth has bee initialized yet
  */
-const hasAuth = () => Boolean(_auth);
+const hasAuth = () => Boolean(_authClient);
+
 
 /**
- * @returns {GoogleAuth.auth}
+ * @returns {import("google-auth-library").AuthClient}
  */
 const getAuth = () => {
   if (!hasAuth())
     throw new Error(`auth hasnt been intialized with setAuth yet`);
-  return _auth;
+
+  // Simply return the client we've already prepared/patched
+  return getAuthClient();
 };
 
+
+
 /**
  * why is this here ?
  * because when we syncit, we import auth for each method and it needs this
@@ -192,7 +357,6 @@ export const Auth = {
   googify,
   setProjectId,
   getUserId,
-  setTokenInfo,
   getAccessToken,
   getTokenScopes,
   getScriptId,
@@ -200,7 +364,6 @@ export const Auth = {
   setSettings,
   getCachePath,
   getPropertiesPath,
-  getTokenInfo,
   getHashedUserId,
   setManifest,
   setClasp,
@@ -210,4 +373,13 @@ export const Auth = {
   setAccessToken,
   isTokenExpired,
   getAuthClient,
+  getSourceClient,
+  getAccessTokenInfo,
+  getSourceAccessTokenInfo,
+  setActiveUser,
+  getActiveUser,
+  setEffectiveUser,
+  getEffectiveUser,
+  invalidateToken,
+  setTokenScopes
 };

package/src/support/slogger.js

@@ -3,8 +3,50 @@
  * used for all internal gas-fakes logging
  */
 
+import fs from 'node:fs';
+
 const q = process.env.QUIET || false
 export const isQuiet =  q.toString().toLowerCase()=== "true";
+const isCloudRun = !!process.env.K_SERVICE;
+
+const getTimestamp = () => new Date().toISOString();
+
+const formatRawMessage = (args) => {
+  return args.map(arg => {
+    if (arg === null) return 'null';
+    if (arg === undefined) return 'undefined';
+    if (typeof arg === 'object') {
+      try {
+        return JSON.stringify(arg);
+      } catch (e) {
+        return '[Complex Object]';
+      }
+    }
+    return String(arg);
+  }).join(' ');
+};
+
+const writeLog = (stream, severity, prefix, args) => {
+  const message = formatRawMessage(args);
+  if (isCloudRun) {
+    // Structured logging for Cloud Run
+    const entry = {
+      severity: severity,
+      message: `${prefix}${message}`,
+      timestamp: getTimestamp()
+    };
+    fs.writeSync(stream, JSON.stringify(entry) + '\n');
+  } else {
+    // Human-readable logging for local use
+    fs.writeSync(stream, `${getTimestamp()} ${prefix}${message}\n`);
+  }
+};
+
+// Monkey-patch console to ensure all logs (including from libraries) are timestamped and synchronized
+globalThis.console.log = (...args) => writeLog(1, 'DEFAULT', '', args);
+globalThis.console.error = (...args) => writeLog(2, 'ERROR', '[Error] ', args);
+globalThis.console.warn = (...args) => writeLog(1, 'WARNING', '[Warn] ', args);
+globalThis.console.info = (...args) => writeLog(1, 'INFO', '[Info] ', args);
 
 export const slogger = {
   log: isQuiet ? () => {} : console.log,

package/src/support/sxauth.js

@@ -8,8 +8,7 @@
 import got from 'got';
 import { Auth } from './auth.js';
 import { syncError, syncLog } from './workersync/synclogger.js';
-import { homedir } from 'os';
-import { access, readFile, writeFile, mkdir } from 'fs/promises';
+import { readFile, writeFile, mkdir } from 'fs/promises';
 import path from 'path'
 
 
@@ -86,54 +85,58 @@ export const sxInit = async ({ manifestPath, claspPath, settingsPath, cachePath,
   // get the required scopes and set them
   const scopes = manifest.oauthScopes || []
 
-  // Initialize auth. This is async and will discover the project ID.
+  // Initialize auth. 
   const auth = await Auth.setAuth(scopes);
+
+  // static things we need to get into the main thread we can do now
   const projectId = Auth.getProjectId();
-  let accessToken = null
 
-  // need to handle an expired refresh token
-  try {
-    accessToken = await auth.getAccessToken()
-  } catch (error) {
+  // the active user is the person we are (ADC) or pretending to be (Workload identity)
+  const [activeInfo, effectiveInfo] = await Promise.all([
+    Auth.getSourceAccessTokenInfo(),
+    Auth.getAccessTokenInfo()])
 
+  /// these all jst exist in this sub process so we need to send them back to parent process
+  /// we'll send back the token, but it should be refreshed dynamically to handle expiry
+  const activeUser = {
+    id: activeInfo.tokenInfo.sub,
+    email: activeInfo.tokenInfo.email,
+    token: activeInfo.token
   }
-  let tokenInfo = null
-  try {
-    tokenInfo = await got(`https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=${accessToken}`).json()
-  } catch (err) {
-    syncError(`Application default credentials needs attention`)
-    if (error.code === 400 && error.message.includes('invalid_grant')) {
-      // Log a specific, actionable error for the developer/operator
-      syncError("ADC 'invalid_grant' Error: The underlying Application Default Credentials have expired or been revoked.");
-      syncError("Helpful note: in your admin console under security/access amd data control there are a couple of settings to fiddle with token life")
-      syncError("Use your settaccount.sh to reauthenticate");
-      throw new Error ('failed to get access token info : Use your settaccount.sh to reauthenticate')
-    }
-    throw error; // Re-throw any other errors
+  const effectiveUser = {
+    id: effectiveInfo.tokenInfo.sub,
+    email: effectiveInfo.tokenInfo.email,
+    token: effectiveInfo.token
   }
 
-  /// these all jst exist in this sub process so we need to send them back to parent process
+  //syncLog(`[Auth] Active User TokenInfo: ${JSON.stringify(activeInfo.tokenInfo)}`)
+  //syncLog(`[Auth] Effective User TokenInfo: ${JSON.stringify(effectiveInfo.tokenInfo)}`)
+  // check that mandatory scopes have been allowed
+  const effectiveScopes = effectiveInfo.tokenInfo.scopes
+  // we strictly need the effective user ID (the one we are impersonating)
+  // but the active user (the SA) might not have a 'sub' on Cloud Run
+  if (!effectiveUser.id) {
+    const isOpenid = effectiveScopes.includes('openid')
+    throw new Error(`...unable to figure out effective user id - openid scope was ${isOpenid ? '' : 'not'} granted`)
+  }
+  if (!activeUser.email || !effectiveUser.email) {
+    const isEmail = effectiveScopes.includes('https://www.googleapis.com/auth/userinfo.email')
+    throw new Error(`...unable to figure out user email - userinfo.email scope was ${isEmail ? '' : 'not'} granted`)
+  }
+  const allowedScopes = new Set(effectiveScopes)
+  const missingScopes = scopes.filter(scope => !allowedScopes.has(scope))
+  if (missingScopes.length > 0) {
+    syncError(`...these scopes were asked for but not granted: ${missingScopes.join(', ')}`)
+  }
   return {
-    scopes,
+    // these will be the scopes we're allowed to get
+    scopes: effectiveScopes,
+    activeUser,
+    effectiveUser,
     projectId,
-    tokenInfo,
-    accessToken, // also return the token itself
     settings,
     manifest,
-    clasp
+    clasp,
   }
 }
 
-export const sxRefreshToken = async (Auth) => {
-  const auth = Auth.getAuth();
-  // force a refresh by clearing the cached credential
-  auth.cachedCredential = null;
-  const accessToken = await auth.getAccessToken();
-  const tokenInfo = await got(`https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=${accessToken}`).json();
-
-  // update the worker's auth state
-  Auth.setAccessToken(accessToken);
-  Auth.setTokenInfo(tokenInfo);
-
-  return { accessToken, tokenInfo };
-};

package/src/support/sxcalendar.js

@@ -6,12 +6,9 @@
  * - arguments and returns must be serializable ie. primitives or plain objects
  */
 
-import { responseSyncify } from './auth.js';
-import { syncWarn, syncError } from './workersync/synclogger.js';
+import { sxRetry } from './sxretry.js';
 import { getCalendarApiClient } from '../services/advcalendar/clapis.js';
 
-const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-
 /**
  * sync a call to calendar api
  * @param {object} Auth the auth object
@@ -25,49 +22,18 @@ const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 export const sxCalendar = async (Auth, { prop, method, params, options = {} }) => {
 
   const apiClient = getCalendarApiClient();
-
-  const maxRetries = 7;
-  let delay = 1777;
+  const tag = `sxCalendar for ${prop}.${method}`;
 
   const { noLog404, ...validParams } = params || {};
 
-  for (let i = 0; i < maxRetries; i++) {
-    let response;
-    let error;
-
-    try {
-      const callish = apiClient[prop];
-      response = await callish[method](validParams, options);
-    } catch (err) {
-      error = err;
-      response = err.response;
-    }
-
-    const isRetryable = [429, 500, 503].includes(response?.status) ||
-      error?.code == 429 ||
-      (response?.status === 403 && (
-        error?.message?.toLowerCase().includes('usage limit') ||
-        error?.message?.toLowerCase().includes('rate limit') ||
-        error?.errors?.some(e => ['rateLimitExceeded', 'userRateLimitExceeded', 'calendarUsageLimitsExceeded'].includes(e.reason))
-      ));
-
-    if (isRetryable && i < maxRetries - 1) {
-      // add a random jitter to avoid thundering herd
-      const jitter = Math.floor(Math.random() * 1000);
-      syncWarn(`Retryable error on Calendar API call ${prop}.${method} (status: ${response?.status}). Retrying in ${delay + jitter}ms...`);
-      await sleep(delay + jitter);
-      delay *= 2;
-      continue;
-    }
-
-    if (error || isRetryable) {
+  return sxRetry(Auth, tag, async () => {
+    return apiClient[prop][method](validParams, options);
+  }, {
+    skipLog: (error, response) => {
       if (noLog404 && (response?.status === 404 || error?.code === 404 || response?.status === 400 || error?.code === 400)) {
-        // Suppress logging for expected 404s (or 400s which can happen if already deleted)
-      } else {
-        syncError(`Failed in sxCalendar for ${prop}.${method}`, error);
+        return true;
       }
-      return { data: null, response: responseSyncify(response) };
+      return false;
     }
-    return { data: response.data, response: responseSyncify(response) };
-  }
+  });
 };

package/src/support/sxdocs.js

@@ -5,12 +5,9 @@
  * note
  * - arguments and returns must be serializable ie. primitives or plain objects
  */
-import { responseSyncify } from './auth.js';
-import { syncWarn, syncError, syncLog } from './workersync/synclogger.js';
+import { sxRetry } from './sxretry.js';
 import { getDocsApiClient } from '../services/advdocs/docapis.js';
 
-const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-
 /**
  * sync a call to docs api
  * @param {object} Auth the auth object
@@ -22,44 +19,11 @@ const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
  * @return {import('./sxdrive.js').SxResult} from the Docs api
  */
 export const sxDocs = async (Auth, { prop, method, params, options = {} }) => {
-  const apiClient = getDocsApiClient();
-  // rate limit on docs is higher that the others so we may as well have a bigger delay
-  const maxRetries = 7;
-  let delay = 2789;
-    //syncLog(JSON.stringify({ prop, method, params, options }))
-  for (let i = 0; i < maxRetries; i++) {
-    let response;
-    let error;
-
-    try {
-      const callish = apiClient[prop]
-      response = await callish[method](params, options);
-    } catch (err) {
-      error = err;
-      response = err.response;
-    }
 
-    const isRetryable = [429, 500, 503].includes(response?.status) || error?.code == 429;
-
-    if (isRetryable && i < maxRetries - 1) {
-      // add a random jitter to avoid thundering herd
-      const jitter = Math.floor(Math.random() * 1000);
-      syncWarn(`Retryable error on Docs API call ${prop}.${method} (status: ${response?.status}). Retrying in ${delay + jitter}ms...`);
-      await sleep(delay + jitter);
-      delay *= 2;
-      continue;
-    }
+  const apiClient = getDocsApiClient();
+  const tag = `sxDocs for ${prop}.${method}`;
 
-    if (error || isRetryable) {
-      syncError(`Failed in sxDocs for ${prop}.${method}`, error);
-      return {
-        data: null,
-        response: responseSyncify(response)
-      };
-    }
-    return {
-      data: response.data,
-      response: responseSyncify(response)
-    };
-  }
+  return sxRetry(Auth, tag, async () => {
+    return apiClient[prop][method](params, options);
+  });
 };