@mearl/client 2.15.0 → 2.15.2

package/dist/buc.js

@@ -1,533 +0,0 @@
-import { accessSync, constants } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-const BUC_ENV = 'production';
-const BUC_PROFILE_APP = 'alineiwai';
-const BUC_PROFILE_ORIGIN = 'https://work.alibaba-inc.com';
-const BUC_COMMAND_TIMEOUT_MS = 120_000;
-const BUC_INSTALL_TIMEOUT_MS = 120_000;
-const BUC_REQUEST_TIMEOUT_MS = 30_000;
-const MAX_COMMAND_OUTPUT = 1024 * 1024;
-const MAX_INSTALL_SCRIPT_LENGTH = 2 * 1024 * 1024;
-const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
-const MAX_PROFILE_REDIRECTS = 5;
-const MAX_PROFILE_COOKIES = 64;
-function appendOutput(current, chunk) {
-    if (current.length >= MAX_COMMAND_OUTPUT)
-        return current;
-    return (current + chunk.toString('utf8')).slice(0, MAX_COMMAND_OUTPUT);
-}
-function sanitizedDiagnostic(value) {
-    return value
-        .replace(/\beyJ[A-Za-z0-9._~+/=-]{40,}\b/g, '<redacted>')
-        .replace(/\bST-[A-Za-z0-9._~+/=-]{8,}\b/g, '<redacted>')
-        .replace(/[\r\n]+/g, ' ')
-        .trim()
-        .slice(0, 500);
-}
-function runProgram(command, args, options = {}) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            windowsHide: true,
-        });
-        let stdout = '';
-        let stderr = '';
-        let settled = false;
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            if (error)
-                reject(error);
-            else
-                resolve({ stdout, stderr });
-        };
-        const timer = setTimeout(() => {
-            child.kill('SIGTERM');
-            finish(new Error(`BUC command timed out after ${(options.timeoutMs ?? BUC_COMMAND_TIMEOUT_MS) / 1000}s`));
-        }, options.timeoutMs ?? BUC_COMMAND_TIMEOUT_MS);
-        child.stdout.on('data', chunk => (stdout = appendOutput(stdout, chunk)));
-        child.stderr.on('data', chunk => (stderr = appendOutput(stderr, chunk)));
-        child.once('error', error => finish(error));
-        child.once('exit', code => {
-            if (code === 0) {
-                finish();
-                return;
-            }
-            const detail = sanitizedDiagnostic(stderr || stdout);
-            finish(new Error(detail ? `BUC CLI failed: ${detail}` : `BUC CLI exited with code ${code}`));
-        });
-        child.stdin.end(options.input);
-    });
-}
-function isExecutable(filePath) {
-    try {
-        accessSync(filePath, process.platform === 'win32' ? constants.F_OK : constants.X_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function resolveBucExecutable() {
-    const names = process.platform === 'win32' ? ['buc.exe', 'buc.cmd', 'buc'] : ['buc'];
-    const pathKey = Object.keys(process.env).find(key => key.toLowerCase() === 'path') ?? 'PATH';
-    const pathDirectories = (process.env[pathKey] ?? '').split(path.delimiter).filter(Boolean);
-    const directories = [path.join(os.homedir(), '.local', 'bin'), ...pathDirectories];
-    for (const directory of directories) {
-        for (const name of names) {
-            const candidate = path.join(directory, name);
-            if (isExecutable(candidate))
-                return candidate;
-        }
-    }
-    return 'buc';
-}
-export const runBucCommand = args => runProgram(resolveBucExecutable(), args);
-async function fetchInstaller(url) {
-    const response = await fetch(url, { signal: AbortSignal.timeout(30_000) });
-    if (!response.ok)
-        throw new Error(`BUC installer returned HTTP ${response.status}`);
-    const script = await response.text();
-    if (!script || script.length > MAX_INSTALL_SCRIPT_LENGTH) {
-        throw new Error('BUC installer returned an invalid script');
-    }
-    return script;
-}
-export async function installBucCli() {
-    if (process.platform === 'win32') {
-        const script = await fetchInstaller('https://cli-hub.alibaba-inc.com/buc/install.ps1');
-        await runProgram('powershell', ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command', '-'], {
-            input: script,
-            timeoutMs: BUC_INSTALL_TIMEOUT_MS,
-        });
-        return;
-    }
-    const script = await fetchInstaller('https://cli-hub.alibaba-inc.com/buc/install.sh');
-    await runProgram('sh', ['-s'], { input: script, timeoutMs: BUC_INSTALL_TIMEOUT_MS });
-}
-function isMissingCommandError(error) {
-    return (error instanceof Error && 'code' in error && error.code === 'ENOENT');
-}
-async function runBucWithInstall(args, dependencies) {
-    const runBuc = dependencies.runBuc ?? runBucCommand;
-    try {
-        return await runBuc(args);
-    }
-    catch (error) {
-        if (!isMissingCommandError(error))
-            throw error;
-    }
-    await (dependencies.installBuc ?? installBucCli)();
-    try {
-        return await runBuc(args);
-    }
-    catch (error) {
-        throw new Error(`BUC CLI is unavailable after installation: ${sanitizedDiagnostic(error instanceof Error ? error.message : String(error))}`, { cause: error });
-    }
-}
-function parseJsonOutput(output, label) {
-    const value = output.trim();
-    if (!value)
-        throw new Error(`BUC CLI returned empty ${label} output`);
-    try {
-        const parsed = JSON.parse(value);
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            throw new Error('not an object');
-        return parsed;
-    }
-    catch (error) {
-        throw new Error(`BUC CLI returned invalid ${label} JSON`, { cause: error });
-    }
-}
-function outputData(payload) {
-    return payload.data && typeof payload.data === 'object' && !Array.isArray(payload.data)
-        ? payload.data
-        : payload;
-}
-function requiredCredentialValue(value, label) {
-    if (typeof value !== 'string' || !value || value.length > 32 * 1024 || /[\r\n\0]/.test(value)) {
-        throw new Error(`BUC CLI returned an invalid ${label}`);
-    }
-    return value;
-}
-function validateApp(app) {
-    const value = typeof app === 'string' ? app.trim() : '';
-    if (!/^[a-z][a-z0-9_-]{0,63}$/i.test(value))
-        throw new Error('BUC app is invalid');
-    return value;
-}
-async function createIdToken(app, dependencies) {
-    const result = await runBucWithInstall(['--no-update-check', 'id-token', 'create', '--app', app, '--env', BUC_ENV], dependencies);
-    const payload = parseJsonOutput(result.stdout, 'id-token');
-    if (payload.success === false)
-        throw new Error('BUC CLI could not create an ID token');
-    const data = outputData(payload);
-    return {
-        idToken: requiredCredentialValue(data.idToken, 'ID token'),
-        dpop: requiredCredentialValue(data.dpop, 'DPoP proof'),
-    };
-}
-async function createSsoTicket(app, dependencies) {
-    const result = await runBucWithInstall(['--no-update-check', 'ticket', 'create', '--app', app, '--env', BUC_ENV], dependencies);
-    const payload = parseJsonOutput(result.stdout, 'ticket');
-    if (payload.success === false)
-        throw new Error('BUC CLI could not create an SSO ticket');
-    return requiredCredentialValue(outputData(payload).ssoTicket, 'SSO ticket');
-}
-export async function bucWhoami(dependencies = {}) {
-    const result = await runBucWithInstall(['--no-update-check', 'whoami'], dependencies);
-    const payload = outputData(parseJsonOutput(result.stdout, 'whoami'));
-    const empId = String(payload.empId ?? '').trim();
-    if (!empId || empId.length > 128 || /[\r\n\0]/.test(empId)) {
-        throw new Error('BUC CLI returned an invalid employee identity');
-    }
-    const name = typeof payload.name === 'string' ? payload.name.trim() : '';
-    const agentId = typeof payload.agentId === 'string' ? payload.agentId.trim() : '';
-    if (agentId && (agentId.length > 256 || /[\r\n\0]/.test(agentId))) {
-        throw new Error('BUC CLI returned an invalid agent identity');
-    }
-    return {
-        empId,
-        ...(name ? { name: name.slice(0, 256) } : {}),
-        ...(agentId ? { agentId } : {}),
-    };
-}
-function splitSetCookieHeader(value) {
-    return value.split(/,(?=\s*[!#$%&'*+\-.^_`|~0-9A-Za-z]+=)/u);
-}
-function getSetCookieHeaders(headers) {
-    const values = headers.getSetCookie?.();
-    if (values?.length)
-        return values;
-    const combined = headers.get('set-cookie');
-    return combined ? splitSetCookieHeader(combined) : [];
-}
-function updateProfileCookies(cookies, headers) {
-    for (const header of getSetCookieHeaders(headers)) {
-        const [pair, ...attributes] = header.split(';');
-        const separator = pair.indexOf('=');
-        if (separator <= 0)
-            continue;
-        const name = pair.slice(0, separator).trim();
-        const value = pair.slice(separator + 1).trim();
-        if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u.test(name) ||
-            value.length > 16 * 1024 ||
-            /[\r\n\0]/.test(value)) {
-            throw new Error('BUC profile response returned an invalid session cookie');
-        }
-        const expired = attributes.some(attribute => /^\s*max-age\s*=\s*0\s*$/iu.test(attribute));
-        if (expired || !value)
-            cookies.delete(name);
-        else
-            cookies.set(name, value);
-        if (cookies.size > MAX_PROFILE_COOKIES) {
-            throw new Error('BUC profile response returned too many session cookies');
-        }
-    }
-}
-function profileCookieHeader(cookies) {
-    return [...cookies].map(([name, value]) => `${name}=${value}`).join('; ');
-}
-function profileRedirectUrl(location, base) {
-    let url;
-    try {
-        url = new URL(location, base);
-    }
-    catch {
-        throw new Error('BUC profile response returned an invalid redirect');
-    }
-    if (url.protocol !== 'https:' ||
-        url.origin !== BUC_PROFILE_ORIGIN ||
-        url.username ||
-        url.password) {
-        throw new Error('BUC profile redirects must stay on work.alibaba-inc.com');
-    }
-    return url;
-}
-async function fetchProfileHtml(empId, ticket, dependencies) {
-    const requestFetch = dependencies.fetch ?? fetch;
-    const cookies = new Map();
-    let url = new URL(`/work/u/${encodeURIComponent(empId)}`, BUC_PROFILE_ORIGIN);
-    let firstRequest = true;
-    for (let redirectCount = 0; redirectCount <= MAX_PROFILE_REDIRECTS; redirectCount += 1) {
-        const headers = new Headers();
-        if (firstRequest)
-            headers.set('SSO-TICKET', ticket);
-        else if (cookies.size)
-            headers.set('Cookie', profileCookieHeader(cookies));
-        const response = await requestFetch(url, {
-            method: 'GET',
-            headers,
-            redirect: 'manual',
-            signal: AbortSignal.timeout(BUC_REQUEST_TIMEOUT_MS),
-        });
-        firstRequest = false;
-        updateProfileCookies(cookies, response.headers);
-        if (response.status >= 300 && response.status < 400) {
-            const location = response.headers.get('location');
-            if (!location)
-                throw new Error('BUC profile response redirected without a location');
-            if (redirectCount === MAX_PROFILE_REDIRECTS) {
-                throw new Error(`BUC profile response exceeded ${MAX_PROFILE_REDIRECTS} redirects`);
-            }
-            url = profileRedirectUrl(location, url);
-            continue;
-        }
-        if (!response.ok)
-            throw new Error(`BUC profile request failed (HTTP ${response.status})`);
-        return (await readResponseText(response)).replaceAll(ticket, '<redacted>');
-    }
-    throw new Error('BUC profile request did not complete');
-}
-function profileString(value) {
-    if (typeof value !== 'string' && typeof value !== 'number')
-        return undefined;
-    const normalized = String(value).trim();
-    if (!normalized)
-        return undefined;
-    if (normalized.length > 4096 || /[\r\n\0]/.test(normalized)) {
-        throw new Error('BUC profile returned an invalid field');
-    }
-    return normalized;
-}
-function parseBucProfile(html, identity) {
-    const match = html.match(/\bg_config\s*=\s*(\{[\s\S]*?\});/u);
-    if (!match)
-        throw new Error('BUC profile response did not contain user data');
-    let user;
-    try {
-        user = JSON.parse(match[1]).user;
-    }
-    catch (error) {
-        throw new Error('BUC profile response contained invalid user data', { cause: error });
-    }
-    if (!user || typeof user !== 'object' || Array.isArray(user)) {
-        throw new Error('BUC profile response did not contain a user profile');
-    }
-    const source = user;
-    const empId = profileString(source.empId);
-    if (!empId || empId !== identity.empId) {
-        throw new Error('BUC profile identity does not match the current employee');
-    }
-    const profile = {
-        empId,
-        ...(identity.agentId ? { agentId: identity.agentId } : {}),
-    };
-    const stringFields = [
-        'bucUserId',
-        'gid',
-        'empType',
-        'photoPath',
-        'displayName',
-        'nickName',
-        'deptId',
-        'buName',
-        'name',
-        'buNo',
-        'deptDesc',
-        'lang',
-        'cid',
-        'jobDesc',
-        'loginWorkNo',
-    ];
-    for (const field of stringFields) {
-        const value = profileString(source[field]);
-        if (value)
-            profile[field] = value;
-    }
-    if (!profile.name && identity.name)
-        profile.name = identity.name;
-    if (typeof source.admin === 'boolean')
-        profile.admin = source.admin;
-    return profile;
-}
-export async function bucProfile(dependencies = {}) {
-    const identity = await bucWhoami(dependencies);
-    const ticket = await createSsoTicket(BUC_PROFILE_APP, dependencies);
-    return parseBucProfile(await fetchProfileHtml(identity.empId, ticket, dependencies), identity);
-}
-function validateRequestUrl(input) {
-    let url;
-    try {
-        url = new URL(input);
-    }
-    catch {
-        throw new Error('BUC request URL is invalid');
-    }
-    const hostname = url.hostname.toLowerCase();
-    if (url.protocol !== 'https:' ||
-        (hostname !== 'alibaba-inc.com' && !hostname.endsWith('.alibaba-inc.com')) ||
-        url.username ||
-        url.password) {
-        throw new Error('BUC requests only support HTTPS alibaba-inc.com URLs without credentials');
-    }
-    return url;
-}
-function validateTimeout(value) {
-    if (value === undefined)
-        return BUC_REQUEST_TIMEOUT_MS;
-    if (!Number.isFinite(value) || Number(value) < 1 || Number(value) > 120_000) {
-        throw new Error('BUC request timeoutMs must be between 1 and 120000');
-    }
-    return Number(value);
-}
-function safeRequestHeaders(input) {
-    const headers = new Headers();
-    for (const [name, value] of Object.entries(input ?? {})) {
-        const normalized = name.trim().toLowerCase();
-        if (normalized === 'authorization' ||
-            normalized === 'dpop' ||
-            normalized === 'cookie' ||
-            normalized === 'sso-ticket') {
-            throw new Error(`BUC request header is managed by Mearl: ${name}`);
-        }
-        headers.set(name, value);
-    }
-    return headers;
-}
-function validateRequestAuth(value) {
-    if (value === undefined)
-        return 'id-token';
-    if (value === 'id-token' || value === 'ticket-header' || value === 'ticket-query')
-        return value;
-    throw new Error('BUC request auth must be id-token, ticket-header, or ticket-query');
-}
-function isSsoTicketParam(name) {
-    return name.replace(/[-_]/g, '').toLowerCase() === 'ssoticket';
-}
-function rejectManagedQueryCredentials(url, params) {
-    for (const name of url.searchParams.keys()) {
-        if (isSsoTicketParam(name))
-            throw new Error(`BUC request query is managed by Mearl: ${name}`);
-    }
-    for (const name of Object.keys(params ?? {})) {
-        if (isSsoTicketParam(name))
-            throw new Error(`BUC request query is managed by Mearl: ${name}`);
-    }
-}
-async function readResponseText(response) {
-    const declaredLength = Number(response.headers.get('content-length'));
-    if (Number.isFinite(declaredLength) && declaredLength > MAX_RESPONSE_BYTES) {
-        throw new Error(`BUC response exceeds ${MAX_RESPONSE_BYTES} bytes`);
-    }
-    const buffer = await response.arrayBuffer();
-    if (buffer.byteLength > MAX_RESPONSE_BYTES) {
-        throw new Error(`BUC response exceeds ${MAX_RESPONSE_BYTES} bytes`);
-    }
-    return new TextDecoder().decode(buffer);
-}
-function parseResponseBody(text, responseType) {
-    if (responseType === 'text')
-        return text;
-    const trimmed = text.trimStart();
-    const shouldParse = responseType === 'json' || trimmed.startsWith('{') || trimmed.startsWith('[');
-    if (!shouldParse)
-        return text;
-    try {
-        return JSON.parse(text);
-    }
-    catch (error) {
-        if (responseType === 'json')
-            throw new Error('BUC response is not valid JSON', { cause: error });
-        return text;
-    }
-}
-function redactCredentials(value, credentials) {
-    return credentials.reduce((result, credential) => {
-        const formEncoded = new URLSearchParams({ value: credential })
-            .toString()
-            .slice('value='.length);
-        return [...new Set([credential, encodeURIComponent(credential), formEncoded])]
-            .sort((left, right) => right.length - left.length)
-            .reduce((redacted, candidate) => redacted.replaceAll(candidate, '<redacted>'), result);
-    }, value);
-}
-function responseHeaders(headers, credentials) {
-    return Object.fromEntries([...headers.entries()]
-        .filter(([name]) => !['authorization', 'dpop', 'set-cookie', 'sso-ticket'].includes(name.toLowerCase()))
-        .map(([name, value]) => [name, redactCredentials(value, credentials)]));
-}
-/** Executes one internal request with a fresh credential in the selected BUC authentication mode. */
-export async function bucRequest(input, dependencies = {}) {
-    const app = validateApp(input?.app);
-    const url = validateRequestUrl(input?.url);
-    const auth = validateRequestAuth(input?.auth);
-    rejectManagedQueryCredentials(url, input.params);
-    for (const [name, value] of Object.entries(input.params ?? {})) {
-        if (value !== undefined && value !== null)
-            url.searchParams.set(name, String(value));
-    }
-    if (input.body !== undefined && input.formData !== undefined) {
-        throw new Error('BUC request body and formData cannot be combined');
-    }
-    const headers = safeRequestHeaders(input.headers);
-    let body;
-    if (input.formData !== undefined) {
-        const form = new FormData();
-        for (const [name, value] of Object.entries(input.formData))
-            form.append(name, String(value));
-        body = form;
-    }
-    else if (input.body !== undefined) {
-        if (typeof input.body === 'string')
-            body = input.body;
-        else {
-            headers.set('Content-Type', 'application/json');
-            body = JSON.stringify(input.body);
-        }
-    }
-    const method = (input.method ?? (body === undefined ? 'GET' : 'POST')).trim().toUpperCase();
-    if (!/^[A-Z]+$/.test(method))
-        throw new Error('BUC request method is invalid');
-    if ((method === 'GET' || method === 'HEAD') && body !== undefined) {
-        throw new Error(`${method} BUC requests cannot include a body`);
-    }
-    let credentials;
-    if (auth === 'id-token') {
-        const credential = await createIdToken(app, dependencies);
-        credentials = [credential.idToken, credential.dpop];
-        headers.set('Authorization', `Bearer ${credential.idToken}`);
-        headers.set('DPoP', credential.dpop);
-    }
-    else {
-        const ticket = await createSsoTicket(app, dependencies);
-        credentials = [ticket];
-        if (auth === 'ticket-header')
-            headers.set('SSO-TICKET', ticket);
-        else
-            url.searchParams.set('SSO_TICKET', ticket);
-    }
-    const requestFetch = dependencies.fetch ?? fetch;
-    let response;
-    try {
-        response = await requestFetch(url, {
-            method,
-            headers,
-            body,
-            redirect: 'manual',
-            signal: AbortSignal.timeout(validateTimeout(input.timeoutMs)),
-        });
-    }
-    catch (error) {
-        const detail = redactCredentials(sanitizedDiagnostic(error instanceof Error ? error.message : String(error)), credentials);
-        // Raw transport errors can retain credential-bearing URLs, so only sanitized text crosses the API.
-        // eslint-disable-next-line preserve-caught-error
-        throw new Error(detail ? `BUC request failed: ${detail}` : 'BUC request failed');
-    }
-    const text = redactCredentials(await readResponseText(response), credentials);
-    return {
-        status: response.status,
-        statusText: redactCredentials(response.statusText, credentials),
-        headers: responseHeaders(response.headers, credentials),
-        body: parseResponseBody(text, input.responseType ?? 'auto'),
-    };
-}
-export const buc = Object.freeze({
-    request: bucRequest,
-    whoami: bucWhoami,
-    profile: bucProfile,
-});