@meltemi/diagrams-cli 0.0.0-stage → 1.9.0

package/dist/login-listener.js

@@ -0,0 +1,173 @@
+/**
+ * The half of `mdg login` that runs on this computer (`cli-cloud`, "Signing in from the command
+ * line"): a listener on `127.0.0.1` at a random port that the approval page redirects the browser
+ * to, with the one-time `code` and the `state` of this request.
+ *
+ * It answers `GET /` with a `code` and a `state` and nothing else (anything else is refused and the
+ * wait goes on), checks the `Host` header so that a name that resolves to this machine is no way in,
+ * stops listening the moment the first such request arrives, and answers the browser only when the
+ * caller says how signing in ended, so the page never claims more than the truth. The code is never
+ * printed or logged.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { DEFAULT_LOCALE, getLocale, resolveLocale } from "@meltemi/diagrams-i18n";
+import { messages } from "./messages/index.js";
+/** How long a person has to approve: five minutes, as the service's one-time code lives. */
+export const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+/** RFC 4648 base32, upper case and without padding, of bytes. */
+export function base32(bytes) {
+    let result = "";
+    let buffer = 0;
+    let bits = 0;
+    for (const byte of bytes) {
+        buffer = (buffer << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            result += BASE32[(buffer >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+        buffer &= (1 << bits) - 1;
+    }
+    if (bits > 0)
+        result += BASE32[(buffer << (5 - bits)) & 31];
+    return result;
+}
+/**
+ * The six characters the approval page shows for a `state`: the first six of the base32 of its
+ * SHA-256, so that a person can tell their own terminal's request from somebody else's.
+ */
+export function approvalCheck(state) {
+    return base32(createHash("sha256").update(state).digest()).slice(0, 6);
+}
+/**
+ * The language of a page from an `Accept-Language` header: the first language, by preference, that
+ * is English or Spanish; the fallback when the header names neither.
+ */
+export function languageOf(header, fallback = DEFAULT_LOCALE) {
+    if (!header)
+        return fallback;
+    const preferences = header
+        .split(",")
+        .map((part, index) => {
+        const [tag = "", ...parameters] = part.trim().split(";");
+        const q = parameters.map((p) => /^\s*q\s*=\s*([0-9.]+)\s*$/i.exec(p)?.[1]).find(Boolean);
+        return { tag: tag.trim().toLowerCase(), q: q === undefined ? 1 : Number(q), index };
+    })
+        .filter((p) => p.tag !== "" && p.tag !== "*" && Number.isFinite(p.q) && p.q > 0)
+        .sort((a, b) => b.q - a.q || a.index - b.index);
+    for (const { tag } of preferences) {
+        const language = tag.split("-")[0];
+        if (language === "es" || language === "en")
+            return resolveLocale(tag);
+    }
+    return fallback;
+}
+const escape = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+/** The small page the browser lands on: done, or that signing in did not finish. */
+export function donePage(locale, finished) {
+    const t = messages(locale).cloud.login.page;
+    return `<!doctype html>
+<html lang="${locale}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>Meltemi Diagrams</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem}</style>
+</head>
+<body>
+<h1>Meltemi Diagrams</h1>
+<p>${escape(finished ? t.done : t.failed)}</p>
+</body>
+</html>
+`;
+}
+/** Whether two texts are equal, in time that does not depend on where they differ. */
+export function sameText(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+function refuse(response, status, headers = {}) {
+    response.writeHead(status, { "Content-Type": "text/plain; charset=utf-8", ...headers });
+    response.end(`${status}\n`);
+}
+/** Starts the listener on `127.0.0.1` at a free port. */
+export function listenForApproval(options) {
+    const server = createServer();
+    let arrived = false;
+    let settle;
+    const outcome = new Promise((resolve) => (settle = resolve));
+    let timer;
+    const closing = new Promise((resolve) => server.once("close", () => resolve()));
+    const close = async () => {
+        clearTimeout(timer);
+        if (server.listening)
+            server.close();
+        server.closeAllConnections();
+        await closing;
+    };
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            const address = server.address();
+            const port = typeof address === "object" && address ? address.port : 0;
+            server.on("request", (request, response) => {
+                // Only this computer's own address names the listener: a page that makes the browser
+                // call it under another name (DNS rebinding) is turned away.
+                if (request.headers.host !== `127.0.0.1:${port}`)
+                    return refuse(response, 421);
+                if (request.method !== "GET")
+                    return refuse(response, 405, { Allow: "GET" });
+                const url = new URL(request.url ?? "/", `http://127.0.0.1:${port}`);
+                if (url.pathname !== "/")
+                    return refuse(response, 404);
+                const codes = url.searchParams.getAll("code");
+                const states = url.searchParams.getAll("state");
+                if (codes.length !== 1 || states.length !== 1 || !codes[0] || !states[0]) {
+                    return refuse(response, 400);
+                }
+                if (arrived)
+                    return refuse(response, 409, { Connection: "close" });
+                arrived = true;
+                // The first request with a code is the only one: stop listening at once.
+                server.close();
+                clearTimeout(timer);
+                const locale = languageOf(request.headers["accept-language"], options.fallbackLocale ?? getLocale());
+                let replied = false;
+                settle({
+                    code: codes[0],
+                    state: states[0],
+                    reply: (finished) => {
+                        if (replied)
+                            return;
+                        replied = true;
+                        const page = donePage(locale, finished);
+                        response.writeHead(finished ? 200 : 400, {
+                            "Content-Type": "text/html; charset=utf-8",
+                            "Content-Length": Buffer.byteLength(page),
+                            "Cache-Control": "no-store",
+                            "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
+                            "Referrer-Policy": "no-referrer",
+                            "X-Content-Type-Options": "nosniff",
+                            Connection: "close",
+                        });
+                        response.end(page, () => server.closeAllConnections());
+                    },
+                });
+            });
+            timer = setTimeout(() => {
+                if (arrived)
+                    return;
+                arrived = true;
+                void close();
+                settle("timeout");
+            }, options.timeoutMs);
+            resolve({ port, outcome, close });
+        });
+    });
+}
+//# sourceMappingURL=login-listener.js.map

package/dist/login-listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-listener.js","sourceRoot":"","sources":["../src/login-listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAe,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC9B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAA0B,EAAE,WAAmB,cAAc;IACtF,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SAC/E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAElG,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,QAAiB;IACxD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5C,OAAO;cACK,MAAM;;;;;;;;;;KAUf,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;;;CAGxC,CAAC;AACF,CAAC;AA8BD,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,MAAM,CAAC,QAAwB,EAAE,MAAc,EAAE,UAAkC,EAAE;IAC5F,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxF,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,MAAM,MAAM,GAAW,YAAY,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAA6C,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAClF,IAAI,KAAgD,CAAC;IAErD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,OAAO,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAEvE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;gBAC1E,qFAAqF;gBACrF,6DAA6D;gBAC7D,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,EAAE;oBAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;oBAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;oBAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACvD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,IAAI,OAAO;oBAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACnE,OAAO,GAAG,IAAI,CAAC;gBACf,yEAAyE;gBACzE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,MAAM,GAAG,UAAU,CACvB,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAClC,OAAO,CAAC,cAAc,IAAI,SAAS,EAAE,CACtC,CAAC;gBACF,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,CAAC;oBACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;oBACd,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;oBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAClB,IAAI,OAAO;4BAAE,OAAO;wBACpB,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;wBACxC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;4BACvC,cAAc,EAAE,0BAA0B;4BAC1C,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;4BACzC,eAAe,EAAE,UAAU;4BAC3B,yBAAyB,EACvB,wFAAwF;4BAC1F,iBAAiB,EAAE,aAAa;4BAChC,wBAAwB,EAAE,SAAS;4BACnC,UAAU,EAAE,OAAO;yBACpB,CAAC,CAAC;wBACH,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC;oBACzD,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,SAAS,CAAC,CAAC;YACpB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}