@milaboratories/pl-client 3.14.7 → 3.16.0

package/src/core/unauth_client_branch.test.ts

@@ -1,17 +1,39 @@
 import { test, expect, vi } from "vitest";
 import { UnauthenticatedPlClient } from "./unauth_client";
+import { LLPlClient } from "./ll_client";
+import { PlatformClient as GrpcPlApiClient } from "../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.client";
 import type { BackendCapability } from "./capabilities";
+import {
+  AuthAPI_ListMethods_SSOAuthMethod_FlowType,
+  type AuthAPI_ListMethods_Response,
+} from "../proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api";
 
 type Scheme = "basic" | "token" | "none";
+type MethodInfo = AuthAPI_ListMethods_Response["methods"][number];
 
-function makeStub(opts: { hasAuthV2: boolean; scheme?: Scheme }) {
+function makeStub(opts: { hasAuthV2: boolean; scheme?: Scheme; methods?: MethodInfo[] }) {
   const scheme = opts.scheme ?? "basic";
   const methods =
-    scheme === "basic"
-      ? [{ id: "basic", method: { oneofKind: "basic", basic: {} } }]
+    opts.methods ??
+    (scheme === "basic"
+      ? [
+          {
+            id: "basic",
+            title: "basic",
+            description: "",
+            method: { oneofKind: "basic", basic: {} },
+          },
+        ]
       : scheme === "token"
-        ? [{ id: "token", method: { oneofKind: "token", token: {} } }]
-        : [];
+        ? [
+            {
+              id: "token",
+              title: "token",
+              description: "",
+              method: { oneofKind: "token", token: {} },
+            },
+          ]
+        : []);
   const ll = {
     hasCapability: vi.fn(
       (capability: BackendCapability) => capability === "auth:v2" && opts.hasAuthV2,
@@ -19,6 +41,8 @@ function makeStub(opts: { hasAuthV2: boolean; scheme?: Scheme }) {
     loginBasic: vi.fn().mockResolvedValue("jwt-from-loginBasic"),
     loginWithToken: vi.fn().mockResolvedValue("jwt-from-loginWithToken"),
     getJwtToken: vi.fn().mockResolvedValue("jwt-from-getJwtToken"),
+    beginSSOLogin: vi.fn().mockResolvedValue({ nonce: "nonce", expiresAt: new Date() }),
+    loginSSO: vi.fn().mockResolvedValue("jwt-from-loginSSO"),
     authMethodsSync: { methods },
     conf: { authTTLSeconds: 100 },
   };
@@ -67,3 +91,390 @@ test("hasCapability proxies to underlying LLPlClient", () => {
   expect(client.hasCapability("treeFilter:v2")).toBe(false);
   expect(ll.hasCapability).toHaveBeenCalledWith("auth:v2");
 });
+
+function ssoMethod(overrides: {
+  id: string;
+  title?: string;
+  description: string;
+  issuer: string;
+  flowType?: AuthAPI_ListMethods_SSOAuthMethod_FlowType;
+  clientId?: string;
+  scopes?: string;
+  resource?: string;
+  prompt?: string;
+  redirectPorts?: number[];
+  subjectTokenSource?: string;
+  userIdClaim?: string;
+  groupsClaim?: string;
+  accessType?: string;
+}): MethodInfo {
+  return {
+    id: overrides.id,
+    title: overrides.title ?? overrides.id,
+    description: overrides.description,
+    method: {
+      oneofKind: "sso",
+      sso: {
+        issuer: overrides.issuer,
+        clientId: overrides.clientId ?? "client-id",
+        scopes: overrides.scopes ?? "openid",
+        resource: overrides.resource ?? "",
+        prompt: overrides.prompt ?? "",
+        redirectPorts: overrides.redirectPorts ?? [12345],
+        subjectTokenSource: overrides.subjectTokenSource ?? "id_token",
+        userIdClaim: overrides.userIdClaim ?? "sub",
+        groupsClaim: overrides.groupsClaim ?? "",
+        flowType: overrides.flowType ?? AuthAPI_ListMethods_SSOAuthMethod_FlowType.PUBLIC_PKCE,
+        accessType: overrides.accessType,
+      },
+    },
+  };
+}
+
+function basicMethod(id: string, description = "Basic auth", title = id): MethodInfo {
+  return { id, title, description, method: { oneofKind: "basic", basic: {} } };
+}
+
+function tokenMethod(id: string, description = "Static token", title = id): MethodInfo {
+  return { id, title, description, method: { oneofKind: "token", token: {} } };
+}
+
+// --- loginMethods() ---
+
+test("loginMethods lists every advertised method, of every kind, in advertised order", () => {
+  const methods: MethodInfo[] = [
+    ssoMethod({ id: "sso-a", description: "First IdP", issuer: "https://first.example" }),
+    ssoMethod({ id: "sso-b", description: "Second IdP", issuer: "https://second.example" }),
+    basicMethod("htpasswd-a", "htpasswd"),
+    basicMethod("htpasswd-b", "htpasswd"),
+    tokenMethod("token-a", "static token"),
+  ];
+  const { client } = makeStub({ hasAuthV2: true, methods });
+
+  const listed = client.loginMethods();
+
+  expect(listed.map((m) => m.kind)).toEqual(["sso", "sso", "basic", "basic", "token"]);
+  expect(listed.map((m) => m.id)).toEqual([
+    "sso-a",
+    "sso-b",
+    "htpasswd-a",
+    "htpasswd-b",
+    "token-a",
+  ]);
+  expect(listed.map((m) => m.title)).toEqual([
+    "sso-a",
+    "sso-b",
+    "htpasswd-a",
+    "htpasswd-b",
+    "token-a",
+  ]);
+});
+
+test("loginMethods falls back to description, then id, when the backend omits title", () => {
+  const methods: MethodInfo[] = [
+    {
+      id: "no-title",
+      title: "",
+      description: "Untitled backend",
+      method: { oneofKind: "basic", basic: {} },
+    },
+    {
+      id: "no-title-no-description",
+      title: "",
+      description: "",
+      method: { oneofKind: "token", token: {} },
+    },
+  ];
+  const { client } = makeStub({ hasAuthV2: true, methods });
+
+  const listed = client.loginMethods();
+
+  expect(listed.map((m) => m.title)).toEqual(["Untitled backend", "no-title-no-description"]);
+});
+
+test("loginMethods keeps same-kind methods distinct while supportedAuthSchemes still collapses them", () => {
+  const methods: MethodInfo[] = [
+    basicMethod("htpasswd-a", "htpasswd"),
+    basicMethod("htpasswd-b", "htpasswd"),
+    tokenMethod("token-a"),
+  ];
+  const { client } = makeStub({ hasAuthV2: true, methods });
+
+  const listed = client.loginMethods().filter((m) => m.kind === "basic");
+
+  expect(listed.map((m) => m.id)).toEqual(["htpasswd-a", "htpasswd-b"]);
+  expect(client.supportedAuthSchemes).toEqual({ basic: true, token: true });
+});
+
+test("loginMethods maps every field of an SSO projection, and drops an empty accessType", () => {
+  const method = ssoMethod({
+    id: "sso-1",
+    title: "Corporate SSO",
+    description: "Corp SSO",
+    issuer: "https://idp.example",
+    clientId: "the-client-id",
+    scopes: "openid profile",
+    resource: "https://api.example",
+    prompt: "consent",
+    redirectPorts: [11000, 11001],
+    subjectTokenSource: "access_token",
+    userIdClaim: "email",
+    groupsClaim: "groups",
+    accessType: "",
+  });
+  const { client } = makeStub({ hasAuthV2: true, methods: [method] });
+
+  const [entry] = client.loginMethods();
+
+  expect(entry).toEqual({
+    kind: "sso",
+    id: "sso-1",
+    title: "Corporate SSO",
+    description: "Corp SSO",
+    issuer: "https://idp.example",
+    clientId: "the-client-id",
+    scopes: "openid profile",
+    resource: "https://api.example",
+    prompt: "consent",
+    redirectPorts: [11000, 11001],
+    subjectTokenSource: "access_token",
+    userIdClaim: "email",
+    groupsClaim: "groups",
+    flowType: "public_pkce",
+    accessType: undefined,
+  });
+});
+
+test("loginMethods drops an advertised method with no usable arm", () => {
+  const armless: MethodInfo = {
+    id: "legacy",
+    title: "legacy",
+    description: "",
+    method: { oneofKind: undefined },
+  };
+  const { client } = makeStub({ hasAuthV2: true, methods: [armless, basicMethod("htpasswd-a")] });
+
+  expect(client.loginMethods().map((m) => m.id)).toEqual(["htpasswd-a"]);
+});
+
+test("loginMethods drops an SSO entry whose flow type is unsupported, keeping every other entry", () => {
+  const unsupported = ssoMethod({
+    id: "sso-legacy",
+    description: "Corp SSO",
+    issuer: "https://idp.example",
+    flowType: 99 as AuthAPI_ListMethods_SSOAuthMethod_FlowType,
+  });
+  const { client } = makeStub({
+    hasAuthV2: true,
+    methods: [unsupported, basicMethod("htpasswd-a")],
+  });
+
+  expect(client.loginMethods().map((m) => m.id)).toEqual(["htpasswd-a"]);
+});
+
+test("beginSSOLogin forwards the picked id to the low-level client", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "none" });
+
+  await client.beginSSOLogin("sso-a");
+
+  expect(ll.beginSSOLogin).toHaveBeenCalledWith("sso-a");
+});
+
+test("beginSSOLogin omits the argument when no id is picked", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "none" });
+
+  await client.beginSSOLogin();
+
+  expect(ll.beginSSOLogin).toHaveBeenCalledWith();
+});
+
+test("loginSSO carries the picked id to the low-level client alongside the token response", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "none" });
+  const tokenResponse = new Uint8Array([1, 2, 3]);
+
+  await client.loginSSO({ tokenResponse, idP: "sso-a" });
+
+  expect(ll.loginSSO).toHaveBeenCalledWith(tokenResponse, "sso-a");
+});
+
+test("loginSSO sends only the token response when no id is picked", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "none" });
+  const tokenResponse = new Uint8Array([1, 2, 3]);
+
+  await client.loginSSO({ tokenResponse });
+
+  expect(ll.loginSSO).toHaveBeenCalledWith(tokenResponse);
+});
+
+test("login forwards the picked id into loginBasic's options bag", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "basic" });
+
+  await client.login("alice", "pw", "htpasswd-b");
+
+  expect(ll.loginBasic).toHaveBeenCalledWith("alice", "pw", { idP: "htpasswd-b" });
+});
+
+test("login drops the picked id on the token branch", async () => {
+  const { client, ll } = makeStub({ hasAuthV2: true, scheme: "token" });
+
+  const info = await client.login("alice", "opaque-token", "some-id");
+
+  expect(ll.loginWithToken).toHaveBeenCalledWith("opaque-token");
+  expect(info.jwtToken).toBe("jwt-from-loginWithToken");
+});
+
+test("login routes to loginWithToken when the picked id names a token method, even though the backend also advertises basic", async () => {
+  const { client, ll } = makeStub({
+    hasAuthV2: true,
+    methods: [
+      { id: "ldap-a", title: "ldap-a", description: "", method: { oneofKind: "basic", basic: {} } },
+      {
+        id: "htpasswd",
+        title: "htpasswd",
+        description: "",
+        method: { oneofKind: "token", token: {} },
+      },
+    ],
+  });
+
+  const info = await client.login("alice", "opaque-token", "htpasswd");
+
+  expect(ll.loginWithToken).toHaveBeenCalledWith("opaque-token");
+  expect(ll.loginBasic).not.toHaveBeenCalled();
+  expect(info.jwtToken).toBe("jwt-from-loginWithToken");
+});
+
+test("ssoConfig returns the first sso method and drops the rest", () => {
+  const first = ssoMethod({
+    id: "sso-first",
+    description: "First IdP",
+    issuer: "https://first.example",
+  });
+  const second = ssoMethod({
+    id: "sso-second",
+    description: "Second IdP",
+    issuer: "https://second.example",
+  });
+  const { client } = makeStub({ hasAuthV2: true, methods: [first, second] });
+
+  const sso = client.ssoConfig();
+
+  expect(sso).toMatchObject({
+    id: "sso-first",
+    description: "First IdP",
+    issuer: "https://first.example",
+  });
+});
+
+test("ssoConfig carries id, title and description onto the returned SSOAuthMethod", () => {
+  const method = ssoMethod({
+    id: "sso-1",
+    title: "Corporate IdP",
+    description: "Corp SSO",
+    issuer: "https://idp.example",
+  });
+  const { client } = makeStub({ hasAuthV2: true, methods: [method] });
+
+  const sso = client.ssoConfig();
+
+  expect(sso?.id).toBe("sso-1");
+  expect(sso?.title).toBe("Corporate IdP");
+  expect(sso?.description).toBe("Corp SSO");
+});
+
+test("ssoConfig throws when the sso method's flow type is not PUBLIC_PKCE", () => {
+  const method = ssoMethod({
+    id: "sso-1",
+    description: "Corp SSO",
+    issuer: "https://idp.example",
+    // 99 is not a defined FlowType value; casts an out-of-range value the
+    // proto currently has none for, to pin the guard against a future flow.
+    flowType: 99 as AuthAPI_ListMethods_SSOAuthMethod_FlowType,
+  });
+  const { client } = makeStub({ hasAuthV2: true, methods: [method] });
+
+  expect(() => client.ssoConfig()).toThrow("ssoConfig: unsupported SSO flow type");
+});
+
+test("supportedAuthSchemes collapses a basic+token+sso method list to scheme booleans", () => {
+  const methods: MethodInfo[] = [
+    { id: "basic", title: "basic", description: "", method: { oneofKind: "basic", basic: {} } },
+    { id: "token", title: "token", description: "", method: { oneofKind: "token", token: {} } },
+    ssoMethod({ id: "sso-1", description: "Corp SSO", issuer: "https://idp.example" }),
+  ];
+  const { client } = makeStub({ hasAuthV2: true, methods });
+
+  expect(client.supportedAuthSchemes).toEqual({ basic: true, token: true });
+});
+
+// --- LLPlClient.loginBasic carries the id on both transports ---
+
+function makeLLStub(cl: { login?: ReturnType<typeof vi.fn>; POST?: ReturnType<typeof vi.fn> }) {
+  return Object.assign(Object.create(LLPlClient.prototype) as object, {
+    clientProvider: { get: () => cl },
+    conf: { authTTLSeconds: 100 },
+  }) as LLPlClient;
+}
+
+test("loginBasic carries idP in the request body on the gRPC transport", async () => {
+  const login = vi.fn(() => ({ response: Promise.resolve({ token: "jwt" }) }));
+  const cl = Object.assign(Object.create(GrpcPlApiClient.prototype) as object, { login });
+  const ll = makeLLStub(cl);
+
+  await ll.loginBasic("alice", "pw", { idP: "htpasswd-b" });
+
+  expect(login).toHaveBeenCalledWith(
+    expect.objectContaining({
+      credentials: {
+        oneofKind: "basic",
+        basic: { login: "alice", password: "pw", idp: "htpasswd-b" },
+      },
+    }),
+    expect.anything(),
+  );
+});
+
+test("loginBasic without idP produces the same gRPC request body as today", async () => {
+  const login = vi.fn(() => ({ response: Promise.resolve({ token: "jwt" }) }));
+  const cl = Object.assign(Object.create(GrpcPlApiClient.prototype) as object, { login });
+  const ll = makeLLStub(cl);
+
+  await ll.loginBasic("alice", "pw");
+
+  expect(login).toHaveBeenCalledWith(
+    expect.objectContaining({
+      credentials: { oneofKind: "basic", basic: { login: "alice", password: "pw" } },
+    }),
+    expect.anything(),
+  );
+});
+
+test("loginBasic carries idP in the request body on the REST transport", async () => {
+  const POST = vi.fn(() => Promise.resolve({ data: { token: "jwt" } }));
+  const ll = makeLLStub({ POST });
+
+  await ll.loginBasic("alice", "pw", { idP: "htpasswd-b" });
+
+  expect(POST).toHaveBeenCalledWith(
+    "/v1/auth/login",
+    expect.objectContaining({
+      body: expect.objectContaining({
+        basic: { login: "alice", password: "pw", idp: "htpasswd-b" },
+      }),
+    }),
+  );
+});
+
+test("loginBasic without idP produces the same REST request body as today", async () => {
+  const POST = vi.fn(() => Promise.resolve({ data: { token: "jwt" } }));
+  const ll = makeLLStub({ POST });
+
+  await ll.loginBasic("alice", "pw");
+
+  expect(POST).toHaveBeenCalledWith(
+    "/v1/auth/login",
+    expect.objectContaining({
+      body: expect.objectContaining({ basic: { login: "alice", password: "pw" } }),
+    }),
+  );
+});

package/src/core/user_resources.ts

@@ -36,6 +36,20 @@ export interface UserEntry {
   readonly login: string;
 }
 
+/** What {@link UserResources.deleteUser} removed, so a caller can report it. */
+export interface UserDeletionReport {
+  /** Raw id of the root resource the user owned, or undefined when they had none. Unsigned —
+   *  the resource is gone, so this is for the audit line, not for further calls. */
+  readonly userRootId: bigint | undefined;
+  /** Whether that root resource was deleted. */
+  readonly userRootDeleted: boolean;
+  /** Grants revoked, the user-root self-grant included. */
+  readonly revokedGrants: number;
+  /** Identity-index entries removed — one per value that resolved to the account: its login,
+   *  its email, and any alternative of either. */
+  readonly removedIdentityIndexEntries: number;
+}
+
 /** Information about a single data library (LS storage). */
 export interface StorageInfo {
   /** Machine-stable identifier, e.g. "library". Used for filtering and map keys. */
@@ -257,6 +271,31 @@ export class UserResources {
     return users.map((user) => ({ login: user.login }));
   }
 
+  /**
+   * Deletes a user account: the record, every identity-index entry that resolves to it (its login,
+   * its email, and any alternative of either), every grant it holds, and its root resource — and
+   * with the root, everything still attached under it.
+   *
+   * Exists for the duplicate account one person can end up with — an identity that could not be
+   * matched across a provider cutover, or one minted before the backend started refusing two
+   * records for one identity. The spare record shows up wherever users are listed and its projects
+   * keep taking part in deduplication.
+   *
+   * Destructive and irreversible. Re-attach anything worth keeping to another user's root before
+   * calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller
+   * credentials; gRPC-only, like {@link listUsers}.
+   */
+  async deleteUser(login: string): Promise<UserDeletionReport> {
+    const resp = await this.ll.deleteUser(login);
+
+    return {
+      userRootId: resp.userRootId === 0n ? undefined : resp.userRootId,
+      userRootDeleted: resp.userRootDeleted,
+      revokedGrants: resp.revokedGrants,
+      removedIdentityIndexEntries: resp.removedIdentityIndexEntries,
+    };
+  }
+
   private async getUserRootViaRpc(opts: {
     login?: string;
     createIfNotExists: true;

package/src/proto-grpc/github.com/milaboratory/pl/plapi/plapiproto/api.client.ts

@@ -10,6 +10,8 @@ import type { MaintenanceAPI_Ping_Response } from "./api";
 import type { MaintenanceAPI_Ping_Request } from "./api";
 import type { MiscAPI_ListResourceTypes_Response } from "./api";
 import type { MiscAPI_ListResourceTypes_Request } from "./api";
+import type { AuthAPI_DeleteUser_Response } from "./api";
+import type { AuthAPI_DeleteUser_Request } from "./api";
 import type { AuthAPI_ListUsers_Response } from "./api";
 import type { AuthAPI_ListUsers_Request } from "./api";
 import type { AuthAPI_ListUserResources_Response } from "./api";
@@ -290,6 +292,19 @@ export interface IPlatformClient {
      * @generated from protobuf rpc: ListUsers
      */
     listUsers(input: AuthAPI_ListUsers_Request, options?: RpcOptions): UnaryCall<AuthAPI_ListUsers_Request, AuthAPI_ListUsers_Response>;
+    /**
+     * DeleteUser removes a user account from the instance: the user record, every login-index
+     * entry that resolves to it, every grant it holds, and its root resource with everything
+     * still attached under it. Admin-only and irreversible - re-attach anything worth keeping
+     * to another user's root before calling (`pl-cli admin delete-user` does both steps).
+     *
+     * Exists because multi-provider auth can mint a duplicate account for one person: the waste
+     * record shows up in the sharing UI and its projects keep taking part in deduplication, and
+     * until now nothing could remove it.
+     *
+     * @generated from protobuf rpc: DeleteUser
+     */
+    deleteUser(input: AuthAPI_DeleteUser_Request, options?: RpcOptions): UnaryCall<AuthAPI_DeleteUser_Request, AuthAPI_DeleteUser_Response>;
     /**
      *
      * Other stuff
@@ -626,6 +641,22 @@ export class PlatformClient implements IPlatformClient, ServiceInfo {
         const method = this.methods[34], opt = this._transport.mergeOptions(options);
         return stackIntercept<AuthAPI_ListUsers_Request, AuthAPI_ListUsers_Response>("unary", this._transport, method, opt, input);
     }
+    /**
+     * DeleteUser removes a user account from the instance: the user record, every login-index
+     * entry that resolves to it, every grant it holds, and its root resource with everything
+     * still attached under it. Admin-only and irreversible - re-attach anything worth keeping
+     * to another user's root before calling (`pl-cli admin delete-user` does both steps).
+     *
+     * Exists because multi-provider auth can mint a duplicate account for one person: the waste
+     * record shows up in the sharing UI and its projects keep taking part in deduplication, and
+     * until now nothing could remove it.
+     *
+     * @generated from protobuf rpc: DeleteUser
+     */
+    deleteUser(input: AuthAPI_DeleteUser_Request, options?: RpcOptions): UnaryCall<AuthAPI_DeleteUser_Request, AuthAPI_DeleteUser_Response> {
+        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        return stackIntercept<AuthAPI_DeleteUser_Request, AuthAPI_DeleteUser_Response>("unary", this._transport, method, opt, input);
+    }
     /**
      *
      * Other stuff
@@ -634,7 +665,7 @@ export class PlatformClient implements IPlatformClient, ServiceInfo {
      * @generated from protobuf rpc: ListResourceTypes
      */
     listResourceTypes(input: MiscAPI_ListResourceTypes_Request, options?: RpcOptions): UnaryCall<MiscAPI_ListResourceTypes_Request, MiscAPI_ListResourceTypes_Response> {
-        const method = this.methods[35], opt = this._transport.mergeOptions(options);
+        const method = this.methods[36], opt = this._transport.mergeOptions(options);
         return stackIntercept<MiscAPI_ListResourceTypes_Request, MiscAPI_ListResourceTypes_Response>("unary", this._transport, method, opt, input);
     }
     /**
@@ -645,14 +676,14 @@ export class PlatformClient implements IPlatformClient, ServiceInfo {
      * @generated from protobuf rpc: Ping
      */
     ping(input: MaintenanceAPI_Ping_Request, options?: RpcOptions): UnaryCall<MaintenanceAPI_Ping_Request, MaintenanceAPI_Ping_Response> {
-        const method = this.methods[36], opt = this._transport.mergeOptions(options);
+        const method = this.methods[37], opt = this._transport.mergeOptions(options);
         return stackIntercept<MaintenanceAPI_Ping_Request, MaintenanceAPI_Ping_Response>("unary", this._transport, method, opt, input);
     }
     /**
      * @generated from protobuf rpc: License
      */
     license(input: MaintenanceAPI_License_Request, options?: RpcOptions): UnaryCall<MaintenanceAPI_License_Request, MaintenanceAPI_License_Response> {
-        const method = this.methods[37], opt = this._transport.mergeOptions(options);
+        const method = this.methods[38], opt = this._transport.mergeOptions(options);
         return stackIntercept<MaintenanceAPI_License_Request, MaintenanceAPI_License_Response>("unary", this._transport, method, opt, input);
     }
 }