@mondaydotcomorg/z2h-cli 0.6.0 → 0.6.2

package/src/util/npm/broker-config.ts

@@ -0,0 +1,63 @@
+import { BROKER_NPM_SCOPE, PUBLIC_NPM_REGISTRY_URL, Z2H_NPM_TOKEN_ENV, brokerNpmRegistryUrl } from '../../constants';
+
+/** `https://host/path/` (with trailing slash) for the registry= line. */
+function registryUrlWithSlash(): string {
+  const url = brokerNpmRegistryUrl();
+  return url.endsWith('/') ? url : `${url}/`;
+}
+
+/**
+ * The `//host/path/` prefix (scheme stripped, trailing slash kept) that npm
+ * requires the `:_authToken` key to be keyed under so it aligns with the
+ * registry path. Derived from the same registry URL so staging overrides flow
+ * through.
+ */
+function authKeyPrefix(): string {
+  return registryUrlWithSlash().replace(/^https?:/, '');
+}
+
+/**
+ * The two npm config lines (§3.1 / §3.3) that route the brokered scope to the
+ * proxy and supply the `${Z2H_NPM_TOKEN}` placeholder. No literal token — npm
+ * interpolates the placeholder from the env at invocation time.
+ */
+export function brokerNpmrcLines(): string[] {
+  return [
+    `${BROKER_NPM_SCOPE}:registry=${registryUrlWithSlash()}`,
+    `${authKeyPrefix()}:_authToken=\${${Z2H_NPM_TOKEN_ENV}}`,
+  ];
+}
+
+/**
+ * Full contents for a **workspace** `.npmrc` (§3.3): broker scope-split plus an
+ * explicit public default registry and always-auth. Used by the template and
+ * the migration so both stay byte-identical.
+ */
+export function workspaceNpmrcContents(): string {
+  return [...brokerNpmrcLines(), `registry=${PUBLIC_NPM_REGISTRY_URL}`, 'always-auth=true'].join('\n') + '\n';
+}
+
+/**
+ * Full contents for a **workspace** `.yarnrc.yml` (§3.2): the brokered scope
+ * points at the proxy with the `${Z2H_NPM_TOKEN}` placeholder + always-auth;
+ * the default `npmRegistryServer` stays the public registry (direct, unchanged
+ * speed). `yarnPath` keeps the bundled Berry release so any `yarn` runs 4.x.
+ */
+export function workspaceYarnrcContents(): string {
+  const scopeKey = BROKER_NPM_SCOPE.replace(/^@/, '');
+  return (
+    [
+      'nodeLinker: node-modules',
+      '',
+      'npmScopes:',
+      `  ${scopeKey}:`,
+      `    npmRegistryServer: "${brokerNpmRegistryUrl()}"`,
+      `    npmAuthToken: "\${${Z2H_NPM_TOKEN_ENV}}"`,
+      '    npmAlwaysAuth: true',
+      '',
+      `npmRegistryServer: "${PUBLIC_NPM_REGISTRY_URL}"`,
+      '',
+      'yarnPath: .yarn/releases/yarn-4.5.1.cjs',
+    ].join('\n') + '\n'
+  );
+}

package/src/util/npm/ensure-token.ts

@@ -0,0 +1,28 @@
+import { tryReadAuthTokenSync } from '../auth/auth-store';
+import { info } from '../logger';
+import { generateZ2HTokenCommand } from '../../commands/generate-z2h-token';
+
+export interface EnsureZ2hTokenOptions {
+  /**
+   * Re-run the token flow even if a token already exists on disk. Used after a
+   * broker 401, where the stored token is present but expired/invalid.
+   */
+  forceRefresh?: boolean;
+}
+
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+export async function ensureZ2hToken(opts: EnsureZ2hTokenOptions = {}): Promise<void> {
+  if (opts.forceRefresh || !tryReadAuthTokenSync()) {
+    info('you need to sign in to install monday packages — opening the sign-in page');
+    await generateZ2HTokenCommand();
+  }
+}

package/src/util/npm/install.ts

@@ -0,0 +1,84 @@
+import { execa, type Options as ExecaOptions } from 'execa';
+import { info, warn } from '../logger';
+import { tryReadAuthTokenSync } from '../auth/auth-store';
+import { Z2H_NPM_TOKEN_ENV } from '../../constants';
+import { ensureZ2hToken } from './ensure-token';
+
+// Substrings that, in a failed install's output, indicate the broker rejected
+// the z2h JWT (expired/invalid). npm surfaces `E401`/`code E401`; yarn berry
+// surfaces an HTTP 401 line. We re-auth on any of these rather than dumping a
+// raw npm error on a non-technical user.
+const AUTH_FAILURE_MARKERS = ['401', 'e401', 'unauthorized', 'authentication'];
+
+function looksLikeAuthFailure(text: string): boolean {
+  const haystack = text.toLowerCase();
+  return AUTH_FAILURE_MARKERS.some(marker => haystack.includes(marker));
+}
+
+export interface RunYarnInstallOptions {
+  /** Directory to run `yarn install` in. */
+  cwd: string;
+  /** Extra env to merge on top of `process.env` + the broker token. */
+  extraEnv?: NodeJS.ProcessEnv;
+}
+
+/**
+ * Spawn `yarn install` in `cwd` with the npm-broker credential injected, while
+ * streaming yarn's output live to the user. stdout is inherited; stderr is
+ * piped so we can both echo it and inspect it for a broker auth failure.
+ *
+ * Returns the captured stderr on success; throws an Error tagged
+ * `isAuthFailure` when the failure output looks like a broker 401 so the
+ * caller can re-auth, or rethrows the raw execa error otherwise.
+ */
+async function spawnYarnInstall(opts: RunYarnInstallOptions): Promise<void> {
+  const token = tryReadAuthTokenSync();
+  const env = { ...process.env, ...(token && { [Z2H_NPM_TOKEN_ENV]: token }), ...opts.extraEnv };
+  const child = execa('yarn', ['install'], {
+    cwd: opts.cwd,
+    stdout: 'inherit',
+    stderr: ['inherit', 'pipe'],
+    env,
+  } satisfies ExecaOptions);
+
+  try {
+    await child;
+  } catch (err) {
+    const e = err as Error & { stderr?: string };
+    const combined = `${e.stderr}\n${e.message ?? ''}`;
+    if (looksLikeAuthFailure(combined)) {
+      const authErr = new Error('broker rejected the z2h token during install') as Error & {
+        isAuthFailure: true;
+      };
+      authErr.isAuthFailure = true;
+      throw authErr;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+export async function runYarnInstall(opts: RunYarnInstallOptions): Promise<void> {
+  await ensureZ2hToken();
+
+  try {
+    await spawnYarnInstall(opts);
+  } catch (err) {
+    if (!(err as { isAuthFailure?: boolean }).isAuthFailure) {
+      throw err;
+    }
+    warn('your access expired — refreshing it now…');
+    await ensureZ2hToken({ forceRefresh: true });
+    info('access refreshed — retrying install');
+    await spawnYarnInstall(opts);
+  }
+}