@mutmutco/installer-gate 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## 0.1.1
+
+- **Fixed: `/user` is a REST call — split the GitHub hosts (#6783).** The gate used one base for
+  three endpoints. `https://github.com/user` answers `406`, which the handler rethrew as
+  `502 upstream_error`, so **every gated sign-in failed right after the user approved the device
+  code**. The device-flow endpoints (`/login/device/code`, `/login/oauth/access_token`) stay on the
+  new `githubWebBase` (default `https://github.com`); `/user` now uses `githubApiBase` (default
+  `https://api.github.com`). Both are normalized by one function and overridable independently.
+- **Consumer action:** bump to `^0.1.1` and redeploy the gate. If your config explicitly set
+  `githubApiBase` to `https://github.com` (its old meaning), remove it or move that value to
+  `githubWebBase` — `githubApiBase` now names the REST host.
+- `GITHUB_WEB_BASE_DEFAULT` / `GITHUB_API_BASE_DEFAULT` and `normalizeGitHubBase(base, fallback)`
+  are exported. `normalizeGitHubApiBase` remains as a deprecated shim and now defaults to the REST
+  host.
+
+## 0.1.0
+
+- Initial release: GitHub device flow, allowlists, and Ed25519-signed release manifests.

package/README.md

@@ -51,7 +51,8 @@ returns `false` and touches nothing, so the adopter's router continues.
 | `kind` | `'github' \| 'google'` | Selects the identity lane. |
 | `githubClientId` | `string` | github kind. The gate rejects a device-flow `client_id` that does not match it. |
 | `githubClientSecret` | `string` | github kind. Passed in by the adopter — **never committed here**. |
-| `githubApiBase` | `string?` | github kind. Default `https://github.com`; override in tests. |
+| `githubWebBase` | `string?` | github kind. GitHub **web** origin for the device flow — `POST /login/device/code` and `POST /login/oauth/access_token`. Default `https://github.com`; override for GHES or tests. Independent of `githubApiBase`. |
+| `githubApiBase` | `string?` | github kind. GitHub **REST** origin for identity lookups (`GET /user`). Default `https://api.github.com`; override for GHES or tests. Independent of `githubWebBase`. |
 | `verifyBearer` | `(token) => Promise<{sub}\|null>` | google kind. The product's own OAuth server. |
 | `allowlist` | `{ source: 'roster' \| 'logins', getLogins?: () => Promise<string[]> }` | Allowed identities. |
 | `release` | `{ manifest, sign, readFile }` | How release artifacts are described, signed and read. |
@@ -63,6 +64,18 @@ returns `false` and touches nothing, so the adopter's router continues.
 `release.manifest()` returns `{ version, files: [{ path, sha256, size }] }`. The gate stamps
 `created` (ISO 8601) and signs; `release.readFile(path)` throws when a file is absent.
 
+### GitHub hosts (#6783)
+
+GitHub serves the device-flow endpoints and the REST API from **different hosts**, so the gate has
+one base per host. `githubWebBase` (default `https://github.com`) carries
+`/login/device/code` and `/login/oauth/access_token`; `githubApiBase` (default
+`https://api.github.com`) carries `/user`. Both go through one normalizer (http(s) scheme check +
+trailing-slash strip), and an override of either never moves the other. Calling `/user` on
+`github.com` answers `406`, which the handler turns into `502 upstream_error`; that is exactly the
+sign-in failure #6783 fixed. **Consumer action:** if you previously set `githubApiBase` to
+`https://github.com` (its old meaning), drop it or move that value to `githubWebBase` — as of
+`0.1.1` `githubApiBase` means the REST host.
+
 ## Wire contract v1
 
 | Method | Path | Body / headers | Response |

package/dist/github.d.ts

@@ -1,10 +1,28 @@
 /**
  * GitHub device flow (OAuth 2.0 Device Authorization Grant) client, plus the identity lookup.
  *
- * Everything talks to `githubApiBase` (default `https://github.com`), which tests point at a local
- * fake server so no real network is touched. The gate never hardcodes credentials: the client id
+ * TWO hosts — this is the #6783 fix. The device-code and token endpoints exist only on the GitHub
+ * WEB host (`githubWebBase`, default `https://github.com`); `/user` is a REST call on the API host
+ * (`githubApiBase`, default `https://api.github.com`). Calling `/user` on github.com answers 406,
+ * which surfaced as `502 upstream_error` on every gated sign-in. Tests point both hosts at local
+ * fake servers so no real network is touched. The gate never hardcodes credentials: the client id
  * and secret arrive in config.
  */
+/** GitHub web host: the device authorization and token endpoints exist only here. */
+export declare const GITHUB_WEB_BASE_DEFAULT = "https://github.com";
+/** GitHub REST API host: `/user` and every other REST call, never on the web host. */
+export declare const GITHUB_API_BASE_DEFAULT = "https://api.github.com";
+/**
+ * The ONE normalizer both hosts pass through: an http(s) scheme check plus a trailing-slash strip.
+ * `fallback` is the per-host default, so an override of one base can never move the other.
+ */
+export declare function normalizeGitHubBase(base: string | undefined, fallback: string): string;
+/**
+ * @deprecated kept for source compatibility. It now normalizes the REST host, matching the config
+ * field it is named after. Use `normalizeGitHubBase(base, GITHUB_API_BASE_DEFAULT)` for REST and
+ * `normalizeGitHubBase(base, GITHUB_WEB_BASE_DEFAULT)` for the device flow.
+ */
+export declare function normalizeGitHubApiBase(base?: string): string;
 export interface GitHubDeviceCodeResponse {
     device_code: string;
     user_code: string;
@@ -20,12 +38,11 @@ export type GitHubDeviceTokenResult = {
 };
 /** The four poll errors the wire contract exposes. */
 export type GateDeviceError = 'authorization_pending' | 'slow_down' | 'expired_token' | 'denied';
-export declare function normalizeGitHubApiBase(base?: string): string;
 /** Starts a device authorization. `POST /gate/device/code` proxies this. */
-export declare function requestDeviceCode(apiBase: string, clientId: string): Promise<GitHubDeviceCodeResponse>;
+export declare function requestDeviceCode(webBase: string, clientId: string): Promise<GitHubDeviceCodeResponse>;
 /** Exchanges a device code for a GitHub access token. Returns the raw result, error included. */
-export declare function pollDeviceToken(apiBase: string, clientId: string, clientSecret: string, deviceCode: string): Promise<GitHubDeviceTokenResult>;
+export declare function pollDeviceToken(webBase: string, clientId: string, clientSecret: string, deviceCode: string): Promise<GitHubDeviceTokenResult>;
 /** Maps a GitHub poll error onto the wire contract's four-value error set. */
 export declare function mapDeviceError(error: string): GateDeviceError;
-/** Resolves the authenticated GitHub login for a token. */
+/** Resolves the authenticated GitHub login for a token. This is a REST call: API host only. */
 export declare function fetchGitHubLogin(apiBase: string, accessToken: string): Promise<string>;

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { canonicalJson } from './canonical.js';
 export { isIdentityAllowed } from './allowlist.js';
 export { mintToken, verifyToken } from './tokens.js';
 export type { GateTokenPayload } from './tokens.js';
-export { fetchGitHubLogin, mapDeviceError, normalizeGitHubApiBase, pollDeviceToken, requestDeviceCode, } from './github.js';
+export { fetchGitHubLogin, GITHUB_API_BASE_DEFAULT, GITHUB_WEB_BASE_DEFAULT, mapDeviceError, normalizeGitHubApiBase, normalizeGitHubBase, pollDeviceToken, requestDeviceCode, } from './github.js';
 export type { GateDeviceError, GitHubDeviceCodeResponse, GitHubDeviceTokenResult, } from './github.js';
 export { resolveGoogleIdentity } from './google.js';
 export type { BearerVerifier } from './google.js';

package/dist/index.js

@@ -24,8 +24,23 @@ async function isIdentityAllowed(allowlist, revoke, identity) {
 }
 
 // src/github.ts
+var GITHUB_WEB_BASE_DEFAULT = "https://github.com";
+var GITHUB_API_BASE_DEFAULT = "https://api.github.com";
+function normalizeGitHubBase(base, fallback) {
+  const value = (base ?? fallback).trim();
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`github base is not a valid URL: ${value}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`github base must be an http(s) URL: ${value}`);
+  }
+  return value.replace(/\/+$/, "");
+}
 function normalizeGitHubApiBase(base) {
-  return (base ?? "https://github.com").replace(/\/+$/, "");
+  return normalizeGitHubBase(base, GITHUB_API_BASE_DEFAULT);
 }
 async function formPost(url, params) {
   const response = await fetch(url, {
@@ -44,8 +59,8 @@ async function formPost(url, params) {
   if (typeof data !== "object" || data === null) throw new Error("github returned a non-object body");
   return data;
 }
-async function requestDeviceCode(apiBase, clientId) {
-  const data = await formPost(`${apiBase}/login/device/code`, { client_id: clientId });
+async function requestDeviceCode(webBase, clientId) {
+  const data = await formPost(`${webBase}/login/device/code`, { client_id: clientId });
   const deviceCode = data.device_code;
   const userCode = data.user_code;
   const verificationUri = data.verification_uri;
@@ -66,8 +81,8 @@ async function requestDeviceCode(apiBase, clientId) {
   }
   return result;
 }
-async function pollDeviceToken(apiBase, clientId, clientSecret, deviceCode) {
-  const data = await formPost(`${apiBase}/login/oauth/access_token`, {
+async function pollDeviceToken(webBase, clientId, clientSecret, deviceCode) {
+  const data = await formPost(`${webBase}/login/oauth/access_token`, {
     client_id: clientId,
     client_secret: clientSecret,
     device_code: deviceCode,
@@ -323,7 +338,8 @@ function createGateHandler(config) {
   const now = config.now ?? (() => Date.now());
   const ttlSeconds = resolveTtl(config);
   const secret = resolveSecret(config);
-  const githubApiBase = config.kind === "github" ? normalizeGitHubApiBase(config.githubApiBase) : "";
+  const githubWebBase = config.kind === "github" ? normalizeGitHubBase(config.githubWebBase, GITHUB_WEB_BASE_DEFAULT) : "";
+  const githubApiBase = config.kind === "github" ? normalizeGitHubBase(config.githubApiBase, GITHUB_API_BASE_DEFAULT) : "";
   return function gateHandler(req, res) {
     const pathname = requestPath(req);
     if (!pathname.startsWith("/gate/") && !pathname.startsWith("/release/")) {
@@ -361,6 +377,11 @@ function createGateHandler(config) {
       await refresh(req, res);
       return;
     }
+    if (pathname === "/release/version") {
+      requireMethod(method, "GET");
+      await releaseVersion(res);
+      return;
+    }
     if (pathname === "/release/manifest") {
       requireMethod(method, "GET");
       await releaseManifest(req, res);
@@ -389,7 +410,7 @@ function createGateHandler(config) {
     requireClientId(body);
     let issued;
     try {
-      issued = await requestDeviceCode(githubApiBase, config.githubClientId);
+      issued = await requestDeviceCode(githubWebBase, config.githubClientId);
     } catch {
       throw new GateHttpError(502, "upstream_error");
     }
@@ -404,7 +425,7 @@ function createGateHandler(config) {
     let result;
     try {
       result = await pollDeviceToken(
-        githubApiBase,
+        githubWebBase,
         config.githubClientId,
         config.githubClientSecret,
         deviceCodeValue
@@ -476,6 +497,20 @@ function createGateHandler(config) {
     }
     return identity;
   }
+  async function releaseVersion(res) {
+    const read = config.release.currentVersion;
+    if (!read) {
+      sendJson(res, 404, { error: "not_found" });
+      return;
+    }
+    let version;
+    try {
+      version = await read();
+    } catch {
+      throw new GateHttpError(500, "internal_error");
+    }
+    sendJson(res, 200, { version });
+  }
   async function releaseManifest(req, res) {
     if (await authenticate(req, res) === null) return;
     let input;
@@ -511,6 +546,8 @@ function createGateHandler(config) {
   }
 }
 export {
+  GITHUB_API_BASE_DEFAULT,
+  GITHUB_WEB_BASE_DEFAULT,
   buildCanonicalManifest,
   canonicalJson,
   createGateHandler,
@@ -519,6 +556,7 @@ export {
   mapDeviceError,
   mintToken,
   normalizeGitHubApiBase,
+  normalizeGitHubBase,
   pollDeviceToken,
   requestDeviceCode,
   resolveGoogleIdentity,

package/dist/types.d.ts

@@ -36,6 +36,11 @@ export interface ReleaseConfig {
     sign: (canonicalBytes: Buffer) => Buffer;
     /** Reads one release file by manifest-relative path. Throws when absent. */
     readFile: (path: string) => Promise<Buffer>;
+    /** #6864: the current release version ALONE, read straight from the pointer — no file hashing.
+     *  Backs the unauthenticated `GET /release/version` probe, so it must stay cheap: `manifest()`
+     *  re-hashes every payload file on each call and must never sit behind a public route. Optional:
+     *  a store that does not provide it simply has no version probe (the route answers 404). */
+    currentVersion?: () => Promise<string>;
 }
 interface GateConfigBase {
     allowlist: AllowlistConfig;
@@ -56,7 +61,11 @@ export interface GitHubGateConfig extends GateConfigBase {
     githubClientId: string;
     /** Passed in by the adopter — never hardcoded in this library. */
     githubClientSecret: string;
-    /** GitHub origin for the device flow. Default `https://github.com`; override for tests. */
+    /** GitHub WEB origin for the device flow (`/login/device/code`, `/login/oauth/access_token`).
+     *  Default `https://github.com`; override for GHES or tests. Independent of `githubApiBase`. */
+    githubWebBase?: string;
+    /** GitHub REST API origin for identity lookups (`/user`). Default `https://api.github.com`;
+     *  override for GHES or tests. Independent of `githubWebBase`. */
     githubApiBase?: string;
 }
 export interface GoogleGateConfig extends GateConfigBase {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/installer-gate",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Installer gate server library — GitHub device flow, allowlists, and signed release manifests. Mounted by a product's own server.",
   "type": "module",
   "license": "UNLICENSED",
@@ -17,7 +17,8 @@
   "types": "./dist/index.d.ts",
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "publishConfig": {
     "access": "public"