@nocobase/cli 2.2.0-beta.7 → 2.2.0-beta.9

package/dist/lib/env-auth.js

@@ -22,9 +22,45 @@ const OAUTH_FETCH_TIMEOUT_MS = 15_000;
 const OAUTH_FETCH_RETRY_DELAYS_MS = [500, 1_000, 2_000];
 const DEFAULT_OAUTH_SCOPE = 'openid api offline_access';
 const DEFAULT_CLIENT_NAME = 'NocoBase CLI';
+const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_DEVICE_POLL_INTERVAL_SECONDS = 5;
 function normalizeBaseUrl(baseUrl) {
     return baseUrl.replace(/\/+$/, '');
 }
+function buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl) {
+    const url = new URL(apiBaseUrl);
+    const subappMatch = url.pathname.match(/^(.*)\/api\/__app\/([^/]+)\/?$/);
+    if (subappMatch) {
+        const publicPath = (subappMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/apps/${subappMatch[2]}/idpOAuth/device`;
+    }
+    const appMatch = url.pathname.match(/^(.*)\/api\/?$/);
+    if (appMatch) {
+        const publicPath = (appMatch[1] || '').replace(/\/+$/, '');
+        return `${publicPath}/idpOAuth/device`;
+    }
+    return undefined;
+}
+export function resolveDeviceVerificationUrlForApiBaseUrl(verificationUrl, apiBaseUrl) {
+    try {
+        const devicePath = buildDeviceVerificationPathFromApiBaseUrl(apiBaseUrl);
+        if (!devicePath) {
+            return verificationUrl;
+        }
+        const originalUrl = new URL(verificationUrl);
+        if (!originalUrl.pathname.endsWith('/idpOAuth/device')) {
+            return verificationUrl;
+        }
+        const publicUrl = new URL(apiBaseUrl);
+        publicUrl.pathname = devicePath;
+        publicUrl.search = originalUrl.search;
+        publicUrl.hash = originalUrl.hash;
+        return publicUrl.toString();
+    }
+    catch {
+        return verificationUrl;
+    }
+}
 export function getOauthMetadataUrl(baseUrl) {
     return `${normalizeBaseUrl(baseUrl)}/.well-known/oauth-authorization-server`;
 }
@@ -129,6 +165,16 @@ function getOauthFetchRetryDelays() {
     }
     return OAUTH_FETCH_RETRY_DELAYS_MS;
 }
+function getDevicePollIntervalMs(intervalSeconds) {
+    const override = process.env.NB_CLI_OAUTH_DEVICE_POLL_INTERVAL_MS;
+    if (override !== undefined) {
+        const delay = Number(override);
+        if (Number.isFinite(delay) && delay >= 0) {
+            return Math.max(1, delay);
+        }
+    }
+    return Math.max(1, intervalSeconds ?? DEFAULT_DEVICE_POLL_INTERVAL_SECONDS) * 1000;
+}
 function formatOauthRetryMessage(options) {
     return `${options.operation} failed (${options.reason}). Retrying ${options.attempt}/${options.maxAttempts}...`;
 }
@@ -223,6 +269,31 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
     if (!metadata.registration_endpoint) {
         throw new Error('OAuth server does not expose a dynamic client registration endpoint.');
     }
+    let body;
+    if (options.deviceFlow) {
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: [DEVICE_CODE_GRANT_TYPE, 'refresh_token'],
+            response_types: [],
+            scope: DEFAULT_OAUTH_SCOPE,
+        };
+    }
+    else {
+        if (!redirectUri) {
+            throw new Error('OAuth redirect URI is required for browser sign-in.');
+        }
+        body = {
+            client_name: DEFAULT_CLIENT_NAME,
+            application_type: 'native',
+            token_endpoint_auth_method: 'none',
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            scope: DEFAULT_OAUTH_SCOPE,
+            redirect_uris: [redirectUri],
+        };
+    }
     let response;
     try {
         response = await fetchWithOauthRetry(metadata.registration_endpoint, {
@@ -231,15 +302,7 @@ async function registerOauthClient(metadata, redirectUri, options = {}) {
                 accept: 'application/json',
                 'content-type': 'application/json',
             },
-            body: JSON.stringify({
-                client_name: DEFAULT_CLIENT_NAME,
-                application_type: 'native',
-                token_endpoint_auth_method: 'none',
-                grant_types: ['authorization_code', 'refresh_token'],
-                response_types: ['code'],
-                scope: DEFAULT_OAUTH_SCOPE,
-                redirect_uris: [redirectUri],
-            }),
+            body: JSON.stringify(body),
         }, {
             operation: 'Registering OAuth client',
             onRetry: (message) => updateTask(message),
@@ -594,6 +657,10 @@ async function maybeOpenBrowser(url) {
         cleanup,
     };
 }
+let browserOpener = maybeOpenBrowser;
+export function setOauthBrowserOpenerForTests(opener) {
+    browserOpener = opener || maybeOpenBrowser;
+}
 async function createLoopbackServer(state) {
     const result = await new Promise((resolve, reject) => {
         const server = createServer((req, res) => {
@@ -706,6 +773,109 @@ async function exchangeAuthorizationCode(options) {
     }
     return data;
 }
+async function requestDeviceAuthorization(options) {
+    if (!options.metadata.device_authorization_endpoint) {
+        throw new Error('OAuth server does not expose a device authorization endpoint.');
+    }
+    const body = new URLSearchParams({
+        client_id: options.clientId,
+        scope: options.scope,
+        resource: options.resource,
+    });
+    let response;
+    try {
+        response = await fetchWithOauthRetry(options.metadata.device_authorization_endpoint, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+            },
+            body,
+        }, {
+            operation: 'Starting OAuth device authorization',
+            onRetry: (message) => updateTask(message),
+        });
+    }
+    catch (error) {
+        throw new Error(formatOauthFetchFailure('Failed to start OAuth device authorization.', {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            url: options.metadata.device_authorization_endpoint,
+            rawMessage: error instanceof Error ? error.message : String(error),
+        }));
+    }
+    const data = await parseJsonResponse(response);
+    if (!response.ok) {
+        throw new Error(formatOauthError('Failed to start OAuth device authorization', data, response.status));
+    }
+    if (!data ||
+        typeof data !== 'object' ||
+        typeof data.device_code !== 'string' ||
+        typeof data.user_code !== 'string' ||
+        typeof data.verification_uri !== 'string') {
+        throw new Error('OAuth device authorization response is missing device_code, user_code, or verification_uri.');
+    }
+    return data;
+}
+async function pollDeviceToken(options) {
+    let intervalMs = getDevicePollIntervalMs(options.interval);
+    const deadline = Date.now() + Math.max(1, options.expiresIn ?? OAUTH_LOGIN_TIMEOUT_MS / 1000) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        const body = new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            client_id: options.clientId,
+            device_code: options.deviceCode,
+        });
+        let response;
+        try {
+            response = await fetchWithOauthRetry(options.metadata.token_endpoint, {
+                method: 'POST',
+                headers: {
+                    accept: 'application/json',
+                    'content-type': 'application/x-www-form-urlencoded',
+                },
+                body,
+            }, {
+                operation: 'Polling OAuth device authorization',
+                onRetry: (message) => updateTask(message),
+            });
+        }
+        catch (error) {
+            throw new Error(formatOauthFetchFailure('Failed to poll OAuth device authorization.', {
+                envName: options.envName,
+                baseUrl: options.baseUrl,
+                url: options.metadata.token_endpoint,
+                rawMessage: error instanceof Error ? error.message : String(error),
+            }));
+        }
+        const data = await parseJsonResponse(response);
+        if (response.ok) {
+            if (!data || typeof data !== 'object' || typeof data.access_token !== 'string') {
+                throw new Error('OAuth token response is missing access_token.');
+            }
+            return data;
+        }
+        const oauthError = typeof data === 'object' && data ? String(data.error || '') : '';
+        if (oauthError === 'authorization_pending') {
+            updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+            continue;
+        }
+        if (oauthError === 'slow_down') {
+            intervalMs += 5_000;
+            updateTask(`OAuth server asked us to slow down. Polling again in ${Math.ceil(intervalMs / 1000)}s...`);
+            continue;
+        }
+        if (oauthError === 'expired_token') {
+            throw new Error(`OAuth device sign-in expired. Run \`nb env auth ${options.envName}\` to try again.`);
+        }
+        if (oauthError === 'access_denied') {
+            throw new Error('OAuth device sign-in was denied.');
+        }
+        throw new Error(formatOauthError('Failed to poll OAuth device authorization', data, response.status));
+    }
+    throw new Error(`OAuth device sign-in timed out. Run \`nb env auth ${options.envName}\` to try again.`);
+}
 async function refreshOauthAccessToken(options) {
     if (!options.auth.refreshToken || !options.auth.clientId) {
         throw new Error(`OAuth session for env "${options.envName}" cannot be refreshed. Run \`nb env auth ${options.envName}\`.`);
@@ -862,41 +1032,79 @@ export async function authenticateEnvWithBasic(options) {
     }
     return token;
 }
-export async function authenticateEnvWithOauth(options) {
-    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
-    const env = await getEnv(envName, { scope: options.scope });
-    const baseUrl = env?.baseUrl;
-    if (!baseUrl) {
-        throw new Error([
-            env
-                ? `Environment "${envName}" does not have an API base URL yet.`
-                : `Environment "${envName}" has not been set up yet.`,
-            env
-                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
-                : `Run \`nb init --ui --env ${envName}\` first.`,
-        ]
-            .filter(Boolean)
-            .join('\n'));
+async function authenticateEnvWithOauthDevice(options) {
+    const resource = getOauthResource(options.metadata.issuer);
+    let cleanupBrowserOpenTarget;
+    try {
+        updateTask(`Preparing device sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, undefined, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+            deviceFlow: true,
+        });
+        const deviceAuthorization = await requestDeviceAuthorization({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            scope: DEFAULT_OAUTH_SCOPE,
+            resource,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        stopTask();
+        const verificationUrl = resolveDeviceVerificationUrlForApiBaseUrl(deviceAuthorization.verification_uri_complete || deviceAuthorization.verification_uri, options.baseUrl);
+        const browser = await browserOpener(verificationUrl);
+        cleanupBrowserOpenTarget = browser.cleanup;
+        if (!browser.opened) {
+            printWarningBlock('We could not open your browser automatically. Open the URL below to approve device sign-in:');
+        }
+        else {
+            printInfo(`Opening device sign-in for "${options.envName}" in your browser.`);
+            printInfo('If the browser does not open automatically, open this URL manually:');
+        }
+        printInfo(verificationUrl);
+        printInfo(`Enter code: ${deviceAuthorization.user_code}`);
+        updateTask(`Waiting for you to approve device sign-in for "${options.envName}"...`);
+        const tokenResponse = await pollDeviceToken({
+            metadata: options.metadata,
+            clientId: registration.clientId,
+            deviceCode: deviceAuthorization.device_code,
+            expiresIn: deviceAuthorization.expires_in,
+            interval: deviceAuthorization.interval,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
+        });
+        if (!tokenResponse.refresh_token) {
+            printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
+        }
+        await setEnvOauthSession(options.envName, {
+            type: 'oauth',
+            accessToken: tokenResponse.access_token,
+            refreshToken: tokenResponse.refresh_token,
+            expiresAt: calculateExpiresAt(tokenResponse.expires_in),
+            scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
+            issuer: options.metadata.issuer,
+            clientId: registration.clientId,
+            resource,
+        }, { scope: options.scope });
     }
-    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
-    updateTask(`Checking sign-in settings for "${envName}"...`);
-    const metadata = await fetchOauthServerMetadata(baseUrl, {
-        envName,
-        onRetry: (message) => updateTask(message),
-    });
+    finally {
+        await cleanupBrowserOpenTarget?.().catch(() => undefined);
+    }
+}
+async function authenticateEnvWithOauthBrowser(options) {
     const state = encodeBase64Url(crypto.randomBytes(16));
     const { codeVerifier, codeChallenge } = buildPkcePair();
     const callback = await createLoopbackServer(state);
-    const resource = getOauthResource(metadata.issuer);
+    const resource = getOauthResource(options.metadata.issuer);
     let cleanupBrowserOpenTarget;
     try {
         printVerbose(`OAuth callback listener ready at ${callback.redirectUri}`);
-        updateTask(`Preparing secure browser sign-in for "${envName}"...`);
-        const registration = await registerOauthClient(metadata, callback.redirectUri, {
-            envName,
-            baseUrl,
+        updateTask(`Preparing secure browser sign-in for "${options.envName}"...`);
+        const registration = await registerOauthClient(options.metadata, callback.redirectUri, {
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
-        const authorizationUrl = new URL(metadata.authorization_endpoint);
+        const authorizationUrl = new URL(options.metadata.authorization_endpoint);
         authorizationUrl.searchParams.set('response_type', 'code');
         authorizationUrl.searchParams.set('client_id', registration.clientId);
         authorizationUrl.searchParams.set('redirect_uri', callback.redirectUri);
@@ -906,8 +1114,8 @@ export async function authenticateEnvWithOauth(options) {
         authorizationUrl.searchParams.set('code_challenge', codeChallenge);
         authorizationUrl.searchParams.set('code_challenge_method', 'S256');
         authorizationUrl.searchParams.set('resource', resource);
-        updateTask(`Waiting for you to finish signing in for "${envName}"...`);
-        const browser = await maybeOpenBrowser(authorizationUrl.toString());
+        updateTask(`Waiting for you to finish signing in for "${options.envName}"...`);
+        const browser = await browserOpener(authorizationUrl.toString());
         cleanupBrowserOpenTarget = browser.cleanup;
         if (!browser.opened) {
             printWarningBlock('We could not open your browser automatically. Open the URL below to continue signing in:');
@@ -918,7 +1126,7 @@ export async function authenticateEnvWithOauth(options) {
         }
         printInfo(authorizationUrl.toString());
         const code = await new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
+            const timeout = setTimeout(() => reject(new Error(`OAuth sign-in timed out after 5 minutes. Run \`nb env auth ${options.envName}\` to try again.`)), OAUTH_LOGIN_TIMEOUT_MS);
             timeout.unref?.();
             callback
                 .waitForCode()
@@ -931,27 +1139,27 @@ export async function authenticateEnvWithOauth(options) {
                 reject(error);
             });
         });
-        updateTask(`Finishing sign-in for "${envName}"...`);
+        updateTask(`Finishing sign-in for "${options.envName}"...`);
         const tokenResponse = await exchangeAuthorizationCode({
-            metadata,
+            metadata: options.metadata,
             clientId: registration.clientId,
             redirectUri: callback.redirectUri,
             code,
             codeVerifier,
             resource,
-            envName,
-            baseUrl,
+            envName: options.envName,
+            baseUrl: options.baseUrl,
         });
         if (!tokenResponse.refresh_token) {
             printWarning('Sign-in succeeded, but no refresh token was returned. You may need to sign in again when this session expires.');
         }
-        await setEnvOauthSession(envName, {
+        await setEnvOauthSession(options.envName, {
             type: 'oauth',
             accessToken: tokenResponse.access_token,
             refreshToken: tokenResponse.refresh_token,
             expiresAt: calculateExpiresAt(tokenResponse.expires_in),
             scope: tokenResponse.scope || DEFAULT_OAUTH_SCOPE,
-            issuer: metadata.issuer,
+            issuer: options.metadata.issuer,
             clientId: registration.clientId,
             resource,
         }, { scope: options.scope });
@@ -961,3 +1169,41 @@ export async function authenticateEnvWithOauth(options) {
         await callback.close().catch(() => undefined);
     }
 }
+export async function authenticateEnvWithOauth(options) {
+    const envName = options.envName ?? (await getCurrentEnvName({ scope: options.scope }));
+    const env = await getEnv(envName, { scope: options.scope });
+    const baseUrl = env?.baseUrl;
+    if (!baseUrl) {
+        throw new Error([
+            env
+                ? `Environment "${envName}" does not have an API base URL yet.`
+                : `Environment "${envName}" has not been set up yet.`,
+            env
+                ? `Run \`nb env update ${envName} --api-base-url <url>\` to finish setting it up.`
+                : `Run \`nb init --ui --env ${envName}\` first.`,
+        ]
+            .filter(Boolean)
+            .join('\n'));
+    }
+    printVerbose(`Starting OAuth sign-in for env "${envName}" using ${baseUrl}`);
+    updateTask(`Checking sign-in settings for "${envName}"...`);
+    const metadata = await fetchOauthServerMetadata(baseUrl, {
+        envName,
+        onRetry: (message) => updateTask(message),
+    });
+    if (metadata.device_authorization_endpoint) {
+        await authenticateEnvWithOauthDevice({
+            envName,
+            baseUrl,
+            metadata,
+            scope: options.scope,
+        });
+        return;
+    }
+    await authenticateEnvWithOauthBrowser({
+        envName,
+        baseUrl,
+        metadata,
+        scope: options.scope,
+    });
+}

package/dist/lib/env-config.js

@@ -6,6 +6,7 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
+import { normalizeEnvProxyConfig } from './env-proxy-config.js';
 import { resolveAppPublicPath } from './app-public-path.js';
 const STRING_ENV_CONFIG_KEYS = [
     'source',
@@ -110,5 +111,9 @@ export function buildStoredEnvConfig(input) {
     if ((authType === 'basic' || authType === 'token') && accessToken) {
         envConfig.accessToken = accessToken;
     }
+    const proxy = normalizeEnvProxyConfig(input.proxy);
+    if (proxy) {
+        envConfig.proxy = proxy;
+    }
     return envConfig;
 }

package/dist/lib/env-proxy-config.js

@@ -0,0 +1,48 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+function normalizeOptionalString(value) {
+    const normalized = String(value ?? '').trim();
+    return normalized || undefined;
+}
+function normalizeOptionalPort(value) {
+    const normalized = normalizeOptionalString(value);
+    if (!normalized || !/^\d+$/.test(normalized)) {
+        return undefined;
+    }
+    const port = Number(normalized);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        return undefined;
+    }
+    return port;
+}
+export function normalizeEnvProxyProviderConfig(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    return { ...value };
+}
+export function normalizeEnvProxyConfig(value) {
+    if (!value || typeof value !== 'object') {
+        return undefined;
+    }
+    const proxy = value;
+    const host = normalizeOptionalString(proxy.host);
+    const port = normalizeOptionalPort(proxy.port);
+    const nginx = normalizeEnvProxyProviderConfig(proxy.nginx);
+    const caddy = normalizeEnvProxyProviderConfig(proxy.caddy);
+    if (!host && port === undefined && !nginx && !caddy) {
+        return undefined;
+    }
+    return {
+        ...(host ? { host } : {}),
+        ...(port !== undefined ? { port } : {}),
+        ...(nginx ? { nginx } : {}),
+        ...(caddy ? { caddy } : {}),
+    };
+}