@nuvlore/extension-access-okta-slack 0.1.1 → 0.1.2

package/vendor/extension-sso/vendor/extension-read-only-toolkit/src/enterprise-api-read.mjs

@@ -1,180 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { assertNonHtmlApiResponse } from "./devops-diagnostics.mjs";
-
-const execFileAsync = promisify(execFile);
-
-export function normalizeBaseUrl(value) {
-  const raw = String(value || "").trim();
-  if (!raw) return "";
-  try {
-    const url = new URL(raw);
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/+$/, "");
-  } catch {
-    return "";
-  }
-}
-
-export function appendQueryValue(searchParams, key, value) {
-  if (Array.isArray(value)) {
-    for (const item of value) appendQueryValue(searchParams, key, item);
-    return;
-  }
-  if (value === undefined || value === null) return;
-  searchParams.append(key, String(value));
-}
-
-export function buildRequestUrl(baseUrl, requestPath, query) {
-  const url = new URL(`${baseUrl}${requestPath}`);
-  for (const [key, value] of Object.entries(query || {})) {
-    if (key) appendQueryValue(url.searchParams, key, value);
-  }
-  return url;
-}
-
-export function extractTokenFromKeychainSecret(rawSecret = "") {
-  const text = typeof rawSecret === "string" ? rawSecret.trim() : "";
-  if (!text) return "";
-  try {
-    const parsed = JSON.parse(text);
-    return typeof parsed?.token === "string" ? parsed.token.trim() : "";
-  } catch {
-    return text;
-  }
-}
-
-export async function readTokenFromKeychain({ execFileImpl = execFileAsync, keychainService, keychainAccount }) {
-  try {
-    const result = await execFileImpl("/usr/bin/security", [
-      "find-generic-password",
-      "-s",
-      keychainService,
-      "-a",
-      keychainAccount,
-      "-w"
-    ], { maxBuffer: 1024 * 1024 });
-    return extractTokenFromKeychainSecret(String(result?.stdout || ""));
-  } catch {
-    return "";
-  }
-}
-
-export function parseResponseBody(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return String(text || "");
-  }
-}
-
-export class KeychainBearerAuthProvider {
-  constructor(options = {}) {
-    this.mode = "keychain";
-    this.execFileImpl = options.execFileImpl || execFileAsync;
-    this.keychainService = options.keychainService;
-    this.keychainAccount = options.keychainAccount;
-    this.authorizationHeader = options.authorizationHeader || ((token) => `Bearer ${token}`);
-  }
-
-  async buildHeaders() {
-    const token = await readTokenFromKeychain({
-      execFileImpl: this.execFileImpl,
-      keychainService: this.keychainService,
-      keychainAccount: this.keychainAccount
-    });
-    if (!token) {
-      throw new Error(
-        `Keychain token missing for ${this.keychainService}/${this.keychainAccount}. Save the personal access token in Keychain.`
-      );
-    }
-    return { authorization: this.authorizationHeader(token) };
-  }
-}
-
-/** Cookie SSO auth — inject `resolveCookieHeader(input)` from @nuvlore/extension-browser-sso. */
-export class CookieSsoAuthProvider {
-  constructor(options = {}) {
-    this.mode = "cookie-sso";
-    this.resolveCookieHeader = options.resolveCookieHeader;
-    if (typeof this.resolveCookieHeader !== "function") {
-      throw new Error("CookieSsoAuthProvider requires resolveCookieHeader(input) async function.");
-    }
-  }
-
-  async buildHeaders(input = {}) {
-    const cookie = await this.resolveCookieHeader(input);
-    if (!cookie) {
-      throw new Error("Browser SSO cookie header is missing. Open the service in Chrome via Okta and retry.");
-    }
-    return { cookie };
-  }
-}
-
-export class EnterpriseApiReadService {
-  constructor(options = {}) {
-    this.fetchImpl = options.fetchImpl || globalThis.fetch;
-    this.execFileImpl = options.execFileImpl || execFileAsync;
-    this.serviceName = options.serviceName;
-    this.defaultBaseUrl = options.defaultBaseUrl;
-    this.defaultUserAgent = options.defaultUserAgent;
-    this.keychainService = options.keychainService;
-    this.keychainAccount = options.keychainAccount;
-    this.normalizePath = options.normalizePath;
-    this.accept = options.accept || "application/json";
-    this.extraHeaders = options.extraHeaders || {};
-    this.authorizationHeader = options.authorizationHeader || ((token) => `Bearer ${token}`);
-    this.formatErrorPayload = options.formatErrorPayload;
-    this.includeMethodInPayload = options.includeMethodInPayload === true;
-    this.transformPayload = options.transformPayload || ((payload) => payload);
-    this.authProvider =
-      options.authProvider ??
-      new KeychainBearerAuthProvider({
-        execFileImpl: this.execFileImpl,
-        keychainService: this.keychainService,
-        keychainAccount: this.keychainAccount,
-        authorizationHeader: this.authorizationHeader
-      });
-  }
-
-  async invoke(input = {}) {
-    if (typeof this.fetchImpl !== "function") {
-      throw new Error(`Fetch API is unavailable for ${this.serviceName} requests.`);
-    }
-    const baseUrl = normalizeBaseUrl(input.baseUrl || this.defaultBaseUrl);
-    if (!baseUrl) {
-      throw new Error(`${this.serviceName} base URL is missing or invalid. Expected something like ${this.defaultBaseUrl}.`);
-    }
-    const requestPath = this.normalizePath(input.restPath || input.path);
-    const url = buildRequestUrl(baseUrl, requestPath, input.query);
-    const authHeaders = await this.authProvider.buildHeaders(input);
-    const response = await this.fetchImpl(url, {
-      method: "GET",
-      headers: {
-        accept: this.accept,
-        "user-agent": this.defaultUserAgent,
-        ...this.extraHeaders,
-        ...authHeaders,
-        ...(input.headers ?? {})
-      }
-    });
-    const text = await response.text();
-    assertNonHtmlApiResponse(this.serviceName, text);
-    const payload = parseResponseBody(text);
-    if (!response.ok) {
-      throw new Error(`${this.serviceName} request failed with status ${response.status}: ${this.formatErrorPayload(payload)}.`);
-    }
-    const output = {
-      baseUrl,
-      restPath: requestPath,
-      path: requestPath,
-      url: url.toString(),
-      status: response.status,
-      data: this.transformPayload(payload)
-    };
-    if (this.includeMethodInPayload) output.method = "GET";
-    return JSON.stringify(output, null, 2);
-  }
-}

package/vendor/extension-sso/vendor/extension-read-only-toolkit/src/read-only-command-pack.mjs

@@ -1 +0,0 @@
-export * from "./read-only-plan.mjs";

package/vendor/extension-sso/vendor/extension-read-only-toolkit/src/read-only-plan.mjs

@@ -1,45 +0,0 @@
-export function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-export function remoteCommandInput({ host, command, timeoutMs = 60_000 }) {
-  return {
-    targetType: "ssh",
-    host,
-    command,
-    timeoutMs
-  };
-}
-
-export class ReadOnlyStep {
-  constructor({ id, purpose, command, expectedEvidence }) {
-    this.id = id;
-    this.purpose = purpose;
-    this.command = command;
-    this.expectedEvidence = expectedEvidence;
-  }
-
-  toMarkdown() {
-    return [
-      `### ${this.id}`,
-      `Purpose: ${this.purpose}`,
-      "",
-      "```bash",
-      this.command,
-      "```",
-      "",
-      `Evidence to capture: ${this.expectedEvidence}`
-    ].join("\n");
-  }
-
-  toJson() {
-    return {
-      id: this.id,
-      purpose: this.purpose,
-      command: this.command,
-      expectedEvidence: this.expectedEvidence
-    };
-  }
-}
-
-export class ReadOnlyCommand extends ReadOnlyStep {}

package/vendor/extension-sso/vendor/extension-read-only-toolkit/src/read-only-shell-policy.d.mts

@@ -1,26 +0,0 @@
-export type ReadOnlyValidation = {
-  allowed: boolean;
-  reason: string;
-};
-
-export type ReadOnlyPolicyConfig = {
-  extraReadOnlyCommandPatterns?: RegExp[];
-};
-
-export const READ_ONLY_ALLOWED_TOOLS: readonly string[];
-export const READ_ONLY_DISALLOWED_TOOLS: readonly string[];
-export const MUTATING_SHELL_TOKENS: RegExp[];
-export const READ_ONLY_COMMAND_PATTERNS: RegExp[];
-
-export class ReadOnlyShellPolicy {
-  constructor(config?: ReadOnlyPolicyConfig);
-  validate(command: string): ReadOnlyValidation;
-  readOnlyPatterns(): RegExp[];
-}
-
-export class ReadOnlyPolicyDescription {
-  text(): string;
-}
-
-export function isReadOnlyShellCommand(command: string, config?: ReadOnlyPolicyConfig): ReadOnlyValidation;
-export function describeReadOnlyPolicy(): string;

package/vendor/extension-sso/vendor/extension-read-only-toolkit/src/read-only-shell-policy.mjs

@@ -1,170 +0,0 @@
-export const READ_ONLY_ALLOWED_TOOLS = [
-  "Read",
-  "Glob",
-  "Grep"
-];
-
-export const READ_ONLY_DISALLOWED_TOOLS = [
-  "Agent",
-  "Task",
-  "TaskCreate",
-  "Write",
-  "Edit",
-  "NotebookEdit",
-  "TodoWrite",
-  "ExitPlanMode",
-  "EnterWorktree",
-  "WebFetch",
-  "WebSearch",
-  "AskUserQuestion"
-];
-
-export const MUTATING_SHELL_TOKENS = [
-  /\bapply\b/i,
-  /\bcreate\b/i,
-  /\bdelete\b/i,
-  /\bdestroy\b/i,
-  /\bedit\b/i,
-  /\binstall\b/i,
-  /\bpatch\b/i,
-  /\bpush\b/i,
-  /\breplace\b/i,
-  /\brestart\b/i,
-  /\brollout\s+(restart|undo)\b/i,
-  /\brm\b/i,
-  /\bscale\b/i,
-  /\bset\b/i,
-  /\bstart\b/i,
-  /\bstop\b/i,
-  /\btaint\b/i,
-  /\buntaint\b/i,
-  /\bupgrade\b/i,
-  /\bwrite\b/i,
-  /\bchmod\b/i,
-  /\bchown\b/i,
-  /\bmv\b/i,
-  /\bcp\b/i,
-  /\bmkdir\b/i,
-  /\btouch\b/i,
-  /\btee\b/i,
-  /\bcurl\b.*\|\s*(sh|bash)\b/i,
-  /\bwget\b.*\|\s*(sh|bash)\b/i,
-  /(^|[^<])>(?!\s*&\d)/,
-  />>/,
-  /\|\s*(xargs\s+)?(sh|bash|kubectl\s+apply|terraform\s+apply|helm\s+upgrade|rm|tee)\b/i,
-  /(^|[^&|]);\s*/,
-  /&&|\|\|/,
-  /`|\$\(/,
-  /\b--write\b/i,
-  /\b--force\b/i,
-  /\b--yes\b|\b-y\b/i
-];
-
-export const READ_ONLY_COMMAND_PATTERNS = [
-  /^\s*pwd\s*$/,
-  /^\s*ls(\s|$)/,
-  /^\s*find\s+/,
-  /^\s*(rg|grep)\s+/,
-  /^\s*(cat|head|tail|sed|awk|wc)\s+/,
-  /^\s*curl\s+-k\s+-sS\s+-o\s+\/dev\/null\s+-w\s+'[A-Za-z0-9_=%{}:./ -]+\\n'\s+https:\/\/[A-Za-z0-9_.:-]+\/[A-Za-z0-9_./:@%+=,~-]+(\s|$)/,
-  /^\s*hostname(\s|$)/,
-  /^\s*command\s+-v\s+/,
-  /^\s*klist(\s|$)/,
-  /^\s*git\s+(status|diff|log|show|branch|remote|rev-parse|describe|ls-files)(\s|$)/,
-  /^\s*kubectl\s+(get|describe|logs|top|api-resources|api-versions|explain|version|cluster-info|config\s+(current-context|get-contexts|view))(\s|$)/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+dags\s+list-runs\s+-d\s+[A-Za-z0-9_.:@/-]+(?:\s+--no-backfill)?(?:\s+--output\s+(?:json|table|yaml|plain))?(?:\s+\|\s+head\s+-\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+states-for-dag-run\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+(?:\s+--output\s+(?:json|table|yaml|plain))?(?:\s+\|\s+head\s+-\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+logs\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+\s+--try-number\s+\d+\s+\|\s+head\s+-\d+\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+render\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+\s+\|\s+head\s+-\d+\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+cat\s+\/(?:(?:data|hadoop\/disk2)\/workday-bds-airflow|data\/airflow)\/logs\/[A-Za-z0-9_.:@+=,~%/-]+(?:\s+\|\s+head\s+-\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-E\s+'[A-Za-z0-9_.:@+=,~%|/-]+'\s+\/(?:(?:data|hadoop\/disk2)\/workday-bds-airflow|data\/airflow)\/logs\/[A-Za-z0-9_.:@+=,~%/-]+(?:\s+\|\s+tail\s+-n\s+\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-E\s+'[A-Za-z0-9_.:@+=,~%|/-]+'\s+\/usr\/local\/airflow\/(?:airflow_s3_config\.json|dags\/[A-Za-z0-9_.:@+=,~%/-]+)(?:\s+\|\s+(?:head|tail)\s+-\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+printenv\s+\|\s+grep\s+-E\s+'\^\(AWS_\|GOOGLE_\|GOOGLE_APPLICATION_CREDENTIALS\|HADOOP_\|HADOOP_CONF_DIR\|AIRFLOW_S3_CONFIG_PATH\)'\s+\|\s+sed\s+-E\s+'s\/=\.\*\/=\[present\]\/'\s+\|\s+head\s+-\d+\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+printenv\s+HADOOP_CREDENTIAL_PROVIDER_PATH\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+hadoop\s+credential\s+list\s+\|\s+head\s+-\d+\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-h\s+-E\s+'fs\.s3a\.aws\.credentials\.provider\|fs\.s3a\.endpoint\|fs\.s3a\.impl\|google\.cloud\.auth'\s+\/etc\/hadoop\/conf\/(?:core-site|hdfs-site|mapred-site|yarn-site)\.xml(?:\s+\/etc\/hadoop\/conf\/(?:core-site|hdfs-site|mapred-site|yarn-site)\.xml)*\s+\|\s+head\s+-\d+\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+cat\s+\/usr\/local\/airflow\/(?:airflow_s3_config\.json|dags\/[A-Za-z0-9_.:@+=,~%/-]+)(?:\s+\|\s+head\s+-\d+)?\s*$/,
-  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+hadoop\s+fs\s+-(?:ls|du|count|stat|test)(?:\s+-d)?\s+s3a:\/\/[A-Za-z0-9][A-Za-z0-9_.-]*[A-Za-z0-9](?:\/[A-Za-z0-9_.:@+=,~%/-]*)?(?:\s+\|\s+head\s+-\d+)?\s*$/,
-  /^\s*kcsb\s+(get|describe|logs|top|api-resources|api-versions|explain|version|cluster-info|config\s+(current-context|get-contexts|view))(\s|$)/,
-  /^\s*kinit\s+-kt\s+\/[A-Za-z0-9._/-]+\s+[A-Za-z0-9_.@/-]+(\s|$)/,
-  /^\s*yarn\s+application\s+-status\s+application_[0-9]+_[0-9]+(\s|$)/,
-  /^\s*yarn\s+logs\s+-applicationId\s+application_[0-9]+_[0-9]+(\s|$)/,
-  /^\s*yarn\s+node\s+-status\s+(?!-)[A-Za-z0-9._:@%-]+:45454(\s|$)/,
-  /^\s*hdfs\s+crypto\s+-listZones(\s|$)/,
-  /^\s*hdfs\s+dfs\s+-(ls|du|find|cat|tail|test|count|stat)\s+/,
-  /^\s*hdfs\s+dfsadmin\s+-report(\s|$)/,
-  /^\s*hadoop\s+fs\s+-(ls|cat|head|du|count|stat|test|text)(\s|$)/,
-  /^\s*helm\s+(list|status|history|get|version|repo\s+list)(\s|$)/,
-  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?sts\s+get-caller-identity(\s|$)/,
-  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?[a-z0-9-]+\s+(describe|list|get|head)-[a-z0-9-]+(\s|$)/,
-  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?s3\s+ls(\s|$)/,
-  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?auth\s+list(\s|$)/,
-  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?config\s+list(\s|$)/,
-  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?projects\s+(describe|get-iam-policy)(\s|$)/,
-  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?[a-z0-9-]+(?:\s+[a-z0-9-]+)*\s+(list|describe|read)(\s|$)/,
-  /^\s*gcloud\s+storage\s+(buckets|objects)\s+list(\s|$)/,
-  /^\s*terraform\s+(version|show|state\s+list|state\s+show|providers|workspace\s+show|output)(\s|$)/,
-  /^\s*docker\s+(ps|images|logs|inspect|stats|version|info)(\s|$)/,
-  /^\s*(df|du|free|uptime|uname|whoami|id|date|env|printenv)(\s|$)/,
-  /^\s*journalctl\s+-k\s+--since\s+/,
-  /^\s*(systemctl|journalctl)\s+(status|-u|--unit)(\s|$)/
-];
-
-export class ReadOnlyShellPolicy {
-  constructor(config = {}) {
-    this.config = config;
-  }
-
-  validate(command) {
-    const normalized = String(command ?? "").trim();
-
-    if (!normalized) {
-      return { allowed: false, reason: "empty shell command" };
-    }
-    if (normalized.includes("\n") || normalized.includes("\r")) {
-      return { allowed: false, reason: "multi-line shell commands are not allowed" };
-    }
-
-    const mutatingToken = MUTATING_SHELL_TOKENS.find((token) => token.test(normalized));
-    if (mutatingToken) {
-      return {
-        allowed: false,
-        reason: `shell command contains mutating or high-risk syntax: ${mutatingToken.source}`
-      };
-    }
-
-    if (this.readOnlyPatterns().some((pattern) => pattern.test(normalized))) {
-      return { allowed: true, reason: "matches read-only command allowlist" };
-    }
-
-    return { allowed: false, reason: "command is not in the read-only allowlist" };
-  }
-
-  readOnlyPatterns() {
-    return [
-      ...READ_ONLY_COMMAND_PATTERNS,
-      ...(this.config.extraReadOnlyCommandPatterns ?? [])
-    ];
-  }
-}
-
-export class ReadOnlyPolicyDescription {
-  text() {
-    return [
-      "Read-only DevOps policy:",
-      `- Auto-approved tools: ${READ_ONLY_ALLOWED_TOOLS.join(", ")}`,
-      `- Always denied tools: ${READ_ONLY_DISALLOWED_TOOLS.join(", ")}`,
-      "- Bash: denied by default; only explicit read-only command patterns are allowed.",
-      "- Filesystem sandbox: enabled with denyWrite on all paths.",
-      "- Permission mode: dontAsk, so unapproved tools fail closed."
-    ].join("\n");
-  }
-}
-
-export function isReadOnlyShellCommand(command, config = {}) {
-  return new ReadOnlyShellPolicy(config).validate(command);
-}
-
-export function describeReadOnlyPolicy() {
-  return new ReadOnlyPolicyDescription().text();
-}