@openbkn/bkn-sdk 0.1.1-alpha.18 → 0.1.1-alpha.19

package/dist/cli.js

@@ -6,8 +6,8 @@ import {
   HttpError,
   InputError,
   activePlatform,
-  attachNoAuth,
   attachToken,
+  changePasswordSafe,
   createClient,
   credentialDeviceLogin,
   currentToken,
@@ -16,7 +16,6 @@ import {
   deletePlatform,
   deviceLogin,
   exportCreds,
-  fetchAuthStatus,
   formatError,
   getUserSafe,
   isHeadless,
@@ -28,7 +27,6 @@ import {
   rawCall,
   readPlatformConfig,
   renderReportMarkdown,
-  request,
   resolveContext,
   setActivePlatform,
   status,
@@ -37,7 +35,7 @@ import {
   use,
   whoami,
   writePlatformConfig
-} from "./chunk-LCOMMFH7.js";
+} from "./chunk-ISJHU26W.js";
 
 // src/cli.ts
 import { Command as Command17 } from "commander";
@@ -45,10 +43,10 @@ import { Command as Command17 } from "commander";
 // package.json
 var package_default = {
   name: "@openbkn/bkn-sdk",
-  version: "0.1.1-alpha.18",
+  version: "0.1.1-alpha.19",
   description: "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   type: "module",
-  license: "SEE LICENSE IN LICENSE",
+  license: "Apache-2.0",
   engines: {
     node: ">=18"
   },
@@ -63,7 +61,7 @@ var package_default = {
       import: "./dist/index.js"
     }
   },
-  files: ["dist", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
+  files: ["dist", "!dist/**/*.map", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
   publishConfig: {
     access: "public"
   },
@@ -76,7 +74,8 @@ var package_default = {
     build: "tsup",
     dev: "tsup --watch",
     typecheck: "tsc --noEmit",
-    lint: "biome check . && tsc --noEmit",
+    "check:deps": "node scripts/check-no-self-dep.mjs",
+    lint: "npm run check:deps && biome check . && tsc --noEmit",
     format: "biome format --write .",
     test: "vitest run",
     "test:cover": "vitest run --coverage",
@@ -85,12 +84,12 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.9.1",
-    "@openbkn/bkn-sdk": "^0.1.1-alpha.3",
     chalk: "^5.4.1",
     commander: "^13.1.0",
     "csv-parse": "^6.2.1",
     "js-yaml": "^4.2.0",
     jszip: "^3.10.1",
+    undici: "^8.7.0",
     zod: "^3.24.1"
   },
   devDependencies: {
@@ -353,25 +352,6 @@ function readBody(opts) {
 
 // src/commands/auth.ts
 import { Command } from "commander";
-
-// src/api/eacp-crypto.ts
-import {
-  constants,
-  createPrivateKey,
-  createPublicKey,
-  publicEncrypt
-} from "crypto";
-
-// src/api/admin.ts
-async function changePasswordSafe(ctx, account, oldPassword, newPassword) {
-  await request(ctx, "/api/safe/v1/auth/change-password", {
-    method: "POST",
-    body: { account, old_password: oldPassword, new_password: newPassword }
-  });
-  return { ok: true };
-}
-
-// src/commands/auth.ts
 async function resolveAccount(baseUrl, accessToken, insecure, idToken) {
   const sub = decodeJwt(idToken ?? accessToken)?.sub;
   if (!sub) return void 0;
@@ -400,25 +380,17 @@ function renderSessions(items) {
   return lines.join("\n") || "(no saved sessions)";
 }
 function registerAuthLeaves(cmd) {
-  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "use a fixed OAuth2 client id (skip dynamic registration)").option("--client-secret <secret>", "OAuth2 client secret (omit for public/PKCE)").option(
-    "--port <n>",
-    "loopback redirect port for the auth_code flow",
-    (v) => Number.parseInt(v, 10)
-  ).option("--device", "headless device-code login (RFC 8628) \u2014 no callback server, no password").option("--audience <aud>", "device-code token audience", "bkn-safe").option(
+  cmd.command("login <url>").description("Log in to a platform (attach a token, or browser/password OAuth)").option("-u, --username <name>", "username for password signin").option("-p, --password <pwd>", "password for password signin").option("--token <token>", "provide a token directly (CI / headless)").option("--client-id <id>", "OAuth2 client id to authenticate as").option("--device", "headless device-code login (RFC 8628) \u2014 no callback server, no password").option("--audience <aud>", "device-code token audience", "bkn-safe").option(
     "--timeout <s>",
     "device-login wait before timing out",
     (v) => Number.parseInt(v, 10),
     120
-  ).option("--no-browser", "(legacy) print the URL instead of opening a browser").option("--product <name>", "(legacy) ISF OAuth product query").option("--signin-public-key-file <path>", "(legacy) RSA public key for ISF /oauth2/signin").option("--no-auth", "register the platform with no authentication (no bkn-safe)").action(async (url, opts, cmd2) => {
+  ).option("--no-browser", "print the URL instead of opening a browser").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const out = outputOptions(cmd2);
     const report = (r) => {
       if (out.json || out.compact) {
         printJson({ loggedIn: true, ...r }, out);
-      } else if (r.noAuth) {
-        process.stdout.write(`Registered ${r.baseUrl ?? url} (no authentication)
-`);
       } else {
         process.stdout.write(`Logged in to ${r.baseUrl ?? url} as ${r.username ?? r.userId}
 `);
@@ -426,20 +398,7 @@ function registerAuthLeaves(cmd) {
     };
     const token = opts.token ?? g.token;
     if (token) {
-      report(attachToken(url, token, { insecure: g.insecure }));
-      return;
-    }
-    if (opts.auth === false) {
-      report(attachNoAuth(url, { insecure: g.insecure }));
-      return;
-    }
-    const authStatus = await fetchAuthStatus(url);
-    if (authStatus && !authStatus.enabled) {
-      process.stderr.write(
-        `Platform auth is disabled (stack: ${authStatus.stack ?? "none"}) \u2014 registering without auth.
-`
-      );
-      report(attachNoAuth(url, { insecure: g.insecure }));
+      report(attachToken(url, token));
       return;
     }
     let tokens;
@@ -452,7 +411,8 @@ function registerAuthLeaves(cmd) {
         tokens = await credentialDeviceLogin(url, username, password, {
           clientId: opts.clientId,
           audience: opts.audience,
-          timeoutMs: opts.timeout * 1e3
+          timeoutMs: opts.timeout * 1e3,
+          insecure: g.insecure
         });
       } else {
         const headless = isHeadless();
@@ -461,6 +421,7 @@ function registerAuthLeaves(cmd) {
           clientId: opts.clientId,
           audience: opts.audience,
           timeoutMs: opts.timeout * 1e3,
+          insecure: g.insecure,
           onPrompt: ({ userCode, verificationUri, verificationUriComplete }) => {
             const target = verificationUriComplete ?? verificationUri;
             process.stderr.write(
@@ -479,9 +440,9 @@ User code: ${userCode}
       }
     } catch (e) {
       if (e instanceof Error && /Device auth failed \(404\)/.test(e.message)) {
-        process.stderr.write("No auth endpoint found \u2014 registering platform without auth.\n");
-        report(attachNoAuth(url, { insecure: g.insecure }));
-        return;
+        throw new InputError(
+          `No auth endpoint on ${url} \u2014 the platform has no bkn-safe auth stack. Deploy bkn-safe, or log in elsewhere and pass the token with \`--token\`.`
+        );
       }
       throw e;
     }
@@ -497,29 +458,28 @@ User code: ${userCode}
       attachToken(url, tokens.accessToken, {
         refreshToken: tokens.refreshToken,
         idToken: tokens.idToken,
-        insecure: g.insecure,
         username: account
       })
     );
   });
-  cmd.command("status").description("Show base URL and whether a token is configured").action((_opts, cmd2) => printJson(status(), outputOptions(cmd2)));
+  cmd.command("status").description("Show base URL and whether a token is configured").action(
+    (_opts, cmd2) => printJson(status({ user: cmd2.optsWithGlobals().user }), outputOptions(cmd2))
+  );
   cmd.command("token").description("Print the current access token, refreshing it if expired (keep secret)").option("--no-refresh", "print the stored token as-is, without refreshing").action(async (opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-    const token = opts.refresh === false ? currentToken() : await currentTokenFresh();
+    const token = opts.refresh === false ? currentToken({ user: g.user }) : await currentTokenFresh({ insecure: g.insecure, user: g.user });
     process.stdout.write(`${token}
 `);
   });
   cmd.command("whoami [url]").description("Show current user identity (from the token)").option("--no-lookup", "skip the backend identity fallback (eacp/user/get)").action(async (_url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-    const me = whoami();
+    const me = whoami({ user: g.user });
     if (opts.lookup !== false && me.baseUrl && me.sub) {
       try {
         const u = await getUserSafe(
           {
             baseUrl: me.baseUrl,
-            token: currentToken(),
+            token: currentToken({ user: g.user }),
             businessDomain: DEFAULT_BUSINESS_DOMAIN,
             insecure: Boolean(g.insecure)
           },
@@ -584,9 +544,8 @@ User code: ${userCode}
   cmd.command("export").description("Export the active session's tokens (for a headless host)").action((_opts, cmd2) => {
     printJson(exportCreds(), outputOptions(cmd2));
   });
-  cmd.command("change-password [url]").description("Change your account password (bkn-safe self-service; no browser)").option("-a, --account <name>", "account / login name (the login column, e.g. admin)").option("--old-password <pwd>", "current password").option("--new-password <pwd>", "new password").option("--public-key-file <path>", "(legacy) RSA public key for ISF password encryption").action(async (url, opts, cmd2) => {
+  cmd.command("change-password [url]").description("Change your account password (bkn-safe self-service; no browser)").option("-a, --account <name>", "account / login name (the login column, e.g. admin)").option("--old-password <pwd>", "current password").option("--new-password <pwd>", "new password").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
-    if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const ctx = resolveContext({
       baseUrl: url ?? g.baseUrl,
       token: g.token,

package/dist/index.d.ts

@@ -107,12 +107,16 @@ type LicenseImportResult = LicenseDetail | {
 };
 
 /**
- * Admin (operator) client — user-management + authorization.
- * Reads and writes (org/user create/update/delete +
- * reset-password) implemented; org/user detail and writes go through ISFWeb
- * thrift where the REST routes are RegisterPrivate. Passed through as JSON.
+ * Admin (operator) input shapes — the CLI-facing contract for the `admin`
+ * command group. `src/resources/admin.ts` maps each of these onto the bkn-safe
+ * client in `./safe.ts`, which is where the requests live.
+ *
+ * The ISF clients that used to back these types (`/api/user-management/v1`,
+ * `/api/authorization/v1`, `/isfweb/api/ShareMgnt`, `/api/eacp/v1`) were removed
+ * once ISF was retired — see docs/exec-plans/admin-bkn-safe-migration.md. Some
+ * fields here are wider than bkn-safe accepts and are dropped in the mapping;
+ * that lossiness is documented in the migration plan.
  */
-
 interface AdminListOptions {
     role?: string;
     offset?: number;
@@ -1225,16 +1229,20 @@ interface TokenConfig {
     refreshToken?: string;
     idToken?: string;
     expiresAt?: string;
-    /** Skip TLS verification for this platform (saved by `auth login -k`). */
-    tlsInsecure?: boolean;
-    /** Platform has no auth stack (no bkn-safe) — requests carry no token. */
-    noAuth?: boolean;
     /** Login name persisted at login time (fallback when JWT lacks claims). */
     username?: string;
     /** Human-readable name from userinfo. */
     displayName?: string;
 }
-/** userId from the token's JWT `sub` (id_token first), else "default". */
+/**
+ * userId from the token's JWT `sub` (id_token first), else "default".
+ *
+ * The `sub` is attacker-supplied — the JWT is never signature-checked — and it
+ * becomes a path segment under `userDir`. An unconstrained one escapes the
+ * store: `sub: "../../<other-platform>/users/default"` overwrites another
+ * platform's saved token, so the victim's later commands there authenticate as
+ * whoever issued this token. Constrain it the way BKN_PROFILE is constrained.
+ */
 declare function userIdFromToken(token: TokenConfig): string;
 interface PlatformUser {
     userId: string;
@@ -1253,20 +1261,12 @@ declare function hostOf(baseUrl: string): string;
 declare function attachToken(baseUrl: string, accessToken: string, opts?: {
     refreshToken?: string;
     idToken?: string;
-    insecure?: boolean;
     username?: string;
 }): {
     baseUrl: string;
     userId: string;
     username?: string;
 };
-/** Register a no-auth platform session (no token; the platform has no bkn-safe). */
-declare function attachNoAuth(baseUrl: string, opts?: {
-    insecure?: boolean;
-}): {
-    baseUrl: string;
-    noAuth: true;
-};
 interface AuthStatus {
     baseUrl?: string;
     userId?: string;
@@ -1274,15 +1274,22 @@ interface AuthStatus {
     username?: string;
     expired?: boolean;
 }
-declare function status(): AuthStatus;
-declare function currentToken(): string;
+declare function status(opts?: {
+    user?: string;
+}): AuthStatus;
+declare function currentToken(opts?: {
+    user?: string;
+}): string;
 /**
  * Like {@link currentToken} but proactively refreshes an expired access token
  * when a refresh token is stored, persisting the result. API requests already
  * refresh on a 401 (see api/http.ts); this covers the `auth token` getter,
  * whose output is copied out and used elsewhere where no 401 retry can help.
  */
-declare function currentTokenFresh(): Promise<string>;
+declare function currentTokenFresh(opts?: {
+    insecure?: boolean;
+    user?: string;
+}): Promise<string>;
 interface WhoamiResult extends JwtClaims {
     /** Platform the active session belongs to. */
     baseUrl?: string;
@@ -1291,7 +1298,9 @@ interface WhoamiResult extends JwtClaims {
     /** Resolved account/login name — what `auth login` looked up and stored. */
     username?: string;
 }
-declare function whoami(): WhoamiResult;
+declare function whoami(opts?: {
+    user?: string;
+}): WhoamiResult;
 interface PlatformListItem {
     baseUrl: string;
     userId: string;
@@ -1326,7 +1335,6 @@ declare function exportCreds(): {
 type auth_AuthStatus = AuthStatus;
 type auth_PlatformListItem = PlatformListItem;
 type auth_WhoamiResult = WhoamiResult;
-declare const auth_attachNoAuth: typeof attachNoAuth;
 declare const auth_attachToken: typeof attachToken;
 declare const auth_currentToken: typeof currentToken;
 declare const auth_currentTokenFresh: typeof currentTokenFresh;
@@ -1342,7 +1350,7 @@ declare const auth_userIdFromToken: typeof userIdFromToken;
 declare const auth_usersOf: typeof usersOf;
 declare const auth_whoami: typeof whoami;
 declare namespace auth {
-  export { type auth_AuthStatus as AuthStatus, type auth_PlatformListItem as PlatformListItem, type auth_WhoamiResult as WhoamiResult, auth_attachNoAuth as attachNoAuth, auth_attachToken as attachToken, auth_currentToken as currentToken, auth_currentTokenFresh as currentTokenFresh, auth_deletePlatform as deletePlatform, auth_exportCreds as exportCreds, auth_hostOf as hostOf, auth_listPlatforms as listPlatforms, auth_logout as logout, auth_status as status, auth_switchUser as switchUser, auth_use as use, auth_userIdFromToken as userIdFromToken, auth_usersOf as usersOf, auth_whoami as whoami };
+  export { type auth_AuthStatus as AuthStatus, type auth_PlatformListItem as PlatformListItem, type auth_WhoamiResult as WhoamiResult, auth_attachToken as attachToken, auth_currentToken as currentToken, auth_currentTokenFresh as currentTokenFresh, auth_deletePlatform as deletePlatform, auth_exportCreds as exportCreds, auth_hostOf as hostOf, auth_listPlatforms as listPlatforms, auth_logout as logout, auth_status as status, auth_switchUser as switchUser, auth_use as use, auth_userIdFromToken as userIdFromToken, auth_usersOf as usersOf, auth_whoami as whoami };
 }
 
 interface RequestInitEx {

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   toolboxes,
   trace,
   vega
-} from "./chunk-LCOMMFH7.js";
+} from "./chunk-ISJHU26W.js";
 export {
   DEFAULT_BUSINESS_DOMAIN,
   DEFAULT_LIST_LIMIT,

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@openbkn/bkn-sdk",
-  "version": "0.1.1-alpha.18",
+  "version": "0.1.1-alpha.19",
   "description": "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "Apache-2.0",
   "engines": {
     "node": ">=18"
   },
@@ -18,7 +18,7 @@
       "import": "./dist/index.js"
     }
   },
-  "files": ["dist", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
+  "files": ["dist", "!dist/**/*.map", "README.md", "README.zh.md", "LICENSE", "NOTICE"],
   "publishConfig": {
     "access": "public"
   },
@@ -31,7 +31,8 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
-    "lint": "biome check . && tsc --noEmit",
+    "check:deps": "node scripts/check-no-self-dep.mjs",
+    "lint": "npm run check:deps && biome check . && tsc --noEmit",
     "format": "biome format --write .",
     "test": "vitest run",
     "test:cover": "vitest run --coverage",
@@ -40,12 +41,12 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.9.1",
-    "@openbkn/bkn-sdk": "^0.1.1-alpha.3",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
     "csv-parse": "^6.2.1",
     "js-yaml": "^4.2.0",
     "jszip": "^3.10.1",
+    "undici": "^8.7.0",
     "zod": "^3.24.1"
   },
   "devDependencies": {