@ory/argus 0.14.0 → 1.0.1

package/dist/setup-actions.js

@@ -1,507 +0,0 @@
-"use strict";
-/**
- * Headless setup actions — the prompt-free, presentation-free core of the
- * install walkthrough, driven by the local web installer's JSON API (and
- * reusable anywhere the interactive TTY wizard's step *decisions* live outside
- * the process, e.g. in a browser).
- *
- * Each function performs exactly one step of the same flow the TTY wizard in
- * {@link file://./interactive-setup.ts} runs — sign in, pick / create a
- * workspace and project, enable DCR, provision the OAuth2 client, grant tool
- * permissions, provision the project API key — but returns a plain result
- * object instead of prompting or printing. The heavy lifting (CLI arg shapes,
- * OPL model inspection/merge, Console-API key minting) is imported from
- * `interactive-setup.ts` so there is a single source of truth for it; only the
- * thin, prompt-free orchestration lives here.
- *
- * Everything is fail-open: an action never throws for an expected failure
- * (CLI error, network blip, missing session) — it returns `{ ok: false }` with
- * a short message the UI can surface.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROJECT_CAP = void 0;
-exports.resolveNamespace = resolveNamespace;
-exports.ensureOryCli = ensureOryCli;
-exports.isSignedIn = isSignedIn;
-exports.startSignIn = startSignIn;
-exports.listWorkspaces = listWorkspaces;
-exports.createWorkspace = createWorkspace;
-exports.listProjects = listProjects;
-exports.createProject = createProject;
-exports.resolveProjectUrl = resolveProjectUrl;
-exports.getDcrState = getDcrState;
-exports.enableDcrAction = enableDcrAction;
-exports.ensureManagedLoginUi = ensureManagedLoginUi;
-exports.resolveIdentityName = resolveIdentityName;
-exports.resourceUserLabel = resourceUserLabel;
-exports.provisionOAuth2Client = provisionOAuth2Client;
-exports.saveNetworkConfig = saveNetworkConfig;
-exports.runFullSetup = runFullSetup;
-exports.inspectPermissions = inspectPermissions;
-exports.provisionPermissions = provisionPermissions;
-exports.grantToolPermissions = grantToolPermissions;
-exports.provisionProjectApiKey = provisionProjectApiKey;
-exports.configureAuditOnly = configureAuditOnly;
-exports.setPermissionMode = setPermissionMode;
-exports.configureLocalStack = configureLocalStack;
-const node_child_process_1 = require("node:child_process");
-const interactive_setup_js_1 = require("./interactive-setup.js");
-const project_api_key_js_1 = require("./project-api-key.js");
-const config_js_1 = require("./config.js");
-const branding_js_1 = require("./branding.js");
-const auth_js_1 = require("./auth.js");
-const auth_store_js_1 = require("./auth-store.js");
-const tool_catalog_js_1 = require("./tool-catalog.js");
-const user_login_js_1 = require("./user-login.js");
-const agent_auth_js_1 = require("./agent-auth.js");
-const client_js_1 = require("./client.js");
-const subject_js_1 = require("./subject.js");
-const index_js_1 = require("./local/index.js");
-const os = __importStar(require("node:os"));
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-/**
- * Ensure the `ory` CLI is available. Probes the default (or injected) runner;
- * if the binary isn't on `PATH`, installs `@ory/cli` into a plugin-managed dir
- * and returns a runner bound to it. Never throws.
- */
-async function ensureOryCli(deps = {}) {
-    const runner = deps.runner ?? (0, interactive_setup_js_1.createOryRunner)("ory");
-    if ((0, interactive_setup_js_1.oryCliPresent)(runner))
-        return { present: true, installed: false, runner };
-    const install = deps.installOryCliFn ?? interactive_setup_js_1.installOryCli;
-    let installed;
-    try {
-        installed = await install();
-    }
-    catch {
-        installed = null;
-    }
-    return { present: !!installed, installed: !!installed, runner: installed };
-}
-// ─── sign in ──────────────────────────────────────────────────────────────
-/** Whether the `ory` CLI already holds a valid Ory Network session. */
-function isSignedIn(runner) {
-    return runner.exec(["list", "workspaces", "--format", "json"]).status === 0;
-}
-/**
- * Launch the interactive `ory auth` browser sign-in as a detached child so the
- * HTTP server's event loop stays free (unlike `runner.exec`, which is
- * spawnSync). The Ory CLI opens its own browser window and runs a local
- * callback listener; we only watch its exit code. Returns a handle whose
- * `done` promise resolves when sign-in completes. Requires `runner.bin`.
- */
-function startSignIn(runner) {
-    const bin = runner.bin;
-    if (!bin) {
-        return { done: Promise.resolve(false), cancel() { } };
-    }
-    const child = (0, node_child_process_1.spawn)(bin, ["auth"], { stdio: "ignore" });
-    const done = new Promise((resolve) => {
-        child.on("exit", (code) => resolve(code === 0));
-        child.on("error", () => resolve(false));
-    });
-    return { done, cancel: () => child.kill() };
-}
-// ─── workspaces & projects ──────────────────────────────────────────────────
-function listWorkspaces(runner) {
-    const r = runner.exec(["list", "workspaces", "--format", "json"]);
-    if (r.status !== 0)
-        return null;
-    return (0, interactive_setup_js_1.parseList)(r.stdout, "workspaces");
-}
-function createWorkspace(runner, name) {
-    const r = runner.exec(["create", "workspace", "--name", name, "--format", "json", "--yes"]);
-    if (r.status !== 0)
-        return { ok: false, error: r.stderr.trim() || "unknown error" };
-    const workspace = (0, interactive_setup_js_1.parseObject)(r.stdout);
-    if (!workspace?.id)
-        return { ok: false, error: "created workspace had no id" };
-    return { ok: true, value: workspace };
-}
-function listProjects(runner, workspaceId) {
-    return (0, interactive_setup_js_1.listProjects)(runner, workspaceId);
-}
-function createProject(runner, workspaceId, name) {
-    const r = runner.exec([
-        "create",
-        "project",
-        "--name",
-        name,
-        "--workspace",
-        workspaceId,
-        "--format",
-        "json",
-        "--yes",
-    ]);
-    if (r.status !== 0)
-        return { ok: false, error: r.stderr.trim() || "unknown error" };
-    const project = (0, interactive_setup_js_1.parseObject)(r.stdout);
-    if (!project?.id)
-        return { ok: false, error: "created project had no id" };
-    return { ok: true, value: project };
-}
-/** Ory Network Developer-plan project cap per workspace. */
-exports.PROJECT_CAP = 2;
-/**
- * Resolve a project's canonical SDK URL from its slug, refusing a missing slug
- * or one that is actually the project id (a UUID) — either would build a URL
- * that points nowhere.
- */
-function resolveProjectUrl(project) {
-    if (!project.slug || (0, config_js_1.looksLikeProjectId)(project.slug)) {
-        return { ok: false, error: "could not resolve the project slug (needed for the SDK URL)" };
-    }
-    try {
-        return { ok: true, value: (0, interactive_setup_js_1.projectUrlFromSlug)(project.slug) };
-    }
-    catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
-    }
-}
-// ─── DCR & OAuth2 client ──────────────────────────────────────────────────
-/** Current DCR state: true/false when known, null when it couldn't be read. */
-function getDcrState(runner, projectId) {
-    return (0, interactive_setup_js_1.dcrEnabled)(runner, projectId);
-}
-/** Enable DCR on the project. Returns true on success. */
-function enableDcrAction(runner, projectId) {
-    return (0, interactive_setup_js_1.enableDcr)(runner, projectId);
-}
-/**
- * Ensure the project's OAuth2 login/consent UI works for a hosted browser
- * login. A CLI-created project defaults these to the `localhost:3000`
- * quickstart sample; this clears them so the Ory Managed Account Experience
- * renders the login instead. Returns the resulting state so the UI can report
- * it: `managed` (fixed or already managed), `custom_external` (a deliberate
- * custom UI, left as-is), or `unknown` (couldn't read the config).
- */
-function ensureManagedLoginUi(runner, projectId) {
-    const state = (0, interactive_setup_js_1.projectLoginUiState)(runner, projectId);
-    if (state === "loopback") {
-        return (0, interactive_setup_js_1.useManagedAccountExperience)(runner, projectId) ? "managed" : "unknown";
-    }
-    return state;
-}
-/**
- * Best-effort human-readable name for a signed-in identity, resolved via the
- * admin `ory` CLI (`ory get identity`). The PKCE login's id_token carries only
- * an opaque subject id under the default `openid` scope, so rather than show a
- * UUID we look the identity up by id and read a display trait (email → username
- * → name). Returns undefined on any CLI/parse failure so callers fall back to
- * the id.
- */
-function resolveIdentityName(runner, projectId, subjectId) {
-    const r = runner.exec([
-        "get",
-        "identity",
-        subjectId,
-        "--project",
-        projectId,
-        "--format",
-        "json",
-    ]);
-    if (r.status !== 0)
-        return undefined;
-    const identity = (0, interactive_setup_js_1.parseObject)(r.stdout);
-    return displayNameFromTraits(identity?.traits);
-}
-/** Pull a display name out of a Kratos identity's traits (best-effort). */
-function displayNameFromTraits(traits) {
-    if (!traits || typeof traits !== "object")
-        return undefined;
-    const t = traits;
-    if (typeof t.email === "string" && t.email.trim())
-        return t.email.trim();
-    if (typeof t.username === "string" && t.username.trim())
-        return t.username.trim();
-    const name = t.name;
-    if (typeof name === "string" && name.trim())
-        return name.trim();
-    if (name && typeof name === "object") {
-        const n = name;
-        const parts = [n.first, n.last].filter((x) => typeof x === "string" && x.trim().length > 0);
-        if (parts.length)
-            return parts.join(" ");
-    }
-    return undefined;
-}
-/**
- * Readable label for a signed-in user when naming a resource (e.g. a project
- * API key), so a shared project's resource list shows an email/username rather
- * than an opaque `user:<uuid>`. Looks the identity up via the admin CLI and
- * falls back to the subject label when no name resolves (no runner, or the
- * lookup fails). The raw subject id is read from either subject shape.
- */
-function resourceUserLabel(runner, projectId, subject) {
-    const sid = "subjectId" in subject ? subject.subjectId : subject.subjectSet.object;
-    const name = runner ? resolveIdentityName(runner, projectId, sid) : undefined;
-    return name ?? (0, subject_js_1.subjectLabel)(subject);
-}
-/**
- * Find or create the public PKCE OAuth2 client the user login needs. Reuses an
- * existing plugin-provisioned client on the project so a re-run never mints a
- * duplicate.
- */
-function provisionOAuth2Client(runner, projectId) {
-    const existing = (0, interactive_setup_js_1.findExistingOAuth2Client)(runner, projectId);
-    if (existing)
-        return { ok: true, clientId: existing, name: branding_js_1.USER_LOGIN_CLIENT_NAME, reused: true };
-    const clientId = (0, interactive_setup_js_1.createOAuth2Client)(runner, projectId);
-    return {
-        ok: !!clientId,
-        clientId: clientId ?? undefined,
-        name: branding_js_1.USER_LOGIN_CLIENT_NAME,
-        reused: false,
-    };
-}
-/** Persist the resolved Ory Network connection and enable the user login. */
-function saveNetworkConfig(input) {
-    (0, config_js_1.saveConfig)({
-        projectUrl: input.projectUrl,
-        projectId: input.projectId,
-        projectName: input.projectName,
-        workspaceName: input.workspaceName,
-        oauth2ClientId: input.oauth2ClientId,
-        auditOnly: false,
-    });
-}
-/**
- * Run the PKCE user login (opens a browser and awaits the loopback callback)
- * and resolve the agent DCR identity, so the next session is fully wired.
- * Best-effort: a declined or failed login just reports `authenticated: false`.
- *
- * `target` pins the project the wizard just selected. The login gate resolves
- * its URL/client id through `resolveConfig()`, which is **env-first** — so a
- * stale `ORY_PROJECT_URL` / `ORY_SDK_URL` / `ORY_OAUTH2_CLIENT_ID` left in the
- * user's shell (e.g. `http://localhost:3000` from a local app) would otherwise
- * override the project they just picked and launch the browser at the wrong
- * URL. During install the fresh selection is ground truth, so we pin it into
- * the environment for the login. (The process exits after install, so this
- * doesn't leak into a long-lived session.)
- */
-async function runFullSetup(binName, harness, deps = {}, target = {}) {
-    const clientFactory = deps.clientFactory ?? client_js_1.OryAgentClient.fromEnv;
-    const userLogin = deps.userLoginFn ?? user_login_js_1.ensureUserAuthenticated;
-    const agentGate = deps.agentGateFn ?? agent_auth_js_1.ensureAgentIdentity;
-    // Scoped to the login call (restored after) so a stale ORY_PROJECT_URL /
-    // ORY_OAUTH2_CLIENT_ID can't override the selected project, and the override
-    // doesn't leak past the login — later steps address the project by id.
-    const prevUrl = process.env.ORY_PROJECT_URL;
-    const prevClient = process.env.ORY_OAUTH2_CLIENT_ID;
-    if (target.projectUrl)
-        process.env.ORY_PROJECT_URL = target.projectUrl;
-    if (target.oauth2ClientId)
-        process.env.ORY_OAUTH2_CLIENT_ID = target.oauth2ClientId;
-    try {
-        const client = clientFactory(harness);
-        const decision = await userLogin(client, { binName, harness });
-        await agentGate(client, { harness });
-        const authenticated = decision.proceed && !!decision.subject;
-        const subject = authenticated ? (0, subject_js_1.resolveUserSubject)(client) : null;
-        const usable = subject && (0, subject_js_1.subjectLabel)(subject) !== "agent:unknown" ? subject : null;
-        // Prefer a human-readable name (email/name) from the login's id_token over
-        // the opaque subject id, so the UI shows who signed in rather than a UUID.
-        const displayName = usable ? (0, auth_js_1.displayNameFromIdToken)((0, auth_store_js_1.loadTokens)()?.idToken) : undefined;
-        return {
-            authenticated,
-            subject: usable,
-            subjectLabel: usable ? (displayName ?? (0, subject_js_1.subjectLabel)(usable)) : null,
-        };
-    }
-    catch {
-        return { authenticated: false, subject: null, subjectLabel: null };
-    }
-    finally {
-        if (prevUrl === undefined)
-            delete process.env.ORY_PROJECT_URL;
-        else
-            process.env.ORY_PROJECT_URL = prevUrl;
-        if (prevClient === undefined)
-            delete process.env.ORY_OAUTH2_CLIENT_ID;
-        else
-            process.env.ORY_OAUTH2_CLIENT_ID = prevClient;
-    }
-}
-/** Inspect how the project's permission model relates to the namespace. */
-async function inspectPermissions(runner, projectId, namespace = resolveNamespace()) {
-    const model = await (0, interactive_setup_js_1.inspectPermissionModel)(runner, projectId, namespace);
-    return model.kind === "merge" ? { model: "merge", opl: model.opl } : { model: model.kind };
-}
-/**
- * Provision (or merge) the namespace into the project's permission model.
- * Pass `opl` (from a prior `inspectPermissions` "merge" result) to append the
- * namespace non-destructively; omit it to create a fresh minimal model.
- */
-function provisionPermissions(runner, projectId, namespace = resolveNamespace(), opl) {
-    return (0, interactive_setup_js_1.provisionPermissionModel)(runner, projectId, namespace, opl);
-}
-/**
- * Grant `<subject>` the `use` relation on every built-in tool by writing the
- * relation tuples through the admin-authenticated `ory` CLI. Assumes the
- * namespace already exists (call {@link inspectPermissions} /
- * {@link provisionPermissions} first).
- */
-function grantToolPermissions(runner, projectId, harness, subject, namespace = resolveNamespace()) {
-    const tools = (0, tool_catalog_js_1.getToolCatalog)(harness);
-    if (tools.length === 0)
-        return { ok: true, count: 0 };
-    const subjectPatch = "subjectSet" in subject
-        ? {
-            subject_set: {
-                namespace: subject.subjectSet.namespace,
-                object: subject.subjectSet.object,
-                relation: subject.subjectSet.relation,
-            },
-        }
-        : { subject_id: subject.subjectId };
-    const tuples = tools.map((object) => ({ namespace, object, relation: "use", ...subjectPatch }));
-    const r = runner.exec(["create", "relationships", "--project", projectId, "--format", "json", "-f", "-", "--yes"], { input: JSON.stringify(tuples) });
-    if (r.status === 0)
-        return { ok: true, count: tools.length };
-    return { ok: false, count: 0, error: r.stderr.trim().split("\n")[0] || "unknown error" };
-}
-/**
- * Ensure a valid project API key is stored for runtime permission *checks*.
- * No-ops for an env-provided key; validates a stored key and re-mints if it is
- * dead; otherwise mints one via the Console API and persists it. Best-effort.
- */
-async function provisionProjectApiKey(input, deps = {}) {
-    const createFn = deps.createProjectApiKeyFn ?? project_api_key_js_1.createProjectApiKeyViaConsole;
-    const validateFn = deps.validateApiKeyFn ?? interactive_setup_js_1.apiKeyAuthenticates;
-    const resolved = (0, config_js_1.resolveConfig)();
-    if (resolved.apiKey) {
-        if (resolved.apiKeySource === "env")
-            return { status: "env" };
-        if (await validateFn(resolved.apiKey, input.projectUrl))
-            return { status: "valid_existing" };
-    }
-    let host = "unknown-host";
-    try {
-        host = os.hostname();
-    }
-    catch {
-        /* keep fallback */
-    }
-    let created = null;
-    try {
-        // Named for the signed-in user + host so a shared project's key list (every
-        // user mints their own) stays attributable and prunable; the Console's
-        // "Date Added" column supplies the timestamp.
-        created = await createFn({
-            projectId: input.projectId,
-            name: (0, branding_js_1.projectApiKeyName)({ host, user: input.user }),
-        });
-    }
-    catch {
-        created = null;
-    }
-    if (created) {
-        // Persist the token id too so uninstall can delete the key server-side.
-        (0, config_js_1.saveConfig)({ apiKey: created.value, apiKeyId: created.id ?? null });
-        return { status: "created" };
-    }
-    return { status: "failed" };
-}
-// ─── audit-only & local stack ─────────────────────────────────────────────
-/** Configure audit-only mode (no project, no auth, no checks). */
-function configureAuditOnly() {
-    (0, config_js_1.saveConfig)({ auditOnly: true });
-}
-// ─── dashboard toggles ────────────────────────────────────────────────────
-/** Set the permission deny posture — `observe` (log) vs `enforce` (block). */
-function setPermissionMode(mode) {
-    (0, config_js_1.saveConfig)({ permissionMode: mode });
-}
-/**
- * Bring up and seed the local Ory stack, persisting the (stable) local
- * connection details regardless of whether Docker came up. Mirrors the TTY
- * wizard's local branch minus the login (the UI drives {@link runFullSetup}
- * separately). Best-effort throughout.
- */
-async function configureLocalStack(deps = {}) {
-    const bringUp = deps.localStackFn ?? index_js_1.ensureLocalOryStack;
-    const seed = deps.seedFn ?? index_js_1.seedLocalEnvironment;
-    let status;
-    let detail;
-    try {
-        const stack = await bringUp();
-        status = stack.status;
-        detail = stack.detail;
-    }
-    catch (err) {
-        status = "compose-failed";
-        detail = err instanceof Error ? err.message : String(err);
-    }
-    const running = status === "started" || status === "already-running";
-    (0, config_js_1.saveConfig)({
-        projectUrl: index_js_1.GATEWAY_URL,
-        oauth2ClientId: index_js_1.USER_CLIENT_ID,
-        userSubjectNamespace: index_js_1.USER_SUBJECT_NAMESPACE,
-        auditOnly: false,
-        // The local stack is not an Ory Network project — clear any workspace /
-        // project identifiers left over from a previous Network connection so they
-        // don't linger in config or surface in the dashboard (null deletes the key).
-        projectId: null,
-        projectName: null,
-        workspaceName: null,
-    });
-    const base = {
-        running,
-        detail: running ? undefined : detail ?? status,
-        seeded: false,
-        projectUrl: index_js_1.GATEWAY_URL,
-        oauth2ClientId: index_js_1.USER_CLIENT_ID,
-        subjectNamespace: index_js_1.USER_SUBJECT_NAMESPACE,
-    };
-    if (!running)
-        return base;
-    try {
-        const result = await seed();
-        return {
-            ...base,
-            seeded: true,
-            credentials: {
-                email: result.user.identity.email,
-                password: result.user.password,
-            },
-        };
-    }
-    catch (err) {
-        return { ...base, seedError: err instanceof Error ? err.message : String(err) };
-    }
-}