@p0security/cli 0.27.0 → 0.27.1

package/build/dist/commands/login.js

@@ -39,7 +39,7 @@ const doActualLogin = (orgWithSlug, debug) => __awaiter(void 0, void 0, void 0,
     const loginFn = plugin && login_1.pluginLoginMap[plugin];
     if (!loginFn)
         throw "Unsupported login for your organization";
-    const tokenResponse = yield loginFn(orgWithSlug);
+    const tokenResponse = yield loginFn(orgWithSlug, { debug });
     yield (0, auth_1.writeIdentity)(orgWithSlug, tokenResponse);
 });
 const formatTimeLeft = (seconds) => {
@@ -105,7 +105,8 @@ const login = (args, options) => __awaiter(void 0, void 0, void 0, function* ()
     else {
         (0, stdio_1.print2)(`You are currently logged in to the ${orgSlug} organization.`);
     }
-    if (tokenTimeRemaining > 0) {
+    // Only show the "expires in" line for identities that lack a refresh_token.
+    if (tokenTimeRemaining > 0 && !(identity === null || identity === void 0 ? void 0 : identity.credential.refresh_token)) {
         (0, stdio_1.print2)(`The current session expires in ${formatTimeLeft(tokenTimeRemaining)}.`);
     }
 });

package/build/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wCAAkD;AAClD,0CAMyB;AACzB,8CAA+C;AAC/C,oDAA0D;AAC1D,wCAA4C;AAC5C,4CAA0C;AAC1C,4CAAkD;AAClD,kDAAqE;AAKrE,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE,CAAC;AAEhD,MAAM,aAAa,GAAG,CAAO,WAAoB,EAAE,KAAe,EAAE,EAAE;IACpE,MAAM,WAAW,GAAG,IAAA,0BAAc,EAAC,WAAW,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAA,2BAAe,EAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAExE,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,uBAAuB,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS,EAAE,CAAC,CAAC;KACtD;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,sBAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO;QAAE,MAAM,yCAAyC,CAAC;IAE9D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;IAEjD,MAAM,IAAA,oBAAa,EAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC,CAAA,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kCAAkC;IACzF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,YAAY,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,KAAK,GAAG,CACnB,IAAyC,EACzC,OAAyD,EACzD,EAAE;IACF,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAe,GAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAA,yBAAkB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,QAAQ,GAAG,kBAAkB,GAAG,gCAAgC,CAAC;IACrE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE;QACZ,IAAI,QAAQ,IAAI,QAAQ,EAAE;YACxB,kFAAkF;YAClF,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;SAC7B;aAAM;YACL,MAAM,2GAA2G,CAAC;SACnH;KACF;SAAM;QACL,IAAI,QAAQ,IAAI,QAAQ,EAAE;YACxB,IAAI,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;gBACjD,sFAAsF;gBACtF,QAAQ,GAAG,KAAK,CAAC;aAClB;SACF;KACF;IAED,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EACJ,yBAAyB,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,UAAU,OAAO,EAAE,CACrF,CAAC;KACH;IAED,MAAM,IAAA,mBAAU,EAAC,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;IAE1C,MAAM,IAAA,8BAAkB,GAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,MAAM,IAAA,gBAAU,EAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,WAAW,mCAAiB,OAAO,KAAE,IAAI,EAAE,OAAO,GAAE,CAAC;IAE3D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EAAC,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;KACpD;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,IAAA,cAAM,EAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;SAC3D;QACD,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;KAClD;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAAA,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,EAAC,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;KACnD;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,IAAA,cAAM,EACJ,gCAAgC,OAAO,wCAAwC,CAChF,CAAC;KACH;SAAM;QACL,IAAA,cAAM,EAAC,sCAAsC,OAAO,gBAAgB,CAAC,CAAC;KACvE;IAED,IAAI,kBAAkB,GAAG,CAAC,EAAE;QAC1B,IAAA,cAAM,EACJ,kCAAkC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CACxE,CAAC;KACH;AACH,CAAC,CAAA,CAAC;AAvEW,QAAA,KAAK,SAuEhB;AAEK,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAE,EAAE,CAChD,KAAK,CAAC,OAAO,CACX,aAAa,EACb,4BAA4B,EAC5B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,UAAU,CAAC,KAAK,EAAE;IACjB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,sBAAsB;CACjC,CAAC;KACD,MAAM,CAAC,SAAS,EAAE;IACjB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,KAAK;CACf,CAAC;KACD,MAAM,CAAC,OAAO,EAAE;IACf,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,0BAA0B;CACrC,CAAC,EAEN,CACE,IAIE,EACF,EAAE,CAAC,IAAA,aAAK,EAAC,IAAI,EAAE,IAAI,CAAC,CACvB,CAAC;AA3BS,QAAA,YAAY,gBA2BrB;AAEJ,MAAM,oBAAoB,GAAG,CAAO,KAAY,EAAE,KAAe,EAAE,EAAE;IACnE,IAAI;QACF,MAAM,IAAA,sBAAgB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAA,qBAAc,GAAE,CAAC;QACvB,MAAM,2CAA2C,CAAC;KACnD;AACH,CAAC,CAAA,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wCAAkD;AAClD,0CAMyB;AACzB,8CAA+C;AAC/C,oDAA0D;AAC1D,wCAA4C;AAC5C,4CAA0C;AAC1C,4CAAkD;AAClD,kDAAqE;AAKrE,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE,CAAC;AAEhD,MAAM,aAAa,GAAG,CAAO,WAAoB,EAAE,KAAe,EAAE,EAAE;IACpE,MAAM,WAAW,GAAG,IAAA,0BAAc,EAAC,WAAW,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAA,2BAAe,EAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAExE,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,uBAAuB,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS,EAAE,CAAC,CAAC;KACtD;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,sBAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO;QAAE,MAAM,yCAAyC,CAAC;IAE9D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,IAAA,oBAAa,EAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC,CAAA,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kCAAkC;IACzF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,YAAY,GAAG,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,KAAK,GAAG,CACnB,IAAyC,EACzC,OAAyD,EACzD,EAAE;IACF,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,IAAA,sBAAe,GAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEhE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAA,yBAAkB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,QAAQ,GAAG,kBAAkB,GAAG,gCAAgC,CAAC;IACrE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC,OAAO,EAAE;QACZ,IAAI,QAAQ,IAAI,QAAQ,EAAE;YACxB,kFAAkF;YAClF,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;SAC7B;aAAM;YACL,MAAM,2GAA2G,CAAC;SACnH;KACF;SAAM;QACL,IAAI,QAAQ,IAAI,QAAQ,EAAE;YACxB,IAAI,OAAO,KAAK,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;gBACjD,sFAAsF;gBACtF,QAAQ,GAAG,KAAK,CAAC;aAClB;SACF;KACF;IAED,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EACJ,yBAAyB,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,UAAU,OAAO,EAAE,CACrF,CAAC;KACH;IAED,MAAM,IAAA,mBAAU,EAAC,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;IAE1C,MAAM,IAAA,8BAAkB,GAAE,CAAC;IAE3B,MAAM,OAAO,GAAG,MAAM,IAAA,gBAAU,EAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,WAAW,mCAAiB,OAAO,KAAE,IAAI,EAAE,OAAO,GAAE,CAAC;IAE3D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EAAC,aAAa,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;KACpD;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,IAAA,cAAM,EAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;SAC3D;QACD,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;KAClD;IAED,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB,CAAA,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,EAAC,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,CAAC;KACnD;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,IAAA,cAAM,EACJ,gCAAgC,OAAO,wCAAwC,CAChF,CAAC;KACH;SAAM;QACL,IAAA,cAAM,EAAC,sCAAsC,OAAO,gBAAgB,CAAC,CAAC;KACvE;IAED,4EAA4E;IAC5E,IAAI,kBAAkB,GAAG,CAAC,IAAI,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,CAAC,aAAa,CAAA,EAAE;QACjE,IAAA,cAAM,EACJ,kCAAkC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CACxE,CAAC;KACH;AACH,CAAC,CAAA,CAAC;AAxEW,QAAA,KAAK,SAwEhB;AAEK,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAE,EAAE,CAChD,KAAK,CAAC,OAAO,CACX,aAAa,EACb,4BAA4B,EAC5B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,UAAU,CAAC,KAAK,EAAE;IACjB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,sBAAsB;CACjC,CAAC;KACD,MAAM,CAAC,SAAS,EAAE;IACjB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,KAAK;CACf,CAAC;KACD,MAAM,CAAC,OAAO,EAAE;IACf,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,0BAA0B;CACrC,CAAC,EAEN,CACE,IAIE,EACF,EAAE,CAAC,IAAA,aAAK,EAAC,IAAI,EAAE,IAAI,CAAC,CACvB,CAAC;AA3BS,QAAA,YAAY,gBA2BrB;AAEJ,MAAM,oBAAoB,GAAG,CAAO,KAAY,EAAE,KAAe,EAAE,EAAE;IACnE,IAAI;QACF,MAAM,IAAA,sBAAgB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAA,qBAAc,GAAE,CAAC;QACvB,MAAM,2CAA2C,CAAC;KACnD;AACH,CAAC,CAAA,CAAC"}

package/build/dist/commands/logout.js

@@ -23,6 +23,7 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
+const auth_1 = require("../drivers/auth");
 const path_1 = require("../drivers/auth/path");
 const stdio_1 = require("../drivers/stdio");
 const promises_1 = __importDefault(require("fs/promises"));
@@ -41,12 +42,10 @@ const safeDelete = (filePath, description, debug) => __awaiter(void 0, void 0, v
 });
 const logout = (debug) => __awaiter(void 0, void 0, void 0, function* () {
     (0, stdio_1.print2)("Logging out...");
-    const identityPath = (0, path_1.getIdentityFilePath)();
-    yield safeDelete(identityPath, "identity file", debug);
+    // Revoke identity token and delete related files
+    yield (0, auth_1.deleteIdentity)({ debug });
     const configPath = (0, path_1.getConfigFilePath)();
     yield safeDelete(configPath, "config file", debug);
-    const cachePath = (0, path_1.getIdentityCachePath)();
-    yield safeDelete(cachePath, "cache", debug);
     (0, stdio_1.print2)("Successfully logged out. All authentication data has been cleared.");
 });
 const logoutCommand = (yargs) => yargs.command("logout", "Log out and clear all authentication data", (yargs) => yargs.option("debug", {

package/build/dist/commands/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/commands/logout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,+CAI8B;AAC9B,4CAA0C;AAC1C,2DAA6B;AAG7B,MAAM,UAAU,GAAG,CACjB,QAAgB,EAChB,WAAmB,EACnB,KAAc,EACd,EAAE;IACF,IAAI;QACF,MAAM,kBAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,WAAW,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;SAC/C;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE;YAC3B,IAAA,cAAM,EACJ,6BAA6B,WAAW,OAAO,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAC5E,CAAC;SACH;KACF;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,MAAM,GAAG,CAAO,KAAc,EAAiB,EAAE;IACrD,IAAA,cAAM,EAAC,gBAAgB,CAAC,CAAC;IAEzB,MAAM,YAAY,GAAG,IAAA,0BAAmB,GAAE,CAAC;IAC3C,MAAM,UAAU,CAAC,YAAY,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAEvD,MAAM,UAAU,GAAG,IAAA,wBAAiB,GAAE,CAAC;IACvC,MAAM,UAAU,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,IAAA,2BAAoB,GAAE,CAAC;IACzC,MAAM,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE5C,IAAA,cAAM,EAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC,CAAA,CAAC;AAEK,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,EAAE,CACjD,KAAK,CAAC,OAAO,CACX,QAAQ,EACR,2CAA2C,EAC3C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,6CAA6C;IACvD,OAAO,EAAE,KAAK;CACf,CAAC,EACJ,CAAO,IAAI,EAAE,EAAE;;IACb,MAAM,MAAM,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,KAAK,CAAC,CAAC;AACpC,CAAC,CAAA,CACF,CAAC;AAbS,QAAA,aAAa,iBAatB"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/commands/logout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,0CAAiD;AACjD,+CAAyD;AACzD,4CAA0C;AAC1C,2DAA6B;AAG7B,MAAM,UAAU,GAAG,CACjB,QAAgB,EAChB,WAAmB,EACnB,KAAc,EACd,EAAE;IACF,IAAI;QACF,MAAM,kBAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,WAAW,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;SAC/C;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE;YAC3B,IAAA,cAAM,EACJ,6BAA6B,WAAW,OAAO,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAC5E,CAAC;SACH;KACF;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,MAAM,GAAG,CAAO,KAAc,EAAiB,EAAE;IACrD,IAAA,cAAM,EAAC,gBAAgB,CAAC,CAAC;IAEzB,iDAAiD;IACjD,MAAM,IAAA,qBAAc,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhC,MAAM,UAAU,GAAG,IAAA,wBAAiB,GAAE,CAAC;IACvC,MAAM,UAAU,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAEnD,IAAA,cAAM,EAAC,oEAAoE,CAAC,CAAC;AAC/E,CAAC,CAAA,CAAC;AAEK,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,EAAE,CACjD,KAAK,CAAC,OAAO,CACX,QAAQ,EACR,2CAA2C,EAC3C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,6CAA6C;IACvD,OAAO,EAAE,KAAK;CACf,CAAC,EACJ,CAAO,IAAI,EAAE,EAAE;;IACb,MAAM,MAAM,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,KAAK,CAAC,CAAC;AACpC,CAAC,CAAA,CACF,CAAC;AAbS,QAAA,aAAa,iBAatB"}

package/build/dist/drivers/auth/index.d.ts

@@ -7,7 +7,9 @@ export declare const cached: <T>(name: string, loader: () => Promise<T>, options
 export declare const loadCredentials: () => Promise<Identity>;
 export declare const remainingTokenTime: (identity: Identity) => number;
 export declare const writeIdentity: (org: OrgData, credential: TokenResponse) => Promise<void>;
-export declare const deleteIdentity: () => Promise<void>;
+export declare const deleteIdentity: (options?: {
+    debug?: boolean;
+}) => Promise<void>;
 export declare const authenticate: (options?: {
     noRefresh?: boolean;
     debug?: boolean;

package/build/dist/drivers/auth/index.js

@@ -45,12 +45,15 @@ You should have received a copy of the GNU General Public License along with @p0
 **/
 const login_1 = require("../../commands/login");
 const instrumentation_1 = require("../../opentelemetry/instrumentation");
+const authUtils_1 = require("../../types/authUtils");
 const util_1 = require("../../util");
 const api_1 = require("../api");
 const firestore_1 = require("../firestore");
 const stdio_1 = require("../stdio");
 const util_2 = require("../util");
+const lock_1 = require("./lock");
 const path_1 = require("./path");
+const refresh_1 = require("./refresh");
 const fs = __importStar(require("fs/promises"));
 const path = __importStar(require("path"));
 const MIN_REMAINING_TOKEN_TIME_SECONDS = 60;
@@ -134,6 +137,7 @@ exports.loadCredentials = loadCredentials;
 const remainingTokenTime = (identity) => Math.floor(identity.credential.expires_at - Date.now() * 1e-3);
 exports.remainingTokenTime = remainingTokenTime;
 const loadCredentialsWithAutoLogin = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    var _e, _f, _g;
     let identity;
     try {
         identity = yield (0, exports.loadCredentials)();
@@ -149,6 +153,33 @@ const loadCredentialsWithAutoLogin = (options) => __awaiter(void 0, void 0, void
     if ((0, exports.remainingTokenTime)(identity) > MIN_REMAINING_TOKEN_TIME_SECONDS) {
         return identity;
     }
+    // If token is expired, and provider is okta, try the silent refresh-token
+    // grant first, and only fall through to the interactive device flow if that
+    // path is unavailable or fails.
+    if (identity.credential.refresh_token &&
+        (0, authUtils_1.getProviderType)(identity.org) === "okta") {
+        try {
+            return yield (0, lock_1.withIdentityLock)(() => __awaiter(void 0, void 0, void 0, function* () {
+                // Double-checked under the lock: a peer process may have refreshed
+                // identity.json while we were waiting to acquire it.
+                const current = yield (0, exports.loadCredentials)();
+                if ((0, exports.remainingTokenTime)(current) > MIN_REMAINING_TOKEN_TIME_SECONDS) {
+                    return current;
+                }
+                const refreshed = yield (0, refresh_1.refreshOktaTokens)(current, {
+                    debug: options === null || options === void 0 ? void 0 : options.debug,
+                });
+                yield (0, exports.writeIdentity)(current.org, refreshed);
+                return yield (0, exports.loadCredentials)();
+            }));
+        }
+        catch (e) {
+            if (options === null || options === void 0 ? void 0 : options.debug) {
+                const detail = (_g = (_f = (_e = e === null || e === void 0 ? void 0 : e.reason) !== null && _e !== void 0 ? _e : e === null || e === void 0 ? void 0 : e.code) !== null && _f !== void 0 ? _f : e === null || e === void 0 ? void 0 : e.message) !== null && _g !== void 0 ? _g : String(e);
+                (0, stdio_1.print2)(`Okta refresh-token grant failed (${detail}); falling back to device flow.`);
+            }
+        }
+    }
     if (options === null || options === void 0 ? void 0 : options.noRefresh) {
         throw (0, util_2.getExpiredCredentialsMessage)();
     }
@@ -163,10 +194,21 @@ const writeIdentity = (org, credential) => __awaiter(void 0, void 0, void 0, fun
     (0, stdio_1.print2)(`Saving authorization to ${identityFilePath}.`);
     const dir = path.dirname(identityFilePath);
     yield fs.mkdir(dir, { recursive: true });
-    yield fs.writeFile(identityFilePath, JSON.stringify({ credential: Object.assign(Object.assign({}, credential), { expires_at }), org }, null, 2), { mode: "600" });
+    // Write to a sibling tmp file then rename, so a crash mid-write can't leave
+    // identity.json truncated. Same-directory rename keeps the operation atomic.
+    const tmpPath = `${identityFilePath}.tmp`;
+    yield fs.writeFile(tmpPath, JSON.stringify({ credential: Object.assign(Object.assign({}, credential), { expires_at }), org }, null, 2), { mode: "600" });
+    yield fs.rename(tmpPath, identityFilePath);
 });
 exports.writeIdentity = writeIdentity;
-const deleteIdentity = () => __awaiter(void 0, void 0, void 0, function* () {
+const deleteIdentity = (options) => __awaiter(void 0, void 0, void 0, function* () {
+    // Best-effort: revoke the refresh_token at the IDP before destroying our
+    // local copy.
+    const identity = yield (0, exports.loadCredentials)();
+    if (identity.credential.refresh_token &&
+        (0, authUtils_1.getProviderType)(identity.org) === "okta") {
+        yield (0, refresh_1.revokeOktaRefreshToken)(identity, { debug: options === null || options === void 0 ? void 0 : options.debug });
+    }
     yield clearIdentityCache();
     yield clearIdentityFile();
 });

package/build/dist/drivers/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/drivers/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,gDAA6C;AAC7C,yEAA4E;AAI5E,qCAAwC;AACxC,gCAAmC;AACnC,4CAAsD;AACtD,oCAAkC;AAClC,kCAAuD;AACvD,iCAAmE;AACnE,gDAAkC;AAClC,2CAA6B;AAE7B,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAErC,MAAM,MAAM,GAAG,CACpB,IAAY,EACZ,MAAwB,EACxB,OAA6B,EAC7B,UAAiC,EACrB,EAAE;;IACd,MAAM,iBAAiB,GAAG,IAAA,2BAAoB,GAAE,CAAC;IAEjD,iCAAiC;IACjC,mHAAmH;IACnH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;KAC3C;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,mCAAmC,IAAI,GAAG,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,IAAI;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;YACxD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAM,CAAC;QACzE,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ;YAC1B,IAAA,cAAM,EACJ,+BAA+B,IAAI,iBAAiB,MAAA,KAAK,CAAC,OAAO,mCAAI,KAAK,EAAE,CAC7E,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;KAC1B;AACH,CAAC,CAAA,CAAC;AA3CW,QAAA,MAAM,UA2CjB;AAEF,MAAM,iBAAiB,GAAG,GAAS,EAAE;IACnC,IAAI;QACF,MAAM,gBAAgB,GAAG,IAAA,0BAAmB,GAAE,CAAC;QAC/C,6DAA6D;QAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;KAC/B;IAAC,WAAM;QACN,OAAO;KACR;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAS,EAAE;IACpC,IAAI;QACF,MAAM,iBAAiB,GAAG,IAAA,2BAAoB,GAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;KACrD;IAAC,WAAM;QACN,OAAO;KACR;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,eAAe,GAAG,GAA4B,EAAE;;IAC3D,IAAI;QACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAA,0BAAmB,GAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAa,CAAC;QACvD,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,GAAG,0CAAE,IAAI,CAAA,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxD;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ,EAAE;YAC5B,MAAM,gBAAgB,IAAA,iBAAU,GAAE,0BAA0B,CAAC;SAC9D;QACD,MAAM,KAAK,CAAC;KACb;AACH,CAAC,CAAA,CAAC;AAdW,QAAA,eAAe,mBAc1B;AAEK,MAAM,kBAAkB,GAAG,CAAC,QAAkB,EAAE,EAAE,CACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AADpD,QAAA,kBAAkB,sBACkC;AAEjE,MAAM,4BAA4B,GAAG,CAAO,OAG3C,EAAqB,EAAE;IACtB,IAAI,QAAkB,CAAC;IACvB,IAAI;QACF,QAAQ,GAAG,MAAM,IAAA,uBAAe,GAAE,CAAC;KACpC;IAAC,OAAO,CAAM,EAAE;QACf,IAAI,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,MAAK,iBAAiB,EAAE;YACjC,MAAM,IAAA,aAAK,EACT,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EACf,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAClD,CAAC;YACF,IAAA,cAAM,EAAC,IAAI,CAAC,CAAC;YACb,OAAO,4BAA4B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1D;QACD,MAAM,CAAC,CAAC;KACT;IAED,IAAI,IAAA,0BAAkB,EAAC,QAAQ,CAAC,GAAG,gCAAgC,EAAE;QACnE,OAAO,QAAQ,CAAC;KACjB;IAED,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE;QACtB,MAAM,IAAA,mCAA4B,GAAE,CAAC;KACtC;IAED,MAAM,IAAA,aAAK,EACT,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAC1B,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAClD,CAAC;IACF,IAAA,cAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;IACrC,OAAO,4BAA4B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAEK,MAAM,aAAa,GAAG,CAC3B,GAAY,EACZ,UAAyB,EACzB,EAAE;IACF,MAAM,kBAAkB,EAAE,CAAC;IAE3B,MAAM,gBAAgB,GAAG,IAAA,0BAAmB,GAAE,CAAC;IAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,6BAA6B;IAC/F,IAAA,cAAM,EAAC,2BAA2B,gBAAgB,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CAAC,SAAS,CAChB,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,kCAAO,UAAU,KAAE,UAAU,GAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC3E,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC,CAAA,CAAC;AAjBW,QAAA,aAAa,iBAiBxB;AAEK,MAAM,cAAc,GAAG,GAAS,EAAE;IACvC,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,iBAAiB,EAAE,CAAC;AAC5B,CAAC,CAAA,CAAC;AAHW,QAAA,cAAc,kBAGzB;AAEF,gEAAgE;AAChE,MAAM,wBAAwB,GAAG,CAAO,KAAY,EAAiB,EAAE;IACrE,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAA,uCAAqB,EAAC,GAAG,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAEK,MAAM,YAAY,GAAG,CAAO,OAGlC,EAAkB,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EAAC,oCAAoC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAA,cAAM,EAAC,oBAAoB,IAAA,0BAAkB,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;KACpE;IACD,IAAI,KAAY,CAAC;IAEjB,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE;QACjC,KAAK,GAAG;YACN,QAAQ;YACR,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;SAClE,CAAC;KACH;SAAM;QACL,kEAAkE;QAClE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,cAAc,GAAG,MAAM,IAAA,kCAAsB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,GAAG;YACN,QAAQ;YACR,cAAc;YACd,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE;SACjD,CAAC;KACH;IAED,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC,CAAA,CAAC;AA9BW,QAAA,YAAY,gBA8BvB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/drivers/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,gDAA6C;AAC7C,yEAA4E;AAC5E,qDAAwD;AAIxD,qCAAwC;AACxC,gCAAmC;AACnC,4CAAsD;AACtD,oCAAkC;AAClC,kCAAuD;AACvD,iCAA0C;AAC1C,iCAAmE;AACnE,uCAAsE;AACtE,gDAAkC;AAClC,2CAA6B;AAE7B,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAErC,MAAM,MAAM,GAAG,CACpB,IAAY,EACZ,MAAwB,EACxB,OAA6B,EAC7B,UAAiC,EACrB,EAAE;;IACd,MAAM,iBAAiB,GAAG,IAAA,2BAAoB,GAAE,CAAC;IAEjD,iCAAiC;IACjC,mHAAmH;IACnH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;KAC3C;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,mCAAmC,IAAI,GAAG,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,IAAI;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;YACxD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAM,CAAC;QACzE,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ;YAC1B,IAAA,cAAM,EACJ,+BAA+B,IAAI,iBAAiB,MAAA,KAAK,CAAC,OAAO,mCAAI,KAAK,EAAE,CAC7E,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;KAC1B;AACH,CAAC,CAAA,CAAC;AA3CW,QAAA,MAAM,UA2CjB;AAEF,MAAM,iBAAiB,GAAG,GAAS,EAAE;IACnC,IAAI;QACF,MAAM,gBAAgB,GAAG,IAAA,0BAAmB,GAAE,CAAC;QAC/C,6DAA6D;QAC7D,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;KAC/B;IAAC,WAAM;QACN,OAAO;KACR;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,kBAAkB,GAAG,GAAS,EAAE;IACpC,IAAI;QACF,MAAM,iBAAiB,GAAG,IAAA,2BAAoB,GAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;KACrD;IAAC,WAAM;QACN,OAAO;KACR;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,eAAe,GAAG,GAA4B,EAAE;;IAC3D,IAAI;QACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAA,0BAAmB,GAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAa,CAAC;QACvD,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,GAAG,0CAAE,IAAI,CAAA,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;SACxD;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ,EAAE;YAC5B,MAAM,gBAAgB,IAAA,iBAAU,GAAE,0BAA0B,CAAC;SAC9D;QACD,MAAM,KAAK,CAAC;KACb;AACH,CAAC,CAAA,CAAC;AAdW,QAAA,eAAe,mBAc1B;AAEK,MAAM,kBAAkB,GAAG,CAAC,QAAkB,EAAE,EAAE,CACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AADpD,QAAA,kBAAkB,sBACkC;AAEjE,MAAM,4BAA4B,GAAG,CAAO,OAG3C,EAAqB,EAAE;;IACtB,IAAI,QAAkB,CAAC;IACvB,IAAI;QACF,QAAQ,GAAG,MAAM,IAAA,uBAAe,GAAE,CAAC;KACpC;IAAC,OAAO,CAAM,EAAE;QACf,IAAI,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,MAAK,iBAAiB,EAAE;YACjC,MAAM,IAAA,aAAK,EACT,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EACf,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAClD,CAAC;YACF,IAAA,cAAM,EAAC,IAAI,CAAC,CAAC;YACb,OAAO,4BAA4B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1D;QACD,MAAM,CAAC,CAAC;KACT;IAED,IAAI,IAAA,0BAAkB,EAAC,QAAQ,CAAC,GAAG,gCAAgC,EAAE;QACnE,OAAO,QAAQ,CAAC;KACjB;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,gCAAgC;IAChC,IACE,QAAQ,CAAC,UAAU,CAAC,aAAa;QACjC,IAAA,2BAAe,EAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,EACxC;QACA,IAAI;YACF,OAAO,MAAM,IAAA,uBAAgB,EAAC,GAAS,EAAE;gBACvC,mEAAmE;gBACnE,qDAAqD;gBACrD,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAe,GAAE,CAAC;gBACxC,IAAI,IAAA,0BAAkB,EAAC,OAAO,CAAC,GAAG,gCAAgC,EAAE;oBAClE,OAAO,OAAO,CAAC;iBAChB;gBACD,MAAM,SAAS,GAAG,MAAM,IAAA,2BAAiB,EAAC,OAAO,EAAE;oBACjD,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK;iBACtB,CAAC,CAAC;gBACH,MAAM,IAAA,qBAAa,EAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAC5C,OAAO,MAAM,IAAA,uBAAe,GAAE,CAAC;YACjC,CAAC,CAAA,CAAC,CAAC;SACJ;QAAC,OAAO,CAAM,EAAE;YACf,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;gBAClB,MAAM,MAAM,GAAG,MAAA,MAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,IAAI,mCAAI,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC/D,IAAA,cAAM,EACJ,oCAAoC,MAAM,iCAAiC,CAC5E,CAAC;aACH;SACF;KACF;IAED,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE;QACtB,MAAM,IAAA,mCAA4B,GAAE,CAAC;KACtC;IAED,MAAM,IAAA,aAAK,EACT,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAC1B,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAClD,CAAC;IACF,IAAA,cAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;IACrC,OAAO,4BAA4B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAEK,MAAM,aAAa,GAAG,CAC3B,GAAY,EACZ,UAAyB,EACzB,EAAE;IACF,MAAM,kBAAkB,EAAE,CAAC;IAE3B,MAAM,gBAAgB,GAAG,IAAA,0BAAmB,GAAE,CAAC;IAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,6BAA6B;IAC/F,IAAA,cAAM,EAAC,2BAA2B,gBAAgB,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,GAAG,gBAAgB,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,SAAS,CAChB,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,kCAAO,UAAU,KAAE,UAAU,GAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC3E,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC7C,CAAC,CAAA,CAAC;AArBW,QAAA,aAAa,iBAqBxB;AAEK,MAAM,cAAc,GAAG,CAAO,OAA6B,EAAE,EAAE;IACpE,yEAAyE;IACzE,cAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAe,GAAE,CAAC;IACzC,IACE,QAAQ,CAAC,UAAU,CAAC,aAAa;QACjC,IAAA,2BAAe,EAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,EACxC;QACA,MAAM,IAAA,gCAAsB,EAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE,CAAC,CAAC;KACnE;IAED,MAAM,kBAAkB,EAAE,CAAC;IAC3B,MAAM,iBAAiB,EAAE,CAAC;AAC5B,CAAC,CAAA,CAAC;AAdW,QAAA,cAAc,kBAczB;AAEF,gEAAgE;AAChE,MAAM,wBAAwB,GAAG,CAAO,KAAY,EAAiB,EAAE;IACrE,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAA,uCAAqB,EAAC,GAAG,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAEK,MAAM,YAAY,GAAG,CAAO,OAGlC,EAAkB,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;QAClB,IAAA,cAAM,EAAC,oCAAoC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAA,cAAM,EAAC,oBAAoB,IAAA,0BAAkB,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;KACpE;IACD,IAAI,KAAY,CAAC;IAEjB,IAAI,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE;QACjC,KAAK,GAAG;YACN,QAAQ;YACR,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;SAClE,CAAC;KACH;SAAM;QACL,kEAAkE;QAClE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,cAAc,GAAG,MAAM,IAAA,kCAAsB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,GAAG;YACN,QAAQ;YACR,cAAc;YACd,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE;SACjD,CAAC;KACH;IAED,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC,CAAA,CAAC;AA9BW,QAAA,YAAY,gBA8BvB"}

package/build/dist/drivers/auth/lock.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Serialize critical sections that read-modify-write the identity file.
+ *
+ * Acquires an exclusive `proper-lockfile` on identity.json (creates an
+ * adjacent `.lock` directory) and releases it after `fn` resolves or rejects.
+ * The caller is expected to re-read the identity inside `fn` because a peer
+ * may have updated it while we were waiting on the lock.
+ *
+ * Requires identity.json to exist — caller's responsibility.
+ */
+export declare const withIdentityLock: <T>(fn: () => Promise<T>) => Promise<T>;

package/build/dist/drivers/auth/lock.js

@@ -0,0 +1,70 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withIdentityLock = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const path_1 = require("./path");
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
+// If a lock holder dies without releasing, the lock file's mtime stops
+// updating; after STALE_LOCK_MS another process is allowed to steal it.
+const STALE_LOCK_MS = 30000;
+// Bound the *total* wait so a hung peer process can't make this CLI invocation
+// appear to hang. The retry backoff below sums to ~20s in the worst case, then
+// proper-lockfile gives up and we let the caller fall through to device flow.
+const LOCK_RETRY_OPTIONS = {
+    retries: 8,
+    factor: 1.5,
+    minTimeout: 100,
+    maxTimeout: 4000,
+};
+/**
+ * Serialize critical sections that read-modify-write the identity file.
+ *
+ * Acquires an exclusive `proper-lockfile` on identity.json (creates an
+ * adjacent `.lock` directory) and releases it after `fn` resolves or rejects.
+ * The caller is expected to re-read the identity inside `fn` because a peer
+ * may have updated it while we were waiting on the lock.
+ *
+ * Requires identity.json to exist — caller's responsibility.
+ */
+const withIdentityLock = (fn) => __awaiter(void 0, void 0, void 0, function* () {
+    const release = yield proper_lockfile_1.default.lock((0, path_1.getIdentityFilePath)(), {
+        stale: STALE_LOCK_MS,
+        retries: LOCK_RETRY_OPTIONS,
+    });
+    try {
+        return yield fn();
+    }
+    finally {
+        try {
+            yield release();
+        }
+        catch (_a) {
+            // release() may throw if the lock was stolen (we exceeded stale time)
+            // or already released. The on-disk state is still consistent because
+            // writeIdentity is atomic; nothing useful to do here.
+        }
+    }
+});
+exports.withIdentityLock = withIdentityLock;
+//# sourceMappingURL=lock.js.map

package/build/dist/drivers/auth/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../../src/drivers/auth/lock.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iCAA6C;AAC7C,sEAAuC;AAEvC,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,aAAa,GAAG,KAAM,CAAC;AAE7B,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG;IACzB,OAAO,EAAE,CAAC;IACV,MAAM,EAAE,GAAG;IACX,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,gBAAgB,GAAG,CAAU,EAAoB,EAAc,EAAE;IAC5E,MAAM,OAAO,GAAG,MAAM,yBAAQ,CAAC,IAAI,CAAC,IAAA,0BAAmB,GAAE,EAAE;QACzD,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAC;IACH,IAAI;QACF,OAAO,MAAM,EAAE,EAAE,CAAC;KACnB;YAAS;QACR,IAAI;YACF,MAAM,OAAO,EAAE,CAAC;SACjB;QAAC,WAAM;YACN,sEAAsE;YACtE,qEAAqE;YACrE,sDAAsD;SACvD;KACF;AACH,CAAC,CAAA,CAAC;AAhBW,QAAA,gBAAgB,oBAgB3B"}

package/build/dist/drivers/auth/refresh.d.ts

@@ -0,0 +1,31 @@
+import { Identity } from "../../types/identity";
+import { TokenResponse } from "../../types/oidc";
+export declare const REFRESH_FAILED: "REFRESH_FAILED";
+export type RefreshError = {
+    code: typeof REFRESH_FAILED;
+    reason: "http_error" | "missing_id_token" | "missing_provider_config" | "network_error" | "no_refresh_token";
+    cause?: unknown;
+    detail?: string;
+};
+/**
+ * Merge a newly-issued credential from the refresh-token grant with the
+ * previously-stored credential. Note, not all fields are included in the
+ * refreshed token, and thus must be carried forward from the previous/original token.
+ **/
+export declare const mergeRefreshedCredential: (previous: TokenResponse, refreshed: TokenResponse) => TokenResponse;
+/**
+ * Exchange the stored refresh_token for a new access/id token pair against
+ * Okta's /oauth2/v1/token endpoint.
+ *
+ * On any failure, throws a RefreshError. Callers are expected to
+ * catch this and fall through to the device-flow path.
+ */
+export declare const refreshOktaTokens: (identity: Identity, options?: {
+    debug?: boolean;
+}) => Promise<TokenResponse>;
+/**
+ * Best-effort revoke of the stored refresh_token at Okta's /oauth2/v1/revoke.
+ */
+export declare const revokeOktaRefreshToken: (identity: Identity, options?: {
+    debug?: boolean;
+}) => Promise<void>;

package/build/dist/drivers/auth/refresh.js

@@ -0,0 +1,130 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revokeOktaRefreshToken = exports.refreshOktaTokens = exports.mergeRefreshedCredential = exports.REFRESH_FAILED = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const oidc_1 = require("../../common/auth/oidc");
+const fetch_1 = require("../../common/fetch");
+const authUtils_1 = require("../../types/authUtils");
+const stdio_1 = require("../stdio");
+exports.REFRESH_FAILED = "REFRESH_FAILED";
+const refreshError = (reason, extra) => (Object.assign({ code: exports.REFRESH_FAILED, reason }, extra));
+/**
+ * Merge a newly-issued credential from the refresh-token grant with the
+ * previously-stored credential. Note, not all fields are included in the
+ * refreshed token, and thus must be carried forward from the previous/original token.
+ **/
+const mergeRefreshedCredential = (previous, refreshed) => {
+    var _a, _b, _c;
+    return (Object.assign(Object.assign(Object.assign({}, previous), refreshed), { refresh_token: (_a = refreshed.refresh_token) !== null && _a !== void 0 ? _a : previous.refresh_token, device_secret: previous.device_secret, 
+        // RFC 6749 §6: omitted scope on refresh means "identical to original grant"
+        scope: (_b = refreshed.scope) !== null && _b !== void 0 ? _b : previous.scope, token_type: (_c = refreshed.token_type) !== null && _c !== void 0 ? _c : previous.token_type }));
+};
+exports.mergeRefreshedCredential = mergeRefreshedCredential;
+/**
+ * Exchange the stored refresh_token for a new access/id token pair against
+ * Okta's /oauth2/v1/token endpoint.
+ *
+ * On any failure, throws a RefreshError. Callers are expected to
+ * catch this and fall through to the device-flow path.
+ */
+const refreshOktaTokens = (identity, options) => __awaiter(void 0, void 0, void 0, function* () {
+    const refresh_token = identity.credential.refresh_token;
+    if (!refresh_token)
+        throw refreshError("no_refresh_token");
+    const providerDomain = (0, authUtils_1.getProviderDomain)(identity.org);
+    const clientId = (0, authUtils_1.getClientId)(identity.org);
+    if (!providerDomain || !clientId) {
+        throw refreshError("missing_provider_config");
+    }
+    const url = `https://${providerDomain}/oauth2/v1/token`;
+    const init = {
+        method: "POST",
+        headers: oidc_1.OIDC_HEADERS,
+        body: (0, fetch_1.urlEncode)({
+            grant_type: "refresh_token",
+            client_id: clientId,
+            refresh_token,
+        }),
+    };
+    let response;
+    try {
+        response = yield fetch(url, init);
+    }
+    catch (e) {
+        throw refreshError("network_error", { cause: e });
+    }
+    if (!response.ok) {
+        if (options === null || options === void 0 ? void 0 : options.debug) {
+            const detail = yield response.text().catch(() => undefined);
+            (0, stdio_1.print2)(`Okta refresh-token grant failed: ${response.status} ${response.statusText} ${detail !== null && detail !== void 0 ? detail : ""}`);
+        }
+        throw refreshError("http_error", {
+            detail: `${response.status} ${response.statusText}`,
+        });
+    }
+    const refreshed = (yield response.json());
+    if (!refreshed.id_token) {
+        if (options === null || options === void 0 ? void 0 : options.debug) {
+            (0, stdio_1.print2)("Okta refresh response omitted id_token; falling back to device flow.");
+        }
+        throw refreshError("missing_id_token");
+    }
+    return (0, exports.mergeRefreshedCredential)(identity.credential, refreshed);
+});
+exports.refreshOktaTokens = refreshOktaTokens;
+/**
+ * Best-effort revoke of the stored refresh_token at Okta's /oauth2/v1/revoke.
+ */
+const revokeOktaRefreshToken = (identity, options) => __awaiter(void 0, void 0, void 0, function* () {
+    const refresh_token = identity.credential.refresh_token;
+    if (!refresh_token)
+        return;
+    const providerDomain = (0, authUtils_1.getProviderDomain)(identity.org);
+    const clientId = (0, authUtils_1.getClientId)(identity.org);
+    if (!providerDomain || !clientId) {
+        if (options === null || options === void 0 ? void 0 : options.debug) {
+            (0, stdio_1.print2)("Skipping refresh-token revoke: missing provider domain or client id.");
+        }
+        return;
+    }
+    try {
+        const response = yield fetch(`https://${providerDomain}/oauth2/v1/revoke`, {
+            method: "POST",
+            headers: oidc_1.OIDC_HEADERS,
+            body: (0, fetch_1.urlEncode)({
+                client_id: clientId,
+                token: refresh_token,
+                token_type_hint: "refresh_token",
+            }),
+        });
+        if (!response.ok && (options === null || options === void 0 ? void 0 : options.debug)) {
+            (0, stdio_1.print2)(`Refresh-token revoke returned ${response.status} ${response.statusText}; proceeding with logout.`);
+        }
+    }
+    catch (e) {
+        if (options === null || options === void 0 ? void 0 : options.debug) {
+            const detail = e instanceof Error ? e.message : String(e);
+            (0, stdio_1.print2)(`Refresh-token revoke failed (${detail}); proceeding with logout.`);
+        }
+    }
+});
+exports.revokeOktaRefreshToken = revokeOktaRefreshToken;
+//# sourceMappingURL=refresh.js.map

package/build/dist/drivers/auth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../../src/drivers/auth/refresh.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iDAAsD;AACtD,8CAA+C;AAC/C,qDAAuE;AAGvE,oCAAkC;AAErB,QAAA,cAAc,GAAG,gBAAyB,CAAC;AAcxD,MAAM,YAAY,GAAG,CACnB,MAA8B,EAC9B,KAA4C,EAC9B,EAAE,CAAC,iBAAG,IAAI,EAAE,sBAAc,EAAE,MAAM,IAAK,KAAK,EAAG,CAAC;AAEhE;;;;IAII;AACG,MAAM,wBAAwB,GAAG,CACtC,QAAuB,EACvB,SAAwB,EACT,EAAE;;IAAC,OAAA,+CACf,QAAQ,GACR,SAAS,KACZ,aAAa,EAAE,MAAA,SAAS,CAAC,aAAa,mCAAI,QAAQ,CAAC,aAAa,EAChE,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,4EAA4E;QAC5E,KAAK,EAAE,MAAA,SAAS,CAAC,KAAK,mCAAI,QAAQ,CAAC,KAAK,EACxC,UAAU,EAAE,MAAA,SAAS,CAAC,UAAU,mCAAI,QAAQ,CAAC,UAAU,IACvD,CAAA;CAAA,CAAC;AAXU,QAAA,wBAAwB,4BAWlC;AAEH;;;;;;GAMG;AACI,MAAM,iBAAiB,GAAG,CAC/B,QAAkB,EAClB,OAA6B,EACL,EAAE;IAC1B,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;IACxD,IAAI,CAAC,aAAa;QAAE,MAAM,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAE3D,MAAM,cAAc,GAAG,IAAA,6BAAiB,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE;QAChC,MAAM,YAAY,CAAC,yBAAyB,CAAC,CAAC;KAC/C;IAED,MAAM,GAAG,GAAG,WAAW,cAAc,kBAAkB,CAAC;IACxD,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,mBAAY;QACrB,IAAI,EAAE,IAAA,iBAAS,EAAC;YACd,UAAU,EAAE,eAAe;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa;SACd,CAAC;KACH,CAAC;IAEF,IAAI,QAAkB,CAAC;IACvB,IAAI;QACF,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;KACnC;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,YAAY,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;KACnD;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAA,cAAM,EACJ,oCAAoC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,EAAE,CAC7F,CAAC;SACH;QACD,MAAM,YAAY,CAAC,YAAY,EAAE;YAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE;SACpD,CAAC,CAAC;KACJ;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IAE3D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;QACvB,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,IAAA,cAAM,EACJ,sEAAsE,CACvE,CAAC;SACH;QACD,MAAM,YAAY,CAAC,kBAAkB,CAAC,CAAC;KACxC;IAED,OAAO,IAAA,gCAAwB,EAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC,CAAA,CAAC;AAvDW,QAAA,iBAAiB,qBAuD5B;AAEF;;GAEG;AACI,MAAM,sBAAsB,GAAG,CACpC,QAAkB,EAClB,OAA6B,EACd,EAAE;IACjB,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;IACxD,IAAI,CAAC,aAAa;QAAE,OAAO;IAE3B,MAAM,cAAc,GAAG,IAAA,6BAAiB,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,EAAE;QAChC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,IAAA,cAAM,EACJ,sEAAsE,CACvE,CAAC;SACH;QACD,OAAO;KACR;IAED,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,cAAc,mBAAmB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAY;YACrB,IAAI,EAAE,IAAA,iBAAS,EAAC;gBACd,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,aAAa;gBACpB,eAAe,EAAE,eAAe;aACjC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,EAAE;YAClC,IAAA,cAAM,EACJ,iCAAiC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,2BAA2B,CACnG,CAAC;SACH;KACF;IAAC,OAAO,CAAC,EAAE;QACV,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,EAAE;YAClB,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAA,cAAM,EACJ,gCAAgC,MAAM,4BAA4B,CACnE,CAAC;SACH;KACF;AACH,CAAC,CAAA,CAAC;AAzCW,QAAA,sBAAsB,0BAyCjC"}

package/build/dist/plugins/google/auth.d.ts

@@ -0,0 +1,4 @@
+export declare const getGcloudAccessToken: () => Promise<string>;
+export declare const ensureGcloudLogin: ({ debug, }?: {
+    debug?: boolean | undefined;
+}) => Promise<string>;

package/build/dist/plugins/google/auth.js

@@ -0,0 +1,75 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureGcloudLogin = exports.getGcloudAccessToken = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const subprocess_1 = require("../../common/subprocess");
+const stdio_1 = require("../../drivers/stdio");
+const util_1 = require("../../util");
+const util_2 = require("./util");
+const getGcloudAccessToken = () => __awaiter(void 0, void 0, void 0, function* () {
+    const { command, args } = (0, util_2.gcloudCommandArgs)(["auth", "print-access-token"]);
+    // Force debug=false otherwise it prints the access token
+    return yield (0, subprocess_1.asyncSpawn)({ debug: false }, command, args);
+});
+exports.getGcloudAccessToken = getGcloudAccessToken;
+const runGcloudLogin = ({ debug }) => __awaiter(void 0, void 0, void 0, function* () {
+    return new Promise((resolve, reject) => {
+        (0, stdio_1.print2)("Logging in to Google Cloud CLI...");
+        const { command, args } = (0, util_2.gcloudCommandArgs)(["auth", "login"]);
+        const child = (0, util_1.spawnWithCleanEnv)(command, args, {
+            // stdio is [stdin, stdout, stderr]. We send the child's stdout to OUR
+            // stderr instead of inheriting fd 1: `gcloud auth login` writes its
+            // human-readable progress to stdout, but this CLI reserves fd 1 for
+            // machine-readable output (e.g. access tokens, JSON) that callers parse.
+            // Inheriting the child's stdout would interleave gcloud's chatter into
+            // that stream and corrupt it, so we redirect it to stderr — where
+            // human-facing text belongs.
+            stdio: ["inherit", process.stderr, "inherit"],
+        });
+        child.on("error", (error) => reject(`Failed to run 'gcloud auth login': ${error.message}`));
+        child.on("exit", (code) => {
+            if (debug) {
+                (0, stdio_1.print2)(`'gcloud auth login' exited with code ${code}`);
+            }
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject("Google Cloud CLI login failed. Please run 'gcloud auth login' and try again.");
+            }
+        });
+    });
+});
+const ensureGcloudLogin = ({ debug, } = {}) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const accessToken = yield (0, exports.getGcloudAccessToken)();
+        if (debug) {
+            (0, stdio_1.print2)("Google Cloud CLI credentials are valid; skipping login.");
+        }
+        return accessToken;
+    }
+    catch (_a) {
+        yield runGcloudLogin({ debug });
+        return yield (0, exports.getGcloudAccessToken)();
+    }
+});
+exports.ensureGcloudLogin = ensureGcloudLogin;
+//# sourceMappingURL=auth.js.map

package/build/dist/plugins/google/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/plugins/google/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wDAAqD;AACrD,+CAA6C;AAC7C,qCAA+C;AAC/C,iCAA2C;AAEpC,MAAM,oBAAoB,GAAG,GAA0B,EAAE;IAC9D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAiB,EAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,yDAAyD;IACzD,OAAO,MAAM,IAAA,uBAAU,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC,CAAA,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEF,MAAM,cAAc,GAAG,CAAO,EAAE,KAAK,EAAuB,EAAE,EAAE;IAC9D,OAAA,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpC,IAAA,cAAM,EAAC,mCAAmC,CAAC,CAAC;QAC5C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAiB,EAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAA,wBAAiB,EAAC,OAAO,EAAE,IAAI,EAAE;YAC7C,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,6BAA6B;YAC7B,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;SAC9C,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,CAAC,sCAAsC,KAAK,CAAC,OAAO,EAAE,CAAC,CAC9D,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,KAAK,EAAE;gBACT,IAAA,cAAM,EAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;aACxD;YACD,IAAI,IAAI,KAAK,CAAC,EAAE;gBACd,OAAO,EAAE,CAAC;aACX;iBAAM;gBACL,MAAM,CACJ,8EAA8E,CAC/E,CAAC;aACH;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAA;EAAA,CAAC;AAEE,MAAM,iBAAiB,GAAG,CAAO,EACtC,KAAK,MACkB,EAAE,EAAmB,EAAE;IAC9C,IAAI;QACF,MAAM,WAAW,GAAG,MAAM,IAAA,4BAAoB,GAAE,CAAC;QACjD,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,yDAAyD,CAAC,CAAC;SACnE;QACD,OAAO,WAAW,CAAC;KACpB;IAAC,WAAM;QACN,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,OAAO,MAAM,IAAA,4BAAoB,GAAE,CAAC;KACrC;AACH,CAAC,CAAA,CAAC;AAbW,QAAA,iBAAiB,qBAa5B"}

package/build/dist/plugins/google/ssh-key.js

@@ -22,6 +22,7 @@ You should have received a copy of the GNU General Public License along with @p0
 **/
 const subprocess_1 = require("../../common/subprocess");
 const stdio_1 = require("../../drivers/stdio");
+const auth_1 = require("./auth");
 const util_1 = require("./util");
 /**
  * Adds an ssh public key to the user object's sshPublicKeys array in Google Workspace.
@@ -37,9 +38,12 @@ const util_1 = require("./util");
 const importSshKey = (publicKey, options) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
     const debug = (_a = options === null || options === void 0 ? void 0 : options.debug) !== null && _a !== void 0 ? _a : false;
-    // Force debug=false otherwise it prints the access token
-    const { command: accessTokenCommand, args: accessTokenArgs } = (0, util_1.gcloudCommandArgs)(["auth", "print-access-token"]);
-    const accessToken = yield (0, subprocess_1.asyncSpawn)({ debug: false }, accessTokenCommand, accessTokenArgs);
+    // Ensure the user is logged in to the Google Cloud CLI and return a valid
+    // access token. This is the earliest point a gcloud token is required in the
+    // direct `p0 ssh` and `ssh-resolve` flows (before the cloudProviderLogin hook
+    // runs), so the login must happen here. `gcloud auth login` runs only when
+    // the existing token is invalid.
+    const accessToken = yield (0, auth_1.ensureGcloudLogin)({ debug });
     const { command: accountCommand, args: accountArgs } = (0, util_1.gcloudCommandArgs)([
         "config",
         "get-value",

package/build/dist/plugins/google/ssh-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-key.js","sourceRoot":"","sources":["../../../../src/plugins/google/ssh-key.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wDAAqD;AACrD,+CAA6C;AAE7C,iCAA2C;AAE3C;;;;;;;;;;GAUG;AACI,MAAM,YAAY,GAAG,CAC1B,SAAiB,EACjB,OAA6B,EAC7B,EAAE;;IACF,MAAM,KAAK,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,KAAK,CAAC;IAEtC,yDAAyD;IACzD,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,GAC1D,IAAA,wBAAiB,EAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,IAAA,uBAAU,EAClC,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,kBAAkB,EAClB,eAAe,CAChB,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,wBAAiB,EAAC;QACvE,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAEzE,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EACJ,0BAA0B,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,OAAO,EAAE,CAC/E,CAAC;QACF,IAAA,cAAM,EACJ,yBAAyB,SAAS,IAAI,WAAW,gBAAgB,OAAO,EAAE,CAC3E,CAAC;KACH;IAED,IAAI,CAAC,SAAS,EAAE;QACd,MAAM,wCAAwC,CAAC;KAChD;IAED,MAAM,GAAG,GAAG,2CAA2C,OAAO,qBAAqB,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,SAAS;SACf,CAAC;QACF,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,cAAc,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACnE;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;YAC3B,MAAM,kFAAkF,CAAC;SAC1F;aAAM;YACL,MAAM,kCAAkC,CAAC;SAC1C;KACF;IAED,MAAM,IAAI,GAA+B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EACJ,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;KACH;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,yEAAyE;IACzE,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CACrD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,KAAK,OAAO,CACrD,CAAC;IAEF,MAAM,YAAY,GAChB,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAEhC,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,2BAA2B,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,QAAQ,EAAE,CAAC,CAAC;KAC7D;IAED,IAAI,CAAC,YAAY,EAAE;QACjB,MAAM,2HAA2H,CAAC;KACnI;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC;AAC/B,CAAC,CAAA,CAAC;AAtFW,QAAA,YAAY,gBAsFvB"}
+{"version":3,"file":"ssh-key.js","sourceRoot":"","sources":["../../../../src/plugins/google/ssh-key.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wDAAqD;AACrD,+CAA6C;AAC7C,iCAA2C;AAE3C,iCAA2C;AAE3C;;;;;;;;;;GAUG;AACI,MAAM,YAAY,GAAG,CAC1B,SAAiB,EACjB,OAA6B,EAC7B,EAAE;;IACF,MAAM,KAAK,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,mCAAI,KAAK,CAAC;IAEtC,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,WAAW,GAAG,MAAM,IAAA,wBAAiB,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,wBAAiB,EAAC;QACvE,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAEzE,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EACJ,0BAA0B,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,OAAO,EAAE,CAC/E,CAAC;QACF,IAAA,cAAM,EACJ,yBAAyB,SAAS,IAAI,WAAW,gBAAgB,OAAO,EAAE,CAC3E,CAAC;KACH;IAED,IAAI,CAAC,SAAS,EAAE;QACd,MAAM,wCAAwC,CAAC;KAChD;IAED,MAAM,GAAG,GAAG,2CAA2C,OAAO,qBAAqB,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG,EAAE,SAAS;SACf,CAAC;QACF,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,cAAc,QAAQ,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACnE;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;YAC3B,MAAM,kFAAkF,CAAC;SAC1F;aAAM;YACL,MAAM,kCAAkC,CAAC;SAC1C;KACF;IAED,MAAM,IAAI,GAA+B,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EACJ,sDAAsD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;KACH;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE9B,yEAAyE;IACzE,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,MAAM,CACrD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,KAAK,OAAO,CACrD,CAAC;IAEF,MAAM,YAAY,GAChB,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAEhC,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,2BAA2B,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,QAAQ,EAAE,CAAC,CAAC;KAC7D;IAED,IAAI,CAAC,YAAY,EAAE;QACjB,MAAM,2HAA2H,CAAC;KACnI;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC;AAC/B,CAAC,CAAA,CAAC;AApFW,QAAA,YAAY,gBAoFvB"}

package/build/dist/plugins/google/ssh.js

@@ -22,6 +22,7 @@ You should have received a copy of the GNU General Public License along with @p0
 **/
 const ssh_1 = require("../../commands/shared/ssh");
 const keys_1 = require("../../common/keys");
+const auth_1 = require("./auth");
 const install_1 = require("./install");
 const ssh_key_1 = require("./ssh-key");
 const util_1 = require("./util");
@@ -60,8 +61,10 @@ const unprovisionedAccessPatterns = [
     { pattern: /Error while connecting \[4010: 'destination read failed'\]/ },
 ];
 exports.gcpSshProvider = {
-    // TODO support login with Google Cloud
-    cloudProviderLogin: () => __awaiter(void 0, void 0, void 0, function* () { return undefined; }),
+    cloudProviderLogin: (_authn, _request, debug) => __awaiter(void 0, void 0, void 0, function* () {
+        yield (0, auth_1.ensureGcloudLogin)({ debug });
+        return undefined;
+    }),
     ensureInstall: () => __awaiter(void 0, void 0, void 0, function* () {
         if (!(yield (0, install_1.ensureGcpSshInstall)())) {
             throw "Please try again after installing the required GCP utilities";

package/build/dist/plugins/google/ssh.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../../src/plugins/google/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,mDAA0D;AAC1D,4CAAqD;AAErD,uCAAgD;AAChD,uCAAyC;AAEzC,iCAA2C;AAE3C,oGAAoG;AACpG,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAG;IAClC,EAAE,OAAO,EAAE,iCAAiC,EAAE;IAC9C;QACE,mEAAmE;QACnE,OAAO,EAAE,uCAAuC;KACjD;IACD,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAChE;QACE,OAAO,EAAE,+CAA+C;QACxD,kBAAkB,EAAE,IAAI;KACzB;IACD,EAAE,OAAO,EAAE,4DAA4D,EAAE;CACjE,CAAC;AAEE,QAAA,cAAc,GAIvB;IACF,uCAAuC;IACvC,kBAAkB,EAAE,GAAS,EAAE,kDAAC,OAAA,SAAS,CAAA,GAAA;IAEzC,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,6BAAmB,GAAE,CAAC,EAAE;YAClC,MAAM,8DAA8D,CAAC;SACtE;IACH,CAAC,CAAA;IAED,YAAY,EAAE,cAAc;IAE5B,oBAAoB,EAClB,2DAA2D;IAE7D,oBAAoB,EAAE,sDAAsD;IAE5E,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,CAAC,OAAO,EAAE,EAAE;QACxC,IAAI,IAAA,mBAAa,EAAC,OAAO,CAAC,EAAE;YAC1B,uCACK,OAAO;gBACV,6GAA6G;gBAC7G,6HAA6H;gBAC7H,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,IAAI,CAAC,IACjB;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,EAAE,CAAO,MAAM,EAAE,OAAO,EAAE,EAAE;QACtC,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,aAAa;YAC/B,cAAc,EAAE,uBAAgB;SACjC,CAAC;IACJ,CAAC,CAAA;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAiB,EAAC;YAC1C,SAAS;YACT,kBAAkB;YAClB,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAClB,kEAAkE;YAClE,oGAAoG;YACpG,oEAAoE;YACpE,kDAAkD;YAClD,mBAAmB;YACnB,UAAU,OAAO,CAAC,IAAI,EAAE;YACxB,aAAa,OAAO,CAAC,SAAS,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS;IAE9B,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY;YAC5C,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS;YAChD,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YAC7B,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;YACjD,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,YAAY,EAAE,CAAO,OAAO,EAAE,OAAO,EAAE,EAAE;QAAC,OAAA,iCACrC,OAAO,KACV,YAAY,EAAE;gBACZ,aAAa,EAAE,MAAM,IAAA,sBAAY,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;aAC9D,IACD,CAAA;MAAA;CACH,CAAC"}
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../../src/plugins/google/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,mDAA0D;AAC1D,4CAAqD;AAErD,iCAA2C;AAC3C,uCAAgD;AAChD,uCAAyC;AAEzC,iCAA2C;AAE3C,oGAAoG;AACpG,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,2BAA2B,GAAG;IAClC,EAAE,OAAO,EAAE,iCAAiC,EAAE;IAC9C;QACE,mEAAmE;QACnE,OAAO,EAAE,uCAAuC;KACjD;IACD,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAChE;QACE,OAAO,EAAE,+CAA+C;QACxD,kBAAkB,EAAE,IAAI;KACzB;IACD,EAAE,OAAO,EAAE,4DAA4D,EAAE;CACjE,CAAC;AAEE,QAAA,cAAc,GAIvB;IACF,kBAAkB,EAAE,CAAO,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,IAAA,wBAAiB,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC,CAAA;IAED,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,6BAAmB,GAAE,CAAC,EAAE;YAClC,MAAM,8DAA8D,CAAC;SACtE;IACH,CAAC,CAAA;IAED,YAAY,EAAE,cAAc;IAE5B,oBAAoB,EAClB,2DAA2D;IAE7D,oBAAoB,EAAE,sDAAsD;IAE5E,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,CAAC,OAAO,EAAE,EAAE;QACxC,IAAI,IAAA,mBAAa,EAAC,OAAO,CAAC,EAAE;YAC1B,uCACK,OAAO;gBACV,6GAA6G;gBAC7G,6HAA6H;gBAC7H,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,IAAI,CAAC,IACjB;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,EAAE,CAAO,MAAM,EAAE,OAAO,EAAE,EAAE;QACtC,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,aAAa;YAC/B,cAAc,EAAE,uBAAgB;SACjC,CAAC;IACJ,CAAC,CAAA;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAiB,EAAC;YAC1C,SAAS;YACT,kBAAkB;YAClB,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAClB,kEAAkE;YAClE,oGAAoG;YACpG,oEAAoE;YACpE,kDAAkD;YAClD,mBAAmB;YACnB,UAAU,OAAO,CAAC,IAAI,EAAE;YACxB,aAAa,OAAO,CAAC,SAAS,EAAE;SACjC,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS;IAE9B,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY;YAC5C,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS;YAChD,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;YAC7B,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,aAAa;YACjD,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,YAAY,EAAE,CAAO,OAAO,EAAE,OAAO,EAAE,EAAE;QAAC,OAAA,iCACrC,OAAO,KACV,YAAY,EAAE;gBACZ,aAAa,EAAE,MAAM,IAAA,sBAAY,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC;aAC9D,IACD,CAAA;MAAA;CACH,CAAC"}