@parix/cli 0.1.5

package/dist/lib/loopback-server.cjs

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startLoopbackServer = startLoopbackServer;
+const node_http_1 = require("node:http");
+async function startLoopbackServer(options) {
+    const server = (0, node_http_1.createServer)();
+    let completed = false;
+    let expectedState = options.state ?? null;
+    let resolveResult = null;
+    let rejectResult = null;
+    let timeout = null;
+    const clearTimeoutIfNeeded = () => {
+        if (timeout) {
+            clearTimeout(timeout);
+            timeout = null;
+        }
+    };
+    const settle = (handler, value, reason) => {
+        if (completed) {
+            return;
+        }
+        completed = true;
+        clearTimeoutIfNeeded();
+        if (!handler) {
+            return;
+        }
+        if (reason !== undefined) {
+            handler(reason);
+            return;
+        }
+        if (value) {
+            handler(value);
+        }
+    };
+    const result = new Promise((resolve, reject) => {
+        resolveResult = resolve;
+        rejectResult = reject;
+    });
+    server.on('request', (request, response) => {
+        const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (requestUrl.pathname === '/favicon.ico') {
+            response.writeHead(204);
+            response.end();
+            return;
+        }
+        if (requestUrl.pathname !== options.callbackPath) {
+            response.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+            response.end('Not found');
+            return;
+        }
+        const returnedState = requestUrl.searchParams.get('state');
+        const code = requestUrl.searchParams.get('code');
+        const error = requestUrl.searchParams.get('error');
+        const errorDescription = requestUrl.searchParams.get('error_description');
+        if (!expectedState || returnedState !== expectedState) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', 'The callback state did not match.'));
+            settle(rejectResult, undefined, new Error('The callback state did not match the original login request.'));
+            return;
+        }
+        if (error) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', errorDescription ?? error));
+            settle(rejectResult, undefined, new Error(errorDescription ?? error));
+            return;
+        }
+        if (!code) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', 'No authorization code was returned.'));
+            settle(rejectResult, undefined, new Error('No authorization code was returned from the browser callback.'));
+            return;
+        }
+        if (options.successPage) {
+            response.writeHead(302, {
+                'cache-control': 'no-store',
+                location: options.successPage.redirectUrl,
+            });
+            response.end();
+            settle(resolveResult, { code });
+            return;
+        }
+        response.writeHead(200, {
+            'cache-control': 'no-store',
+            'content-type': 'text/html; charset=utf-8',
+        });
+        response.end(buildHtml('Authentication complete', 'You can close the tab and return to the terminal.'));
+        settle(resolveResult, { code });
+    });
+    await listen(server, options.port ?? 0);
+    timeout = setTimeout(() => {
+        settle(rejectResult, undefined, new Error('Timed out waiting for the browser callback.'));
+        void closeServer(server);
+    }, options.timeoutMs);
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Failed to determine the loopback callback port.');
+    }
+    return {
+        callbackUrl: `http://127.0.0.1:${address.port}${options.callbackPath}`,
+        setState: (state) => {
+            expectedState = state;
+        },
+        waitForResult: async () => {
+            return await result;
+        },
+        close: async () => {
+            clearTimeoutIfNeeded();
+            await closeServer(server);
+        },
+    };
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen({ host: '127.0.0.1', port }, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                if ('code' in error && error.code === 'ERR_SERVER_NOT_RUNNING') {
+                    resolve();
+                    return;
+                }
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+function buildHtml(title, message) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="font-family: sans-serif; padding: 2rem; line-height: 1.5;">
+    <h1>${escapeHtml(title)}</h1>
+    <p>${escapeHtml(message)}</p>
+    <script>window.close()</script>
+  </body>
+</html>`;
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}

package/dist/lib/loopback-server.d.cts

@@ -0,0 +1,20 @@
+interface StartLoopbackServerOptions {
+    callbackPath: string;
+    port?: number;
+    successPage?: {
+        redirectUrl: string;
+    };
+    state?: string;
+    timeoutMs: number;
+}
+interface CallbackResult {
+    code: string;
+}
+export interface LoopbackServer {
+    callbackUrl: string;
+    setState: (state: string) => void;
+    waitForResult: () => Promise<CallbackResult>;
+    close: () => Promise<void>;
+}
+export declare function startLoopbackServer(options: StartLoopbackServerOptions): Promise<LoopbackServer>;
+export {};

package/dist/lib/loopback-server.d.ts

@@ -0,0 +1,20 @@
+interface StartLoopbackServerOptions {
+    callbackPath: string;
+    port?: number;
+    successPage?: {
+        redirectUrl: string;
+    };
+    state?: string;
+    timeoutMs: number;
+}
+interface CallbackResult {
+    code: string;
+}
+export interface LoopbackServer {
+    callbackUrl: string;
+    setState: (state: string) => void;
+    waitForResult: () => Promise<CallbackResult>;
+    close: () => Promise<void>;
+}
+export declare function startLoopbackServer(options: StartLoopbackServerOptions): Promise<LoopbackServer>;
+export {};

package/dist/lib/loopback-server.js

@@ -0,0 +1,155 @@
+import { createServer } from 'node:http';
+export async function startLoopbackServer(options) {
+    const server = createServer();
+    let completed = false;
+    let expectedState = options.state ?? null;
+    let resolveResult = null;
+    let rejectResult = null;
+    let timeout = null;
+    const clearTimeoutIfNeeded = () => {
+        if (timeout) {
+            clearTimeout(timeout);
+            timeout = null;
+        }
+    };
+    const settle = (handler, value, reason) => {
+        if (completed) {
+            return;
+        }
+        completed = true;
+        clearTimeoutIfNeeded();
+        if (!handler) {
+            return;
+        }
+        if (reason !== undefined) {
+            handler(reason);
+            return;
+        }
+        if (value) {
+            handler(value);
+        }
+    };
+    const result = new Promise((resolve, reject) => {
+        resolveResult = resolve;
+        rejectResult = reject;
+    });
+    server.on('request', (request, response) => {
+        const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (requestUrl.pathname === '/favicon.ico') {
+            response.writeHead(204);
+            response.end();
+            return;
+        }
+        if (requestUrl.pathname !== options.callbackPath) {
+            response.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+            response.end('Not found');
+            return;
+        }
+        const returnedState = requestUrl.searchParams.get('state');
+        const code = requestUrl.searchParams.get('code');
+        const error = requestUrl.searchParams.get('error');
+        const errorDescription = requestUrl.searchParams.get('error_description');
+        if (!expectedState || returnedState !== expectedState) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', 'The callback state did not match.'));
+            settle(rejectResult, undefined, new Error('The callback state did not match the original login request.'));
+            return;
+        }
+        if (error) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', errorDescription ?? error));
+            settle(rejectResult, undefined, new Error(errorDescription ?? error));
+            return;
+        }
+        if (!code) {
+            response.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
+            response.end(buildHtml('Authentication failed', 'No authorization code was returned.'));
+            settle(rejectResult, undefined, new Error('No authorization code was returned from the browser callback.'));
+            return;
+        }
+        if (options.successPage) {
+            response.writeHead(302, {
+                'cache-control': 'no-store',
+                location: options.successPage.redirectUrl,
+            });
+            response.end();
+            settle(resolveResult, { code });
+            return;
+        }
+        response.writeHead(200, {
+            'cache-control': 'no-store',
+            'content-type': 'text/html; charset=utf-8',
+        });
+        response.end(buildHtml('Authentication complete', 'You can close the tab and return to the terminal.'));
+        settle(resolveResult, { code });
+    });
+    await listen(server, options.port ?? 0);
+    timeout = setTimeout(() => {
+        settle(rejectResult, undefined, new Error('Timed out waiting for the browser callback.'));
+        void closeServer(server);
+    }, options.timeoutMs);
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Failed to determine the loopback callback port.');
+    }
+    return {
+        callbackUrl: `http://127.0.0.1:${address.port}${options.callbackPath}`,
+        setState: (state) => {
+            expectedState = state;
+        },
+        waitForResult: async () => {
+            return await result;
+        },
+        close: async () => {
+            clearTimeoutIfNeeded();
+            await closeServer(server);
+        },
+    };
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen({ host: '127.0.0.1', port }, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                if ('code' in error && error.code === 'ERR_SERVER_NOT_RUNNING') {
+                    resolve();
+                    return;
+                }
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+function buildHtml(title, message) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(title)}</title>
+  </head>
+  <body style="font-family: sans-serif; padding: 2rem; line-height: 1.5;">
+    <h1>${escapeHtml(title)}</h1>
+    <p>${escapeHtml(message)}</p>
+    <script>window.close()</script>
+  </body>
+</html>`;
+}
+function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+}

package/dist/lib/oauth-api.cjs

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
+exports.refreshOAuthTokens = refreshOAuthTokens;
+exports.fetchOAuthUserInfo = fetchOAuthUserInfo;
+const oauth_1 = require("./oauth.cjs");
+const WHITESPACE_REGEX = /\s+/;
+async function exchangeAuthorizationCode(input) {
+    const body = new URLSearchParams({
+        client_id: oauth_1.PARIX_CLIENT_ID,
+        code: input.code,
+        code_verifier: input.codeVerifier,
+        grant_type: 'authorization_code',
+        redirect_uri: (0, oauth_1.buildOAuthCallbackUrl)(input.baseUrl),
+    });
+    const response = await fetch((0, oauth_1.buildOAuthTokenUrl)(input.baseUrl), {
+        body,
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        method: 'POST',
+    });
+    return await parseTokenResponse(response);
+}
+async function refreshOAuthTokens(input) {
+    const body = new URLSearchParams({
+        client_id: oauth_1.PARIX_CLIENT_ID,
+        grant_type: 'refresh_token',
+        refresh_token: input.refreshToken,
+    });
+    const response = await fetch((0, oauth_1.buildOAuthTokenUrl)(input.baseUrl), {
+        body,
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        method: 'POST',
+    });
+    return await parseTokenResponse(response);
+}
+async function fetchOAuthUserInfo(input) {
+    const response = await fetch((0, oauth_1.buildOAuthUserInfoUrl)(input.baseUrl), {
+        headers: {
+            authorization: `Bearer ${input.accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(await readErrorMessage(response, 'Unable to fetch the authenticated user.'));
+    }
+    return (await response.json());
+}
+async function parseTokenResponse(response) {
+    if (!response.ok) {
+        throw new Error(await readErrorMessage(response, 'Unable to exchange OAuth tokens.'));
+    }
+    const payload = (await response.json());
+    return {
+        accessToken: payload.access_token,
+        expiresIn: payload.expires_in,
+        refreshToken: payload.refresh_token ?? null,
+        scope: payload.scope?.split(WHITESPACE_REGEX).filter(Boolean) ?? [],
+        tokenType: payload.token_type,
+    };
+}
+async function readErrorMessage(response, fallback) {
+    try {
+        const payload = (await response.clone().json());
+        return payload.error_description ?? payload.message ?? payload.error ?? fallback;
+    }
+    catch {
+        const text = await response.text();
+        return text.trim() || fallback;
+    }
+}

package/dist/lib/oauth-api.d.cts

@@ -0,0 +1,31 @@
+export interface OAuthTokenSet {
+    accessToken: string;
+    expiresIn: number;
+    refreshToken: string | null;
+    scope: string[];
+    tokenType: string;
+}
+export interface OAuthUserInfo {
+    sub: string;
+    email?: string | null;
+    email_verified?: boolean;
+    name?: string | null;
+    picture?: string | null;
+    organization_id?: string | null;
+    organization_name?: string | null;
+    organization_slug?: string | null;
+    member_role?: string | null;
+}
+export declare function exchangeAuthorizationCode(input: {
+    baseUrl: string;
+    code: string;
+    codeVerifier: string;
+}): Promise<OAuthTokenSet>;
+export declare function refreshOAuthTokens(input: {
+    baseUrl: string;
+    refreshToken: string;
+}): Promise<OAuthTokenSet>;
+export declare function fetchOAuthUserInfo(input: {
+    accessToken: string;
+    baseUrl: string;
+}): Promise<OAuthUserInfo>;

package/dist/lib/oauth-api.d.ts

@@ -0,0 +1,31 @@
+export interface OAuthTokenSet {
+    accessToken: string;
+    expiresIn: number;
+    refreshToken: string | null;
+    scope: string[];
+    tokenType: string;
+}
+export interface OAuthUserInfo {
+    sub: string;
+    email?: string | null;
+    email_verified?: boolean;
+    name?: string | null;
+    picture?: string | null;
+    organization_id?: string | null;
+    organization_name?: string | null;
+    organization_slug?: string | null;
+    member_role?: string | null;
+}
+export declare function exchangeAuthorizationCode(input: {
+    baseUrl: string;
+    code: string;
+    codeVerifier: string;
+}): Promise<OAuthTokenSet>;
+export declare function refreshOAuthTokens(input: {
+    baseUrl: string;
+    refreshToken: string;
+}): Promise<OAuthTokenSet>;
+export declare function fetchOAuthUserInfo(input: {
+    accessToken: string;
+    baseUrl: string;
+}): Promise<OAuthUserInfo>;

package/dist/lib/oauth-api.js

@@ -0,0 +1,68 @@
+import { buildOAuthCallbackUrl, buildOAuthTokenUrl, buildOAuthUserInfoUrl, PARIX_CLIENT_ID } from "./oauth.js";
+const WHITESPACE_REGEX = /\s+/;
+export async function exchangeAuthorizationCode(input) {
+    const body = new URLSearchParams({
+        client_id: PARIX_CLIENT_ID,
+        code: input.code,
+        code_verifier: input.codeVerifier,
+        grant_type: 'authorization_code',
+        redirect_uri: buildOAuthCallbackUrl(input.baseUrl),
+    });
+    const response = await fetch(buildOAuthTokenUrl(input.baseUrl), {
+        body,
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        method: 'POST',
+    });
+    return await parseTokenResponse(response);
+}
+export async function refreshOAuthTokens(input) {
+    const body = new URLSearchParams({
+        client_id: PARIX_CLIENT_ID,
+        grant_type: 'refresh_token',
+        refresh_token: input.refreshToken,
+    });
+    const response = await fetch(buildOAuthTokenUrl(input.baseUrl), {
+        body,
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        method: 'POST',
+    });
+    return await parseTokenResponse(response);
+}
+export async function fetchOAuthUserInfo(input) {
+    const response = await fetch(buildOAuthUserInfoUrl(input.baseUrl), {
+        headers: {
+            authorization: `Bearer ${input.accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(await readErrorMessage(response, 'Unable to fetch the authenticated user.'));
+    }
+    return (await response.json());
+}
+async function parseTokenResponse(response) {
+    if (!response.ok) {
+        throw new Error(await readErrorMessage(response, 'Unable to exchange OAuth tokens.'));
+    }
+    const payload = (await response.json());
+    return {
+        accessToken: payload.access_token,
+        expiresIn: payload.expires_in,
+        refreshToken: payload.refresh_token ?? null,
+        scope: payload.scope?.split(WHITESPACE_REGEX).filter(Boolean) ?? [],
+        tokenType: payload.token_type,
+    };
+}
+async function readErrorMessage(response, fallback) {
+    try {
+        const payload = (await response.clone().json());
+        return payload.error_description ?? payload.message ?? payload.error ?? fallback;
+    }
+    catch {
+        const text = await response.text();
+        return text.trim() || fallback;
+    }
+}

package/dist/lib/oauth-session.cjs

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStoredSession = createStoredSession;
+exports.hydrateStoredSessionOrganization = hydrateStoredSessionOrganization;
+exports.ensureFreshSession = ensureFreshSession;
+const oauth_api_1 = require("./oauth-api.cjs");
+const session_1 = require("./session.cjs");
+const REFRESH_BUFFER_MS = 60_000;
+async function createStoredSession(input) {
+    const now = new Date();
+    const [userInfo, resolvedOrganization] = await Promise.all([
+        (0, oauth_api_1.fetchOAuthUserInfo)({
+            accessToken: input.tokenSet.accessToken,
+            baseUrl: input.baseUrl,
+        }),
+        fetchResolvedSessionOrganization({
+            accessToken: input.tokenSet.accessToken,
+            baseUrl: input.baseUrl,
+        }).catch(() => null),
+    ]);
+    return {
+        version: 2,
+        accessToken: input.tokenSet.accessToken,
+        accessTokenExpiresAt: new Date(now.getTime() + input.tokenSet.expiresIn * 1000).toISOString(),
+        baseUrl: input.baseUrl,
+        createdAt: input.createdAt ?? now.toISOString(),
+        refreshToken: input.tokenSet.refreshToken,
+        scopes: input.tokenSet.scope,
+        tokenType: input.tokenSet.tokenType,
+        updatedAt: now.toISOString(),
+        user: {
+            email: userInfo.email ?? null,
+            emailVerified: userInfo.email_verified ?? null,
+            id: userInfo.sub,
+            image: userInfo.picture ?? null,
+            name: userInfo.name ?? null,
+        },
+        organization: {
+            id: resolvedOrganization?.id ?? userInfo.organization_id ?? null,
+            memberRole: resolvedOrganization?.memberRole ?? userInfo.member_role ?? null,
+            name: resolvedOrganization?.name ?? userInfo.organization_name ?? null,
+            slug: resolvedOrganization?.slug ?? userInfo.organization_slug ?? null,
+        },
+    };
+}
+async function hydrateStoredSessionOrganization(session) {
+    const resolvedOrganization = await fetchResolvedSessionOrganization({
+        accessToken: session.accessToken,
+        baseUrl: session.baseUrl,
+    }).catch(() => null);
+    if (!resolvedOrganization || organizationsEqual(session.organization, resolvedOrganization)) {
+        return session;
+    }
+    const nextSession = {
+        ...session,
+        organization: resolvedOrganization,
+        updatedAt: new Date().toISOString(),
+    };
+    await (0, session_1.writeStoredSession)(nextSession);
+    return nextSession;
+}
+async function ensureFreshSession(session) {
+    if (!shouldRefresh(session)) {
+        return session;
+    }
+    if (!session.refreshToken) {
+        throw new Error('The local session has expired and cannot be refreshed. Run `parix auth login` again.');
+    }
+    const refreshedTokens = await (0, oauth_api_1.refreshOAuthTokens)({
+        baseUrl: session.baseUrl,
+        refreshToken: session.refreshToken,
+    });
+    const updatedSession = await createStoredSession({
+        baseUrl: session.baseUrl,
+        createdAt: session.createdAt,
+        tokenSet: refreshedTokens,
+    });
+    await (0, session_1.writeStoredSession)(updatedSession);
+    return updatedSession;
+}
+function shouldRefresh(session) {
+    const expiresAt = Date.parse(session.accessTokenExpiresAt);
+    return Number.isNaN(expiresAt) || expiresAt <= Date.now() + REFRESH_BUFFER_MS;
+}
+async function fetchResolvedSessionOrganization(input) {
+    const response = await fetch(new URL('/api/v1/session', input.baseUrl), {
+        headers: {
+            authorization: `Bearer ${input.accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error('Unable to resolve the authenticated organization.');
+    }
+    const payload = (await response.json());
+    const organization = payload.auth?.organization;
+    if (!organization) {
+        return null;
+    }
+    return {
+        id: typeof organization.id === 'string' ? organization.id : null,
+        memberRole: typeof organization.memberRole === 'string' ? organization.memberRole : null,
+        name: typeof organization.name === 'string' ? organization.name : null,
+        slug: typeof organization.slug === 'string' ? organization.slug : null,
+    };
+}
+function organizationsEqual(left, right) {
+    return (left.id === right.id && left.memberRole === right.memberRole && left.name === right.name && left.slug === right.slug);
+}