@pippit-dev/cli 1.0.43 → 1.0.44

package/checksums.txt

@@ -1,6 +1,6 @@
-e7ee32acef1c0a16912c46500ae7f15c46d920953792d1012886fac7e6424b2e  pippit-tool-cli-1.0.43-darwin-amd64.tar.gz
-57e4df86eaa244cd9845eb966299c8c2e1186f74495da0c16f0b378fb4bc5125  pippit-tool-cli-1.0.43-darwin-arm64.tar.gz
-21823c7a675ebcaadebe2ddbfa0324b9e939220d4dd74d5d5d4546f5e6938060  pippit-tool-cli-1.0.43-linux-amd64.tar.gz
-e387bc8eaeafa430a9a594ed1cc381964953b598875b520a6d009a12aec9d619  pippit-tool-cli-1.0.43-linux-arm64.tar.gz
-4569d389a20c75f0485ecc24ad5034308a818f294886dabdf07b2804e915f3a2  pippit-tool-cli-1.0.43-windows-amd64.zip
-078fb4fb09353a58095e1370668884664aad1760ae065983bb23abfdcd9939d1  pippit-tool-cli-1.0.43-windows-arm64.zip
+8bf338b7fc4bb3de289778896059f364f91743e7fe3127380e193f29bb10fecf  pippit-tool-cli-1.0.44-darwin-amd64.tar.gz
+fd7aac74fda167481b76e3a7aa2f30e45271670cad11f0e969080db1b135411a  pippit-tool-cli-1.0.44-darwin-arm64.tar.gz
+526e3641047d7e997fb5c271d795337692b0a47c092622747f6e2b4e9d22e473  pippit-tool-cli-1.0.44-linux-amd64.tar.gz
+6170436a3ec60dc2a2681e6f790c6a52d9daa4248ce8c3eede83136a62ccb4b6  pippit-tool-cli-1.0.44-linux-arm64.tar.gz
+d3c7166314bb52deae5e0caf383ac7e3cdde27c61325d6556de43f8f46aa9963  pippit-tool-cli-1.0.44-windows-amd64.zip
+9cb3d470688cd89a42a2267d9d181159dd624937c9590d3b744db25a66edbac9  pippit-tool-cli-1.0.44-windows-arm64.zip

package/cmd/auth/auth_test.go

@@ -75,7 +75,7 @@ func (manager *fakeAuthManager) CredentialScope(context.Context) (string, error)
 
 func TestLoginCommandPrintsMetadataWithoutAccessKey(t *testing.T) {
 	const accessKey = "must-never-be-printed"
-	const loginURL = "https://xyq.jianying.com/cli/pippit-tool-login?callback=http%3A%2F%2F127.0.0.1%3A1234&random_secret_key=one-time-secret"
+	const loginURL = "https://www.xiaoyunque.com/cli/pippit-tool-login?callback=http%3A%2F%2F127.0.0.1%3A1234&random_secret_key=one-time-secret"
 	expiresAt := time.Now().Add(time.Hour).Unix()
 	manager := &fakeAuthManager{credential: &internal_auth.Credential{
 		AccessKey: accessKey, UID: "123", CredentialScope: "device-scope", ExpiredAt: expiresAt,

package/dist/checksums.txt

@@ -1,6 +1,6 @@
-e7ee32acef1c0a16912c46500ae7f15c46d920953792d1012886fac7e6424b2e  pippit-tool-cli-1.0.43-darwin-amd64.tar.gz
-57e4df86eaa244cd9845eb966299c8c2e1186f74495da0c16f0b378fb4bc5125  pippit-tool-cli-1.0.43-darwin-arm64.tar.gz
-21823c7a675ebcaadebe2ddbfa0324b9e939220d4dd74d5d5d4546f5e6938060  pippit-tool-cli-1.0.43-linux-amd64.tar.gz
-e387bc8eaeafa430a9a594ed1cc381964953b598875b520a6d009a12aec9d619  pippit-tool-cli-1.0.43-linux-arm64.tar.gz
-4569d389a20c75f0485ecc24ad5034308a818f294886dabdf07b2804e915f3a2  pippit-tool-cli-1.0.43-windows-amd64.zip
-078fb4fb09353a58095e1370668884664aad1760ae065983bb23abfdcd9939d1  pippit-tool-cli-1.0.43-windows-arm64.zip
+8bf338b7fc4bb3de289778896059f364f91743e7fe3127380e193f29bb10fecf  pippit-tool-cli-1.0.44-darwin-amd64.tar.gz
+fd7aac74fda167481b76e3a7aa2f30e45271670cad11f0e969080db1b135411a  pippit-tool-cli-1.0.44-darwin-arm64.tar.gz
+526e3641047d7e997fb5c271d795337692b0a47c092622747f6e2b4e9d22e473  pippit-tool-cli-1.0.44-linux-amd64.tar.gz
+6170436a3ec60dc2a2681e6f790c6a52d9daa4248ce8c3eede83136a62ccb4b6  pippit-tool-cli-1.0.44-linux-arm64.tar.gz
+d3c7166314bb52deae5e0caf383ac7e3cdde27c61325d6556de43f8f46aa9963  pippit-tool-cli-1.0.44-windows-amd64.zip
+9cb3d470688cd89a42a2267d9d181159dd624937c9590d3b744db25a66edbac9  pippit-tool-cli-1.0.44-windows-arm64.zip

package/internal/auth/auth_test.go

@@ -96,7 +96,7 @@ func (s *memoryCredentialStore) Delete(ctx context.Context) error {
 }
 
 func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)),
@@ -111,7 +111,7 @@ func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if loginURL.Scheme+"://"+loginURL.Host != config.DefaultBaseURL || loginURL.Path != loginPagePath {
+	if loginURL.Scheme+"://"+loginURL.Host != config.DefaultAuthBaseURL || loginURL.Path != loginPagePath {
 		t.Fatalf("login URL target = %s://%s%s", loginURL.Scheme, loginURL.Host, loginURL.Path)
 	}
 	query := loginURL.Query()
@@ -152,30 +152,30 @@ func TestBrowserFlowUsesDedicatedPageAndStrictBoundCallback(t *testing.T) {
 	}
 	wrongSecret := payload
 	wrongSecret.RandomSecretKey = "wrong-secret"
-	if status := sendCallback(t, callbackURL, config.DefaultBaseURL, wrongSecret); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL, config.DefaultAuthBaseURL, wrongSecret); status != http.StatusBadRequest {
 		t.Fatalf("wrong secret status = %d", status)
 	}
-	if status := postRawCallback(t, callbackURL, config.DefaultBaseURL, `{"type":"access_key","unknown":true}`); status != http.StatusBadRequest {
+	if status := postRawCallback(t, callbackURL, config.DefaultAuthBaseURL, `{"type":"access_key","unknown":true}`); status != http.StatusBadRequest {
 		t.Fatalf("unknown field status = %d", status)
 	}
-	if status := sendCallback(t, callbackURL+"&state=duplicate", config.DefaultBaseURL, payload); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL+"&state=duplicate", config.DefaultAuthBaseURL, payload); status != http.StatusBadRequest {
 		t.Fatalf("duplicate state status = %d", status)
 	}
-	if status := sendCallback(t, callbackURL+"&unexpected=value", config.DefaultBaseURL, payload); status != http.StatusBadRequest {
+	if status := sendCallback(t, callbackURL+"&unexpected=value", config.DefaultAuthBaseURL, payload); status != http.StatusBadRequest {
 		t.Fatalf("unexpected transport query status = %d", status)
 	}
-	if status := sendPreflight(t, callbackURL, config.DefaultBaseURL); status != http.StatusNoContent {
+	if status := sendPreflight(t, callbackURL, config.DefaultAuthBaseURL); status != http.StatusNoContent {
 		t.Fatalf("preflight status = %d", status)
 	}
 	securityRuntimeCallback := callbackURL + "&a_bogus=signed-request&msToken=transport-token"
-	if status := sendCallback(t, securityRuntimeCallback, config.DefaultBaseURL, payload); status != http.StatusOK {
+	if status := sendCallback(t, securityRuntimeCallback, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 		t.Fatalf("security-runtime callback status = %d", status)
 	}
 	got, err := flow.wait(context.Background())
 	if err != nil || got.AccessKey != payload.AccessKey || got.UID != payload.UID || got.TokenID != payload.TokenID {
 		t.Fatalf("callback payload = %#v, %v", credentialPayloadWithoutSecret(got), err)
 	}
-	if status := sendCallback(t, callbackURL, config.DefaultBaseURL, payload); status != http.StatusConflict {
+	if status := sendCallback(t, callbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusConflict {
 		t.Fatalf("replayed callback status = %d", status)
 	}
 }
@@ -185,6 +185,7 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 	store := &memoryCredentialStore{}
 	cfg := config.Load()
 	cfg.AccessKey = ""
+	cfg.BaseURL = "https://untrusted.invalid"
 	manager := NewManager(
 		cfg,
 		WithCredentialStore(store),
@@ -204,6 +205,9 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 			if parseErr != nil {
 				return parseErr
 			}
+			if loginURL.Scheme != "https" || loginURL.Host != "www.xiaoyunque.com" {
+				t.Errorf("login origin = %s://%s, want https://www.xiaoyunque.com", loginURL.Scheme, loginURL.Host)
+			}
 			if loginURL.Path != loginPagePath || loginURL.Query().Get("force") != "" {
 				return fmt.Errorf("unexpected login URL")
 			}
@@ -218,7 +222,7 @@ func TestManagerLoginStoresPageIssuedCredentialWithoutServerExchange(t *testing.
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, loginURL.Scheme+"://"+loginURL.Host, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return nil
@@ -273,7 +277,7 @@ func TestManagerWaitsForCallbackWhenBrowserOpenFails(t *testing.T) {
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return errors.New("browser opener unavailable")
@@ -347,7 +351,7 @@ func TestManagerReauthenticationPinsAccountAndRequiresRotation(t *testing.T) {
 }
 
 func TestBrowserFlowRequiresExpectedAccountForForceAndNeverUsesRawUID(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x22}, deviceIDBytes)), deviceIDBytes)
 	if _, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)),
@@ -378,7 +382,7 @@ func TestBrowserFlowRequiresExpectedAccountForForceAndNeverUsesRawUID(t *testing
 }
 
 func TestBrowserFlowSendsStoredTokenIDOnNormalLogin(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x23}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x44}, 2*randomBindingBytes)),
@@ -398,7 +402,7 @@ func TestBrowserFlowSendsStoredTokenIDOnNormalLogin(t *testing.T) {
 }
 
 func TestBrowserFlowAllowsLogoutIdentityTokenWithoutAccountBinding(t *testing.T) {
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x24}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(
 		authURL, bytes.NewReader(bytes.Repeat([]byte{0x45}, 2*randomBindingBytes)),
@@ -464,7 +468,7 @@ func TestManagerDerivesExpectedAccountFromDurableScope(t *testing.T) {
 				Source:          loginSource,
 				CallbackURL:     loginURL.Query().Get("callback"),
 			}
-			if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+			if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 				return fmt.Errorf("callback status %d", status)
 			}
 			return nil
@@ -488,7 +492,7 @@ func TestResolveStatusLogoutAndAuthOrigin(t *testing.T) {
 	cfg.AccessKey = " env-ak "
 	cfg.BaseURL = "https://untrusted.invalid"
 	manager := NewManager(cfg, WithCredentialStore(store), withClockForTest(func() time.Time { return fixedNow }))
-	if manager.authBaseURL.String() != config.DefaultBaseURL {
+	if manager.authBaseURL.String() != config.DefaultAuthBaseURL {
 		t.Fatalf("browser login followed runtime business base URL: %q", manager.authBaseURL)
 	}
 	if key, err := manager.ResolveAccessKey(context.Background()); err != nil || key != "env-ak" {
@@ -738,7 +742,7 @@ func callbackOpener(t *testing.T, expiry time.Time, uid, tokenID, accessKey stri
 			Source:          loginSource,
 			CallbackURL:     loginURL.Query().Get("callback"),
 		}
-		if status := sendCallback(t, payload.CallbackURL, config.DefaultBaseURL, payload); status != http.StatusOK {
+		if status := sendCallback(t, payload.CallbackURL, config.DefaultAuthBaseURL, payload); status != http.StatusOK {
 			return fmt.Errorf("callback status %d", status)
 		}
 		return nil

package/internal/auth/loopback_origins_test.go

@@ -16,7 +16,7 @@ import (
 
 func newOriginTestFlow(t *testing.T) (*browserFlow, accessKeyPayload) {
 	t.Helper()
-	authURL, _ := url.Parse(config.DefaultBaseURL)
+	authURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	deviceID, _ := randomEncoded(bytes.NewReader(bytes.Repeat([]byte{0x21}, deviceIDBytes)), deviceIDBytes)
 	flow, err := startBrowserFlow(authURL, bytes.NewReader(bytes.Repeat([]byte{0x42}, 2*randomBindingBytes)), deviceID, "", "", false)
 	if err != nil {

package/internal/auth/manager.go

@@ -46,7 +46,7 @@ func WithCredentialStore(store CredentialStore) ManagerOption {
 // API configuration does not affect the browser identity origin.
 func NewManager(cfg *config.Config, options ...ManagerOption) *Manager {
 	serviceName := config.DefaultAuthStoreServiceName
-	authBaseURL, _ := url.Parse(config.DefaultBaseURL)
+	authBaseURL, _ := url.Parse(config.DefaultAuthBaseURL)
 	manager := &Manager{
 		localCredentialsEnabled: true,
 		cfg:                     cfg,

package/internal/config/config.go

@@ -13,6 +13,7 @@ import (
 
 const (
 	DefaultBaseURL               = "https://xyq.jianying.com"
+	DefaultAuthBaseURL           = "https://www.xiaoyunque.com"
 	DefaultHTTPTimeout           = 30 * time.Minute
 	DefaultAuthTTL               = 30 * time.Second
 	DefaultAuthStoreServiceName  = "pippit-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pippit-dev/cli",
-  "version": "1.0.43",
+  "version": "1.0.44",
   "description": "Pippit CLI",
   "bin": {
     "pippit-tool-cli": "scripts/run.js"