@qlever-llc/trellis 0.8.4 → 0.9.0-rc.10

package/src/_dnt.polyfills.ts

@@ -0,0 +1,274 @@
+declare global {
+  interface Error {
+    cause?: unknown;
+  }
+}
+
+export {};
+// https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
+if (!Object.hasOwn) {
+  Object.defineProperty(Object, "hasOwn", {
+    value: function (object: any, property: any) {
+      if (object == null) {
+        throw new TypeError("Cannot convert undefined or null to object");
+      }
+      return Object.prototype.hasOwnProperty.call(Object(object), property);
+    },
+    configurable: true,
+    enumerable: false,
+    writable: true,
+  });
+}
+
+declare global {
+  interface Object {
+    /**
+     * Determines whether an object has a property with the specified name.
+     * @param o An object.
+     * @param v A property name.
+     */
+    hasOwn(o: object, v: PropertyKey): boolean;
+  }
+}
+
+export {};
+/**
+ * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
+ * but instead of using npm to install additional dependencies,
+ * this approach manually consolidates cjs/mjs/d.ts into a single file.
+ *
+ * Note that this code might be imported multiple times
+ * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
+ *  or Node.js might dynamically clear the cache and then force a require).
+ * Therefore, it's important to avoid redundant writes to global objects.
+ * Additionally, consider that commonjs is used alongside esm,
+ * so the two ponyfill functions are stored independently in two separate global objects.
+ */
+//@ts-ignore
+import { createRequire } from "node:module";
+//@ts-ignore
+import { fileURLToPath, pathToFileURL, type URL } from "node:url";
+//@ts-ignore
+import { dirname } from "node:path";
+declare global {
+  interface ImportMeta {
+    /** A string representation of the fully qualified module URL. When the
+     * module is loaded locally, the value will be a file URL (e.g.
+     * `file:///path/module.ts`).
+     *
+     * You can also parse the string as a URL to determine more information about
+     * how the current module was loaded. For example to determine if a module was
+     * local or not:
+     *
+     * ```ts
+     * const url = new URL(import.meta.url);
+     * if (url.protocol === "file:") {
+     *   console.log("this module was loaded locally");
+     * }
+     * ```
+     */
+    url: string;
+    /**
+     * A function that returns resolved specifier as if it would be imported
+     * using `import(specifier)`.
+     *
+     * ```ts
+     * console.log(import.meta.resolve("./foo.js"));
+     * // file:///dev/foo.js
+     * ```
+     *
+     * @param specifier The module specifier to resolve relative to `parent`.
+     * @param parent The absolute parent module URL to resolve from.
+     * @returns The absolute (`file:`) URL string for the resolved module.
+     */
+    resolve(specifier: string, parent?: string | URL | undefined): string;
+    /** A flag that indicates if the current module is the main module that was
+     * called when starting the program under Deno.
+     *
+     * ```ts
+     * if (import.meta.main) {
+     *   // this was loaded as the main module, maybe do some bootstrapping
+     * }
+     * ```
+     */
+    main: boolean;
+
+    /** The absolute path of the current module.
+     *
+     * This property is only provided for local modules (ie. using `file://` URLs).
+     *
+     * Example:
+     * ```
+     * // Unix
+     * console.log(import.meta.filename); // /home/alice/my_module.ts
+     *
+     * // Windows
+     * console.log(import.meta.filename); // C:\alice\my_module.ts
+     * ```
+     */
+    filename: string;
+
+    /** The absolute path of the directory containing the current module.
+     *
+     * This property is only provided for local modules (ie. using `file://` URLs).
+     *
+     * * Example:
+     * ```
+     * // Unix
+     * console.log(import.meta.dirname); // /home/alice
+     *
+     * // Windows
+     * console.log(import.meta.dirname); // C:\alice
+     * ```
+     */
+    dirname: string;
+  }
+}
+
+type NodeRequest = ReturnType<typeof createRequire>;
+type NodeModule = NonNullable<NodeRequest["main"]>;
+interface ImportMetaPonyfillCommonjs {
+  (require: NodeRequest, module: NodeModule): ImportMeta;
+}
+interface ImportMetaPonyfillEsmodule {
+  (importMeta: ImportMeta): ImportMeta;
+}
+interface ImportMetaPonyfill
+  extends ImportMetaPonyfillCommonjs, ImportMetaPonyfillEsmodule {
+}
+
+const defineGlobalPonyfill = (symbolFor: string, fn: Function) => {
+  if (!Reflect.has(globalThis, Symbol.for(symbolFor))) {
+    Object.defineProperty(
+      globalThis,
+      Symbol.for(symbolFor),
+      {
+        configurable: true,
+        get() {
+          return fn;
+        },
+      },
+    );
+  }
+};
+
+export let import_meta_ponyfill_commonjs = (
+  Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-commonjs")) ??
+    (() => {
+      const moduleImportMetaWM = new WeakMap<NodeModule, ImportMeta>();
+      return (require, module) => {
+        let importMetaCache = moduleImportMetaWM.get(module);
+        if (importMetaCache == null) {
+          const importMeta = Object.assign(Object.create(null), {
+            url: pathToFileURL(module.filename).href,
+            main: require.main == module,
+            resolve: (specifier: string, parentURL = importMeta.url) => {
+              return pathToFileURL(
+                (importMeta.url === parentURL
+                  ? require
+                  : createRequire(parentURL))
+                  .resolve(specifier),
+              ).href;
+            },
+            filename: module.filename,
+            dirname: module.path,
+          });
+          moduleImportMetaWM.set(module, importMeta);
+          importMetaCache = importMeta;
+        }
+        return importMetaCache;
+      };
+    })()
+) as ImportMetaPonyfillCommonjs;
+defineGlobalPonyfill(
+  "import-meta-ponyfill-commonjs",
+  import_meta_ponyfill_commonjs,
+);
+
+export let import_meta_ponyfill_esmodule = (
+  Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-esmodule")) ??
+    ((importMeta: ImportMeta) => {
+      const resolveFunStr = String(importMeta.resolve);
+      const shimWs = new WeakSet();
+      //@ts-ignore
+      const mainUrl = ("file:///" + process.argv[1].replace(/\\/g, "/"))
+        .replace(
+          /\/{3,}/,
+          "///",
+        );
+      const commonShim = (importMeta: ImportMeta) => {
+        if (typeof importMeta.main !== "boolean") {
+          importMeta.main = importMeta.url === mainUrl;
+        }
+        if (typeof importMeta.filename !== "string") {
+          importMeta.filename = fileURLToPath(importMeta.url);
+          importMeta.dirname = dirname(importMeta.filename);
+        }
+      };
+      if (
+        // v16.2.0+, v14.18.0+: Add support for WHATWG URL object to parentURL parameter.
+        resolveFunStr === "undefined" ||
+        // v20.0.0+, v18.19.0+"" This API now returns a string synchronously instead of a Promise.
+        resolveFunStr.startsWith("async")
+        // enable by --experimental-import-meta-resolve flag
+      ) {
+        import_meta_ponyfill_esmodule = (importMeta: ImportMeta) => {
+          if (!shimWs.has(importMeta)) {
+            shimWs.add(importMeta);
+            const importMetaUrlRequire = {
+              url: importMeta.url,
+              require: createRequire(importMeta.url),
+            };
+            importMeta.resolve = function resolve(
+              specifier: string,
+              parentURL = importMeta.url,
+            ) {
+              return pathToFileURL(
+                (importMetaUrlRequire.url === parentURL
+                  ? importMetaUrlRequire.require
+                  : createRequire(parentURL)).resolve(specifier),
+              ).href;
+            };
+            commonShim(importMeta);
+          }
+          return importMeta;
+        };
+      } else {
+        /// native support
+        import_meta_ponyfill_esmodule = (importMeta: ImportMeta) => {
+          if (!shimWs.has(importMeta)) {
+            shimWs.add(importMeta);
+            commonShim(importMeta);
+          }
+          return importMeta;
+        };
+      }
+      return import_meta_ponyfill_esmodule(importMeta);
+    })
+) as ImportMetaPonyfillEsmodule;
+defineGlobalPonyfill(
+  "import-meta-ponyfill-esmodule",
+  import_meta_ponyfill_esmodule,
+);
+
+export let import_meta_ponyfill = (
+  (...args: any[]) => {
+    const _MODULE = (() => {
+      if (typeof require === "function" && typeof module === "object") {
+        return "commonjs";
+      } else {
+        // eval("typeof import.meta");
+        return "esmodule";
+      }
+    })();
+    if (_MODULE === "commonjs") {
+      //@ts-ignore
+      import_meta_ponyfill = (r, m) => import_meta_ponyfill_commonjs(r, m);
+    } else {
+      //@ts-ignore
+      import_meta_ponyfill = (im) => import_meta_ponyfill_esmodule(im);
+    }
+    //@ts-ignore
+    return import_meta_ponyfill(...args);
+  }
+) as ImportMetaPonyfill;

package/src/_dnt.shims.ts

@@ -0,0 +1,64 @@
+import { Deno } from "@deno/shim-deno";
+export { Deno } from "@deno/shim-deno";
+
+const dntGlobals = {
+  Deno,
+};
+export const dntGlobalThis = createMergeProxy(globalThis, dntGlobals);
+
+function createMergeProxy<T extends object, U extends object>(
+  baseObj: T,
+  extObj: U,
+): Omit<T, keyof U> & U {
+  return new Proxy(baseObj, {
+    get(_target, prop, _receiver) {
+      if (prop in extObj) {
+        return (extObj as any)[prop];
+      } else {
+        return (baseObj as any)[prop];
+      }
+    },
+    set(_target, prop, value) {
+      if (prop in extObj) {
+        delete (extObj as any)[prop];
+      }
+      (baseObj as any)[prop] = value;
+      return true;
+    },
+    deleteProperty(_target, prop) {
+      let success = false;
+      if (prop in extObj) {
+        delete (extObj as any)[prop];
+        success = true;
+      }
+      if (prop in baseObj) {
+        delete (baseObj as any)[prop];
+        success = true;
+      }
+      return success;
+    },
+    ownKeys(_target) {
+      const baseKeys = Reflect.ownKeys(baseObj);
+      const extKeys = Reflect.ownKeys(extObj);
+      const extKeysSet = new Set(extKeys);
+      return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];
+    },
+    defineProperty(_target, prop, desc) {
+      if (prop in extObj) {
+        delete (extObj as any)[prop];
+      }
+      Reflect.defineProperty(baseObj, prop, desc);
+      return true;
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+      if (prop in extObj) {
+        return Reflect.getOwnPropertyDescriptor(extObj, prop);
+      } else {
+        return Reflect.getOwnPropertyDescriptor(baseObj, prop);
+      }
+    },
+    has(_target, prop) {
+      return prop in extObj || prop in baseObj;
+    },
+  }) as any;
+}

package/src/auth/browser/login.ts

@@ -0,0 +1,295 @@
+import { Value } from "typebox/value";
+import {
+  digestContractManifest,
+  type TrellisContractV1,
+} from "../../contract_support/mod.js";
+import {
+  type AuthStartRequest,
+  AuthStartRequestSchema,
+  type AuthStartResponse,
+  AuthStartResponseSchema,
+  type BindResponse,
+  BindResponseSchema,
+  type BindSuccessResponse,
+  type SentinelCreds,
+} from "../schemas.js";
+import type { SessionKeyHandle } from "./session.js";
+import { bindFlowSig, getPublicSessionKey, oauthInitSig } from "./session.js";
+
+export type {
+  AuthStartFlowResponse,
+  AuthStartRequest,
+  AuthStartResponse,
+  BindResponse,
+  BindSuccessResponse,
+  ContractApproval,
+  SentinelCreds,
+} from "../schemas.js";
+
+export type AuthConfig = {
+  authUrl: string;
+};
+
+type BuildLoginUrlArgs = {
+  config: AuthConfig;
+  provider?: string;
+  redirectTo: string;
+  handle: SessionKeyHandle;
+  contract: Record<string, unknown>;
+  context?: unknown;
+};
+
+type BuildLoginUrlFlatArgs = {
+  authUrl: string;
+  provider?: string;
+  redirectTo: string;
+  handle: SessionKeyHandle;
+  contract: Record<string, unknown>;
+  context?: unknown;
+};
+
+function contextRecord(value: unknown): Record<string, unknown> | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return undefined;
+  }
+  return value as Record<string, unknown>;
+}
+
+export async function buildLoginUrl(
+  config: AuthConfig,
+  provider: string | undefined,
+  redirectTo: string,
+  handle: SessionKeyHandle,
+  contract: Record<string, unknown>,
+  context?: unknown,
+): Promise<string>;
+export async function buildLoginUrl(
+  args: {
+    authUrl: string;
+    provider?: string;
+    redirectTo: string;
+    handle: SessionKeyHandle;
+    contract: Record<string, unknown>;
+    context?: unknown;
+  },
+): Promise<string>;
+export async function buildLoginUrl(
+  args: {
+    config: AuthConfig;
+    provider?: string;
+    redirectTo: string;
+    handle: SessionKeyHandle;
+    contract: Record<string, unknown>;
+    context?: unknown;
+  },
+): Promise<string>;
+export async function buildLoginUrl(
+  argsOrConfig: BuildLoginUrlArgs | BuildLoginUrlFlatArgs | AuthConfig,
+  provider?: string,
+  redirectTo?: string,
+  handle?: SessionKeyHandle,
+  contract?: Record<string, unknown>,
+  context?: unknown,
+): Promise<string> {
+  const resolved = isNestedBuildLoginUrlArgs(argsOrConfig)
+    ? argsOrConfig
+    : isFlatBuildLoginUrlArgs(argsOrConfig)
+    ? {
+      config: { authUrl: argsOrConfig.authUrl },
+      provider: argsOrConfig.provider,
+      redirectTo: argsOrConfig.redirectTo,
+      handle: argsOrConfig.handle,
+      contract: argsOrConfig.contract,
+      context: argsOrConfig.context,
+    }
+    : buildLoginUrlArgsFromPositional(
+      argsOrConfig,
+      provider,
+      redirectTo,
+      handle,
+      contract,
+      context,
+    );
+  const response = await startAuthRequest({
+    authUrl: resolved.config.authUrl,
+    provider: resolved.provider,
+    redirectTo: resolved.redirectTo,
+    handle: resolved.handle,
+    contract: resolved.contract,
+    context: resolved.context,
+  });
+  if (response.status !== "flow_started") {
+    throw new Error("Auth request completed without starting a browser flow");
+  }
+  return response.loginUrl;
+}
+
+export async function startAuthRequest(args: {
+  authUrl: string;
+  provider?: string;
+  redirectTo: string;
+  handle: SessionKeyHandle;
+  contract: Record<string, unknown>;
+  context?: unknown;
+}): Promise<AuthStartResponse> {
+  const context = contextRecord(args.context);
+  const contractDigest = isTrellisContractV1(args.contract)
+    ? digestContractManifest(args.contract)
+    : undefined;
+  const sig = await oauthInitSig(
+    args.handle,
+    args.redirectTo,
+    context,
+    args.provider,
+    contractDigest ?? args.contract,
+  );
+  const request = Value.Parse(AuthStartRequestSchema, {
+    redirectTo: args.redirectTo,
+    sessionKey: getPublicSessionKey(args.handle),
+    sig,
+    ...(contractDigest ? { contractDigest } : { contract: args.contract }),
+    ...(args.provider ? { provider: args.provider } : {}),
+    ...(context ? { context } : {}),
+  }) as AuthStartRequest;
+
+  let response = await fetch(`${args.authUrl}/auth/requests`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(request),
+  });
+  if (await authStartNeedsManifest(response)) {
+    const fullSig = await oauthInitSig(
+      args.handle,
+      args.redirectTo,
+      context,
+      args.provider,
+      args.contract,
+    );
+    response = await fetch(`${args.authUrl}/auth/requests`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...request,
+        sig: fullSig,
+        contract: args.contract,
+      }),
+    });
+  }
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Auth request failed: ${response.status} ${text}`);
+  }
+
+  return Value.Parse(
+    AuthStartResponseSchema,
+    await response.json(),
+  ) as AuthStartResponse;
+}
+
+async function authStartNeedsManifest(response: Response): Promise<boolean> {
+  if (response.ok || response.status !== 409) return false;
+  const clone = response.clone();
+  let payload: unknown;
+  try {
+    payload = await clone.json();
+  } catch {
+    payload = undefined;
+  }
+  if (payload && typeof payload === "object") {
+    const record = payload as {
+      reason?: unknown;
+      code?: unknown;
+      error?: unknown;
+      message?: unknown;
+    };
+    return record.reason === "manifest_required" ||
+      record.code === "manifest_required" ||
+      record.error === "manifest_required" ||
+      record.message === "manifest_required";
+  }
+  return (await response.clone().text()).includes("manifest_required");
+}
+
+function buildLoginUrlArgsFromPositional(
+  config: AuthConfig,
+  provider: string | undefined,
+  redirectTo: string | undefined,
+  handle: SessionKeyHandle | undefined,
+  contract: Record<string, unknown> | undefined,
+  context: unknown,
+): BuildLoginUrlArgs {
+  if (
+    redirectTo === undefined || handle === undefined || contract === undefined
+  ) {
+    throw new TypeError(
+      "buildLoginUrl requires redirectTo, handle, and contract",
+    );
+  }
+  return {
+    config,
+    provider,
+    redirectTo,
+    handle,
+    contract,
+    context,
+  };
+}
+
+function isTrellisContractV1(
+  contract: Record<string, unknown>,
+): contract is TrellisContractV1 {
+  return contract.format === "trellis.contract.v1" &&
+    typeof contract.id === "string" &&
+    typeof contract.displayName === "string" &&
+    typeof contract.description === "string" &&
+    typeof contract.kind === "string";
+}
+
+function isNestedBuildLoginUrlArgs(
+  value: BuildLoginUrlArgs | BuildLoginUrlFlatArgs | AuthConfig,
+): value is BuildLoginUrlArgs {
+  return "config" in value;
+}
+
+function isFlatBuildLoginUrlArgs(
+  value: BuildLoginUrlArgs | BuildLoginUrlFlatArgs | AuthConfig,
+): value is BuildLoginUrlFlatArgs {
+  return "authUrl" in value && "redirectTo" in value && "handle" in value &&
+    "contract" in value;
+}
+
+export function isBindSuccessResponse(
+  response: BindResponse,
+): response is BindSuccessResponse {
+  return response.status === "bound";
+}
+
+export async function bindFlow(
+  config: AuthConfig,
+  handle: SessionKeyHandle,
+  flowId: string,
+): Promise<BindResponse> {
+  const sessionKey = getPublicSessionKey(handle);
+  const sig = await bindFlowSig(handle, flowId);
+
+  const response = await fetch(
+    `${config.authUrl}/auth/flow/${encodeURIComponent(flowId)}/bind`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ sessionKey, sig }),
+    },
+  );
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Bind failed: ${response.status} ${text}`);
+  }
+
+  const payload = await response.json();
+  if (payload && typeof payload === "object" && payload.status === "expired") {
+    throw new Error("Bind failed: expired");
+  }
+
+  return Value.Parse(BindResponseSchema, payload) as BindResponse;
+}

package/src/auth/browser/portal.ts

@@ -0,0 +1,75 @@
+import { type PortalFlowState, PortalFlowStateSchema } from "../protocol.js";
+import type { ApprovalDecision } from "../schemas.js";
+import type { AuthConfig } from "./login.js";
+import { Value } from "typebox/value";
+
+export type { PortalFlowState } from "../protocol.js";
+export type { ApprovalDecision } from "../schemas.js";
+
+function authBaseUrl(config: AuthConfig): string {
+  return config.authUrl.replace(/\/$/, "");
+}
+
+export function portalFlowIdFromUrl(url: URL): string | null {
+  return url.searchParams.get("flowId");
+}
+
+export async function fetchPortalFlowState(
+  config: AuthConfig,
+  flowId: string,
+): Promise<PortalFlowState> {
+  const response = await fetch(
+    `${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}`,
+  );
+  if (!response.ok) {
+    throw new Error(`Failed to load portal flow (${response.status})`);
+  }
+
+  return Value.Parse(
+    PortalFlowStateSchema,
+    await response.json(),
+  ) as PortalFlowState;
+}
+
+export function portalProviderLoginUrl(
+  config: AuthConfig,
+  providerId: string,
+  flowId: string,
+): string {
+  const base = `${authBaseUrl(config)}/auth/login/${
+    encodeURIComponent(providerId)
+  }`;
+  return `${base}?flowId=${encodeURIComponent(flowId)}`;
+}
+
+export async function submitPortalApproval(
+  config: AuthConfig,
+  flowId: string,
+  decision: ApprovalDecision,
+): Promise<PortalFlowState> {
+  const response = await fetch(
+    `${authBaseUrl(config)}/auth/flow/${encodeURIComponent(flowId)}/approval`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ approved: decision === "approved" }),
+    },
+  );
+
+  if (!response.ok) {
+    throw new Error(`Approval request failed (${response.status})`);
+  }
+
+  return Value.Parse(
+    PortalFlowStateSchema,
+    await response.json(),
+  ) as PortalFlowState;
+}
+
+export function portalRedirectLocation(
+  state: PortalFlowState | null,
+): string | null {
+  if (state?.status === "redirect") return state.location;
+  if (state?.status === "approval_denied") return state.returnLocation ?? null;
+  return null;
+}