@qodalis/cli-server-node 1.0.0-beta.1 → 1.0.0-beta.10

package/dist/src/abstractions/cli-process-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-process-command.js","sourceRoot":"","sources":["../../../src/abstractions/cli-process-command.ts"],"names":[],"mappings":""}

package/dist/src/abstractions/index.d.ts

@@ -0,0 +1,2 @@
+export { ICliCommandAuthor, CliCommandAuthor, DefaultLibraryAuthor, CliProcessCommand, splitShellWords, joinShellWords, getPositionals, getPositionalText, quoteShellWord, ICliCommandParameterDescriptor, CliCommandParameterDescriptor, ICliCommandProcessor, CliCommandProcessor, ICliModule, CliModule, ICliJob, ICliJobExecutionContext, ICliJobLogger, CliJobOptions, JobOverlapPolicy, ICliJobStorageProvider, JobExecution, JobExecutionStatus, JobState, JobStatus, JobLogEntry, JobLogLevel, CliStructuredOutput, CliStructuredResponse, IDataExplorerProvider, DataExplorerProviderOptions, DataExplorerLanguage, DataExplorerOutputFormat, DataExplorerTemplate, DataExplorerParameterDescriptor, DataExplorerExecutionContext, DataExplorerResult, DataExplorerExecuteRequest, DataExplorerSourceInfo, ICliProcessorFilter, ICliStreamCommandProcessor, isStreamCapable, } from '@qodalis/cli-server-abstractions';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/abstractions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/abstractions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,8BAA8B,EAC9B,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,OAAO,EACP,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,+BAA+B,EAC/B,4BAA4B,EAC5B,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,GAClB,MAAM,kCAAkC,CAAC"}

package/dist/src/abstractions/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isStreamCapable = exports.DataExplorerOutputFormat = exports.DataExplorerLanguage = exports.CliModule = exports.CliCommandProcessor = exports.CliCommandParameterDescriptor = exports.quoteShellWord = exports.getPositionalText = exports.getPositionals = exports.joinShellWords = exports.splitShellWords = exports.DefaultLibraryAuthor = exports.CliCommandAuthor = void 0;
+var cli_server_abstractions_1 = require("@qodalis/cli-server-abstractions");
+Object.defineProperty(exports, "CliCommandAuthor", { enumerable: true, get: function () { return cli_server_abstractions_1.CliCommandAuthor; } });
+Object.defineProperty(exports, "DefaultLibraryAuthor", { enumerable: true, get: function () { return cli_server_abstractions_1.DefaultLibraryAuthor; } });
+Object.defineProperty(exports, "splitShellWords", { enumerable: true, get: function () { return cli_server_abstractions_1.splitShellWords; } });
+Object.defineProperty(exports, "joinShellWords", { enumerable: true, get: function () { return cli_server_abstractions_1.joinShellWords; } });
+Object.defineProperty(exports, "getPositionals", { enumerable: true, get: function () { return cli_server_abstractions_1.getPositionals; } });
+Object.defineProperty(exports, "getPositionalText", { enumerable: true, get: function () { return cli_server_abstractions_1.getPositionalText; } });
+Object.defineProperty(exports, "quoteShellWord", { enumerable: true, get: function () { return cli_server_abstractions_1.quoteShellWord; } });
+Object.defineProperty(exports, "CliCommandParameterDescriptor", { enumerable: true, get: function () { return cli_server_abstractions_1.CliCommandParameterDescriptor; } });
+Object.defineProperty(exports, "CliCommandProcessor", { enumerable: true, get: function () { return cli_server_abstractions_1.CliCommandProcessor; } });
+Object.defineProperty(exports, "CliModule", { enumerable: true, get: function () { return cli_server_abstractions_1.CliModule; } });
+Object.defineProperty(exports, "DataExplorerLanguage", { enumerable: true, get: function () { return cli_server_abstractions_1.DataExplorerLanguage; } });
+Object.defineProperty(exports, "DataExplorerOutputFormat", { enumerable: true, get: function () { return cli_server_abstractions_1.DataExplorerOutputFormat; } });
+Object.defineProperty(exports, "isStreamCapable", { enumerable: true, get: function () { return cli_server_abstractions_1.isStreamCapable; } });
+//# sourceMappingURL=index.js.map

package/dist/src/abstractions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/abstractions/index.ts"],"names":[],"mappings":";;;AAAA,4EA2C0C;AAzCtC,2HAAA,gBAAgB,OAAA;AAChB,+HAAA,oBAAoB,OAAA;AAEpB,0HAAA,eAAe,OAAA;AACf,yHAAA,cAAc,OAAA;AACd,yHAAA,cAAc,OAAA;AACd,4HAAA,iBAAiB,OAAA;AACjB,yHAAA,cAAc,OAAA;AAEd,wIAAA,6BAA6B,OAAA;AAE7B,8HAAA,mBAAmB,OAAA;AAEnB,oHAAA,SAAS,OAAA;AAiBT,+HAAA,oBAAoB,OAAA;AACpB,mIAAA,wBAAwB,OAAA;AASxB,0HAAA,eAAe,OAAA"}

package/dist/src/auth/cli-server-auth-gate.d.ts

@@ -0,0 +1,33 @@
+import { RequestHandler } from 'express';
+import { ICliCommandRegistry } from '../services/cli-command-registry';
+import { CliServerAuthContext, ICliServerAuth } from './cli-server-auth';
+declare global {
+    namespace Express {
+        interface Request {
+            /** Set by the server auth gate when the users plugin protects the server. */
+            qcliServerAuth?: CliServerAuthContext;
+        }
+    }
+}
+/** Normalizes a request path for classification: lower-case, single slashes, no trailing slash. */
+export declare function normalizePath(path: string): string;
+export interface ServerAuthGateOptions {
+    registry: ICliCommandRegistry;
+    /** Prefixes serving the CLI controller (`/api/v1/qcli`, custom basePath). */
+    cliPrefixes: string[];
+    /** Extra public routes as `"METHOD /path"` (e.g. a plugin's own login). */
+    publicRoutes: Set<string>;
+    /** MCP endpoint paths (normalized), requiring `commands:execute`. */
+    mcpPaths?: string[];
+}
+/** Collects `requiredPermissions` along the resolved processor chain. */
+export declare function processorPermissions(registry: ICliCommandRegistry, command: unknown, chain: unknown): string[];
+/** Permissions required for a (protected) server route. */
+export declare function requiredServerPermissions(method: string, path: string, body: any, options: ServerAuthGateOptions): string[];
+/**
+ * Express middleware protecting every `/api/...` route of the CLI server when
+ * an auth provider with `protectServer` is installed. Without a provider it is
+ * a no-op, so servers without the users plugin behave as before.
+ */
+export declare function createServerAuthGate(getAuth: () => ICliServerAuth | undefined, options: ServerAuthGateOptions): RequestHandler;
+//# sourceMappingURL=cli-server-auth-gate.d.ts.map

package/dist/src/auth/cli-server-auth-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth-gate.d.ts","sourceRoot":"","sources":["../../../src/auth/cli-server-auth-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAA6B,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKpG,OAAO,CAAC,MAAM,CAAC;IACX,UAAU,OAAO,CAAC;QACd,UAAU,OAAO;YACb,6EAA6E;YAC7E,cAAc,CAAC,EAAE,oBAAoB,CAAC;SACzC;KACJ;CACJ;AAED,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGlD;AAgBD,MAAM,WAAW,qBAAqB;IAClC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,GACf,MAAM,EAAE,CAkBV;AAED,2DAA2D;AAC3D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAoB3H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,MAAM,cAAc,GAAG,SAAS,EACzC,OAAO,EAAE,qBAAqB,GAC/B,cAAc,CAkDhB"}

package/dist/src/auth/cli-server-auth-gate.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizePath = normalizePath;
+exports.processorPermissions = processorPermissions;
+exports.requiredServerPermissions = requiredServerPermissions;
+exports.createServerAuthGate = createServerAuthGate;
+const cli_server_auth_1 = require("./cli-server-auth");
+const logger_1 = require("../utils/logger");
+const logger = (0, logger_1.createLogger)('ServerAuth');
+/** Normalizes a request path for classification: lower-case, single slashes, no trailing slash. */
+function normalizePath(path) {
+    const p = path.toLowerCase().replace(/\/{2,}/g, '/').replace(/\/+$/, '');
+    return p || '/';
+}
+const PUBLIC_GET = new Set([
+    '/api/qcli/versions',
+    '/api/qcli/version',
+    '/api/qcli/capabilities',
+    '/api/cli/versions',
+    '/api/v1/qcli/version',
+    '/api/v1/qcli/capabilities',
+    '/health',
+    '/healthz',
+    '/api/health',
+]);
+const FS_READ = new Set(['ls', 'cat', 'stat', 'download']);
+/** Collects `requiredPermissions` along the resolved processor chain. */
+function processorPermissions(registry, command, chain) {
+    if (typeof command !== 'string')
+        return [];
+    const root = registry.processors.find((p) => p.command.toLowerCase() === command.toLowerCase());
+    if (!root)
+        return [];
+    const out = [...(root.requiredPermissions ?? [])];
+    let current = root;
+    if (Array.isArray(chain)) {
+        for (const sub of chain) {
+            if (typeof sub !== 'string')
+                break;
+            const child = current.processors?.find((p) => p.command.toLowerCase() === sub.toLowerCase());
+            if (!child)
+                break;
+            out.push(...(child.requiredPermissions ?? []));
+            current = child;
+        }
+    }
+    return out;
+}
+/** Permissions required for a (protected) server route. */
+function requiredServerPermissions(method, path, body, options) {
+    for (const prefix of options.cliPrefixes) {
+        if (path === `${prefix}/execute` || path === `${prefix}/execute/stream`) {
+            return [cli_server_auth_1.CliServerPermissions.CommandsExecute, ...processorPermissions(options.registry, body?.command, body?.chainCommands)];
+        }
+    }
+    if (options.mcpPaths?.includes(path)) {
+        return [cli_server_auth_1.CliServerPermissions.CommandsExecute];
+    }
+    if (path === '/api/qcli/fs' || path.startsWith('/api/qcli/fs/')) {
+        const op = path.slice('/api/qcli/fs/'.length);
+        return [method === 'GET' && FS_READ.has(op) ? cli_server_auth_1.CliServerPermissions.FilesRead : cli_server_auth_1.CliServerPermissions.FilesWrite];
+    }
+    if (path === '/api/qcli/data-explorer' || path.startsWith('/api/qcli/data-explorer/')) {
+        return [cli_server_auth_1.CliServerPermissions.DataQuery];
+    }
+    if (path === '/api/v1/qcli/jobs' || path.startsWith('/api/v1/qcli/jobs/')) {
+        return [method === 'GET' ? cli_server_auth_1.CliServerPermissions.JobsRead : cli_server_auth_1.CliServerPermissions.JobsManage];
+    }
+    return [];
+}
+/**
+ * Express middleware protecting every `/api/...` route of the CLI server when
+ * an auth provider with `protectServer` is installed. Without a provider it is
+ * a no-op, so servers without the users plugin behave as before.
+ */
+function createServerAuthGate(getAuth, options) {
+    return (req, res, next) => {
+        const auth = getAuth();
+        if (!auth || !auth.protectServer) {
+            next();
+            return;
+        }
+        const method = req.method.toUpperCase();
+        if (method === 'OPTIONS') {
+            next();
+            return;
+        }
+        const path = normalizePath(req.path);
+        if (!path.startsWith('/api/') && path !== '/api') {
+            next();
+            return;
+        }
+        if ((method === 'GET' || method === 'HEAD') && PUBLIC_GET.has(path)) {
+            next();
+            return;
+        }
+        if (options.publicRoutes.has(`${method} ${path}`) || auth.handlesPath(path, method)) {
+            next();
+            return;
+        }
+        auth.authenticateRequest(req).then((ctx) => {
+            const missing = requiredServerPermissions(method, path, req.body, options).filter((p) => !auth.hasPermission(ctx, p));
+            if (missing.length > 0) {
+                res.status(403).json({ error: `forbidden: missing permission ${missing.join(', ')}` });
+                return;
+            }
+            req.qcliServerAuth = ctx;
+            next();
+        }, (err) => {
+            if (typeof err?.status !== 'number') {
+                // not an auth error (e.g. a store failure): never expose its message
+                logger.error('authentication failed unexpectedly:', err);
+                res.status(500).json({ error: 'internal server error' });
+                return;
+            }
+            const status = err.status;
+            res.status(status).json({ error: status === 401 ? err.message || 'unauthorized' : err.message || 'forbidden' });
+        });
+    };
+}
+//# sourceMappingURL=cli-server-auth-gate.js.map

package/dist/src/auth/cli-server-auth-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth-gate.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth-gate.ts"],"names":[],"mappings":";;AAkBA,sCAGC;AA2BD,oDAsBC;AAGD,8DAoBC;AAOD,oDAqDC;AAtJD,uDAAoG;AACpG,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;AAW1C,mGAAmG;AACnG,SAAgB,aAAa,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,aAAa;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAY3D,yEAAyE;AACzE,SAAgB,oBAAoB,CAChC,QAA6B,EAC7B,OAAgB,EAChB,KAAc;IAEd,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM;YACnC,MAAM,KAAK,GAAqC,OAAO,CAAC,UAAU,EAAE,IAAI,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CACvD,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,KAAK,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,SAAgB,yBAAyB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAS,EAAE,OAA8B;IAC7G,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU,IAAI,IAAI,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACtE,OAAO,CAAC,sCAAC,CAAC,eAAe,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,sCAAC,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sCAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAChC,OAAyC,EACzC,OAA8B;IAE9B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9B,CAAC,GAAG,EAAE,EAAE;YACJ,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAC7E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CACrC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,OAAO;YACX,CAAC;YACD,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;YACzB,IAAI,EAAE,CAAC;QACX,CAAC,EACD,CAAC,GAA0C,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,qEAAqE;gBACrE,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;QACpH,CAAC,CACJ,CAAC;IACN,CAAC,CAAC;AACN,CAAC"}

package/dist/src/auth/cli-server-auth.d.ts

@@ -0,0 +1,149 @@
+import type { IncomingMessage } from 'http';
+import type { Request } from 'express';
+/** Identity of an authenticated caller (HTTP request or WebSocket). */
+export interface CliServerAuthContext {
+    userId: string;
+    userName: string;
+    /** Absent for host-authenticated (adapter) callers. */
+    sessionId?: string;
+    /** Set when the caller authenticated with an API token (no session). */
+    tokenId?: string;
+    /** Effective permissions (`resource:action`, `*` wildcards). */
+    permissions: string[];
+}
+/** Error thrown by {@link ICliServerAuth.authenticateRequest}; rendered as `{ error }`. */
+export interface CliServerAuthError extends Error {
+    status?: number;
+}
+/**
+ * Authentication provider that protects the whole CLI server (routes and
+ * sockets). Implemented by the users plugin (`usersPlugin.serverAuth`).
+ */
+export interface ICliServerAuth {
+    /** When false the server stays open; sockets only use tickets for optional identity. */
+    readonly protectServer: boolean;
+    /** True for routes the provider authenticates itself (its own API, its login). */
+    handlesPath(path: string, method: string): boolean;
+    /**
+     * Authenticates an HTTP request. Throws an error with `status`
+     * (401 unauthenticated, 403 e.g. password change required / CSRF); any
+     * other error is logged and answered with a generic 500.
+     */
+    authenticateRequest(req: Request): Promise<CliServerAuthContext>;
+    /**
+     * Consumes a single-use WebSocket ticket; undefined when invalid/expired/used.
+     * May throw an error with `status: 403` when the identity is valid but not
+     * allowed yet (e.g. password change required).
+     */
+    consumeTicket(ticket: string): Promise<CliServerAuthContext | undefined>;
+    hasPermission(ctx: CliServerAuthContext, permission: string): boolean;
+    /** Called once when installed into a server. */
+    attachToServer?(server: {
+        allowedOrigins?: string[];
+        broadcast: (message: Record<string, unknown>) => void;
+    }): void;
+    /**
+     * Re-validates a socket identity without sliding the session: the session still
+     * exists and is not expired, the user exists and is enabled. Returns the identity
+     * with fresh permissions, or undefined when it ended. Used to bind long-lived
+     * sockets (the shell) to their session. `request` is the socket's original
+     * upgrade request, for identities without a stored session that the provider
+     * re-authenticates from the request (e.g. a host auth adapter reading cookies).
+     */
+    revalidate?(ctx: CliServerAuthContext, request?: IncomingMessage): Promise<CliServerAuthContext | undefined>;
+    /** Records activity on the session behind `ctx` (slides the idle expiry). */
+    touch?(ctx: CliServerAuthContext): Promise<void>;
+    /** Writes an audit entry (never include secrets, command text or stdin). */
+    audit?(entry: CliServerAuditEntry): Promise<void>;
+    /** Subscribes to session lifecycle events; returns an unsubscribe function. */
+    onSessionEvent?(listener: (event: CliServerSessionEvent) => void): () => void;
+}
+/** Audit entry written by the server through {@link ICliServerAuth.audit}. */
+export interface CliServerAuditEntry {
+    event: string;
+    userId: string;
+    userName: string;
+    /** Acting user (defaults to the user). */
+    actorId?: string;
+    actorName?: string;
+    details?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Session lifecycle events emitted by the auth provider:
+ * - `session-ended`: logout, expiry, revoke (kick), user disabled/deleted;
+ *   `revoked` is true for revocations, which also broadcast `session-kicked`;
+ * - `access-changed`: users/groups/permissions changed, or the expired-session
+ *   sweep ran (re-check open sockets).
+ */
+export type CliServerSessionEvent = {
+    type: 'session-ended';
+    sessionId: string;
+    userId?: string;
+    reason?: string;
+    revoked?: boolean;
+} | {
+    type: 'access-changed';
+    userId?: string;
+};
+/** Server permissions enforced when the users plugin protects the server. */
+export declare const CliServerPermissions: {
+    readonly CommandsExecute: "commands:execute";
+    readonly FilesRead: "files:read";
+    readonly FilesWrite: "files:write";
+    readonly DataQuery: "data:query";
+    readonly JobsRead: "jobs:read";
+    readonly JobsManage: "jobs:manage";
+    readonly LogsRead: "logs:read";
+    readonly ShellExecute: "shell:execute";
+    readonly AdminAccess: "admin:access";
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+export declare function isOriginAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+export declare function trustedProxyHops(trustProxy: boolean | number | undefined): number;
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+export declare function clientAddress(req: {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    } | null;
+}, trustProxy: boolean | number | undefined): string;
+/** Minimal request shape for {@link isSameOrigin} (Node `IncomingMessage` or Express `Request`). */
+export interface OriginCheckRequest {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        encrypted?: boolean;
+        remoteAddress?: string;
+    } | null;
+    /** Express app (when present, its `trust proxy` setting is honoured). */
+    app?: {
+        get?: (name: string) => unknown;
+    };
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+export declare function requestOrigin(req: OriginCheckRequest, trustProxy?: boolean | number): string | undefined;
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+export declare function isSameOrigin(origin: string | undefined, req: OriginCheckRequest, trustProxy?: boolean | number): boolean;
+//# sourceMappingURL=cli-server-auth.d.ts.map

package/dist/src/auth/cli-server-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;;;OAIG;IACH,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACzE,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,gDAAgD;IAChD,cAAc,CAAC,CAAC,MAAM,EAAE;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACzD,GAAG,IAAI,CAAC;IACT;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC7G,6EAA6E;IAC7E,KAAK,CAAC,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,4EAA4E;IAC5E,KAAK,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,+EAA+E;IAC/E,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACjF;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC3B;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACjG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;CAUvB,CAAC;AAEX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAW3G;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjF;AAeD;;;GAGG;AACH,wBAAgB,aAAa,CACzB,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,EAC3G,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACzC,MAAM,CAER;AAED,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,yEAAyE;IACzE,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;CAC7C;AAsCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAWxH"}

package/dist/src/auth/cli-server-auth.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliServerPermissions = void 0;
+exports.isOriginAllowed = isOriginAllowed;
+exports.trustedProxyHops = trustedProxyHops;
+exports.clientAddress = clientAddress;
+exports.requestOrigin = requestOrigin;
+exports.isSameOrigin = isSameOrigin;
+/** Server permissions enforced when the users plugin protects the server. */
+exports.CliServerPermissions = {
+    CommandsExecute: 'commands:execute',
+    FilesRead: 'files:read',
+    FilesWrite: 'files:write',
+    DataQuery: 'data:query',
+    JobsRead: 'jobs:read',
+    JobsManage: 'jobs:manage',
+    LogsRead: 'logs:read',
+    ShellExecute: 'shell:execute',
+    AdminAccess: 'admin:access',
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+function isOriginAllowed(origin, allowed) {
+    if (!origin || !allowed || allowed.length === 0)
+        return false;
+    const o = origin.toLowerCase().replace(/\/+$/, '');
+    return allowed.some((entry) => {
+        const e = entry.toLowerCase().replace(/\/+$/, '');
+        if (e.endsWith(':*')) {
+            const base = e.slice(0, -2);
+            return o === base || (o.startsWith(base + ':') && /^\d+$/.test(o.slice(base.length + 1)));
+        }
+        return o === e;
+    });
+}
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+function trustedProxyHops(trustProxy) {
+    if (typeof trustProxy === 'number') {
+        if (trustProxy === 0)
+            return 0;
+        return trustProxy >= 1 ? Math.floor(trustProxy) : 1;
+    }
+    return trustProxy ? 1 : 0;
+}
+/**
+ * The `X-Forwarded-*` entry behind `hops` trusted proxies (for
+ * `X-Forwarded-For`: the client): index `len - hops` (with one hop, the
+ * rightmost entry, appended by the trusted proxy; leftmost entries are
+ * client-controlled). The leftmost entry when the list is shorter than `hops`;
+ * undefined when the header is absent or the selected entry is empty.
+ */
+function forwardedEntry(header, hops) {
+    if (hops <= 0 || header === undefined)
+        return undefined;
+    const entries = (Array.isArray(header) ? header.join(',') : header).split(',').map((e) => e.trim());
+    return entries[Math.max(0, entries.length - hops)] || undefined;
+}
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+function clientAddress(req, trustProxy) {
+    return forwardedEntry(req.headers['x-forwarded-for'], trustedProxyHops(trustProxy)) ?? req.socket?.remoteAddress ?? 'unknown';
+}
+const DEFAULT_PORTS = { http: '80', https: '443' };
+function firstHeader(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const first = raw?.split(',')[0]?.trim();
+    return first || undefined;
+}
+/** `scheme://host:port`, lower-cased, explicit port (http:80, https:443); `ws`/`wss` map to `http`/`https`. */
+function normalizeOrigin(scheme, hostPort) {
+    let s = scheme.toLowerCase().replace(/:$/, '');
+    if (s === 'ws')
+        s = 'http';
+    if (s === 'wss')
+        s = 'https';
+    if (!DEFAULT_PORTS[s])
+        return undefined;
+    try {
+        const url = new URL(`${s}://${hostPort}`);
+        if (url.username || url.password || (url.pathname && url.pathname !== '/') || url.search || url.hash)
+            return undefined;
+        return `${s}://${url.hostname.toLowerCase()}:${url.port || DEFAULT_PORTS[s]}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Trusted proxy hops for the forwarded headers: from `trustProxy`, or — when it
+ * is omitted and the Express app's `trust proxy` setting trusts the socket — that
+ * setting's hop count (a number), otherwise 1.
+ */
+function proxyHops(req, trustProxy) {
+    if (trustProxy !== undefined)
+        return trustedProxyHops(trustProxy);
+    const fn = req.app?.get?.('trust proxy fn');
+    if (typeof fn !== 'function' || !fn(req.socket?.remoteAddress, 0))
+        return 0;
+    const setting = req.app?.get?.('trust proxy');
+    return typeof setting === 'number' ? trustedProxyHops(setting) || 1 : 1;
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+function requestOrigin(req, trustProxy) {
+    const hops = proxyHops(req, trustProxy);
+    const scheme = forwardedEntry(req.headers['x-forwarded-proto'], hops) || (req.socket?.encrypted ? 'https' : 'http');
+    const host = forwardedEntry(req.headers['x-forwarded-host'], hops) || firstHeader(req.headers['host']);
+    return host ? normalizeOrigin(scheme, host) : undefined;
+}
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+function isSameOrigin(origin, req, trustProxy) {
+    if (!origin || origin === 'null')
+        return false;
+    let o;
+    try {
+        const url = new URL(origin);
+        o = normalizeOrigin(url.protocol, url.host);
+    }
+    catch {
+        return false;
+    }
+    const own = requestOrigin(req, trustProxy);
+    return !!o && !!own && o === own;
+}
+//# sourceMappingURL=cli-server-auth.js.map

package/dist/src/auth/cli-server-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":";;;AAwGA,0CAWC;AAOD,4CAMC;AAmBD,sCAKC;AAsDD,sCAKC;AAOD,oCAWC;AA9ID,6EAA6E;AAChE,QAAA,oBAAoB,GAAG;IAChC,eAAe,EAAE,kBAAkB;IACnC,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;CACrB,CAAC;AAEX;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAA0B,EAAE,OAAsC;IAC9F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,UAAwC;IACrE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAqC,EAAE,IAAY;IACvE,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CACzB,GAA2G,EAC3G,UAAwC;IAExC,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAClI,CAAC;AAUD,MAAM,aAAa,GAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAE3E,SAAS,WAAW,CAAC,KAAoC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,+GAA+G;AAC/G,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACrD,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,KAAK;QAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,UAAwC;IAChF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,UAAU,IAAI,CAAE,EAAuD,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,GAAuB,EAAE,UAA6B;IAChF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAA0B,EAAE,GAAuB,EAAE,UAA6B;IAC3G,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AACrC,CAAC"}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { CliServerAuthContext, CliServerAuthError, CliServerAuditEntry, CliServerSessionEvent, ICliServerAuth, CliServerPermissions, isOriginAllowed, isSameOrigin, requestOrigin, clientAddress, trustedProxyHops, } from './cli-server-auth';
+export { createServerAuthGate, ServerAuthGateOptions, requiredServerPermissions, processorPermissions, normalizePath, } from './cli-server-auth-gate';
+export { authorizeWsUpgrade, rejectUpgrade, WsUpgradeAuthOptions, WsUpgradeAuthResult } from './ws-upgrade-auth';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/auth/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectUpgrade = exports.authorizeWsUpgrade = exports.normalizePath = exports.processorPermissions = exports.requiredServerPermissions = exports.createServerAuthGate = exports.trustedProxyHops = exports.clientAddress = exports.requestOrigin = exports.isSameOrigin = exports.isOriginAllowed = exports.CliServerPermissions = void 0;
+var cli_server_auth_1 = require("./cli-server-auth");
+Object.defineProperty(exports, "CliServerPermissions", { enumerable: true, get: function () { return cli_server_auth_1.CliServerPermissions; } });
+Object.defineProperty(exports, "isOriginAllowed", { enumerable: true, get: function () { return cli_server_auth_1.isOriginAllowed; } });
+Object.defineProperty(exports, "isSameOrigin", { enumerable: true, get: function () { return cli_server_auth_1.isSameOrigin; } });
+Object.defineProperty(exports, "requestOrigin", { enumerable: true, get: function () { return cli_server_auth_1.requestOrigin; } });
+Object.defineProperty(exports, "clientAddress", { enumerable: true, get: function () { return cli_server_auth_1.clientAddress; } });
+Object.defineProperty(exports, "trustedProxyHops", { enumerable: true, get: function () { return cli_server_auth_1.trustedProxyHops; } });
+var cli_server_auth_gate_1 = require("./cli-server-auth-gate");
+Object.defineProperty(exports, "createServerAuthGate", { enumerable: true, get: function () { return cli_server_auth_gate_1.createServerAuthGate; } });
+Object.defineProperty(exports, "requiredServerPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.requiredServerPermissions; } });
+Object.defineProperty(exports, "processorPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.processorPermissions; } });
+Object.defineProperty(exports, "normalizePath", { enumerable: true, get: function () { return cli_server_auth_gate_1.normalizePath; } });
+var ws_upgrade_auth_1 = require("./ws-upgrade-auth");
+Object.defineProperty(exports, "authorizeWsUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.authorizeWsUpgrade; } });
+Object.defineProperty(exports, "rejectUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.rejectUpgrade; } });
+//# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,qDAY2B;AANvB,uHAAA,oBAAoB,OAAA;AACpB,kHAAA,eAAe,OAAA;AACf,+GAAA,YAAY,OAAA;AACZ,gHAAA,aAAa,OAAA;AACb,gHAAA,aAAa,OAAA;AACb,mHAAA,gBAAgB,OAAA;AAEpB,+DAMgC;AAL5B,4HAAA,oBAAoB,OAAA;AAEpB,iIAAA,yBAAyB,OAAA;AACzB,4HAAA,oBAAoB,OAAA;AACpB,qHAAA,aAAa,OAAA;AAEjB,qDAAiH;AAAxG,qHAAA,kBAAkB,OAAA;AAAE,gHAAA,aAAa,OAAA"}

package/dist/src/auth/ws-upgrade-auth.d.ts

@@ -0,0 +1,30 @@
+import type { IncomingMessage } from 'http';
+import type { Duplex } from 'stream';
+import { CliServerAuthContext, ICliServerAuth } from './cli-server-auth';
+export interface WsUpgradeAuthOptions {
+    auth?: ICliServerAuth;
+    allowedOrigins?: string[];
+    /** Honour `X-Forwarded-Proto`/`X-Forwarded-Host` when deciding whether the Origin is the server's own. */
+    trustProxy?: boolean | number;
+    /** Permission required on top of authentication (protected mode only). */
+    permission?: string;
+}
+export type WsUpgradeAuthResult = {
+    ok: true;
+    ctx?: CliServerAuthContext;
+} | {
+    ok: false;
+    status: 401 | 403;
+};
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+export declare function authorizeWsUpgrade(request: IncomingMessage, url: URL, options: WsUpgradeAuthOptions): Promise<WsUpgradeAuthResult>;
+/** Rejects an upgrade with a bare HTTP status response. */
+export declare function rejectUpgrade(socket: Duplex, status: number): void;
+//# sourceMappingURL=ws-upgrade-auth.d.ts.map

package/dist/src/auth/ws-upgrade-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/ws-upgrade-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiC,MAAM,mBAAmB,CAAC;AAExG,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0GAA0G;IAC1G,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,oBAAoB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQlE"}

package/dist/src/auth/ws-upgrade-auth.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeWsUpgrade = authorizeWsUpgrade;
+exports.rejectUpgrade = rejectUpgrade;
+const cli_server_auth_1 = require("./cli-server-auth");
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+async function authorizeWsUpgrade(request, url, options) {
+    const origin = request.headers.origin;
+    if (options.allowedOrigins && options.allowedOrigins.length > 0 && origin !== undefined) {
+        if (!(0, cli_server_auth_1.isOriginAllowed)(origin, options.allowedOrigins) && !(0, cli_server_auth_1.isSameOrigin)(origin, request, options.trustProxy ?? false)) {
+            return { ok: false, status: 403 };
+        }
+    }
+    const auth = options.auth;
+    if (!auth) {
+        return { ok: true };
+    }
+    const ticket = url.searchParams.get('ticket');
+    const ctx = ticket ? await auth.consumeTicket(ticket).catch(() => undefined) : undefined;
+    if (!auth.protectServer) {
+        return { ok: true, ctx };
+    }
+    if (!ctx) {
+        return { ok: false, status: 401 };
+    }
+    if (options.permission && !auth.hasPermission(ctx, options.permission)) {
+        return { ok: false, status: 403 };
+    }
+    return { ok: true, ctx };
+}
+/** Rejects an upgrade with a bare HTTP status response. */
+function rejectUpgrade(socket, status) {
+    const text = status === 401 ? 'Unauthorized' : status === 403 ? 'Forbidden' : status === 404 ? 'Not Found' : 'Error';
+    try {
+        socket.write(`HTTP/1.1 ${status} ${text}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    }
+    catch {
+        // ignore
+    }
+    socket.destroy();
+}
+//# sourceMappingURL=ws-upgrade-auth.js.map