@rome-os/node-core 0.1.0 → 0.1.1

package/README.md

@@ -137,6 +137,13 @@ A custom credential store implements `load`, `save`, and `clear`. The built-in
 login adapter uses a temporary loopback callback listener. Applications can
 supply their own authorization function returning a device session.
 
+For authorization from another device, import `loginDeviceCode` from the same
+`/host` entry. It accepts the same origin, name, and abort signal as `loginDevice`.
+Its callback receives `{ verificationUri, verificationUriComplete, userCode, expiresIn }`,
+where `expiresIn` is in seconds. It returns a `DeviceSession` after approval and
+rejects on denial, expiry, cancellation, or a terminal error. It opens no browser
+or callback listener. The callback receives neither the device code nor the access token.
+
 The host exposes `system.info` and `exec`. Programs run as the application's OS
 user. Connection loss terminates direct child processes on a best-effort basis.
 A local caller timeout does not cancel remote execution.

package/dist/device-authorization.d.ts

@@ -0,0 +1,8 @@
+import { type DeviceSession } from "./device-session.js";
+export interface DeviceAuthorizationPrompt {
+    verificationUri: string;
+    verificationUriComplete: string;
+    userCode: string;
+    expiresIn: number;
+}
+export declare function loginDeviceCode(cloudUrl: string, name: string, signal: AbortSignal, onAuthorizationRequired: (prompt: DeviceAuthorizationPrompt) => void): Promise<DeviceSession>;

package/dist/device-authorization.js

@@ -0,0 +1,156 @@
+import { isRecord } from "./actions.js";
+import { cloudOrigin } from "./cloud.js";
+import { devicePlatform, deviceSessionFromToken } from "./device-session.js";
+class DeviceAuthorizationError extends Error {
+}
+class RetryableRequestError extends Error {
+}
+function seconds(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= 2_147_483;
+}
+function verificationUrl(value, origin) {
+    if (typeof value !== "string")
+        throw new DeviceAuthorizationError("Invalid device authorization response.");
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new DeviceAuthorizationError("Invalid device authorization response.");
+    }
+    if (url.origin !== origin || url.username || url.password)
+        throw new DeviceAuthorizationError("Invalid device authorization response.");
+    return url.href;
+}
+async function post(origin, path, body, signal) {
+    let response;
+    try {
+        response = await fetch(new URL(path, origin), {
+            method: "POST",
+            body,
+            signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]),
+            redirect: "error",
+            cache: "no-store",
+        });
+    }
+    catch {
+        throw new RetryableRequestError();
+    }
+    if (response.status === 429 || response.status >= 500) {
+        await response.body?.cancel().catch(() => { });
+        throw new RetryableRequestError();
+    }
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new DeviceAuthorizationError("Invalid device authorization response.");
+        throw new RetryableRequestError();
+    }
+    return { response, result };
+}
+function wait(milliseconds, signal) {
+    return new Promise((resolve, reject) => {
+        signal.throwIfAborted();
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", abort);
+            resolve();
+        }, milliseconds);
+        signal.addEventListener("abort", abort, { once: true });
+    });
+}
+export async function loginDeviceCode(cloudUrl, name, signal, onAuthorizationRequired) {
+    const origin = cloudOrigin(cloudUrl);
+    const expiry = new AbortController();
+    const pollingSignal = AbortSignal.any([signal, expiry.signal]);
+    let timer;
+    try {
+        signal.throwIfAborted();
+        const { response, result } = await post(origin, "/oauth2/device_authorization", new URLSearchParams({
+            client_id: "rome-computer",
+            display_name: name,
+            platform: devicePlatform(),
+        }), signal);
+        if (!response.ok ||
+            !isRecord(result) ||
+            typeof result.device_code !== "string" ||
+            !result.device_code ||
+            typeof result.user_code !== "string" ||
+            !/^[A-Za-z0-9-]{1,64}$/.test(result.user_code) ||
+            !seconds(result.expires_in) ||
+            !seconds(result.interval))
+            throw new DeviceAuthorizationError("Invalid device authorization response.");
+        const prompt = {
+            verificationUri: verificationUrl(result.verification_uri, origin),
+            verificationUriComplete: verificationUrl(result.verification_uri_complete, origin),
+            userCode: result.user_code,
+            expiresIn: result.expires_in,
+        };
+        const deadline = Date.now() + result.expires_in * 1000;
+        timer = setTimeout(() => expiry.abort(), result.expires_in * 1000);
+        onAuthorizationRequired(prompt);
+        let interval = result.interval * 1000;
+        while (true) {
+            await wait(Math.min(interval, Math.max(0, deadline - Date.now())), pollingSignal);
+            if (Date.now() >= deadline)
+                expiry.abort();
+            pollingSignal.throwIfAborted();
+            let polled;
+            try {
+                polled = await post(origin, "/oauth2/token", new URLSearchParams({
+                    client_id: "rome-computer",
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: result.device_code,
+                }), pollingSignal);
+            }
+            catch (error) {
+                pollingSignal.throwIfAborted();
+                if (!(error instanceof RetryableRequestError))
+                    throw error;
+                interval = Math.max(interval, Math.min(interval * 2, 60_000));
+                continue;
+            }
+            const { response, result: token } = polled;
+            pollingSignal.throwIfAborted();
+            if (response.ok) {
+                const session = deviceSessionFromToken(token, origin);
+                if (!session)
+                    throw new DeviceAuthorizationError("Invalid token response.");
+                return session;
+            }
+            if (response.status === 400 && isRecord(token)) {
+                if (token.error === "authorization_pending")
+                    continue;
+                if (token.error === "slow_down") {
+                    interval += 5000;
+                    continue;
+                }
+                if (token.error === "access_denied")
+                    throw new DeviceAuthorizationError("Device authorization denied.");
+                if (token.error === "expired_token")
+                    throw new DeviceAuthorizationError("Device authorization expired.");
+                if (token.error === "invalid_grant")
+                    throw new DeviceAuthorizationError("Device authorization is invalid.");
+            }
+            throw new DeviceAuthorizationError("Device authorization rejected.");
+        }
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw new DeviceAuthorizationError("Authorization canceled.");
+        if (expiry.signal.aborted)
+            throw new DeviceAuthorizationError("Device authorization expired.");
+        if (error instanceof DeviceAuthorizationError)
+            throw error;
+        throw new DeviceAuthorizationError("Could not complete device authorization. Try connecting again.");
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/device-session.d.ts

@@ -0,0 +1,7 @@
+export interface DeviceSession {
+    cloudUrl: string;
+    token: string;
+    deviceId: string;
+}
+export declare function devicePlatform(): "macos" | "windows" | "linux";
+export declare function deviceSessionFromToken(body: unknown, origin: string): DeviceSession | null;

package/dist/device-session.js

@@ -0,0 +1,16 @@
+import { platform } from "node:os";
+import { isRecord } from "./actions.js";
+import { validId } from "./protocol.js";
+export function devicePlatform() {
+    const value = platform();
+    return value === "darwin" ? "macos" : value === "win32" ? "windows" : "linux";
+}
+export function deviceSessionFromToken(body, origin) {
+    if (!isRecord(body) ||
+        typeof body.access_token !== "string" ||
+        !/^romedev_[A-Za-z0-9_-]{43}$/.test(body.access_token) ||
+        body.token_type !== "Bearer" ||
+        !validId(body.device_id))
+        return null;
+    return { cloudUrl: origin, token: body.access_token, deviceId: body.device_id };
+}

package/dist/host.d.ts

@@ -1,3 +1,4 @@
 export { connectHost, defaultDeviceName, type HostCredential, type HostEvent, type HostOptions, } from "./connect.js";
 export { loginDevice, type DeviceSession } from "./login.js";
+export { loginDeviceCode, type DeviceAuthorizationPrompt } from "./device-authorization.js";
 export { createFileCredentialStore, type CredentialStore } from "./storage.js";

package/dist/host.js

@@ -1,3 +1,4 @@
 export { connectHost, defaultDeviceName, } from "./connect.js";
 export { loginDevice } from "./login.js";
+export { loginDeviceCode } from "./device-authorization.js";
 export { createFileCredentialStore } from "./storage.js";

package/dist/login.d.ts

@@ -1,6 +1,3 @@
-export interface DeviceSession {
-    cloudUrl: string;
-    token: string;
-    deviceId: string;
-}
+import { type DeviceSession } from "./device-session.js";
+export type { DeviceSession } from "./device-session.js";
 export declare function loginDevice(cloudUrl: string, name: string, signal: AbortSignal, onAuthorizationRequired: (url: string) => void): Promise<DeviceSession>;

package/dist/login.js

@@ -1,8 +1,7 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes } from "node:crypto";
-import { platform } from "node:os";
 import { cloudOrigin } from "./cloud.js";
-import { validId } from "./protocol.js";
+import { devicePlatform, deviceSessionFromToken } from "./device-session.js";
 export async function loginDevice(cloudUrl, name, signal, onAuthorizationRequired) {
     const cloud = new URL(cloudOrigin(cloudUrl));
     const verifier = randomBytes(32).toString("base64url");
@@ -36,20 +35,18 @@ export async function loginDevice(cloudUrl, name, signal, onAuthorizationRequire
                         redirect_uri: redirectUri,
                         code: incoming.searchParams.get("code"),
                         code_verifier: verifier,
-                        platform: platform() === "darwin" ? "macos" : platform() === "win32" ? "windows" : "linux",
+                        platform: devicePlatform(),
                     }),
                 });
                 if (!result.ok)
                     throw new Error("Token exchange rejected");
-                const body = (await result.json());
-                if (typeof body.access_token !== "string" ||
-                    !/^romedev_[A-Za-z0-9_-]{43}$/.test(body.access_token) ||
-                    !validId(body.device_id))
+                const session = deviceSessionFromToken(await result.json(), cloud.origin);
+                if (!session)
                     throw new Error("Invalid token response");
                 response
                     .writeHead(200, { "content-type": "text/plain", "cache-control": "no-store" })
                     .end("Device authorized. Return to Rome Node.");
-                resolve({ cloudUrl: cloud.origin, token: body.access_token, deviceId: body.device_id });
+                resolve(session);
             }
             catch {
                 response

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rome-os/node-core",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "JavaScript APIs for Rome device hosts and shared caller daemons",
   "license": "MIT",
   "type": "module",