@rool-dev/sdk 0.12.5 → 2.0.0-dev.03df95a

package/dist/auth-node.js

@@ -1,302 +1,375 @@
-import * as http from 'node:http';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import * as crypto from 'node:crypto';
-import open from 'open';
-import { defaultLogger } from './logger.js';
-export class NodeAuthProvider {
-    config;
-    _authUrl = null;
-    logger = defaultLogger;
-    authStateChangedHandler = null;
+import { createHash, randomBytes } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import open from "open";
+import { resolveAuthUrl } from "./auth-url.js";
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const MAX_CALLBACK_BODY_BYTES = 64 * 1024;
+export class NodeAuthLoginRequiredError extends Error {
+    constructor(message = "Node authentication is required; call login()") {
+        super(message);
+        this.name = "NodeAuthLoginRequiredError";
+    }
+}
+export class NodeAuth {
+    credentialsPath;
+    getTokens;
+    getAccessToken;
+    authUrl;
+    listeners = new Set();
+    loginTimeoutMs;
+    fetchRequest;
+    openUrl;
+    refreshInFlight = null;
     constructor(config = {}) {
-        this.config = config;
+        this.authUrl = resolveAuthUrl(config);
+        this.credentialsPath = resolveCredentialsPath(this.authUrl, config.profile, config.credentialsPath);
+        this.loginTimeoutMs = config.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS;
+        this.fetchRequest = config.fetch ?? globalThis.fetch.bind(globalThis);
+        this.openUrl = config.openUrl ?? ((url) => open(url).then(() => undefined));
+        this.getTokens = () => this.resolveTokens();
+        this.getAccessToken = async () => {
+            const tokens = await this.getTokens();
+            if (!tokens)
+                throw new NodeAuthLoginRequiredError();
+            return tokens.accessToken;
+        };
     }
-    /** Called by AuthManager to inject the auth URL */
-    setAuthUrl(url) {
-        this._authUrl = url;
+    initialize() {
+        return this.isAuthenticated();
     }
-    /** Called by AuthManager to bridge auth state to client events */
-    setAuthStateChangedHandler(handler) {
-        this.authStateChangedHandler = handler;
+    async isAuthenticated() {
+        return (await this.readCredentials()) !== null;
     }
-    notifyAuthState(authenticated) {
-        this.config.onAuthStateChanged?.(authenticated);
-        this.authStateChangedHandler?.(authenticated);
+    login(appName, params = {}) {
+        return this.authFlow("login", appName, params);
     }
-    /** Called by AuthManager to inject the logger */
-    setLogger(logger) {
-        this.logger = logger;
+    signup(appName, params = {}) {
+        return this.authFlow("signup", appName, params);
     }
-    /**
-     * Get a short hash of the auth URL for scoping credentials by endpoint.
-     */
-    get endpointHash() {
-        if (!this._authUrl) {
-            return 'default';
-        }
-        return crypto.createHash('sha256').update(this._authUrl).digest('hex').slice(0, 8);
+    onAuthStateChanged(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
     }
-    get credentialsPath() {
-        if (this.config.credentialsPath) {
-            return this.config.credentialsPath;
+    logout = async () => {
+        try {
+            await fs.unlink(this.credentialsPath);
+            this.emitAuthState(false);
         }
-        const homeDir = os.homedir();
-        const configDir = path.join(homeDir, '.config', 'rool');
-        // Scope credentials by endpoint to avoid mixing tokens from different environments
-        return path.join(configDir, `credentials-${this.endpointHash}.json`);
-    }
-    /**
-     * Get the auth endpoint URL (without trailing slash).
-     */
-    get authEndpoint() {
-        if (!this._authUrl) {
-            throw new Error('Auth URL not set. Ensure RoolClient is configured correctly.');
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
         }
-        return this._authUrl.replace(/\/+$/, '');
-    }
-    initialize() {
-        // For Node.js, initialize just checks if credentials file exists
-        // The actual validation happens in isAuthenticated()
-        return this.readCredentials() !== null;
-    }
-    async getTokens() {
-        const creds = this.readCredentials();
-        if (!creds)
-            return undefined;
-        // Refresh if expiring in less than 5 minutes
-        if (Date.now() >= creds.expires_at - 5 * 60 * 1000) {
-            const refreshed = await this.refreshToken(creds);
-            if (!refreshed)
-                return undefined;
-            const freshCreds = this.readCredentials();
-            if (!freshCreds)
-                return undefined;
-            return { accessToken: freshCreds.access_token, roolToken: freshCreds.rool_token ?? '' };
+    };
+    async authFlow(flow, appName, params) {
+        const state = randomBytes(32).toString("base64url");
+        const server = createServer();
+        await listen(server);
+        const address = server.address();
+        if (!address || typeof address === "string") {
+            await close(server);
+            throw new Error("Could not start the Node authentication callback");
         }
-        return { accessToken: creds.access_token, roolToken: creds.rool_token ?? '' };
-    }
-    getAuthUser() {
-        const creds = this.readCredentials();
-        if (!creds?.access_token)
-            return { email: null, name: null };
+        const redirectUri = `http://127.0.0.1:${address.port}`;
+        const loginUrl = new URL(`/${flow}`, new URL(this.authUrl).origin);
+        for (const [name, value] of Object.entries(params)) {
+            loginUrl.searchParams.set(name, value);
+        }
+        loginUrl.searchParams.set("redirect_uri", redirectUri);
+        loginUrl.searchParams.set("app_name", appName);
+        loginUrl.searchParams.set("state", state);
+        const callback = receiveLogin(server, state, this.loginTimeoutMs);
         try {
-            const payload = JSON.parse(Buffer.from(creds.access_token.split('.')[1], 'base64').toString());
-            return {
-                email: payload.email || null,
-                name: payload.name || null,
-            };
+            await this.openUrl(loginUrl.toString());
+            const credentials = await callback.result;
+            await this.writeCredentials({
+                access_token: credentials.accessToken,
+                refresh_token: credentials.refreshToken,
+                rool_token: credentials.roolToken,
+                expires_at: credentials.expiresAt,
+                auth_url: this.authUrl,
+            });
+            this.emitAuthState(true);
         }
-        catch {
-            return { email: null, name: null };
+        finally {
+            callback.cancel();
+            await close(server);
         }
     }
-    async isAuthenticated() {
-        const tokens = await this.getTokens();
-        return tokens !== undefined;
-    }
-    async login(appName, params) {
-        return this.authFlow('login', appName, params);
+    emitAuthState(authenticated) {
+        for (const listener of this.listeners)
+            listener(authenticated);
     }
-    async signup(appName, params) {
-        return this.authFlow('signup', appName, params);
-    }
-    async authFlow(flow, appName, params) {
-        const { server, closeAll } = await this.startLoopbackServer();
-        const port = server.address().port;
-        const redirectUri = `http://localhost:${port}`;
-        const state = Math.random().toString(36).substring(2);
-        const origin = new URL(this.authEndpoint).origin;
-        const url = new URL(`${origin}/${flow}`);
-        url.searchParams.set('redirect_uri', redirectUri);
-        url.searchParams.set('app_name', appName);
-        if (params) {
-            for (const [key, value] of Object.entries(params)) {
-                url.searchParams.set(key, value);
+    async resolveTokens() {
+        let credentials = await this.readCredentials();
+        if (!credentials)
+            return undefined;
+        if (credentials.expires_at <= Date.now() + REFRESH_BUFFER_MS) {
+            if (!this.refreshInFlight) {
+                this.refreshInFlight = this.refresh(credentials).finally(() => {
+                    this.refreshInFlight = null;
+                });
             }
+            credentials = await this.refreshInFlight;
         }
-        url.searchParams.set('state', state);
-        this.logger.info(`Opening browser to ${flow} to ${appName}:`, url.toString());
-        await open(url.toString());
-        const timeoutMs = this.config.loginTimeoutMs ?? 5 * 60 * 1000; // 5 minutes default
-        return new Promise((resolve, reject) => {
-            const timeout = setTimeout(() => {
-                closeAll();
-                reject(new Error('Login timed out. Please try again.'));
-            }, timeoutMs);
-            server.on('authenticated', (tokens) => {
-                clearTimeout(timeout);
-                const expiresAt = Date.now() + (tokens.expires_in * 1000);
-                this.writeCredentials({
-                    access_token: tokens.id_token, // GCIP returns id_token
-                    refresh_token: tokens.refresh_token,
-                    rool_token: tokens.rool_token ?? null,
-                    expires_at: expiresAt
-                });
-                this.notifyAuthState(true);
-                closeAll();
-                resolve();
-            });
-            server.on('error', (err) => {
-                clearTimeout(timeout);
-                closeAll();
-                reject(err);
-            });
-        });
+        return {
+            accessToken: credentials.access_token,
+            roolToken: credentials.rool_token ?? "",
+        };
     }
-    replaceTokens(tokens) {
-        const credentials = this.readCredentials();
-        if (!credentials)
-            throw new Error('Cannot replace a missing session');
-        this.writeCredentials({
-            access_token: tokens.accessToken,
-            refresh_token: tokens.refreshToken,
-            rool_token: credentials.rool_token,
-            expires_at: tokens.expiresAt,
+    async refresh(credentials) {
+        const response = await this.fetchRequest(`${this.authUrl}/refresh`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                refresh_token: credentials.refresh_token,
+                rool_token: credentials.rool_token ?? null,
+            }),
         });
+        if (response.status === 400 || response.status === 401) {
+            await this.logout();
+            throw new NodeAuthLoginRequiredError("Node authentication expired; call login() again");
+        }
+        if (!response.ok) {
+            throw new Error(`Could not refresh Node authentication: HTTP ${response.status}`);
+        }
+        const data = (await response.json());
+        const accessToken = data.id_token;
+        const refreshToken = data.refresh_token;
+        const roolToken = data.rool_token;
+        const expiresIn = Number(data.expires_in);
+        const hasInvalidRoolToken = roolToken !== undefined &&
+            roolToken !== null &&
+            typeof roolToken !== "string";
+        if (typeof accessToken !== "string" ||
+            typeof refreshToken !== "string" ||
+            hasInvalidRoolToken ||
+            !Number.isFinite(expiresIn) ||
+            expiresIn <= 0) {
+            throw new Error("The authentication refresh response is invalid");
+        }
+        const refreshed = {
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            rool_token: typeof roolToken === "string"
+                ? roolToken
+                : roolToken === null
+                    ? null
+                    : (credentials.rool_token ?? null),
+            expires_at: Date.now() + expiresIn * 1000,
+            auth_url: this.authUrl,
+        };
+        await this.writeCredentials(refreshed);
+        return refreshed;
     }
-    logout() {
-        // Notify only on a real transition, so concurrent 401-driven logouts
-        // emit a single sign-out.
-        const filePath = this.credentialsPath;
-        if (!fs.existsSync(filePath))
-            return;
-        fs.unlinkSync(filePath);
-        this.notifyAuthState(false);
-    }
-    // ===========================================================================
-    // Private Helpers
-    // ===========================================================================
-    readCredentials() {
+    async readCredentials() {
+        let serialized;
         try {
-            const filePath = this.credentialsPath;
-            if (!fs.existsSync(filePath))
+            serialized = await fs.readFile(this.credentialsPath, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
                 return null;
-            const data = fs.readFileSync(filePath, 'utf-8');
-            return JSON.parse(data);
+            throw error;
+        }
+        let value;
+        try {
+            value = JSON.parse(serialized);
         }
         catch {
-            return null;
+            throw new Error(`Invalid Node credentials at ${this.credentialsPath}`);
         }
-    }
-    writeCredentials(creds) {
-        const filePath = this.credentialsPath;
-        const dir = path.dirname(filePath);
-        try {
-            fs.mkdirSync(dir, { recursive: true });
-            fs.writeFileSync(filePath, JSON.stringify(creds, null, 2), { mode: 0o600 });
+        if (!isStoredCredentials(value)) {
+            throw new Error(`Invalid Node credentials at ${this.credentialsPath}`);
         }
-        catch (error) {
-            this.logger.error('[RoolClient] Failed to save credentials:', error);
+        if (value.auth_url &&
+            resolveAuthUrl({ authUrl: value.auth_url }) !== this.authUrl) {
+            throw new Error(`Node credentials at ${this.credentialsPath} belong to another auth endpoint`);
         }
+        return value;
     }
-    async refreshToken(creds) {
-        if (!creds.refresh_token)
-            return undefined;
+    async writeCredentials(credentials) {
+        const directory = dirname(this.credentialsPath);
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+        const temporaryPath = `${this.credentialsPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
         try {
-            const response = await fetch(`${this.authEndpoint}/refresh`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    refresh_token: creds.refresh_token,
-                    rool_token: creds.rool_token,
-                }),
-            });
-            if (!response.ok) {
-                // 400/401 typically means invalid/expired refresh token - clear credentials
-                if (response.status === 400 || response.status === 401) {
-                    this.logger.warn('[RoolClient] Refresh token expired or invalid. Please login again.');
-                    this.logout();
-                }
-                else {
-                    this.logger.warn(`[RoolClient] Refresh failed: ${response.status}`);
-                }
-                return undefined;
+            await fs.writeFile(temporaryPath, `${JSON.stringify(credentials, null, 2)}\n`, { mode: 0o600 });
+            await fs.rename(temporaryPath, this.credentialsPath);
+        }
+        finally {
+            try {
+                await fs.unlink(temporaryPath);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
             }
-            const data = await response.json();
-            const newCreds = {
-                access_token: data.id_token,
-                refresh_token: data.refresh_token || creds.refresh_token,
-                rool_token: data.rool_token ?? creds.rool_token,
-                expires_at: Date.now() + (Number(data.expires_in) * 1000),
-            };
-            this.writeCredentials(newCreds);
-            return newCreds.access_token;
         }
-        catch (error) {
-            this.logger.error('[RoolClient] Refresh failed:', error);
-            return undefined;
+    }
+}
+function resolveCredentialsPath(authUrl, profile, configuredPath) {
+    if (configuredPath) {
+        if (configuredPath === "~")
+            return homedir();
+        if (configuredPath.startsWith("~/")) {
+            return join(homedir(), configuredPath.slice(2));
         }
+        return configuredPath;
     }
-    startLoopbackServer() {
-        return new Promise((resolve) => {
-            const server = http.createServer((req, res) => {
-                const url = new URL(req.url || '/', `http://localhost`);
-                // 1. Serve the capture page if we just have a root request
-                if (url.pathname === '/') {
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end(`
-            <html>
-            <body>
-              <h1>Authenticating...</h1>
-              <script>
-                // Extract hash and post to /callback
-                if (window.location.hash) {
-                  const hash = window.location.hash.substring(1);
-                  fetch('/callback', {
-                    method: 'POST',
-                    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
-                    body: hash
-                  })
-                  .then(() => document.body.innerHTML = '<h1>Login Successful. You can close this window.</h1>')
-                  .catch(err => document.body.innerHTML = '<h1>Error: ' + err.message + '</h1>');
-                }
-              </script>
-            </body>
-            </html>
-          `);
-                    return;
-                }
-                // 2. Handle the callback POST
-                if (url.pathname === '/callback' && req.method === 'POST') {
-                    let body = '';
-                    req.on('data', (chunk) => body += chunk.toString());
-                    req.on('end', () => {
-                        const params = new URLSearchParams(body);
-                        const idToken = params.get('id_token');
-                        const refreshToken = params.get('refresh_token');
-                        const roolToken = params.get('rool_token');
-                        const expiresIn = params.get('expires_in');
-                        if (idToken && expiresIn) {
-                            res.writeHead(200);
-                            res.end('OK');
-                            server.emit('authenticated', {
-                                id_token: idToken,
-                                refresh_token: refreshToken,
-                                rool_token: roolToken,
-                                expires_in: Number(expiresIn)
-                            });
-                        }
-                        else {
-                            res.writeHead(400);
-                            res.end('Invalid tokens');
-                        }
-                    });
-                    return;
-                }
-                res.writeHead(404);
-                res.end();
-            });
-            // Listen on random port
-            server.listen(0, '127.0.0.1', () => resolve({
-                server,
-                closeAll: () => {
-                    server.close();
-                    server.closeAllConnections();
-                },
-            }));
+    if (profile && !/^[A-Za-z0-9._-]+$/.test(profile)) {
+        throw new Error("Node authentication profile contains invalid characters");
+    }
+    const endpointHash = createHash("sha256")
+        .update(authUrl)
+        .digest("hex")
+        .slice(0, 8);
+    const profileSuffix = profile ? `-${profile}` : "";
+    return join(homedir(), ".config", "rool", `credentials-${endpointHash}${profileSuffix}.json`);
+}
+function isStoredCredentials(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const credentials = value;
+    return (typeof credentials.access_token === "string" &&
+        typeof credentials.refresh_token === "string" &&
+        (credentials.rool_token === undefined ||
+            credentials.rool_token === null ||
+            typeof credentials.rool_token === "string") &&
+        typeof credentials.expires_at === "number" &&
+        (credentials.auth_url === undefined ||
+            typeof credentials.auth_url === "string"));
+}
+function listen(server) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
         });
+    });
+}
+function close(server) {
+    if (!server.listening)
+        return Promise.resolve();
+    server.closeAllConnections();
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
+function receiveLogin(server, expectedState, timeoutMs) {
+    let settled = false;
+    let resolveResult;
+    let rejectResult;
+    const result = new Promise((resolve, reject) => {
+        resolveResult = resolve;
+        rejectResult = reject;
+    });
+    const timeout = setTimeout(() => {
+        settle(() => rejectResult(new Error("Node authentication timed out")));
+    }, timeoutMs);
+    const settle = (action) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timeout);
+        action();
+    };
+    server.on("request", (request, response) => {
+        void handleCallbackRequest(request, response, expectedState)
+            .then((credentials) => {
+            if (credentials)
+                settle(() => resolveResult(credentials));
+        })
+            .catch((error) => settle(() => rejectResult(error)));
+    });
+    server.once("error", (error) => settle(() => rejectResult(error)));
+    return {
+        result,
+        cancel: () => settle(() => undefined),
+    };
+}
+async function handleCallbackRequest(request, response, expectedState) {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (request.method === "GET" && url.pathname === "/") {
+        response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        response.end(callbackPage);
+        return null;
+    }
+    if (request.method !== "POST" || url.pathname !== "/callback") {
+        response.writeHead(404);
+        response.end();
+        return null;
+    }
+    const body = await readRequestBody(request);
+    const params = new URLSearchParams(body);
+    if (params.get("state") !== expectedState) {
+        response.writeHead(400);
+        response.end("Invalid authentication state");
+        throw new Error("Node authentication state mismatch");
     }
+    const accessToken = params.get("id_token");
+    const refreshToken = params.get("refresh_token");
+    const roolToken = params.get("rool_token");
+    const expiresIn = Number(params.get("expires_in"));
+    if (!accessToken ||
+        !refreshToken ||
+        !Number.isFinite(expiresIn) ||
+        expiresIn <= 0) {
+        response.writeHead(400);
+        response.end("Invalid authentication response");
+        throw new Error("The Node authentication response is invalid");
+    }
+    response.writeHead(200);
+    response.end("Authentication complete. You can close this window.");
+    return {
+        accessToken,
+        refreshToken,
+        roolToken,
+        expiresAt: Date.now() + expiresIn * 1000,
+    };
+}
+function readRequestBody(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        request.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_CALLBACK_BODY_BYTES) {
+                request.destroy();
+                reject(new Error("The Node authentication response is too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        request.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        request.on("error", reject);
+    });
 }
+const callbackPage = `<!doctype html>
+<html lang="en">
+  <head><meta charset="utf-8"><title>Rool authentication</title></head>
+  <body>
+    <p>Completing authentication…</p>
+    <script>
+      const body = window.location.hash.slice(1);
+      fetch('/callback', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body,
+      }).then(async (response) => {
+        document.body.textContent = response.ok
+          ? 'Authentication complete. You can close this window.'
+          : await response.text();
+      });
+    </script>
+  </body>
+</html>`;
 //# sourceMappingURL=auth-node.js.map