@scalebun/cli 1.0.0 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/api/client.d.ts +8 -0
- package/lib/api/client.d.ts.map +1 -1
- package/lib/api/client.js +70 -2
- package/lib/api/client.js.map +1 -1
- package/lib/commands/ci-init.d.ts +0 -6
- package/lib/commands/ci-init.d.ts.map +1 -1
- package/lib/commands/ci-init.js +172 -28
- package/lib/commands/ci-init.js.map +1 -1
- package/lib/commands/doctor.d.ts +8 -0
- package/lib/commands/doctor.d.ts.map +1 -0
- package/lib/commands/doctor.js +252 -0
- package/lib/commands/doctor.js.map +1 -0
- package/lib/commands/login.d.ts +28 -4
- package/lib/commands/login.d.ts.map +1 -1
- package/lib/commands/login.js +132 -51
- package/lib/commands/login.js.map +1 -1
- package/lib/commands/ota-bundle.d.ts.map +1 -1
- package/lib/commands/ota-bundle.js +2 -0
- package/lib/commands/ota-bundle.js.map +1 -1
- package/lib/commands/ota-delete-bundle.d.ts +8 -0
- package/lib/commands/ota-delete-bundle.d.ts.map +1 -1
- package/lib/commands/ota-delete-bundle.js +60 -0
- package/lib/commands/ota-delete-bundle.js.map +1 -1
- package/lib/commands/ota-keys.d.ts +14 -0
- package/lib/commands/ota-keys.d.ts.map +1 -0
- package/lib/commands/ota-keys.js +200 -0
- package/lib/commands/ota-keys.js.map +1 -0
- package/lib/commands/ota-publish.d.ts +10 -0
- package/lib/commands/ota-publish.d.ts.map +1 -1
- package/lib/commands/ota-publish.js +251 -34
- package/lib/commands/ota-publish.js.map +1 -1
- package/lib/commands/ota-rollout.d.ts +3 -0
- package/lib/commands/ota-rollout.d.ts.map +1 -0
- package/lib/commands/ota-rollout.js +235 -0
- package/lib/commands/ota-rollout.js.map +1 -0
- package/lib/commands/quickstart.d.ts +4 -0
- package/lib/commands/quickstart.d.ts.map +1 -0
- package/lib/commands/quickstart.js +274 -0
- package/lib/commands/quickstart.js.map +1 -0
- package/lib/index.js +20 -1
- package/lib/index.js.map +1 -1
- package/lib/utils/bundle.d.ts +86 -0
- package/lib/utils/bundle.d.ts.map +1 -1
- package/lib/utils/bundle.js +244 -14
- package/lib/utils/bundle.js.map +1 -1
- package/lib/utils/credentials.d.ts +12 -1
- package/lib/utils/credentials.d.ts.map +1 -1
- package/lib/utils/credentials.js +40 -1
- package/lib/utils/credentials.js.map +1 -1
- package/lib/utils/transportSecurity.d.ts +36 -0
- package/lib/utils/transportSecurity.d.ts.map +1 -0
- package/lib/utils/transportSecurity.js +74 -0
- package/lib/utils/transportSecurity.js.map +1 -0
- package/lib/utils/ui.d.ts.map +1 -1
- package/lib/utils/ui.js +2 -0
- package/lib/utils/ui.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* HTTPS enforcement for everything the CLI authenticates to.
|
|
4
|
+
*
|
|
5
|
+
* WHAT WAS WRONG. The API client picked its transport straight off the URL
|
|
6
|
+
* scheme — `parsed.protocol === 'https:' ? https : http` — with nothing
|
|
7
|
+
* requiring HTTPS in the first place, and every request attaches
|
|
8
|
+
* `Authorization: Bearer <token>`. `scalebun login` accepts an arbitrary
|
|
9
|
+
* `--api-url` and POSTs an email and password to it. So a CLI pointed at an
|
|
10
|
+
* `http://` URL — by a typo, a copied CI snippet, or a tampered config —
|
|
11
|
+
* would put a personal access token, or the user's actual password, on the
|
|
12
|
+
* wire in cleartext, with no warning and no failure.
|
|
13
|
+
*
|
|
14
|
+
* THE RULE. Credentials only travel over TLS. The single exception is
|
|
15
|
+
* loopback, because local development against `http://localhost:3000` is a
|
|
16
|
+
* real workflow and traffic that never leaves the machine cannot be
|
|
17
|
+
* intercepted on the network. Anything else is refused before a socket is
|
|
18
|
+
* opened, rather than warned about — a warning printed above a successful
|
|
19
|
+
* request is not a control.
|
|
20
|
+
*
|
|
21
|
+
* Loopback is matched on resolved literals, not on name. `localhost` and the
|
|
22
|
+
* reserved 127/8 and ::1 literals are loopback by definition; an arbitrary
|
|
23
|
+
* hostname that merely happens to resolve to 127.0.0.1 today is not, because
|
|
24
|
+
* whoever controls the DNS answer controls where the token goes tomorrow.
|
|
25
|
+
*/
|
|
26
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
27
|
+
exports.InsecureApiUrlError = void 0;
|
|
28
|
+
exports.assertSecureApiUrl = assertSecureApiUrl;
|
|
29
|
+
/** Hostnames that are loopback by specification rather than by resolution. */
|
|
30
|
+
const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
|
|
31
|
+
function isLoopback(hostname) {
|
|
32
|
+
const h = hostname.toLowerCase();
|
|
33
|
+
if (LOOPBACK_HOSTNAMES.has(h))
|
|
34
|
+
return true;
|
|
35
|
+
// The whole of 127.0.0.0/8 is loopback, not just 127.0.0.1.
|
|
36
|
+
return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
|
|
37
|
+
}
|
|
38
|
+
class InsecureApiUrlError extends Error {
|
|
39
|
+
constructor(url, hostname) {
|
|
40
|
+
super(`Refusing to send credentials over an unencrypted connection to ${url}\n` +
|
|
41
|
+
` The CLI attaches your access token to every request, and "http://" would\n` +
|
|
42
|
+
` put it on the wire in cleartext where anyone on the network can read it.\n` +
|
|
43
|
+
`\n` +
|
|
44
|
+
` Use https://${hostname} instead.\n` +
|
|
45
|
+
` (Plain http:// is allowed only for localhost / 127.0.0.1 during local development.)`);
|
|
46
|
+
this.name = 'InsecureApiUrlError';
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
exports.InsecureApiUrlError = InsecureApiUrlError;
|
|
50
|
+
/**
|
|
51
|
+
* Validate an API base URL before it is used or persisted.
|
|
52
|
+
*
|
|
53
|
+
* @returns the normalised URL (trailing slashes stripped)
|
|
54
|
+
* @throws InsecureApiUrlError for a non-loopback `http://` URL
|
|
55
|
+
* @throws Error for a URL that is malformed or uses a non-HTTP scheme
|
|
56
|
+
*/
|
|
57
|
+
function assertSecureApiUrl(rawUrl) {
|
|
58
|
+
let parsed;
|
|
59
|
+
try {
|
|
60
|
+
parsed = new URL(rawUrl);
|
|
61
|
+
}
|
|
62
|
+
catch {
|
|
63
|
+
throw new Error(`Not a valid API URL: ${rawUrl}`);
|
|
64
|
+
}
|
|
65
|
+
if (parsed.protocol === 'https:')
|
|
66
|
+
return rawUrl.replace(/\/+$/, '');
|
|
67
|
+
if (parsed.protocol === 'http:') {
|
|
68
|
+
if (isLoopback(parsed.hostname))
|
|
69
|
+
return rawUrl.replace(/\/+$/, '');
|
|
70
|
+
throw new InsecureApiUrlError(rawUrl, parsed.hostname);
|
|
71
|
+
}
|
|
72
|
+
throw new Error(`Unsupported API URL scheme "${parsed.protocol}" in ${rawUrl} — expected https://`);
|
|
73
|
+
}
|
|
74
|
+
//# sourceMappingURL=transportSecurity.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"transportSecurity.js","sourceRoot":"","sources":["../../src/utils/transportSecurity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAiCH,gDAkBC;AAjDD,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/E,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,4DAA4D;IAC5D,OAAO,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,GAAW,EAAE,QAAgB;QACvC,KAAK,CACH,kEAAkE,GAAG,IAAI;YACvE,8EAA8E;YAC9E,8EAA8E;YAC9E,IAAI;YACJ,iBAAiB,QAAQ,aAAa;YACtC,uFAAuF,CAC1F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAZD,kDAYC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAC/C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpE,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,QAAQ,QAAQ,MAAM,sBAAsB,CACnF,CAAC;AACJ,CAAC"}
|
package/lib/utils/ui.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":"AAGA,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAED,wBAAgB,cAAc,IAAI,IAAI,
|
|
1
|
+
{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":"AAGA,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAED,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAED,wBAAgB,cAAc,IAAI,IAAI,CAqBrC"}
|
package/lib/utils/ui.js
CHANGED
|
@@ -33,6 +33,8 @@ function renderStatus() {
|
|
|
33
33
|
}
|
|
34
34
|
function renderCommands() {
|
|
35
35
|
console.log(chalk_1.default.bold.white(' COMMANDS'));
|
|
36
|
+
console.log(` ${chalk_1.default.cyan('scalebun quickstart')} ${chalk_1.default.dim('Guided walkthrough: login → app → keys → first release')}`);
|
|
37
|
+
console.log(` ${chalk_1.default.cyan('scalebun apps')} ${chalk_1.default.dim('List your apps with the IDs other commands need (--keys for client keys)')}`);
|
|
36
38
|
console.log(` ${chalk_1.default.cyan('scalebun login')} ${chalk_1.default.dim('Authenticate with your Scalebun backend')}`);
|
|
37
39
|
console.log(` ${chalk_1.default.cyan('scalebun ota publish')} ${chalk_1.default.dim('Bundle, upload, & publish an OTA release (Instant or Silent)')}`);
|
|
38
40
|
console.log(` ${chalk_1.default.cyan('scalebun ota bundle')} ${chalk_1.default.dim('Build standalone bundle for manual upload via Web Dashboard')}`);
|
package/lib/utils/ui.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":";;;;;AAGA,oCAUC;AAED,oCAUC;AAED,
|
|
1
|
+
{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/utils/ui.ts"],"names":[],"mappings":";;;;;AAGA,oCAUC;AAED,oCAUC;AAED,wCAqBC;AAhDD,kDAA0B;AAC1B,+CAAgD;AAEhD,SAAgB,YAAY;IAC1B,MAAM,IAAI,GAAG;GACZ,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,YAAY,CAAC;GACrO,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,YAAY,CAAC;GACvO,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,YAAY,CAAC;GACtO,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,eAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,YAAY,CAAC;GACtO,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,eAAK,CAAC,OAAO,CAAC,YAAY,CAAC;CAC1O,CAAC;IACA,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,6CAA6C,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,eAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAgB,cAAc;IAC5B,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,eAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC;IACjI,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,eAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,EAAE,CAAC,CAAC;IACnJ,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,eAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;IAClH,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,eAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,EAAE,CAAC,CAAC;IACvI,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,eAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,EAAE,CAAC,CAAC;IACtI,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,eAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,EAAE,CAAC,CAAC;IACvI,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,eAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,eAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,eAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,IAAI,CAAC,CAAC;IAExH,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,uGAAuG,CAAC,CAAC;IAE/K,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,gGAAgG,CAAC,CAAC;IAExK,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,6DAA6D,CAAC,CAAC;AACtI,CAAC"}
|