@the-open-engine/zeroshot 6.28.0 → 6.29.1

package/src/target/target-session.ts

@@ -1,249 +1,132 @@
-import type { TargetCredentialStore } from './credential-store.ts';
-import type { TargetRecord, SettingsPort } from './target-registry.ts';
+import type { TargetCredentialStore } from './credential-store.js';
+import type { Clock } from './device-flow.js';
 import {
-  requestDeviceCode,
-  pollForToken,
-  UnboundSessionError,
-  type HttpTransport,
-  type Clock,
-  type TokenResponse,
-} from './device-flow.ts';
-import { targetServiceKey, TARGET_ACCOUNT } from './credential-store.ts';
-import { updateTargetOrganization } from './target-registry.ts';
+  TargetSessionManager,
+  type TargetSessionDeps,
+} from './target-session-manager.js';
+import type { SettingsPort, TargetRecord } from './target-registry.js';
+
+export {
+  LoginRequiredError,
+  TargetSessionManager,
+  type BrowserOpener,
+  type TargetSessionDeps,
+  type TargetSessionManagerInit,
+} from './target-session-manager.js';
 
-export class LoginRequiredError extends Error {
-  readonly targetName: string;
-  constructor(targetName: string) {
-    super(`Login required. Run: zeroshot target login ${targetName}`);
-    this.name = 'LoginRequiredError';
-    this.targetName = targetName;
-  }
-}
-
-export interface BrowserOpener {
-  open(url: string): Promise<void>;
+export interface TargetAccessTokenProvider {
+  getAccessToken(signal?: AbortSignal): Promise<string>;
 }
 
-export interface TargetSessionDeps {
-  readonly http: HttpTransport;
-  readonly clock: Clock;
-  readonly browserOpener: BrowserOpener;
-  readonly stderr: { write(s: string): void };
-  readonly discoveryEndpoints: {
-    readonly deviceAuthorizationEndpoint: string;
-    readonly tokenEndpoint: string;
-    readonly revocationEndpoint?: string;
-    readonly clientId: string;
-  };
-}
+type LegacySessionDeps = Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'> & {
+  readonly settings?: SettingsPort;
+  readonly targetName?: string;
+  readonly clock?: Clock;
+};
 
-export async function targetLogin(
+type TargetLoginArgs = readonly [
   targetName: string,
   target: TargetRecord,
   credentialStore: TargetCredentialStore,
   acquireLock: () => Promise<() => Promise<void>>,
   settings: SettingsPort,
-  deps: TargetSessionDeps
-): Promise<{ organization: { id: string; name: string } }> {
-  const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
-  const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
-
-  const codeResponse = await requestDeviceCode(deviceAuthorizationEndpoint, clientId, http);
-
-  stderr.write(
-    `\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`
-  );
-
-  if (codeResponse.verification_uri_complete) {
-    try {
-      await browserOpener.open(codeResponse.verification_uri_complete);
-    } catch {
-      // Browser open is best-effort
-    }
-  }
-
-  const tokenResponse = await pollForToken(
-    tokenEndpoint,
-    clientId,
-    codeResponse.device_code,
-    codeResponse.interval,
-    codeResponse.expires_in,
-    http,
-    clock
-  );
-
-  if (!tokenResponse.organization) {
-    throw new UnboundSessionError(codeResponse.verification_uri);
-  }
+  deps: TargetSessionDeps,
+];
 
-  const serviceKey = targetServiceKey(target.id);
-  const release = await acquireLock();
-  try {
-    await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
-  } finally {
-    await release();
-  }
-
-  updateTargetOrganization(targetName, tokenResponse.organization, settings);
-
-  return { organization: tokenResponse.organization };
-}
-
-export async function refreshAccessToken(
+type RefreshAccessArgs = readonly [
   targetName: string,
   target: TargetRecord,
   credentialStore: TargetCredentialStore,
   acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>
-): Promise<{ accessToken: string; expiresIn: number }> {
-  const { http, discoveryEndpoints } = deps;
-  const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
-  const serviceKey = targetServiceKey(target.id);
+  deps: LegacySessionDeps,
+  clock?: Clock,
+];
 
-  const release = await acquireLock();
-  try {
-    const currentRefreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
-    if (!currentRefreshToken) {
-      throw new LoginRequiredError(targetName);
-    }
-
-    const body = new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: currentRefreshToken,
-      client_id: clientId,
-    });
-
-    let tokenResponse: TokenResponse;
-    const response = await http.fetch(tokenEndpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: body.toString(),
-      redirect: 'error',
-    });
-
-    if (!response.ok) {
-      const errorBody = (await response.json().catch(() => ({ error: 'unknown' }))) as {
-        error: string;
-      };
-      if (errorBody.error === 'invalid_grant') {
-        await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-        throw new LoginRequiredError(targetName);
-      }
-      throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
-    }
-
-    tokenResponse = (await response.json()) as TokenResponse;
-
-    try {
-      await credentialStore.set(serviceKey, TARGET_ACCOUNT, tokenResponse.refresh_token);
-    } catch {
-      await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
-      await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-      throw new LoginRequiredError(targetName);
-    }
+type RevokeArgs = readonly [
+  target: TargetRecord,
+  credentialStore: TargetCredentialStore,
+  acquireLock: () => Promise<() => Promise<void>>,
+  deps: LegacySessionDeps,
+  force: boolean,
+];
 
-    return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
-  } finally {
-    await release();
-  }
+type LegacyManagerInit = {
+  readonly targetName: string;
+  readonly target: TargetRecord;
+  readonly credentialStore: TargetCredentialStore;
+  readonly acquireLock: () => Promise<() => Promise<void>>;
+  readonly deps: LegacySessionDeps;
+  readonly clock?: Clock;
+};
+
+function transientSettings(targetName: string, target: TargetRecord): SettingsPort {
+  const state: { _targets: Record<string, TargetRecord> } = {
+    _targets: { [targetName]: target },
+  };
+  return {
+    load: () => state,
+    mutate: (mutator) => mutator(state),
+  };
 }
 
-async function bestEffortRevoke(
-  token: string,
-  revocationEndpoint: string | undefined,
-  clientId: string,
-  http: HttpTransport
-): Promise<void> {
-  if (!revocationEndpoint) return;
-  try {
-    const body = new URLSearchParams({
-      token,
-      client_id: clientId,
-      token_type_hint: 'refresh_token',
-    });
-    await http.fetch(revocationEndpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: body.toString(),
-      redirect: 'error',
-    });
-  } catch {
-    // Best-effort
-  }
+function legacyManager(init: LegacyManagerInit): TargetSessionManager {
+  const clock = init.clock ?? init.deps.clock ?? { now: () => Date.now() };
+  return new TargetSessionManager({
+    targetName: init.targetName,
+    target: init.target,
+    credentialStore: init.credentialStore,
+    acquireLock: init.acquireLock,
+    settings: init.deps.settings ?? transientSettings(init.targetName, init.target),
+    deps: {
+      http: init.deps.http,
+      clock,
+      browserOpener: { open: () => Promise.resolve() },
+      stderr: { write: () => undefined },
+      discoveryEndpoints: init.deps.discoveryEndpoints,
+    },
+  });
 }
 
-export interface TargetAccessTokenProvider {
-  getAccessToken(signal?: AbortSignal): Promise<string>;
+export function targetLogin(...args: TargetLoginArgs): Promise<{ organization: { id: string } }> {
+  const [targetName, target, credentialStore, acquireLock, settings, deps] = args;
+  return new TargetSessionManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    settings,
+    deps,
+  }).login();
 }
 
-export function getAccessTokenProvider(
-  targetName: string,
-  target: TargetRecord,
-  credentialStore: TargetCredentialStore,
-  acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
-  clock: Clock = { now: () => Date.now() }
-): TargetAccessTokenProvider {
-  let cachedToken: string | null = null;
-  let expiresAt = 0;
-
-  return {
-    async getAccessToken(_signal?: AbortSignal): Promise<string> {
-      if (cachedToken && clock.now() < expiresAt - 30_000) {
-        return cachedToken;
-      }
-      const result = await refreshAccessToken(
-        targetName,
-        target,
-        credentialStore,
-        acquireLock,
-        deps
-      );
-      cachedToken = result.accessToken;
-      expiresAt = clock.now() + result.expiresIn * 1000;
-      return result.accessToken;
-    },
-  };
+export async function refreshAccessToken(
+  ...args: RefreshAccessArgs
+): Promise<{ accessToken: string; expiresIn: number }> {
+  const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+  return legacyManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    deps,
+    ...(clock === undefined ? {} : { clock }),
+  }).getAccessTokenWithLifetime('capsule');
 }
 
-export async function revokeAndCleanup(
-  target: TargetRecord,
-  credentialStore: TargetCredentialStore,
-  acquireLock: () => Promise<() => Promise<void>>,
-  deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>,
-  force: boolean
-): Promise<void> {
-  const { http, discoveryEndpoints } = deps;
-  const { revocationEndpoint, clientId } = discoveryEndpoints;
-  const serviceKey = targetServiceKey(target.id);
+export function getAccessTokenProvider(...args: RefreshAccessArgs): TargetAccessTokenProvider {
+  const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+  return legacyManager({
+    targetName,
+    target,
+    credentialStore,
+    acquireLock,
+    deps,
+    ...(clock === undefined ? {} : { clock }),
+  }).tokenProvider('capsule');
+}
 
-  const release = await acquireLock();
-  try {
-    const refreshToken = await credentialStore.get(serviceKey, TARGET_ACCOUNT);
-    if (refreshToken && revocationEndpoint) {
-      const body = new URLSearchParams({
-        token: refreshToken,
-        client_id: clientId,
-        token_type_hint: 'refresh_token',
-      });
-      try {
-        const response = await http.fetch(revocationEndpoint, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-          body: body.toString(),
-          redirect: 'error',
-        });
-        if (!response.ok && !force) {
-          throw new Error(
-            `Remote revocation failed (${response.status}). Use --force to remove anyway.`
-          );
-        }
-      } catch (err) {
-        if (!force) throw err;
-      }
-    }
-    await credentialStore.delete(serviceKey, TARGET_ACCOUNT);
-  } finally {
-    await release();
-  }
+export function revokeAndCleanup(...args: RevokeArgs): Promise<void> {
+  const [target, credentialStore, acquireLock, deps, force] = args;
+  const targetName = deps.targetName ?? target.id;
+  return legacyManager({ targetName, target, credentialStore, acquireLock, deps }).revoke(force);
 }

package/src/target/token-response.ts

@@ -0,0 +1,62 @@
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+  'access_token',
+  'refresh_token',
+  'token_type',
+  'expires_in',
+  'refresh_expires_in',
+  'scope',
+] as const;
+
+export interface TokenResponse {
+  readonly access_token: string;
+  readonly refresh_token: string;
+  readonly token_type: 'Bearer';
+  readonly expires_in: number;
+}
+
+function boundedString(value: unknown, maxBytes: number): value is string {
+  return typeof value === 'string' && value.length > 0 &&
+    new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+
+function tokenFieldsValid(token: Record<string, unknown>): boolean {
+  const fields = Object.keys(token);
+  return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+    fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(
+      key as (typeof TOKEN_RESPONSE_FIELDS)[number],
+    ));
+}
+
+function tokenLifetimesValid(token: Record<string, unknown>): boolean {
+  return Number.isSafeInteger(token.expires_in) &&
+    (token.expires_in as number) > 0 &&
+    (token.expires_in as number) <= 86_400 &&
+    Number.isSafeInteger(token.refresh_expires_in) &&
+    (token.refresh_expires_in as number) > 0 &&
+    (token.refresh_expires_in as number) <= 31_536_000;
+}
+
+function tokenStringsValid(token: Record<string, unknown>): boolean {
+  return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+    boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+    token.token_type === 'Bearer' &&
+    boundedString(token.scope, 512) &&
+    !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+
+export function parseTokenResponse(value: unknown): TokenResponse {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error('Token response is malformed');
+  }
+  const token = value as Record<string, unknown>;
+  if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+    throw new Error('Token response is malformed');
+  }
+  return Object.freeze({
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    token_type: 'Bearer',
+    expires_in: token.expires_in,
+  }) as TokenResponse;
+}