@the-open-engine/zeroshot 6.29.0 → 6.30.0

package/lib/target/device-flow.js

@@ -1,8 +1,30 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = void 0;
+exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = exports.parseTokenResponse = void 0;
+exports.oauthFormRequest = oauthFormRequest;
 exports.requestDeviceCode = requestDeviceCode;
 exports.pollForToken = pollForToken;
+const bounded_response_js_1 = require("./bounded-response.js");
+const token_response_js_1 = require("./token-response.js");
+var token_response_js_2 = require("./token-response.js");
+Object.defineProperty(exports, "parseTokenResponse", { enumerable: true, get: function () { return token_response_js_2.parseTokenResponse; } });
+function exchangeFields(exchange) {
+    if (exchange === undefined)
+        return {};
+    if ('grantType' in exchange) {
+        return {
+            grant_type: exchange.grantType,
+            device_token: exchange.deviceToken,
+            device_label: exchange.deviceLabel,
+            audience: exchange.audience,
+        };
+    }
+    return {
+        device_token: exchange.token,
+        device_label: exchange.label,
+        audience: 'admin',
+    };
+}
 class DeviceFlowDeniedError extends Error {
     constructor() {
         super('Device authorization denied by user');
@@ -27,6 +49,104 @@ class UnboundSessionError extends Error {
 }
 exports.UnboundSessionError = UnboundSessionError;
 const DEFAULT_CLOCK = { now: () => Date.now() };
+const MAX_OAUTH_RESPONSE_BYTES = 64 * 1024;
+const MAX_DEVICE_CODE_BYTES = 16 * 1024;
+const LOOPBACK_HOSTS = Object.freeze({
+    '127.0.0.1': true,
+    '::1': true,
+    '[::1]': true,
+});
+const MAX_URI_BYTES = 4 * 1024;
+function oauthFormRequest(body, signal) {
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal !== undefined)
+        init.signal = signal;
+    return init;
+}
+async function requireResponseRoute(response, expectedUrl) {
+    if (!response.url || new URL(response.url).href === expectedUrl)
+        return;
+    await response.body?.cancel().catch(() => undefined);
+    throw new Error('OAuth response changed target route or authority');
+}
+async function readBoundedJson(response) {
+    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_OAUTH_RESPONSE_BYTES, (kind) => new Error(kind === 'size' ? 'OAuth response exceeds the size limit' : 'OAuth response is malformed'));
+}
+function boundedString(value, maxBytes) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes);
+}
+function safeVerificationAuthority(url, allowQuery) {
+    const literalLoopback = LOOPBACK_HOSTS[url.hostname] === true;
+    return !url.username && !url.password && !url.hash &&
+        (allowQuery || !url.search) &&
+        (url.protocol === 'https:' || (url.protocol === 'http:' && literalLoopback));
+}
+function verificationUrl(value, allowQuery) {
+    if (!boundedString(value, MAX_URI_BYTES) ||
+        /[\u0000-\u0020\u007f]|\s/u.test(value)) {
+        return false;
+    }
+    try {
+        const url = new URL(value);
+        return url.href === value && safeVerificationAuthority(url, allowQuery);
+    }
+    catch {
+        return false;
+    }
+}
+function deviceFieldsValid(device) {
+    const fields = Object.keys(device);
+    const required = ['device_code', 'user_code', 'verification_uri', 'expires_in', 'interval'];
+    return fields.every((field) => required.includes(field) || field === 'verification_uri_complete') && required.every((field) => field in device);
+}
+function deviceStringsValid(device) {
+    return boundedString(device.device_code, MAX_DEVICE_CODE_BYTES) &&
+        boundedString(device.user_code, 256) &&
+        verificationUrl(device.verification_uri, false) &&
+        (device.verification_uri_complete === undefined ||
+            verificationUrl(device.verification_uri_complete, true));
+}
+function deviceTimingValid(device) {
+    return Number.isSafeInteger(device.expires_in) &&
+        device.expires_in >= 1 &&
+        device.expires_in <= 86_400 &&
+        Number.isSafeInteger(device.interval) &&
+        device.interval >= 0 &&
+        device.interval <= 300;
+}
+function browserAuthorityMatches(device) {
+    return device.verification_uri_complete === undefined ||
+        new URL(device.verification_uri_complete).origin ===
+            new URL(device.verification_uri).origin;
+}
+function parseDeviceCodeResponse(value) {
+    const device = object(value, 'Device code');
+    if (!deviceFieldsValid(device) || !deviceStringsValid(device) ||
+        !deviceTimingValid(device) || !browserAuthorityMatches(device)) {
+        throw new Error('Device code response is malformed');
+    }
+    return Object.freeze(device);
+}
+function parseOAuthError(value) {
+    const error = object(value, 'OAuth error');
+    if (Object.keys(error).length !== 1 || typeof error.error !== 'string') {
+        throw new Error('OAuth error response is malformed');
+    }
+    return error.error;
+}
+function object(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${field} response is malformed`);
+    }
+    return value;
+}
 function sleep(ms, signal) {
     return new Promise((resolve, reject) => {
         if (signal?.aborted) {
@@ -41,69 +161,53 @@ function sleep(ms, signal) {
     });
 }
 async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
-    const body = new URLSearchParams({
-        client_id: clientId,
-        scope: 'openid',
-    });
-    const init = {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-        redirect: 'error',
-    };
-    if (signal)
-        init.signal = signal;
-    const response = await http.fetch(deviceAuthorizationEndpoint, init);
+    const body = new URLSearchParams({ client_id: clientId });
+    const response = await http.fetch(deviceAuthorizationEndpoint, oauthFormRequest(body, signal));
+    await requireResponseRoute(response, deviceAuthorizationEndpoint);
     if (!response.ok) {
-        const text = await response.text();
-        throw new Error(`Device code request failed (${response.status}): ${text}`);
+        parseOAuthError(await readBoundedJson(response));
+        throw new Error(`Device code request failed (${response.status})`);
     }
-    return (await response.json());
+    return parseDeviceCodeResponse(await readBoundedJson(response));
+}
+async function parsePollResponse(response) {
+    if (response.ok)
+        return (0, token_response_js_1.parseTokenResponse)(await readBoundedJson(response));
+    const error = parseOAuthError(await readBoundedJson(response));
+    if (error === 'authorization_pending' || error === 'slow_down')
+        return error;
+    if (error === 'access_denied')
+        throw new DeviceFlowDeniedError();
+    if (error === 'expired_token')
+        throw new DeviceFlowExpiredError();
+    throw new Error('Token endpoint returned an unsupported OAuth error');
 }
-async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal, deviceIdentity) {
-    const deadline = clock.now() + expiresIn * 1000;
-    let currentInterval = interval;
+function pollBody(request) {
+    return new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        device_code: request.deviceCode,
+        client_id: request.clientId,
+        ...exchangeFields(request.exchange),
+    });
+}
+async function pollForToken(request) {
+    const clock = request.clock ?? DEFAULT_CLOCK;
+    const deadline = clock.now() + request.expiresIn * 1000;
+    let currentInterval = request.interval;
     while (clock.now() < deadline) {
-        if (signal?.aborted) {
-            throw signal.reason ?? new DOMException('Aborted', 'AbortError');
-        }
-        await sleep(currentInterval * 1000, signal);
-        const body = new URLSearchParams({
-            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-            device_code: deviceCode,
-            client_id: clientId,
-        });
-        if (deviceIdentity) {
-            body.set('audience', 'admin');
-            body.set('device_token', deviceIdentity.token);
-            body.set('device_label', deviceIdentity.label);
-        }
-        const init = {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        };
-        if (signal)
-            init.signal = signal;
-        const response = await http.fetch(tokenEndpoint, init);
-        if (response.ok) {
-            return (await response.json());
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new DOMException('Aborted', 'AbortError');
         }
-        const errorBody = (await response.json());
-        switch (errorBody.error) {
-            case 'authorization_pending':
-                continue;
-            case 'slow_down':
-                currentInterval += 5;
-                continue;
-            case 'access_denied':
-                throw new DeviceFlowDeniedError();
-            case 'expired_token':
-                throw new DeviceFlowExpiredError();
-            default:
-                throw new Error(`Token endpoint error: ${errorBody.error}`);
+        await sleep(currentInterval * 1000, request.signal);
+        const response = await request.http.fetch(request.tokenEndpoint, oauthFormRequest(pollBody(request), request.signal));
+        const result = await parsePollResponse(response);
+        if (result === 'authorization_pending')
+            continue;
+        if (result === 'slow_down') {
+            currentInterval += 5;
+            continue;
         }
+        return result;
     }
     throw new DeviceFlowExpiredError();
 }

package/lib/target/device-flow.mjs

@@ -0,0 +1,203 @@
+import { readBoundedResponseJson } from './bounded-response.mjs';
+import { parseTokenResponse } from './token-response.mjs';
+export { parseTokenResponse } from './token-response.mjs';
+function exchangeFields(exchange) {
+    if (exchange === undefined)
+        return {};
+    if ('grantType' in exchange) {
+        return {
+            grant_type: exchange.grantType,
+            device_token: exchange.deviceToken,
+            device_label: exchange.deviceLabel,
+            audience: exchange.audience,
+        };
+    }
+    return {
+        device_token: exchange.token,
+        device_label: exchange.label,
+        audience: 'admin',
+    };
+}
+export class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super('Device authorization denied by user');
+        this.name = 'DeviceFlowDeniedError';
+    }
+}
+export class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super('Device authorization code expired');
+        this.name = 'DeviceFlowExpiredError';
+    }
+}
+export class UnboundSessionError extends Error {
+    verificationUri;
+    constructor(verificationUri) {
+        super(`Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`);
+        this.name = 'UnboundSessionError';
+        this.verificationUri = verificationUri;
+    }
+}
+const DEFAULT_CLOCK = { now: () => Date.now() };
+const MAX_OAUTH_RESPONSE_BYTES = 64 * 1024;
+const MAX_DEVICE_CODE_BYTES = 16 * 1024;
+const LOOPBACK_HOSTS = Object.freeze({
+    '127.0.0.1': true,
+    '::1': true,
+    '[::1]': true,
+});
+const MAX_URI_BYTES = 4 * 1024;
+export function oauthFormRequest(body, signal) {
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal !== undefined)
+        init.signal = signal;
+    return init;
+}
+async function requireResponseRoute(response, expectedUrl) {
+    if (!response.url || new URL(response.url).href === expectedUrl)
+        return;
+    await response.body?.cancel().catch(() => undefined);
+    throw new Error('OAuth response changed target route or authority');
+}
+async function readBoundedJson(response) {
+    return readBoundedResponseJson(response, MAX_OAUTH_RESPONSE_BYTES, (kind) => new Error(kind === 'size' ? 'OAuth response exceeds the size limit' : 'OAuth response is malformed'));
+}
+function boundedString(value, maxBytes) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes);
+}
+function safeVerificationAuthority(url, allowQuery) {
+    const literalLoopback = LOOPBACK_HOSTS[url.hostname] === true;
+    return !url.username && !url.password && !url.hash &&
+        (allowQuery || !url.search) &&
+        (url.protocol === 'https:' || (url.protocol === 'http:' && literalLoopback));
+}
+function verificationUrl(value, allowQuery) {
+    if (!boundedString(value, MAX_URI_BYTES) ||
+        /[\u0000-\u0020\u007f]|\s/u.test(value)) {
+        return false;
+    }
+    try {
+        const url = new URL(value);
+        return url.href === value && safeVerificationAuthority(url, allowQuery);
+    }
+    catch {
+        return false;
+    }
+}
+function deviceFieldsValid(device) {
+    const fields = Object.keys(device);
+    const required = ['device_code', 'user_code', 'verification_uri', 'expires_in', 'interval'];
+    return fields.every((field) => required.includes(field) || field === 'verification_uri_complete') && required.every((field) => field in device);
+}
+function deviceStringsValid(device) {
+    return boundedString(device.device_code, MAX_DEVICE_CODE_BYTES) &&
+        boundedString(device.user_code, 256) &&
+        verificationUrl(device.verification_uri, false) &&
+        (device.verification_uri_complete === undefined ||
+            verificationUrl(device.verification_uri_complete, true));
+}
+function deviceTimingValid(device) {
+    return Number.isSafeInteger(device.expires_in) &&
+        device.expires_in >= 1 &&
+        device.expires_in <= 86_400 &&
+        Number.isSafeInteger(device.interval) &&
+        device.interval >= 0 &&
+        device.interval <= 300;
+}
+function browserAuthorityMatches(device) {
+    return device.verification_uri_complete === undefined ||
+        new URL(device.verification_uri_complete).origin ===
+            new URL(device.verification_uri).origin;
+}
+function parseDeviceCodeResponse(value) {
+    const device = object(value, 'Device code');
+    if (!deviceFieldsValid(device) || !deviceStringsValid(device) ||
+        !deviceTimingValid(device) || !browserAuthorityMatches(device)) {
+        throw new Error('Device code response is malformed');
+    }
+    return Object.freeze(device);
+}
+function parseOAuthError(value) {
+    const error = object(value, 'OAuth error');
+    if (Object.keys(error).length !== 1 || typeof error.error !== 'string') {
+        throw new Error('OAuth error response is malformed');
+    }
+    return error.error;
+}
+function object(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${field} response is malformed`);
+    }
+    return value;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        }, { once: true });
+    });
+}
+export async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
+    const body = new URLSearchParams({ client_id: clientId });
+    const response = await http.fetch(deviceAuthorizationEndpoint, oauthFormRequest(body, signal));
+    await requireResponseRoute(response, deviceAuthorizationEndpoint);
+    if (!response.ok) {
+        parseOAuthError(await readBoundedJson(response));
+        throw new Error(`Device code request failed (${response.status})`);
+    }
+    return parseDeviceCodeResponse(await readBoundedJson(response));
+}
+async function parsePollResponse(response) {
+    if (response.ok)
+        return parseTokenResponse(await readBoundedJson(response));
+    const error = parseOAuthError(await readBoundedJson(response));
+    if (error === 'authorization_pending' || error === 'slow_down')
+        return error;
+    if (error === 'access_denied')
+        throw new DeviceFlowDeniedError();
+    if (error === 'expired_token')
+        throw new DeviceFlowExpiredError();
+    throw new Error('Token endpoint returned an unsupported OAuth error');
+}
+function pollBody(request) {
+    return new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        device_code: request.deviceCode,
+        client_id: request.clientId,
+        ...exchangeFields(request.exchange),
+    });
+}
+export async function pollForToken(request) {
+    const clock = request.clock ?? DEFAULT_CLOCK;
+    const deadline = clock.now() + request.expiresIn * 1000;
+    let currentInterval = request.interval;
+    while (clock.now() < deadline) {
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        await sleep(currentInterval * 1000, request.signal);
+        const response = await request.http.fetch(request.tokenEndpoint, oauthFormRequest(pollBody(request), request.signal));
+        const result = await parsePollResponse(response);
+        if (result === 'authorization_pending')
+            continue;
+        if (result === 'slow_down') {
+            currentInterval += 5;
+            continue;
+        }
+        return result;
+    }
+    throw new DeviceFlowExpiredError();
+}

package/lib/target/discovery-errors.cjs

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetDiscoveryError = void 0;
+class TargetDiscoveryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TargetDiscoveryError';
+    }
+}
+exports.TargetDiscoveryError = TargetDiscoveryError;

package/lib/target/discovery-errors.d.cts

@@ -0,0 +1,3 @@
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}

package/lib/target/discovery-errors.d.mts

@@ -0,0 +1,3 @@
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}

package/lib/target/discovery-errors.d.ts

@@ -0,0 +1,3 @@
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}

package/lib/target/discovery-errors.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetDiscoveryError = void 0;
+class TargetDiscoveryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TargetDiscoveryError';
+    }
+}
+exports.TargetDiscoveryError = TargetDiscoveryError;

package/lib/target/discovery-errors.mjs

@@ -0,0 +1,6 @@
+export class TargetDiscoveryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TargetDiscoveryError';
+    }
+}