@theholocron/holocron-plugin-infisical 5.0.0-alpha.35 → 5.0.0-alpha.351
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/index.d.mts +29 -45
- package/dist/index.mjs +29 -12
- package/package.json +27 -25
package/README.md
CHANGED
|
@@ -160,7 +160,7 @@ Set the `baseUrl` option in `holocron.config.json`:
|
|
|
160
160
|
|
|
161
161
|
## Status
|
|
162
162
|
|
|
163
|
-
**`v2.0.0-alpha.1`** — scaffolded via `holocron plugin
|
|
163
|
+
**`v2.0.0-alpha.1`** — scaffolded via `holocron new plugin` (see
|
|
164
164
|
`docs/wiki/specifications/tool-plugin-create.spec.md` — this is the first real
|
|
165
165
|
production use of that command, doubling as its acceptance test in
|
|
166
166
|
a live scenario). Not yet published on npm; capability methods are
|
package/dist/index.d.mts
CHANGED
|
@@ -1,24 +1,27 @@
|
|
|
1
|
-
import { AuthError, EnsureResult, ResolveTokenInput, Vault } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, EnsureResult, PluginToken, ResolveTokenInput, Vault, VerifyTokenFailure, VerifyTokenResult, VerifyTokenResult as VerifyTokenResult$1, VerifyTokenSuccess } from "@theholocron/cli";
|
|
2
2
|
import { InfisicalClient, InfisicalClient as InfisicalClient$1, InfisicalClientOptions, createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
4
|
-
declare const resolveToken: (
|
|
5
|
-
|
|
6
|
-
|
|
3
|
+
/** Resolves the Infisical token from `--token`, `HOLOCRON_INFISICAL_TOKEN`, `INFISICAL_TOKEN` or the keyring entry for `infisical`, and throws `AuthError` when none is set. */
|
|
4
|
+
export declare const resolveToken: import("@theholocron/cli").TokenResolver;
|
|
5
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
6
|
+
export declare const tokens: PluginToken[];
|
|
7
7
|
interface InfisicalVaultOptions {
|
|
8
8
|
/** Default workspace (project) id — read/list/etc. operate here unless overridden. */
|
|
9
9
|
workspace: string;
|
|
10
10
|
/** Default environment slug — e.g., "dev", "stg", "prd". */
|
|
11
11
|
environment: string;
|
|
12
12
|
}
|
|
13
|
-
|
|
13
|
+
/** `vault` capability for Infisical, with references shaped `infisical://<workspaceId>/<environment>/<name>`. */
|
|
14
|
+
export declare class InfisicalVault implements Vault {
|
|
14
15
|
private readonly client;
|
|
16
|
+
/** Capability key; always `"vault"`. */
|
|
15
17
|
readonly key: "vault";
|
|
18
|
+
/** Provider name; always `"infisical"`. */
|
|
16
19
|
readonly providerName = "infisical";
|
|
17
20
|
private readonly workspace;
|
|
18
21
|
private readonly environment;
|
|
19
22
|
/**
|
|
20
23
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
21
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
24
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
22
25
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
23
26
|
* calls in the same run.
|
|
24
27
|
*/
|
|
@@ -33,54 +36,36 @@ declare class InfisicalVault implements Vault {
|
|
|
33
36
|
ensureEnvironment(project: string, name: string): Promise<EnsureResult>;
|
|
34
37
|
private resolveWorkspaceId;
|
|
35
38
|
}
|
|
36
|
-
//#endregion
|
|
37
|
-
//#region src/verify-token.d.ts
|
|
38
|
-
/**
|
|
39
|
-
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
40
|
-
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
41
|
-
* response permissively:
|
|
42
|
-
*
|
|
43
|
-
* - 200 → token is valid AND has workspace-list scope; report the
|
|
44
|
-
* workspace count + first workspace name.
|
|
45
|
-
* - 403 → token is valid (authenticated) but doesn't have scope
|
|
46
|
-
* to list workspaces at the org level. This is normal for
|
|
47
|
-
* Universal Auth machine-identity tokens that are scoped to a
|
|
48
|
-
* specific workspace rather than org-wide. Return ok with a
|
|
49
|
-
* "scope-limited" subject — the operator's `holocron.config.json`
|
|
50
|
-
* will name the specific workspace + environment the token
|
|
51
|
-
* actually has access to.
|
|
52
|
-
* - 401 or other → token is invalid.
|
|
53
|
-
*/
|
|
54
|
-
interface VerifyTokenSuccess {
|
|
55
|
-
ok: true;
|
|
56
|
-
subject: string;
|
|
57
|
-
}
|
|
58
|
-
interface VerifyTokenFailure {
|
|
59
|
-
ok: false;
|
|
60
|
-
message: string;
|
|
61
|
-
}
|
|
62
|
-
type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
|
|
63
39
|
interface VerifyTokenOptions {
|
|
64
40
|
baseUrl?: string;
|
|
65
41
|
fetch?: typeof fetch;
|
|
66
42
|
}
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
43
|
+
/** Checks an Infisical token by listing workspaces; a 403 is reported as a valid but scope-limited token. */
|
|
44
|
+
export declare function verifyToken(token: string, opts?: VerifyTokenOptions): Promise<VerifyTokenResult$1>;
|
|
45
|
+
/** Options for the Infisical plugin: the token lookup inputs plus the default workspace and environment. */
|
|
46
|
+
export interface InfisicalPluginOptions extends ResolveTokenInput, InfisicalVaultOptions {
|
|
71
47
|
/** Override base URL for tests (or self-hosted Infisical). */
|
|
72
48
|
baseUrl?: string;
|
|
73
49
|
/** Override `fetch` for tests. */
|
|
74
50
|
fetch?: typeof fetch;
|
|
75
51
|
}
|
|
76
|
-
|
|
52
|
+
/** Shared state for one Infisical plugin instance: its options and a lazily created client. */
|
|
53
|
+
export interface PluginContext {
|
|
54
|
+
/** The options the plugin was created with. */
|
|
77
55
|
options: InfisicalPluginOptions;
|
|
56
|
+
/** Returns the memoized Infisical client; the token is resolved on the first call, not at plugin load. */
|
|
78
57
|
client: () => InfisicalClient;
|
|
79
58
|
}
|
|
80
|
-
|
|
81
|
-
declare function
|
|
82
|
-
|
|
59
|
+
/** Builds the plugin context from its options. */
|
|
60
|
+
export declare function createContext(options: InfisicalPluginOptions): PluginContext;
|
|
61
|
+
/** Builds the `vault` capability for the context's default workspace and environment. */
|
|
62
|
+
export declare function vault(ctx: PluginContext): Vault;
|
|
63
|
+
/** Creates the Infisical plugin: its `connection` probe and the `vault` capability. */
|
|
64
|
+
export declare function createPlugin(options: InfisicalPluginOptions): {
|
|
83
65
|
name: string;
|
|
66
|
+
probes: {
|
|
67
|
+
connection: import("@theholocron/cli").Probe;
|
|
68
|
+
};
|
|
84
69
|
capabilities: {
|
|
85
70
|
vault: () => Vault;
|
|
86
71
|
};
|
|
@@ -89,6 +74,5 @@ declare function createPlugin(options: InfisicalPluginOptions): {
|
|
|
89
74
|
* One-line hint printed by `holocron auth set infisical` when no
|
|
90
75
|
* token is supplied or the supplied token is rejected.
|
|
91
76
|
*/
|
|
92
|
-
declare const AUTH_HINT: string;
|
|
93
|
-
|
|
94
|
-
export { AUTH_HINT, AuthError, type InfisicalClient, type InfisicalClientOptions, InfisicalPluginOptions, InfisicalVault, PluginContext, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
|
77
|
+
export declare const AUTH_HINT: string;
|
|
78
|
+
export { AuthError, type InfisicalClient, type InfisicalClientOptions, type ResolveTokenInput, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createInfisicalClient };
|
package/dist/index.mjs
CHANGED
|
@@ -1,23 +1,29 @@
|
|
|
1
|
-
import { AuthError, ProviderApiError, createResolveToken } from "@theholocron/cli";
|
|
1
|
+
import { AuthError, ProviderApiError, connectionProbe, createResolveToken } from "@theholocron/cli";
|
|
2
2
|
import { createInfisicalClient } from "@theholocron/infisical-client";
|
|
3
|
-
|
|
3
|
+
import { errorMessage } from "@theholocron/misc-utils";
|
|
4
|
+
// src/auth.ts
|
|
5
|
+
/** Resolves the Infisical token from `--token`, `HOLOCRON_INFISICAL_TOKEN`, `INFISICAL_TOKEN` or the keyring entry for `infisical`, and throws `AuthError` when none is set. */
|
|
4
6
|
const resolveToken = createResolveToken({
|
|
5
7
|
envName: "HOLOCRON_INFISICAL_TOKEN",
|
|
6
8
|
vendorEnvName: "INFISICAL_TOKEN",
|
|
7
9
|
keyringService: "infisical",
|
|
8
10
|
errorMessage: "no Infisical token found. Pass --token <TOKEN>, set HOLOCRON_INFISICAL_TOKEN / INFISICAL_TOKEN, or run: holocron auth set infisical <TOKEN>"
|
|
9
11
|
});
|
|
10
|
-
|
|
11
|
-
|
|
12
|
+
/** Every token this plugin takes, for `holocron doctor tokens`. */
|
|
13
|
+
const tokens = [resolveToken.token];
|
|
14
|
+
// src/capabilities/vault.ts
|
|
15
|
+
/** `vault` capability for Infisical, with references shaped `infisical://<workspaceId>/<environment>/<name>`. */
|
|
12
16
|
var InfisicalVault = class {
|
|
13
17
|
client;
|
|
18
|
+
/** Capability key; always `"vault"`. */
|
|
14
19
|
key = "vault";
|
|
20
|
+
/** Provider name; always `"infisical"`. */
|
|
15
21
|
providerName = "infisical";
|
|
16
22
|
workspace;
|
|
17
23
|
environment;
|
|
18
24
|
/**
|
|
19
25
|
* Cache of resolved workspace name/slug → id. `ensureEnvironment`
|
|
20
|
-
* is called once per environment during `holocron setup` (dev / stg
|
|
26
|
+
* is called once per environment during `holocron repo setup` (dev / stg
|
|
21
27
|
* / prd), so a single `GET /v1/workspace` lookup covers all three
|
|
22
28
|
* calls in the same run.
|
|
23
29
|
*/
|
|
@@ -135,8 +141,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
135
141
|
if (typeof details !== "string") return false;
|
|
136
142
|
return /already exists|duplicate/i.test(details);
|
|
137
143
|
}
|
|
138
|
-
|
|
139
|
-
//#region src/verify-token.ts
|
|
144
|
+
// src/verify-token.ts
|
|
140
145
|
/**
|
|
141
146
|
* `verifyToken` — plugin-level export used by `holocron auth set` +
|
|
142
147
|
* `holocron auth check`. Hits `GET /v1/workspace` and interprets the
|
|
@@ -153,6 +158,7 @@ function hasAlreadyExistsBody(details) {
|
|
|
153
158
|
* actually has access to.
|
|
154
159
|
* - 401 or other → token is invalid.
|
|
155
160
|
*/
|
|
161
|
+
/** Checks an Infisical token by listing workspaces; a 403 is reported as a valid but scope-limited token. */
|
|
156
162
|
async function verifyToken(token, opts = {}) {
|
|
157
163
|
const client = createInfisicalClient({
|
|
158
164
|
token,
|
|
@@ -175,12 +181,12 @@ async function verifyToken(token, opts = {}) {
|
|
|
175
181
|
};
|
|
176
182
|
return {
|
|
177
183
|
ok: false,
|
|
178
|
-
message:
|
|
184
|
+
message: errorMessage(err)
|
|
179
185
|
};
|
|
180
186
|
}
|
|
181
187
|
}
|
|
182
|
-
|
|
183
|
-
|
|
188
|
+
// src/index.ts
|
|
189
|
+
/** Builds the plugin context from its options. */
|
|
184
190
|
function createContext(options) {
|
|
185
191
|
let client;
|
|
186
192
|
return {
|
|
@@ -192,16 +198,28 @@ function createContext(options) {
|
|
|
192
198
|
})
|
|
193
199
|
};
|
|
194
200
|
}
|
|
201
|
+
/** Builds the `vault` capability for the context's default workspace and environment. */
|
|
195
202
|
function vault(ctx) {
|
|
196
203
|
return new InfisicalVault(ctx.client, {
|
|
197
204
|
workspace: ctx.options.workspace,
|
|
198
205
|
environment: ctx.options.environment
|
|
199
206
|
});
|
|
200
207
|
}
|
|
208
|
+
/** Creates the Infisical plugin: its `connection` probe and the `vault` capability. */
|
|
201
209
|
function createPlugin(options) {
|
|
202
210
|
const ctx = createContext(options);
|
|
203
211
|
return {
|
|
204
212
|
name: "@theholocron/holocron-plugin-infisical",
|
|
213
|
+
probes: { connection: connectionProbe({
|
|
214
|
+
provider: "Infisical",
|
|
215
|
+
url: options.baseUrl ?? "https://app.infisical.com",
|
|
216
|
+
fetch: options.fetch,
|
|
217
|
+
token: () => resolveToken(options),
|
|
218
|
+
verify: (token) => verifyToken(token, {
|
|
219
|
+
baseUrl: options.baseUrl,
|
|
220
|
+
fetch: options.fetch
|
|
221
|
+
})
|
|
222
|
+
}) },
|
|
205
223
|
capabilities: { vault: () => vault(ctx) }
|
|
206
224
|
};
|
|
207
225
|
}
|
|
@@ -210,5 +228,4 @@ function createPlugin(options) {
|
|
|
210
228
|
* token is supplied or the supplied token is rejected.
|
|
211
229
|
*/
|
|
212
230
|
const AUTH_HINT = "generate a Token Auth token on your machine identity (organization → access control → identities → your identity → add auth method → Token Auth → create token) OR a Personal API Token, then: holocron auth set infisical <TOKEN>. NOT Universal Auth's Client Secret — that needs a login exchange this plugin doesn't do yet.";
|
|
213
|
-
|
|
214
|
-
export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, vault, verifyToken };
|
|
231
|
+
export { AUTH_HINT, AuthError, InfisicalVault, createContext, createInfisicalClient, createPlugin, resolveToken, tokens, vault, verifyToken };
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@theholocron/holocron-plugin-infisical",
|
|
3
|
-
"version": "5.0.0-alpha.
|
|
3
|
+
"version": "5.0.0-alpha.351",
|
|
4
4
|
"description": "Holocron plugin for Infisical. Implements the vault capability against Infisical's REST API, plus exports verifyToken + AUTH_HINT for `holocron auth`.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"holocron",
|
|
@@ -8,12 +8,12 @@
|
|
|
8
8
|
"plugin",
|
|
9
9
|
"vault"
|
|
10
10
|
],
|
|
11
|
-
"homepage": "https://
|
|
11
|
+
"homepage": "https://docs.theholocron.dev/holocron/plugins/infisical/",
|
|
12
12
|
"bugs": "https://github.com/theholocron/holocron/issues",
|
|
13
13
|
"repository": {
|
|
14
14
|
"type": "git",
|
|
15
15
|
"url": "git+https://github.com/theholocron/holocron.git",
|
|
16
|
-
"directory": "
|
|
16
|
+
"directory": "plugins/holocron-plugin-infisical"
|
|
17
17
|
},
|
|
18
18
|
"license": "MIT",
|
|
19
19
|
"author": "Newton Koumantzelis",
|
|
@@ -30,27 +30,29 @@
|
|
|
30
30
|
"dist"
|
|
31
31
|
],
|
|
32
32
|
"devDependencies": {
|
|
33
|
-
"@theholocron/eslint-config": "^8.0.0",
|
|
34
|
-
"@theholocron/http-client": "^1.24.0",
|
|
35
|
-
"@theholocron/infisical-client": "^1.24.0",
|
|
36
|
-
"@theholocron/tsconfig": "^8.0.0",
|
|
37
|
-
"@theholocron/tsdown-config": "^8.0.0",
|
|
38
|
-
"@theholocron/vitest-config": "^8.0.0",
|
|
39
33
|
"@types/node": "^26",
|
|
40
|
-
"@vitest/coverage-v8": "^
|
|
41
|
-
"@vitest/eslint-plugin": "^1.6.
|
|
42
|
-
"eslint": "^10.
|
|
43
|
-
"eslint-plugin-n": "^18.
|
|
44
|
-
"globals": "^17.
|
|
45
|
-
"tsdown": "^0.
|
|
46
|
-
"tsx": "4.23.
|
|
34
|
+
"@vitest/coverage-v8": "^5.0.5",
|
|
35
|
+
"@vitest/eslint-plugin": "^1.6.28",
|
|
36
|
+
"eslint": "^10.14.0",
|
|
37
|
+
"eslint-plugin-n": "^18.5.0",
|
|
38
|
+
"globals": "^17.14.0",
|
|
39
|
+
"tsdown": "^0.23.4",
|
|
40
|
+
"tsx": "4.23.15",
|
|
47
41
|
"typescript": "^5.9.3",
|
|
48
|
-
"vitest": "^
|
|
49
|
-
"@theholocron/cli": "5.0.0-alpha.
|
|
42
|
+
"vitest": "^5.0.5",
|
|
43
|
+
"@theholocron/cli": "5.0.0-alpha.351",
|
|
44
|
+
"@theholocron/eslint-config": "^8.9.0-alpha.8",
|
|
45
|
+
"@theholocron/http-client": "^1.58.0-alpha.11",
|
|
46
|
+
"@theholocron/infisical-client": "^1.58.0-alpha.11",
|
|
47
|
+
"@theholocron/misc-utils": "^1.17.0-alpha.1",
|
|
48
|
+
"@theholocron/tsconfig": "^8.9.0-alpha.8",
|
|
49
|
+
"@theholocron/tsdown-config": "^8.9.0-alpha.8",
|
|
50
|
+
"@theholocron/vitest-config": "^8.9.0-alpha.8"
|
|
50
51
|
},
|
|
51
52
|
"peerDependencies": {
|
|
52
|
-
"@theholocron/infisical-client": "^1.
|
|
53
|
-
"@theholocron/
|
|
53
|
+
"@theholocron/infisical-client": "^1.43.1",
|
|
54
|
+
"@theholocron/misc-utils": "^1.16.0",
|
|
55
|
+
"@theholocron/cli": "5.0.0-alpha.351"
|
|
54
56
|
},
|
|
55
57
|
"peerDependenciesMeta": {
|
|
56
58
|
"@theholocron/infisical-client": {}
|
|
@@ -62,11 +64,11 @@
|
|
|
62
64
|
"access": "public"
|
|
63
65
|
},
|
|
64
66
|
"scripts": {
|
|
65
|
-
"
|
|
66
|
-
"
|
|
67
|
+
"build": "tsdown",
|
|
68
|
+
"lint:code": "eslint .",
|
|
69
|
+
"test:unit": "vitest run --coverage",
|
|
67
70
|
"test:watch": "vitest",
|
|
68
|
-
"
|
|
69
|
-
"
|
|
70
|
-
"verification.unitTests": "holocron run verification.unitTests --"
|
|
71
|
+
"typecheck": "tsc --noEmit",
|
|
72
|
+
"validate:plugin": "tsx scripts/validate.mjs"
|
|
71
73
|
}
|
|
72
74
|
}
|