@uipath/authz-commands 1.204.0-preview.255 → 1.205.0-preview.256

package/dist/index.js

@@ -2206,22 +2206,12 @@ var resolveConfigAsync = async ({
     baseUrl = DEFAULT_BASE_URL;
   }
   baseUrl = normalizeAndValidateBaseUrl(baseUrl);
-  let clientId = customClientId;
-  if (!clientId && fileAuth.clientId) {
-    clientId = fileAuth.clientId;
-  }
-  if (!clientId) {
-    clientId = DEFAULT_CLIENT_ID;
-  }
-  let clientSecret = customClientSecret;
-  if (!clientSecret && fileAuth.clientSecret) {
-    clientSecret = fileAuth.clientSecret;
-  }
-  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(clientSecret) || Boolean(customClientAssertion));
+  const clientId = customClientId || DEFAULT_CLIENT_ID;
+  const isExternalAppAuth = clientId !== DEFAULT_CLIENT_ID && (Boolean(customClientSecret) || Boolean(customClientAssertion));
   const scopes = resolveScopes(isExternalAppAuth, customScopes, fileAuth.scopes);
   return {
     clientId,
-    clientSecret,
+    clientSecret: customClientSecret,
     scopes,
     baseUrl,
     authorizationEndpoint: `${baseUrl}/identity_/connect/authorize`,
@@ -2414,6 +2404,16 @@ class NodeFileSystem {
   async rename(oldPath, newPath) {
     await fs.rename(oldPath, newPath);
   }
+  async isSymbolicLink(filePath) {
+    try {
+      return (await fs.lstat(filePath)).isSymbolicLink();
+    } catch (error) {
+      if (this.isEnoent(error) || this.hasErrnoCode(error, "ENOTDIR")) {
+        return false;
+      }
+      throw error;
+    }
+  }
   async realpath(filePath) {
     try {
       return await fs.realpath(filePath);
@@ -2625,6 +2625,16 @@ var resolveIdentityType = (claims, authFlow, email) => {
   }
   return;
 };
+var resolveApplicationSubtype = (claims, authFlow) => {
+  switch (asString(claims?.sub_type)) {
+    case "service.external":
+      return "External";
+    case "service.internal":
+      return "Internal";
+    default:
+      return authFlow === "client_credentials" || authFlow === "federated_credentials" ? "External" : undefined;
+  }
+};
 var looksLikeEmail = (value) => value?.includes("@") ?? false;
 var pickEmail = (claims) => {
   for (const candidate of [claims?.email, claims?.preferred_username]) {
@@ -2666,6 +2676,12 @@ var resolveSessionIdentity = (accessToken, authFlow) => {
   const clientId = asString(claims?.client_id);
   if (clientId)
     identity.clientId = clientId;
+  const subType = asString(claims?.sub_type);
+  if (subType)
+    identity.subType = subType;
+  const applicationSubtype = resolveApplicationSubtype(claims, authFlow);
+  if (applicationSubtype)
+    identity.applicationSubtype = applicationSubtype;
   return identity;
 };
 var readTokenScopes = (accessToken) => accessToken ? pickScopes(decodeClaims(accessToken)) : undefined;
@@ -2958,6 +2974,40 @@ var tryRobotClientFallback = async (options = {}) => {
   }
 };
 
+// ../../auth/src/tenantSelection.ts
+var LOGIN_STATUS_HINT = "Run 'uip login status' to see the organization the CLI is signed in to.";
+var organizationHint = (organizationId) => `The request used '${organizationId}' as the organization. ${LOGIN_STATUS_HINT}`;
+var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
+var describeNonJsonResponse = (organizationId, response, parseError) => {
+  if (response.redirected) {
+    return `Could not find organization '${organizationId}': the request was ` + `redirected to a sign-in page instead of the organization's tenant ` + `list. ${LOGIN_STATUS_HINT}`;
+  }
+  const contentType = response.headers.get("content-type") ?? "unknown";
+  return `The organization service returned a '${contentType}' response instead ` + `of JSON: ${parseError.message}. ${organizationHint(organizationId)}`;
+};
+var fetchTenantsAndOrganizations = async (baseUrl, accessToken, organizationId, signal) => {
+  const url = `${baseUrl}/${organizationId}/portal_/api/filtering/leftnav/tenantsAndOrganizationInfo`;
+  const response = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new Error(`Unauthorized: the access token was rejected, it was not ` + `issued for organization '${organizationId}', or ` + `'${organizationId}' was not accepted as an organization ` + `URL segment in this environment. ` + LOGIN_STATUS_HINT);
+    }
+    const errorText = await response.text();
+    const message = `Failed to get tenants and organizations: ${response.status} ${errorText}`;
+    throw new Error(IDENTIFIER_STATUSES.has(response.status) ? `${message}. ${organizationHint(organizationId)}` : message);
+  }
+  const [parseError, data] = await catchError(response.json());
+  if (parseError) {
+    throw new Error(describeNonJsonResponse(organizationId, response, parseError));
+  }
+  return data;
+};
+
 // ../../auth/src/tokenRefresh.ts
 var TOKEN_REFRESH_REAUTHENTICATE_MESSAGE = "Token refresh failed. Run 'uip login' to re-authenticate.";
 
@@ -3170,6 +3220,8 @@ var saveEnvFileAsync = async ({
 };
 
 // ../../auth/src/loginStatus.ts
+var defaultRobotTenantIdCache = new Map;
+var ROBOT_TENANT_LOOKUP_TIMEOUT_MS = 5000;
 var getLoginStatusAsync = async (options = {}) => {
   return getLoginStatusWithDeps(options);
 };
@@ -3182,12 +3234,20 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
     refreshToken: refreshTokenFn = refreshAccessToken,
     resolveConfig = resolveConfigAsync,
     robotFallback = tryRobotClientFallback,
+    fetchTenantsAndOrgs = fetchTenantsAndOrganizations,
+    robotTenantIdCache = defaultRobotTenantIdCache,
+    robotTenantLookupTimeoutMs = ROBOT_TENANT_LOOKUP_TIMEOUT_MS,
     loadBreaker = loadRefreshBreaker,
     saveBreaker = saveRefreshBreaker,
     clearBreaker = clearRefreshBreaker
   } = deps;
+  const robotDeps = {
+    fetchTenantsAndOrgs,
+    cache: robotTenantIdCache,
+    lookupTimeoutMs: robotTenantLookupTimeoutMs
+  };
   if (isRobotAuthEnforced()) {
-    return resolveRobotEnforcedStatus(robotFallback);
+    return resolveRobotEnforcedStatus(robotFallback, robotDeps);
   }
   if (isEnvAuthEnabled()) {
     return readAuthFromEnv();
@@ -3205,7 +3265,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
         hint: `No credentials found for profile "${activeProfile}". Run 'uip login --profile ${activeProfile}' to authenticate this profile.`
       };
     }
-    return resolveBorrowedRobotStatus(robotFallback);
+    return resolveBorrowedRobotStatus(robotFallback, robotDeps);
   }
   const loaded = await loadFileCredentials(loadEnvFile, absolutePath);
   if ("status" in loaded) {
@@ -3247,7 +3307,7 @@ var getLoginStatusWithDeps = async (options = {}, deps = {}) => {
   }
   return buildFileStatus(tokens, credentials, globalHint);
 };
-async function resolveRobotEnforcedStatus(robotFallback) {
+async function resolveRobotEnforcedStatus(robotFallback, deps) {
   if (isEnvAuthEnabled()) {
     throw new EnvAuthConfigError(`${ENV_AUTH_ENABLE_VAR}=true and ${ENFORCE_ROBOT_AUTH_VAR}=true ` + `are mutually exclusive. Unset one of them and re-run.`);
   }
@@ -3258,11 +3318,11 @@ async function resolveRobotEnforcedStatus(robotFallback) {
       hint: `${ENFORCE_ROBOT_AUTH_VAR}=true but the UiPath Robot ` + `session is unavailable. Start and sign in to the Assistant, ` + `or unset ${ENFORCE_ROBOT_AUTH_VAR} to fall back to file or ` + `env-var authentication.`
     };
   }
-  return buildRobotStatus(robotCreds);
+  return buildRobotStatus(robotCreds, deps);
 }
-async function resolveBorrowedRobotStatus(robotFallback) {
+async function resolveBorrowedRobotStatus(robotFallback, deps) {
   const robotCreds = await robotFallback();
-  return robotCreds ? buildRobotStatus(robotCreds) : { loginStatus: "Not logged in" };
+  return robotCreds ? buildRobotStatus(robotCreds, deps) : { loginStatus: "Not logged in" };
 }
 async function loadFileCredentials(loadEnvFile, absolutePath) {
   let credentials;
@@ -3397,9 +3457,10 @@ function identityFields(accessToken, credentials) {
     ...scopes ? { scopes } : {}
   };
 }
-function buildRobotStatus(robotCreds) {
+async function buildRobotStatus(robotCreds, deps) {
   const identity = resolveSessionIdentity(robotCreds.accessToken);
   const scopes = readTokenScopes(robotCreds.accessToken);
+  const tenant = robotCreds.tenantId ? { tenantId: robotCreds.tenantId } : await resolveRobotTenantId(robotCreds, deps);
   return {
     loginStatus: "Logged in",
     accessToken: robotCreds.accessToken,
@@ -3407,14 +3468,62 @@ function buildRobotStatus(robotCreds) {
     organizationName: robotCreds.organizationName,
     organizationId: robotCreds.organizationId,
     tenantName: robotCreds.tenantName,
-    tenantId: robotCreds.tenantId,
+    tenantId: tenant.tenantId,
     issuer: robotCreds.issuer,
     expiration: getTokenExpiration(robotCreds.accessToken),
     source: "robot" /* Robot */,
+    ...tenant.hint ? { hint: tenant.hint } : {},
     ...identity ? { identity } : {},
     ...scopes ? { scopes } : {}
   };
 }
+async function resolveRobotTenantId(robotCreds, deps) {
+  const { baseUrl, accessToken, tenantName } = robotCreds;
+  const organization = robotCreds.organizationName ?? robotCreds.organizationId;
+  if (!tenantName || !organization) {
+    return {};
+  }
+  const key = `${baseUrl}|${organization}|${tenantName}|${accessToken}`;
+  let pending = deps.cache.get(key);
+  if (!pending) {
+    pending = catchError(lookupRobotTenantId({ baseUrl, accessToken, organization, tenantName }, deps)).then(([error, resolution]) => {
+      const settled = error ? { hint: tenantLookupFailureHint(tenantName, error.message) } : resolution;
+      if (!settled.tenantId) {
+        deps.cache.delete(key);
+      }
+      return settled;
+    });
+    deps.cache.set(key, pending);
+  }
+  return pending;
+}
+async function lookupRobotTenantId(target, deps) {
+  const { baseUrl, accessToken, organization, tenantName } = target;
+  const [error, data] = await catchError(deps.fetchTenantsAndOrgs(baseUrl, accessToken, organization, AbortSignal.timeout(deps.lookupTimeoutMs)));
+  if (error) {
+    const reason = error.name === "TimeoutError" ? `the tenant list did not answer within ${deps.lookupTimeoutMs} ms.` : error.message;
+    return { hint: tenantLookupFailureHint(tenantName, reason) };
+  }
+  const rows = data?.tenants;
+  const tenants = Array.isArray(rows) ? rows.filter((tenant) => typeof tenant?.id === "string" && typeof tenant?.name === "string") : [];
+  const wantedName = decodePathSegment(tenantName);
+  const wanted = wantedName.toLowerCase();
+  const match = tenants.find((tenant) => tenant.name === wantedName) ?? tenants.find((tenant) => tenant.name.toLowerCase() === wanted);
+  if (!match) {
+    const names = tenants.map((tenant) => tenant.name).join(", ");
+    return {
+      hint: `The Robot session targets tenant '${tenantName}', but ` + `organization '${organization}' lists no tenant of that name` + `${names ? ` (available: ${names})` : ""}. Commands that need ` + `the tenant id will fail until it can be resolved.`
+    };
+  }
+  return { tenantId: match.id };
+}
+function tenantLookupFailureHint(tenantName, reason) {
+  return `Could not resolve the id of tenant '${tenantName}' from the ` + `Robot session: ${reason} Commands that need the tenant id will ` + `fail until it can be resolved.`;
+}
+function decodePathSegment(segment) {
+  const [error, decoded] = catchError(() => decodeURIComponent(segment));
+  return error ? segment : decoded;
+}
 var isFileNotFoundError = (error) => {
   if (!(error instanceof Object))
     return false;
@@ -3683,9 +3792,6 @@ var getAuthContext = async (options = {}) => {
     identity: status.identity
   };
 };
-// ../../auth/src/tenantSelection.ts
-var IDENTIFIER_STATUSES = new Set([400, 403, 404]);
-
 // ../../auth/src/selectTenant.ts
 var TENANT_SELECTION_REQUIRED_CODE = "TENANT_SELECTION_REQUIRED";
 var INVALID_TENANT_CODE = "INVALID_TENANT";
@@ -3782,7 +3888,9 @@ var ErrorDimensions = {
   Result: "Result",
   ErrorCode: "ErrorCode",
   Retry: "Retry",
-  ErrorMessage: "ErrorMessage"
+  ErrorMessage: "ErrorMessage",
+  HttpStatus: "HttpStatus",
+  UpstreamErrorCode: "UpstreamErrorCode"
 };
 var AuthDimensions = {
   AuthenticationMethod: "AuthenticationMethod",
@@ -4206,7 +4314,7 @@ var package_default = {
   name: "@uipath/authz-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0",
+  version: "1.205.0",
   description: "SDK for the UiPath Authorization Service API.",
   repository: {
     type: "git",
@@ -5759,7 +5867,7 @@ function setGlobalLogFilePath(path2) {
 function getGlobalLogFilePath() {
   return logFilePathSlot.get("");
 }
-var DEFAULT_LOG_LEVEL = 3 /* ERROR */;
+var DEFAULT_LOG_LEVEL = 2 /* WARN */;
 
 class SimpleLogger {
   __brand = "SimpleLogger";
@@ -6861,7 +6969,9 @@ var CLI_ERROR_CODES = [
   "timeout",
   "server_error",
   "method_not_allowed",
+  "not_supported",
   "configuration_error",
+  "execution_failed",
   "unknown_error"
 ];
 var RETRY_HINTS = [
@@ -7818,7 +7928,9 @@ var OutputFormatter;
         [ErrorDimensions.Result]: data.Result,
         [ErrorDimensions.ErrorCode]: data.ErrorCode,
         [ErrorDimensions.Retry]: data.Retry,
-        [ErrorDimensions.ErrorMessage]: data.Message
+        [ErrorDimensions.ErrorMessage]: data.Message,
+        [ErrorDimensions.HttpStatus]: data.Context?.httpStatus?.toString(),
+        [ErrorDimensions.UpstreamErrorCode]: data.Context?.errorCode
       });
     }
     logOutput(normalizeOutputKeys(envelope), getOutputFormat());
@@ -8913,7 +9025,7 @@ var package_default2 = {
   name: "@uipath/identity-sdk",
   author: "UiPath",
   license: "SEE LICENSE IN LICENSE.txt",
-  version: "1.204.0",
+  version: "1.205.0",
   repository: {
     type: "git",
     url: "https://github.com/UiPath/cli.git",
@@ -11369,4 +11481,4 @@ export {
   registerCommands
 };
 
-//# debugId=8388DA7711B566A064756E2164756E21
+//# debugId=F2DB86481C2DAC6F64756E2164756E21

package/package.json

@@ -2,7 +2,7 @@
     "name": "@uipath/authz-commands",
     "author": "UiPath",
     "license": "SEE LICENSE IN LICENSE.txt",
-    "version": "1.204.0-preview.255",
+    "version": "1.205.0-preview.256",
     "description": "Admin CLI commands for the UiPath Authorization service. Library composed by admin-tool, not a standalone CLI tool.",
     "private": false,
     "repository": {
@@ -26,5 +26,5 @@
     "files": [
         "dist"
     ],
-    "gitHead": "699c58dabb59414557755a8933bcbe40aa420df3"
+    "gitHead": "63740c6cbb7ff282fa9118cc16a148eb030b245f"
 }