@valbuild/server 0.113.0 → 0.115.0

package/dist/valbuild-server.cjs.dev.js

@@ -5352,13 +5352,6 @@ class ValOpsFS extends ValOps {
       };
     }
   }
-  async getCommitSummary() {
-    return {
-      error: {
-        message: "Val is in development / local mode. Cannot generate summary"
-      }
-    };
-  }
   async getStat(params) {
     // In ValOpsFS, we don't have a websocket server to listen to file changes so we use long-polling.
     // If a file that Val depends on changes, we break the connection and tell the client to request again to get the latest values.
@@ -6536,9 +6529,6 @@ const MetadataRes = z.z.object({
   metadata: Metadata,
   type: z.z.union([z.z.literal("file"), z.z.literal("image")]).nullable()
 });
-const SummaryResponse = z.z.object({
-  commitSummary: z.z.string()
-});
 const GetApplicablePatches = z.z.object({
   patches: z.z.array(z.z.object({
     path: z.z.string(),
@@ -6725,69 +6715,6 @@ class ValOpsHttp extends ValOps {
       };
     }
   }
-  async getCommitSummary(preparedCommit) {
-    try {
-      var _res$headers$get2;
-      const res = await fetch(`${this.contentUrl}/v1/${this.project}/commit-summary`, {
-        method: "POST",
-        headers: {
-          ...this.authHeaders,
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          patchedSourceFiles: preparedCommit.patchedSourceFiles,
-          previousSourceFiles: preparedCommit.previousSourceFiles
-        })
-      });
-      if (res.ok) {
-        const json = await res.json();
-        const parsed = SummaryResponse.safeParse(json);
-        if (parsed.success) {
-          return {
-            commitSummary: parsed.data.commitSummary
-          };
-        }
-        console.error(`Could not parse summary response.  Error: ${zodValidationError.fromError(parsed.error).toString()}`);
-        return {
-          error: {
-            message: `Cannot get the summary of your changes. An error has been logged. Possible cause: the current version of Val might be too old. Please try again later or contact the developers on your team.`
-          }
-        };
-      }
-      if (res.status === 401) {
-        console.error("Unauthorized to get summary");
-        return {
-          error: {
-            message: "Could not get summary. Although your user is authorized, the application has authorization issues. Contact the developers on your team and ask them to verify the api keys."
-          }
-        };
-      }
-      const unknownErrorMessage = `Could not get summary. HTTP error: ${res.status} ${res.statusText}`;
-      if ((_res$headers$get2 = res.headers.get("Content-Type")) !== null && _res$headers$get2 !== void 0 && _res$headers$get2.includes("application/json")) {
-        const json = await res.json();
-        const message = internal.getErrorMessageFromUnknownJson(json, unknownErrorMessage);
-        console.error("Summary error:", message);
-        return {
-          error: {
-            message
-          }
-        };
-      }
-      console.error(unknownErrorMessage);
-      return {
-        error: {
-          message: unknownErrorMessage
-        }
-      };
-    } catch (e) {
-      console.error("Could not get summary (connection error?):", e);
-      return {
-        error: {
-          message: `Could not get summary. Error: ${e instanceof Error ? e.message : JSON.stringify(e)}`
-        }
-      };
-    }
-  }
   async getStat(params) {
     if (!(params !== null && params !== void 0 && params.profileId)) {
       return {
@@ -7115,7 +7042,7 @@ class ValOpsHttp extends ValOps {
         coreVersion: core.Internal.VERSION.core
       })
     }).then(async res => {
-      var _res$headers$get3;
+      var _res$headers$get2;
       if (res.ok) {
         const parsed = SavePatchResponse.safeParse(await res.json());
         if (parsed.success) {
@@ -7134,7 +7061,7 @@ class ValOpsHttp extends ValOps {
           message: "Conflict: " + (await res.text())
         });
       }
-      if ((_res$headers$get3 = res.headers.get("Content-Type")) !== null && _res$headers$get3 !== void 0 && _res$headers$get3.includes("application/json")) {
+      if ((_res$headers$get2 = res.headers.get("Content-Type")) !== null && _res$headers$get2 !== void 0 && _res$headers$get2.includes("application/json")) {
         const json = await res.json();
         const message = internal.getErrorMessageFromUnknownJson(json, "Unknown error");
         return fp.result.err({
@@ -7417,51 +7344,9 @@ class ValOpsHttp extends ValOps {
       };
     });
   }
-  async getCommitMessage(preparedCommit) {
-    var _res$headers$get4;
-    const res = await fetch(`${this.contentUrl}/v1/${this.project}/commit-summary`, {
-      method: "POST",
-      headers: {
-        ...this.authHeaders,
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        patchedSourceFiles: preparedCommit.patchedSourceFiles,
-        previousSourceFiles: preparedCommit.previousSourceFiles
-      })
-    });
-    if (res.ok) {
-      const json = await res.json();
-      const parsed = SummaryResponse.safeParse(json);
-      if (parsed.success) {
-        return {
-          commitSummary: parsed.data.commitSummary
-        };
-      }
-      return {
-        error: {
-          message: `Could not parse commit summary response. Error: ${zodValidationError.fromError(parsed.error)}`
-        }
-      };
-    }
-    if ((_res$headers$get4 = res.headers.get("Content-Type")) !== null && _res$headers$get4 !== void 0 && _res$headers$get4.includes("application/json")) {
-      const json = await res.json();
-      const message = internal.getErrorMessageFromUnknownJson(json, "Unknown error");
-      return {
-        error: {
-          message
-        }
-      };
-    }
-    return {
-      error: {
-        message: "Could not get commit message. HTTP error: " + res.status + " " + res.statusText
-      }
-    };
-  }
   async commit(prepared, message, committer, filesDirectory, newBranch) {
     try {
-      var _res$headers$get5;
+      var _res$headers$get3;
       const existingBranch = this.branch;
       const res = await fetch(`${this.contentUrl}/v1/${this.project}/commit`, {
         method: "POST",
@@ -7498,7 +7383,7 @@ class ValOpsHttp extends ValOps {
           }
         };
       }
-      if ((_res$headers$get5 = res.headers.get("Content-Type")) !== null && _res$headers$get5 !== void 0 && _res$headers$get5.includes("application/json")) {
+      if ((_res$headers$get3 = res.headers.get("Content-Type")) !== null && _res$headers$get3 !== void 0 && _res$headers$get3.includes("application/json")) {
         const json = z.z.object({
           isNotFastForward: z.z.boolean().optional()
         }).safeParse(await res.json());
@@ -9151,49 +9036,6 @@ const ValServer = (valModules, options, callbacks) => {
         });
       }
     },
-    "/commit-summary": {
-      GET: async req => {
-        const cookies = req.cookies;
-        const auth = getAuth(cookies);
-        if (auth.error) {
-          return {
-            status: 401,
-            json: {
-              message: auth.error
-            }
-          };
-        }
-        const query = req.query;
-        const patchIds = query.patch_id;
-        const patches = await serverOps.fetchPatches({
-          patchIds,
-          excludePatchOps: false
-        });
-        const analysis = serverOps.analyzePatches(patches.patches, patches.commits, commit);
-        const preparedCommit = await serverOps.prepare({
-          ...analysis,
-          ...patches
-        });
-        const res = await serverOps.getCommitSummary(preparedCommit);
-        if (res.error) {
-          console.error("Failed to summarize", res.error);
-          return {
-            status: 400,
-            json: {
-              message: res.error.message
-            }
-          };
-        }
-        return {
-          status: 200,
-          json: {
-            baseSha: await serverOps.getBaseSha(),
-            patchIds,
-            commitSummary: res.commitSummary
-          }
-        };
-      }
-    },
     "/save": {
       POST: async req => {
         const cookies = req.cookies;
@@ -9476,11 +9318,18 @@ const ValServer = (valModules, options, callbacks) => {
             }
             const json = await upstreamRes.json();
             const wsUrl = options.valContentUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:") + `/v1/${options.project}/ai/connect`;
+            // Forwarded as-is, minus anything that is not a string: which
+            // providers are reachable is the content server's to decide, and
+            // this only has to carry the answer without editorialising.
+            const providers = Array.isArray(json.providers) ? json.providers.filter(provider => typeof provider === "string") : undefined;
             return {
               status: 200,
               json: {
                 nonce: json.nonce,
-                wsUrl
+                wsUrl,
+                ...(providers ? {
+                  providers
+                } : {})
               }
             };
           } catch (err) {
@@ -10498,6 +10347,10 @@ async function initHandlerOptions(route, opts, config) {
   const maybeValProject = opts.project || process.env.VAL_PROJECT;
   const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
   const valContentUrl = opts.valContentUrl || process.env.VAL_CONTENT_URL || core.DEFAULT_CONTENT_HOST;
+  warnIfInsecureUrls({
+    valBuildUrl,
+    valContentUrl
+  });
   if (isProxyMode) {
     var _opts$versions, _opts$versions2;
     if (!maybeApiKey || !maybeValSecret) {
@@ -10539,7 +10392,6 @@ async function initHandlerOptions(route, opts, config) {
     };
   } else {
     const cwd = process.cwd();
-    const valBuildUrl = opts.valBuildUrl || process.env.VAL_BUILD_URL || "https://admin.val.build";
     return {
       mode: "fs",
       cwd,
@@ -10556,6 +10408,84 @@ async function initHandlerOptions(route, opts, config) {
   }
 }
 
+/**
+ * Hosts we send credentials to, and what each one puts at risk. They differ:
+ * only `valBuildUrl` hands back the app token that becomes the session cookie,
+ * so a single shared sentence would overstate one and understate the other.
+ */
+
+const CREDENTIAL_BEARING_URLS = ["valBuildUrl", "valContentUrl"];
+const WHAT_IS_AT_RISK = {
+  valBuildUrl: "Val's api key is sent to this host, and the token it returns is what this server signs into the session cookie, " + "so both can be read - and the token replaced - by anyone on the network path.",
+  valContentUrl: "Val's api key, or the caller's personal access token, is sent to this host, " + "so it can be read by anyone on the network path."
+};
+
+// NOTE: `URL.hostname` keeps the brackets on an IPv6 literal, so this is
+// "[::1]" and not "::1" - and `http://[0:0:0:0:0:0:0:1]` normalises to the
+// same short form before it gets here. Dropping the brackets looks like a
+// tidy-up and silently stops matching IPv6 loopback.
+const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
+
+/**
+ * The URL as it is safe to print. `http://user:pass@host` is a legal override,
+ * and a warning about credential exposure that puts the password in the log
+ * would be the very thing it is warning about.
+ */
+function forLog(parsed) {
+  if (!parsed.username && !parsed.password) {
+    return parsed.href;
+  }
+  const redacted = new URL(parsed.href);
+  redacted.username = "";
+  redacted.password = "";
+  return `${redacted.href} (credentials redacted)`;
+}
+
+/**
+ * Returns a warning if `url` would send credentials somewhere they can be read
+ * off the wire, or null if it is fine.
+ *
+ * Both URLs default to https, but each is overridable - `opts.valBuildUrl` /
+ * `VAL_BUILD_URL`, `opts.valContentUrl` / `VAL_CONTENT_URL` - and neither
+ * override has ever been scheme-checked. Point one at a plain http host and the
+ * api key goes out in clear text, and whatever comes back is whatever the
+ * network says: for `valBuildUrl` that includes the app token this server
+ * re-signs into the session cookie.
+ *
+ * Loopback over http is exempt: that is a val.build running on the developer's
+ * own machine, and there is no network to be on the wrong side of.
+ *
+ * This warns rather than throws. Both overrides are set by the operator, not by
+ * an attacker, so this is a misconfiguration to surface - not untrusted input to
+ * reject - and refusing to boot would break anyone deliberately pointing at an
+ * internal http host today.
+ */
+function insecureUrlWarning(name, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // NOTE: the URL is not echoed here. It did not parse, so there is nothing
+    // to redact with, and an unparseable string can still hold a password.
+    return `Val: ${name} is not a valid URL.`;
+  }
+  if (parsed.protocol === "https:") {
+    return null;
+  }
+  if (parsed.protocol === "http:" && (LOOPBACK_HOSTNAMES.includes(parsed.hostname) || parsed.hostname.endsWith(".localhost"))) {
+    return null;
+  }
+  return `Val: ${name} is set to ${forLog(parsed)}, which is not https. ` + `${WHAT_IS_AT_RISK[name]} ` + `Use https, or a loopback address for local development.`;
+}
+function warnIfInsecureUrls(urls) {
+  for (const name of CREDENTIAL_BEARING_URLS) {
+    const warning = insecureUrlWarning(name, urls[name]);
+    if (warning) {
+      console.warn(warning);
+    }
+  }
+}
+
 // TODO: remove
 async function safeReadGit(cwd) {
   async function findGitHead(currentDir, depth) {
@@ -12559,7 +12489,17 @@ async function findAndEvalValConfigFile(projectRoot) {
 }
 
 /**
- * The Val login device flow, as reusable primitives.
+ * The Val login flow, as reusable primitives.
+ *
+ * This is an RFC 8628 device authorization grant. The shape that matters:
+ * {@link ValDeviceAuthorization.deviceCode} is a secret this process holds and
+ * polls with, while {@link ValDeviceAuthorization.userCode} is the short string
+ * the human reads out of the terminal and types into a browser. Only the device
+ * code can collect a token.
+ *
+ * Keep them apart. Show the user code; never print, log or put the device code
+ * in a URL. An earlier version of this flow used one value for both jobs, which
+ * meant anyone who saw the verification link could collect the token it led to.
  *
  * The CLI wraps these with terminal output, and `@valbuild/language-server`
  * wraps them with LSP `window/showDocument` and progress reporting. Neither the
@@ -12573,6 +12513,21 @@ const DEFAULT_LOGIN_HOST = "https://admin.val.build";
 function defaultHost() {
   return process.env.VAL_BUILD_URL || DEFAULT_LOGIN_HOST;
 }
+
+/**
+ * What gets shown on the approval screen so the person can tell which terminal
+ * is asking. Self-reported and therefore a hint, not proof — the server treats
+ * it as untrusted display text.
+ */
+function defaultDeviceName() {
+  try {
+    return `${os__default["default"].hostname()} (${os__default["default"].platform()})`;
+  } catch {
+    // hostname() can throw on locked-down containers. A missing device name is
+    // not worth failing a login over; the server renders "Unknown".
+    return "";
+  }
+}
 class ValLoginError extends Error {
   constructor(code, message, details) {
     super(message);
@@ -12582,20 +12537,24 @@ class ValLoginError extends Error {
   }
 }
 
-/** A login attempt that is waiting for the user to confirm in a browser. */
+/** A login attempt that is waiting for the user to approve it in a browser. */
 
 /**
- * Begin a login attempt. The caller is responsible for getting
- * {@link ValLoginSession.url} in front of the user.
+ * Begin a login attempt. The caller is responsible for getting the user code
+ * and verification URL in front of the user.
  */
 async function startValLogin(options = {}) {
   var _response$headers$get;
   const host = options.host ?? defaultHost();
+  const deviceName = options.deviceName ?? defaultDeviceName();
   const response = await fetch(`${host}/api/login`, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
-    }
+    },
+    body: JSON.stringify(deviceName ? {
+      device_name: deviceName
+    } : {})
   });
   if (response.status >= 500) {
     const text = await response.text().catch(() => "");
@@ -12606,42 +12565,63 @@ async function startValLogin(options = {}) {
     throw new ValLoginError("unexpected-content-type", "Unexpected failure while trying to login (content type was not JSON).", text ? `Server response: ${text} (status: ${response.status})` : `Status: ${response.status}`);
   }
   const json = await response.json();
-  const nonce = json === null || json === void 0 ? void 0 : json.nonce;
-  const url = json === null || json === void 0 ? void 0 : json.url;
-  if (typeof nonce !== "string" || typeof url !== "string") {
-    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
+  const deviceCode = json === null || json === void 0 ? void 0 : json.device_code;
+  const userCode = json === null || json === void 0 ? void 0 : json.user_code;
+  const verificationUri = json === null || json === void 0 ? void 0 : json.verification_uri;
+  if (typeof deviceCode !== "string" || typeof userCode !== "string" || typeof verificationUri !== "string") {
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server. This version of Val may be too old for the login flow on this host — try updating @valbuild/cli.", JSON.stringify(json));
   }
   return {
-    nonce,
-    url
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete: typeof (json === null || json === void 0 ? void 0 : json.verification_uri_complete) === "string" ? json.verification_uri_complete : verificationUri,
+    expiresInSeconds: typeof (json === null || json === void 0 ? void 0 : json.expires_in) === "number" ? json.expires_in : DEFAULT_LOGIN_EXPIRES_IN_SECONDS,
+    intervalSeconds: typeof (json === null || json === void 0 ? void 0 : json.interval) === "number" ? json.interval : DEFAULT_LOGIN_POLL_INTERVAL_SECONDS
   };
 }
-const DEFAULT_LOGIN_MAX_DURATION = 5 * 60 * 1000; // 5 minutes
-const DEFAULT_LOGIN_POLL_INTERVAL = 1000;
+
+/** Fallbacks for a server that omits the optional RFC 8628 timing fields. */
+const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 600;
+const DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = 5;
 
 /**
- * Poll until the user confirms the login in their browser.
+ * How much to add to the poll interval when the server answers `slow_down`.
+ * RFC 8628 section 3.5 specifies 5 seconds.
+ */
+const SLOW_DOWN_INCREMENT_SECONDS = 5;
+
+/**
+ * Poll until the user approves the login in their browser.
  *
  * Accepts an `AbortSignal` so an editor can cancel the flow when the user
- * dismisses the prompt, instead of leaving a poll loop running for 5 minutes.
+ * dismisses the prompt, instead of leaving a poll loop running to expiry.
  */
-async function awaitValLoginConfirmation(nonce, options = {}) {
+async function awaitValLoginConfirmation(authorization, options = {}) {
   const host = options.host ?? defaultHost();
-  const maxDuration = options.maxDurationMs ?? DEFAULT_LOGIN_MAX_DURATION;
-  const pollInterval = options.pollIntervalMs ?? DEFAULT_LOGIN_POLL_INTERVAL;
+  const maxDuration = options.maxDurationMs ?? authorization.expiresInSeconds * 1000;
   const now = options.now ?? (() => Date.now());
+  // Mutable: `slow_down` widens it as we go, and never narrows it again.
+  let intervalMs = authorization.intervalSeconds * 1000;
   const start = now();
   while (now() - start < maxDuration) {
     var _options$signal, _options$signal2;
     if ((_options$signal = options.signal) !== null && _options$signal !== void 0 && _options$signal.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    await new Promise(resolve => setTimeout(resolve, pollInterval));
+    // Wait first: the user has not had time to approve anything yet.
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
     if ((_options$signal2 = options.signal) !== null && _options$signal2 !== void 0 && _options$signal2.aborted) {
       throw new ValLoginError("aborted", "Login was cancelled.");
     }
-    const response = await fetch(`${host}/api/login?token=${nonce}&consume=true`, {
-      method: "POST"
+    const response = await fetch(`${host}/api/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        device_code: authorization.deviceCode
+      })
     });
     if (response.status >= 500) {
       throw new ValLoginError("server-error", "An error occurred on the server.", `Status: ${response.status}`);
@@ -12659,6 +12639,23 @@ async function awaitValLoginConfirmation(nonce, options = {}) {
       }
       throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
     }
+    const json = await response.json().catch(() => null);
+    const error = typeof (json === null || json === void 0 ? void 0 : json.error) === "string" ? json.error : null;
+    const description = typeof (json === null || json === void 0 ? void 0 : json.error_description) === "string" ? json.error_description : undefined;
+    if (error === "authorization_pending") {
+      continue;
+    }
+    if (error === "slow_down" || response.status === 429) {
+      intervalMs += SLOW_DOWN_INCREMENT_SECONDS * 1000;
+      continue;
+    }
+    if (error === "access_denied") {
+      throw new ValLoginError("access-denied", "The login was declined in the browser.", description);
+    }
+    if (error === "expired_token") {
+      throw new ValLoginError("expired", "The login code expired before it was approved.", description);
+    }
+    throw new ValLoginError("unexpected-response", "Unexpected response from the server.", JSON.stringify(json));
   }
   throw new ValLoginError("timeout", "Login confirmation timed out.");
 }
@@ -12964,9 +12961,9 @@ Object.defineProperty(exports, 'hasRemoteFileSchema', {
   enumerable: true,
   get: function () { return core.hasRemoteFileSchema; }
 });
+exports.DEFAULT_LOGIN_EXPIRES_IN_SECONDS = DEFAULT_LOGIN_EXPIRES_IN_SECONDS;
 exports.DEFAULT_LOGIN_HOST = DEFAULT_LOGIN_HOST;
-exports.DEFAULT_LOGIN_MAX_DURATION = DEFAULT_LOGIN_MAX_DURATION;
-exports.DEFAULT_LOGIN_POLL_INTERVAL = DEFAULT_LOGIN_POLL_INTERVAL;
+exports.DEFAULT_LOGIN_POLL_INTERVAL_SECONDS = DEFAULT_LOGIN_POLL_INTERVAL_SECONDS;
 exports.Service = Service;
 exports.ValFSHost = ValFSHost;
 exports.ValLoginError = ValLoginError;