@vercel/cli-auth 0.0.1

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@vercel/cli-auth",
+  "description": "Used by Vercel's CLIs to handle authentication",
+  "version": "0.0.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vercel/vercel.git",
+    "directory": "packages/cli-auth"
+  },
+  "private": false,
+  "files": [
+    "*.js",
+    "*.js.map",
+    "*.ts",
+    "!vitest.config.mts",
+    "!**/*.test.ts"
+  ],
+  "dependencies": {
+    "async-listen": "3.0.0",
+    "open": "8.4.0",
+    "xdg-app-paths": "5",
+    "zod": "4.1.11"
+  },
+  "devDependencies": {
+    "@types/node": "22",
+    "memfs": "4.14.0",
+    "typescript": "5.9.2",
+    "vite": "7.1.7",
+    "vitest": "2.1.4"
+  },
+  "ci-cd": {
+    "//": "https://www.notion.so/1d6e06b059c48017a7afe7e8698de336",
+    "test": {
+      "requiredDependencies": [
+        "@api/tests"
+      ]
+    }
+  },
+  "scripts": {
+    "build": "pnpm clear && tsc -b",
+    "clear": "rm -rf *.js *.d.ts *.js.map tsconfig.tsbuildinfo",
+    "test": "vitest",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/sso.d.ts

@@ -0,0 +1,24 @@
+import * as z from 'zod/mini';
+import type { OAuth } from './oauth';
+import type { Credentials } from './credentials-store';
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+export declare function reauthorizeTeam(params: {
+    /** The team's slug that requires re-authorization */
+    team: string;
+    /** The current access token that needs to be re-authorized */
+    token: Credentials['token'];
+    oauth: OAuth;
+}): Promise<void>;
+declare const SSOError: z.ZodMiniObject<{
+    code: z.ZodMiniString<string>;
+    message: z.ZodMiniString<string>;
+    scope: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    enforced: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+}, z.core.$strip>;
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+export declare function parseSSOError(error: unknown): z.infer<typeof SSOError> | undefined;
+export {};

package/sso.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reauthorizeTeam = reauthorizeTeam;
+exports.parseSSOError = parseSSOError;
+const node_http_1 = __importDefault(require("node:http"));
+const async_listen_1 = require("async-listen");
+const open_1 = __importDefault(require("open"));
+const z = __importStar(require("zod/mini"));
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+async function reauthorizeTeam(params) {
+    const { team, token, oauth } = params;
+    if (!token) {
+        throw new TypeError('Token is missing, cannot initiate SSO re-authorization. Please log in again.');
+    }
+    const introspection = await oauth.introspectToken(token);
+    const { active, session_id, client_id } = introspection;
+    if (!active || !session_id || !client_id) {
+        throw new Error('Introspection failed. Token is either expired or otherwise invalid. Please log in again.');
+    }
+    const verificationToken = await waitForVerification({
+        team,
+        session_id,
+        client_id,
+    });
+    await fetch(`https://api.vercel.com/registration/verify?${new URLSearchParams({ token: verificationToken })}`);
+}
+/**
+ * Get a verification token by spawning a localhost HTTP server
+ * that gets redirected to as the OAuth callback URL.
+ *
+ * The token returned can be sent back to the Vercel API to complete
+ * the SSO re-authorization.
+ */
+async function waitForVerification(params) {
+    const { team, session_id, client_id } = params;
+    const server = node_http_1.default.createServer();
+    const { port } = await (0, async_listen_1.listen)(server, 0, '127.0.0.1');
+    const initSSOUrl = new URL(`/sso/${team}?${new URLSearchParams({
+        session_id,
+        client_id,
+        next: `http://localhost:${port}`,
+    })}`, `https://vercel.com`);
+    try {
+        const [query] = await Promise.all([
+            new Promise((resolve, reject) => {
+                server.once('request', (req, res) => {
+                    // Close the HTTP connection to prevent `server.close()` from hanging
+                    res.setHeader('connection', 'close');
+                    const { searchParams } = new URL(req.url || '/', 'http://localhost');
+                    resolve(searchParams);
+                    // Redirect the user back to the Vercel login notification page
+                    res.statusCode = 302;
+                    res.setHeader('location', getNotificationUrl(searchParams)).end();
+                });
+                server.once('error', reject);
+            }),
+            (0, open_1.default)(initSSOUrl.href),
+        ]);
+        const loginError = query.get('loginError');
+        if (loginError) {
+            const error = new Error('Login failed.');
+            error.cause = JSON.parse(loginError);
+            throw error;
+        }
+        const token = query.get('token');
+        if (!token) {
+            throw new TypeError('Could not get verification token. Please contact support.');
+        }
+        return token;
+    }
+    finally {
+        server.close();
+    }
+}
+function getNotificationUrl(params) {
+    const loginState = params.has('loginError')
+        ? 'failed'
+        : params.has('ssoEmail')
+            ? 'incomplete'
+            : 'success';
+    return `https://vercel.com/notifications/cli-login-${loginState}?${params}`;
+}
+const SSOError = z.object({
+    code: z.string(),
+    message: z.string(),
+    scope: z.optional(z.string()),
+    enforced: z.optional(z.boolean()),
+});
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+function parseSSOError(error) {
+    const { data } = SSOError.safeParse(error);
+    if (!data?.enforced)
+        return;
+    return data;
+}
+//# sourceMappingURL=sso.js.map

package/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["sso.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,0CAiCC;AAmFD,sCAMC;AAtID,0DAA6B;AAC7B,+CAAsC;AACtC,gDAAwB;AACxB,4CAA8B;AAI9B;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,MAMrC;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CACjB,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;IAExD,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,IAAI;QACJ,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,KAAK,CACT,8CAA8C,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAClG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAIlC;IACC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,mBAAI,CAAC,YAAY,EAAE,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,qBAAM,EAAC,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,QAAQ,IAAI,IAAI,IAAI,eAAe,CAAC;QAClC,UAAU;QACV,SAAS;QACT,IAAI,EAAE,oBAAoB,IAAI,EAAE;KACjC,CAAC,EAAE,EACJ,oBAAoB,CACrB,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChC,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;oBAClC,qEAAqE;oBACrE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;oBAErC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;oBACrE,OAAO,CAAC,YAAY,CAAC,CAAC;oBAEtB,+DAA+D;oBAC/D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpE,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC,CAAC;YACF,IAAA,cAAI,EAAC,UAAU,CAAC,IAAI,CAAC;SACtB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAuB;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;YACtB,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,8CAA8C,UAAU,IAAI,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,mFAAmF;AACnF,SAAgB,aAAa,CAC3B,KAAc;IAEd,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/sso.ts

@@ -0,0 +1,135 @@
+import http from 'node:http';
+import { listen } from 'async-listen';
+import open from 'open';
+import * as z from 'zod/mini';
+import type { OAuth } from './oauth';
+import type { Credentials } from './credentials-store';
+
+/**
+ * Re-authorize a team's SSO session by opening the browser and waiting for the user to complete
+ * the SSO flow. Use when the user's SSO session has expired or missing.
+ *
+ */
+export async function reauthorizeTeam(params: {
+  /** The team's slug that requires re-authorization */
+  team: string;
+  /** The current access token that needs to be re-authorized */
+  token: Credentials['token'];
+  oauth: OAuth;
+}): Promise<void> {
+  const { team, token, oauth } = params;
+
+  if (!token) {
+    throw new TypeError(
+      'Token is missing, cannot initiate SSO re-authorization. Please log in again.'
+    );
+  }
+
+  const introspection = await oauth.introspectToken(token);
+  const { active, session_id, client_id } = introspection;
+
+  if (!active || !session_id || !client_id) {
+    throw new Error(
+      'Introspection failed. Token is either expired or otherwise invalid. Please log in again.'
+    );
+  }
+
+  const verificationToken = await waitForVerification({
+    team,
+    session_id,
+    client_id,
+  });
+
+  await fetch(
+    `https://api.vercel.com/registration/verify?${new URLSearchParams({ token: verificationToken })}`
+  );
+}
+
+/**
+ * Get a verification token by spawning a localhost HTTP server
+ * that gets redirected to as the OAuth callback URL.
+ *
+ * The token returned can be sent back to the Vercel API to complete
+ * the SSO re-authorization.
+ */
+async function waitForVerification(params: {
+  team: string;
+  session_id: string;
+  client_id: string;
+}): Promise<string> {
+  const { team, session_id, client_id } = params;
+  const server = http.createServer();
+  const { port } = await listen(server, 0, '127.0.0.1');
+  const initSSOUrl = new URL(
+    `/sso/${team}?${new URLSearchParams({
+      session_id,
+      client_id,
+      next: `http://localhost:${port}`,
+    })}`,
+    `https://vercel.com`
+  );
+
+  try {
+    const [query] = await Promise.all([
+      new Promise<URLSearchParams>((resolve, reject) => {
+        server.once('request', (req, res) => {
+          // Close the HTTP connection to prevent `server.close()` from hanging
+          res.setHeader('connection', 'close');
+
+          const { searchParams } = new URL(req.url || '/', 'http://localhost');
+          resolve(searchParams);
+
+          // Redirect the user back to the Vercel login notification page
+          res.statusCode = 302;
+          res.setHeader('location', getNotificationUrl(searchParams)).end();
+        });
+        server.once('error', reject);
+      }),
+      open(initSSOUrl.href),
+    ]);
+
+    const loginError = query.get('loginError');
+    if (loginError) {
+      const error = new Error('Login failed.');
+      error.cause = JSON.parse(loginError);
+      throw error;
+    }
+
+    const token = query.get('token');
+    if (!token) {
+      throw new TypeError(
+        'Could not get verification token. Please contact support.'
+      );
+    }
+
+    return token;
+  } finally {
+    server.close();
+  }
+}
+
+function getNotificationUrl(params: URLSearchParams): string {
+  const loginState = params.has('loginError')
+    ? 'failed'
+    : params.has('ssoEmail')
+      ? 'incomplete'
+      : 'success';
+
+  return `https://vercel.com/notifications/cli-login-${loginState}?${params}`;
+}
+
+const SSOError = z.object({
+  code: z.string(),
+  message: z.string(),
+  scope: z.optional(z.string()),
+  enforced: z.optional(z.boolean()),
+});
+
+/** Parse an error-like object to determine if SSO re-authorization is required. */
+export function parseSSOError(
+  error: unknown
+): z.infer<typeof SSOError> | undefined {
+  const { data } = SSOError.safeParse(error);
+  if (!data?.enforced) return;
+  return data;
+}

package/user-agent.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Get the user agent string for the current environment.
+ *
+ * @exapmle
+ * ```
+ * getUserAgent({ name: 'my-cli', version: '1.0.0' });
+ * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
+ * ```
+ */
+export declare function getUserAgent(pkg: {
+    name: string;
+    version: string;
+}): string;

package/user-agent.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUserAgent = getUserAgent;
+const node_os_1 = __importDefault(require("node:os"));
+/**
+ * Get the user agent string for the current environment.
+ *
+ * @exapmle
+ * ```
+ * getUserAgent({ name: 'my-cli', version: '1.0.0' });
+ * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
+ * ```
+ */
+function getUserAgent(pkg) {
+    return `${node_os_1.default.hostname()} @ ${pkg.name} ${pkg.version} node-${process.version} ${node_os_1.default.platform()} (${node_os_1.default.arch()})`;
+}
+//# sourceMappingURL=user-agent.js.map

package/user-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.js","sourceRoot":"","sources":["user-agent.ts"],"names":[],"mappings":";;;;;AAWA,oCAIC;AAfD,sDAAyB;AAEzB;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,GAAsC;IACjE,OAAO,GAAG,iBAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,SAClD,OAAO,CAAC,OACV,IAAI,iBAAE,CAAC,QAAQ,EAAE,KAAK,iBAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AACrC,CAAC"}

package/user-agent.ts

@@ -0,0 +1,16 @@
+import os from 'node:os';
+
+/**
+ * Get the user agent string for the current environment.
+ *
+ * @exapmle
+ * ```
+ * getUserAgent({ name: 'my-cli', version: '1.0.0' });
+ * // 'hostname @ my-cli 1.0.0 node-v18.16.0 linux (x64)'
+ * ```
+ */
+export function getUserAgent(pkg: { name: string; version: string }): string {
+  return `${os.hostname()} @ ${pkg.name} ${pkg.version} node-${
+    process.version
+  } ${os.platform()} (${os.arch()})`;
+}