@vercel/oidc 4.0.4 → 4.0.5-snapshot-dd15927e8ded

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @vercel/oidc
 
+## 4.0.5
+
+### Patch Changes
+
+- dc2c86d: With a DPoP login (`__VERCEL_FF_DPOP=1`), refresh the OIDC token with `vercel project token`, which signs the request, instead of sending the CLI's token as `Bearer`.
+- dc2c86d: Refuse to refresh the OIDC token through `vercel project token` when the project or team ID from `.vercel/project.json` is not a valid ID or name, so a value such as `--api=...` can't be read by the CLI as an option.
+- Updated dependencies [dc2c86d]
+- Updated dependencies [dc2c86d]
+- Updated dependencies [dc2c86d]
+- Updated dependencies [dc2c86d]
+  - @vercel/cli-config@0.3.5
+
 ## 4.0.4
 
 ### Patch Changes

package/dist/token-util.js

@@ -93,7 +93,19 @@ function isValidAccessToken(authConfig, expirationBufferMs = 0) {
   const bufferInSeconds = expirationBufferMs / 1e3;
   return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
 }
+const CLI_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function assertCliId(value, kind) {
+  if (!CLI_ID_PATTERN.test(value)) {
+    throw new import_token_error.VercelOidcTokenError(
+      `Failed to refresh OIDC token: ${JSON.stringify(value)} is not a valid ${kind} ID or name. Try re-linking your project with \`vc link\``
+    );
+  }
+}
 async function getVercelOidcTokenFromCli(projectId, teamId) {
+  assertCliId(projectId, "project");
+  if (teamId) {
+    assertCliId(teamId, "team");
+  }
   const args = ["project", "token", projectId, "--format=json"];
   if (teamId) {
     args.push("--scope", teamId);

package/dist/token.js

@@ -44,7 +44,7 @@ async function refreshToken(options) {
   let maybeToken = (0, import_token_util.loadToken)(projectId);
   if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token), options?.expirationBufferMs)) {
     const configDir = (0, import_cli_config.getGlobalPathConfig)();
-    if ((0, import_cli_config.getLikelyEffectiveCredStorage)(configDir) === "keyring") {
+    if ((0, import_cli_config.getLikelyEffectiveCredStorage)(configDir) === "keyring" || isDpopLoginEnabled()) {
       maybeToken = await (0, import_token_util.getVercelOidcTokenFromCli)(projectId, teamId);
     } else {
       const authToken = await (0, import_token_util.getVercelToken)({
@@ -60,6 +60,9 @@ async function refreshToken(options) {
   process.env.VERCEL_OIDC_TOKEN = maybeToken.token;
   return;
 }
+function isDpopLoginEnabled() {
+  return process.env.__VERCEL_FF_DPOP === "1";
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   refreshToken

package/dist/token.test.js

@@ -55,6 +55,7 @@ import_vitest.vi.mock("./token-io");
   (0, import_vitest.beforeEach)(() => {
     import_vitest.vi.clearAllMocks();
     import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("file");
+    import_vitest.vi.stubEnv("__VERCEL_FF_DPOP", void 0);
     process.env.VERCEL_OIDC_TOKEN = void 0;
     const random = `test-${(0, import_crypto.randomUUID)()}`;
     rootDir = path.join(os.tmpdir(), random);
@@ -137,6 +138,66 @@ import_vitest.vi.mock("./token-io");
       customTeamId
     ]);
   });
+  (0, import_vitest.test)("should use cli-exec with a DPoP login", async () => {
+    import_vitest.vi.stubEnv("__VERCEL_FF_DPOP", "1");
+    await (0, import_token.refreshToken)();
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).toHaveBeenCalledWith([
+      "project",
+      "token",
+      projectId,
+      "--format=json"
+    ]);
+    (0, import_vitest.expect)(tokenUtil.getVercelToken).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(tokenUtil.getVercelOidcToken).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("cli-token");
+  });
+  (0, import_vitest.test)("should read auth.json directly unless __VERCEL_FF_DPOP is exactly 1", async () => {
+    import_vitest.vi.stubEnv("__VERCEL_FF_DPOP", "0");
+    await (0, import_token.refreshToken)();
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).not.toHaveBeenCalled();
+    (0, import_vitest.expect)(tokenUtil.getVercelToken).toHaveBeenCalled();
+    (0, import_vitest.expect)(process.env.VERCEL_OIDC_TOKEN).toBe("test-token");
+  });
+  import_vitest.test.each([
+    [
+      "keyring storage",
+      () => {
+        import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
+      }
+    ],
+    [
+      "a DPoP login",
+      () => {
+        import_vitest.vi.stubEnv("__VERCEL_FF_DPOP", "1");
+      }
+    ]
+  ])("with %s, should not pass an option-shaped project.json value to the cli", async (_, setup) => {
+    setup();
+    for (const prj of [
+      { projectId: "--api=https://example.com" },
+      { projectId, orgId: "--api=https://example.com" },
+      { projectId, orgId: "-A" }
+    ]) {
+      fs.writeFileSync(
+        path.join(rootDir, ".vercel", "project.json"),
+        JSON.stringify(prj)
+      );
+      await (0, import_vitest.expect)((0, import_token.refreshToken)()).rejects.toThrow("is not a valid");
+    }
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.test)("should pass a project slug to the cli", async () => {
+    import_vitest.vi.stubEnv("__VERCEL_FF_DPOP", "1");
+    await (0, import_token.refreshToken)({ project: "my-app.v2", team: "my_team" });
+    (0, import_vitest.expect)(import_cli_exec.execVercelCli).toHaveBeenCalledWith([
+      "project",
+      "token",
+      "my-app.v2",
+      "--format=json",
+      "--scope",
+      "my_team"
+    ]);
+  });
   (0, import_vitest.test)("should fail with a cli-specific error for malformed cli json output", async () => {
     import_vitest.vi.mocked(import_cli_config.getLikelyEffectiveCredStorage).mockReturnValue("keyring");
     import_vitest.vi.mocked(import_cli_exec.execVercelCli).mockResolvedValue({

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const version = "4.0.4";
+export declare const version = "4.0.5-snapshot-dd15927e8ded";

package/dist/version.js

@@ -21,7 +21,7 @@ __export(version_exports, {
   version: () => version
 });
 module.exports = __toCommonJS(version_exports);
-const version = "4.0.4";
+const version = "4.0.5-snapshot-dd15927e8ded";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/package.json

@@ -18,7 +18,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "4.0.4",
+  "version": "4.0.5-snapshot-dd15927e8ded",
   "repository": {
     "directory": "packages/oidc",
     "type": "git",
@@ -29,8 +29,8 @@
   },
   "dependencies": {
     "jose": "^5.9.6",
-    "@vercel/cli-exec": "1.0.1",
-    "@vercel/cli-config": "0.3.4"
+    "@vercel/cli-config": "0.3.5-snapshot-dd15927e8ded",
+    "@vercel/cli-exec": "1.0.1"
   },
   "devDependencies": {
     "prettier": "3.8.3",