@vizamodo/modo-dispatcher 1.1.77

package/dist/auth/session/login.js

@@ -0,0 +1,144 @@
+import { randomBytes, webcrypto } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { exchangeGithubCodeForTokens } from "../oauth/github.js";
+import { createOAuthCallbackServer } from "../oauth/callback-server.js";
+import { AuthError, toStructuredAuthError } from "../oauth/auth-error.js";
+import { rotateTokens } from "./rotate.js";
+import { extractIdentity } from "../identity/extract-identity.js";
+import { persistBootstrapMap } from "../../core/bootstrap.js";
+const execFileAsync = promisify(execFile);
+const VIZA_LOGIN_URL = "https://auth.viza.io.vn/auth/login";
+const DEFAULT_OAUTH_CALLBACK_PORT = 39123;
+function base64UrlEncode(bytes) {
+    return Buffer.from(bytes)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+async function sha256(input) {
+    const digest = await webcrypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+export async function performInteractiveLogin(deps, options) {
+    if (!options.loginEndpoint) {
+        throw new Error("Missing token endpoint for login flow.");
+    }
+    const state = randomBytes(12).toString("hex");
+    const codeVerifier = base64UrlEncode(randomBytes(32));
+    const codeChallenge = await sha256(codeVerifier);
+    const callbackPath = "/callback";
+    // Start the local callback server first so we know the actual port.
+    // If the preferred port is in use the server will bind to a random one.
+    const srv = await createOAuthCallbackServer(DEFAULT_OAUTH_CALLBACK_PORT, callbackPath);
+    const redirectUri = `http://127.0.0.1:${srv.port}${callbackPath}`;
+    const url = new URL(VIZA_LOGIN_URL);
+    url.searchParams.set("state", state);
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("local_port", String(srv.port));
+    url.searchParams.set("code_challenge", codeChallenge);
+    await openBrowser(url.toString());
+    let callback;
+    try {
+        callback = await Promise.race([
+            srv.waitForCallback(),
+            new Promise((_, reject) => {
+                setTimeout(() => {
+                    reject(new AuthError({
+                        code: "oauth_timeout",
+                        message: "Authentication timed out while waiting for OAuth callback.",
+                        suggestion: "Retry login and complete authorization in the same browser session.",
+                    }));
+                }, 1000 * 60 * 5);
+            }),
+        ]);
+    }
+    catch (error) {
+        try {
+            await srv.close();
+        }
+        catch {
+            // ignore close failures
+        }
+        throw error;
+    }
+    try {
+        if (callback.state && callback.state !== state) {
+            await callback.notifyAuthResult({
+                status: "failed",
+                error: {
+                    code: "state_mismatch",
+                    message: "Authentication session expired. Please retry login.",
+                    suggestion: "Retry login and complete authorization in the same browser session.",
+                },
+            });
+            throw new AuthError({
+                code: "state_mismatch",
+                message: "Authentication session expired. Please retry login.",
+                suggestion: "Retry login and complete authorization in the same browser session.",
+            });
+        }
+        const exchangeResult = await exchangeGithubCodeForTokens({
+            exchangeEndpoint: options.exchangeEndpoint ??
+                "https://auth.viza.io.vn/auth/exchange",
+            code: callback.code,
+            redirectUri,
+            state,
+            codeVerifier,
+        });
+        await rotateTokens(exchangeResult.tokenPair, deps.accessTokenService, deps.refreshTokenService);
+        // Persist bootstrap configs received from the gateway exchange
+        if (exchangeResult.bootstrap) {
+            persistBootstrapMap(exchangeResult.bootstrap);
+            const envs = Object.keys(exchangeResult.bootstrap).join(", ");
+            console.log(`\n[auth] bootstrap config(s) received for: ${envs}`);
+        }
+        const claims = deps.accessTokenService.getClaims();
+        const identity = extractIdentity(claims);
+        await callback.notifyAuthResult({
+            status: "success",
+            login: identity.login,
+            email: identity.email,
+            avatarUrl: identity.avatarUrl,
+            teams: identity.teams,
+        });
+        return {
+            bootstrapReceived: !!exchangeResult.bootstrap,
+        };
+    }
+    catch (error) {
+        try {
+            await callback.notifyAuthResult({
+                status: "failed",
+                error: toStructuredAuthError(error),
+            });
+        }
+        catch {
+            // ignore local callback notification failures
+        }
+        try {
+            await callback.close();
+        }
+        catch {
+            // ignore close failures
+        }
+        throw error;
+    }
+}
+async function openBrowser(url) {
+    try {
+        if (process.platform === "darwin") {
+            await execFileAsync("open", [url]);
+            return;
+        }
+        if (process.platform === "win32") {
+            await execFileAsync("cmd", ["/c", "start", "", url]);
+            return;
+        }
+        await execFileAsync("xdg-open", [url]);
+    }
+    catch {
+        throw new Error(`Failed to open browser automatically. Please open this URL manually:\n${url}`);
+    }
+}

package/dist/auth/session/logout.d.ts

@@ -0,0 +1,3 @@
+import { AccessTokenService } from "./access-token.js";
+import { RefreshTokenService } from "./refresh-token.js";
+export declare function logoutSession(accessTokenService: AccessTokenService, refreshTokenService: RefreshTokenService, revokeEndpoint?: string): Promise<void>;

package/dist/auth/session/logout.js

@@ -0,0 +1,21 @@
+import { TokenStateMachine } from "./token-state.js";
+export async function logoutSession(accessTokenService, refreshTokenService, revokeEndpoint) {
+    const refreshToken = await refreshTokenService.get();
+    if (revokeEndpoint && refreshToken) {
+        try {
+            await fetch(revokeEndpoint, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${refreshToken}`,
+                },
+            });
+        }
+        catch {
+            // best-effort revoke
+        }
+    }
+    // Invalidate runtime auth/session state before clearing persisted tokens.
+    TokenStateMachine.invalidate();
+    accessTokenService.clear();
+    await refreshTokenService.clear();
+}

package/dist/auth/session/refresh-token.d.ts

@@ -0,0 +1,8 @@
+import { SecureStore } from "../storage/types.js";
+export declare class RefreshTokenService {
+    private readonly secureStore;
+    constructor(secureStore: SecureStore);
+    get(): Promise<string | null>;
+    set(token: string): Promise<void>;
+    clear(): Promise<void>;
+}

package/dist/auth/session/refresh-token.js

@@ -0,0 +1,16 @@
+const REFRESH_TOKEN_KEY = "viza.refresh-token";
+export class RefreshTokenService {
+    secureStore;
+    constructor(secureStore) {
+        this.secureStore = secureStore;
+    }
+    get() {
+        return this.secureStore.get(REFRESH_TOKEN_KEY);
+    }
+    set(token) {
+        return this.secureStore.set(REFRESH_TOKEN_KEY, token);
+    }
+    clear() {
+        return this.secureStore.remove(REFRESH_TOKEN_KEY);
+    }
+}

package/dist/auth/session/refresh.d.ts

@@ -0,0 +1,2 @@
+import { TokenPair } from "./types.js";
+export declare function executeRefresh(refreshToken: string, refreshEndpoint: string, timeoutMs?: number): Promise<TokenPair>;

package/dist/auth/session/refresh.js

@@ -0,0 +1,61 @@
+export async function executeRefresh(refreshToken, refreshEndpoint, timeoutMs = 12000) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(refreshEndpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ refresh_token: refreshToken }),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        if (err?.name === "AbortError") {
+            throw new Error("Token refresh timed out");
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+    if (!res.ok) {
+        let errorCode;
+        try {
+            const errorJson = (await res.json());
+            errorCode =
+                typeof errorJson.code === "string"
+                    ? errorJson.code
+                    : typeof errorJson.error === "string"
+                        ? errorJson.error
+                        : undefined;
+        }
+        catch {
+            // Ignore non-JSON error bodies.
+        }
+        if (errorCode) {
+            throw new Error(errorCode);
+        }
+        throw new Error(`Token refresh failed: HTTP ${res.status}`);
+    }
+    const json = (await res.json());
+    const pair = {
+        accessToken: typeof json.access_token === "string"
+            ? json.access_token
+            : (json.accessToken ?? ""),
+        refreshToken: typeof json.refresh_token === "string"
+            ? json.refresh_token
+            : (json.refreshToken ?? ""),
+        tokenType: "Bearer",
+        ...(typeof json.accessTokenExpiresAt === "number"
+            ? { accessTokenExpiresAt: json.accessTokenExpiresAt }
+            : {}),
+        ...(typeof json.refreshTokenExpiresAt === "number"
+            ? { refreshTokenExpiresAt: json.refreshTokenExpiresAt }
+            : {}),
+    };
+    if (!pair.accessToken || !pair.refreshToken) {
+        throw new Error("Token refresh response is invalid");
+    }
+    return pair;
+}

package/dist/auth/session/rotate.d.ts

@@ -0,0 +1,4 @@
+import { AccessTokenService } from "./access-token.js";
+import { RefreshTokenService } from "./refresh-token.js";
+import { TokenPair } from "./types.js";
+export declare function rotateTokens(pair: TokenPair, accessTokenService: AccessTokenService, refreshTokenService: RefreshTokenService): Promise<void>;

package/dist/auth/session/rotate.js

@@ -0,0 +1,4 @@
+export async function rotateTokens(pair, accessTokenService, refreshTokenService) {
+    accessTokenService.set(pair.accessToken);
+    await refreshTokenService.set(pair.refreshToken);
+}

package/dist/auth/session/session-manager.d.ts

@@ -0,0 +1,16 @@
+import { AccessTokenService } from "./access-token.js";
+import { RefreshTokenService } from "./refresh-token.js";
+import { TokenStateMachine } from "./token-state.js";
+import { RuntimeContext } from "../../runtime/runtime-context.js";
+export interface SessionManagerOptions {
+    loginEndpoint?: string;
+    exchangeEndpoint?: string;
+    refreshEndpoint?: string;
+    logoutEndpoint?: string;
+}
+export interface SessionManagerDeps {
+    accessTokenService: AccessTokenService;
+    refreshTokenService: RefreshTokenService;
+    tokenState: TokenStateMachine;
+}
+export declare function ensureAuthenticated(deps: SessionManagerDeps, options: SessionManagerOptions): Promise<RuntimeContext>;

package/dist/auth/session/session-manager.js

@@ -0,0 +1,54 @@
+import { performInteractiveLogin } from "./login.js";
+import { extractIdentity } from "../identity/extract-identity.js";
+let inFlightAuthentication = null;
+export async function ensureAuthenticated(deps, options) {
+    await ensureAuthenticationSession(deps, options);
+    const accessToken = await deps.tokenState.getValidAccessToken();
+    const claims = deps.accessTokenService.getClaims();
+    const identity = extractIdentity(claims);
+    return {
+        teams: identity.teams,
+        accessToken,
+        claims,
+    };
+}
+async function ensureAuthenticationSession(deps, options) {
+    if (inFlightAuthentication) {
+        return inFlightAuthentication;
+    }
+    inFlightAuthentication = (async () => {
+        const refreshToken = await deps.refreshTokenService.get();
+        if (!refreshToken) {
+            await performInteractiveLogin(deps, options);
+            return;
+        }
+        try {
+            await deps.tokenState.getValidAccessToken();
+            return;
+        }
+        catch (error) {
+            const message = error instanceof Error
+                ? error.message
+                : String(error);
+            // IMPORTANT:
+            // Only interactive-login when the refresh token itself is invalid.
+            //
+            // Access-token expiry / JWT expiry must silently refresh.
+            // Gateway 401/403 must NOT destroy the session.
+            const isRefreshTokenRejected = message.includes("invalid_refresh_token") ||
+                message.includes("refresh_token_revoked") ||
+                message.includes("refresh_token_expired");
+            if (!isRefreshTokenRejected) {
+                throw error;
+            }
+            await deps.refreshTokenService.clear();
+        }
+        await performInteractiveLogin(deps, options);
+    })();
+    try {
+        await inFlightAuthentication;
+    }
+    finally {
+        inFlightAuthentication = null;
+    }
+}

package/dist/auth/session/token-state.d.ts

@@ -0,0 +1,20 @@
+import { AccessTokenService } from "./access-token.js";
+import { RefreshTokenService } from "./refresh-token.js";
+export interface TokenStateOptions {
+    refreshEndpoint: string;
+    timeoutMs?: number;
+}
+export declare class TokenStateMachine {
+    private readonly accessTokenService;
+    private readonly refreshTokenService;
+    private readonly options;
+    private static invalidationGeneration;
+    private inFlight;
+    private generation;
+    constructor(accessTokenService: AccessTokenService, refreshTokenService: RefreshTokenService, options: TokenStateOptions);
+    static invalidate(): void;
+    getValidAccessToken(): Promise<string>;
+    forceExpireAccessToken(): void;
+    refreshAccessToken(): Promise<string>;
+    private refreshOnce;
+}

package/dist/auth/session/token-state.js

@@ -0,0 +1,55 @@
+import { executeRefresh } from "./refresh.js";
+import { rotateTokens } from "./rotate.js";
+export class TokenStateMachine {
+    accessTokenService;
+    refreshTokenService;
+    options;
+    static invalidationGeneration = 0;
+    inFlight;
+    generation = 0;
+    constructor(accessTokenService, refreshTokenService, options) {
+        this.accessTokenService = accessTokenService;
+        this.refreshTokenService = refreshTokenService;
+        this.options = options;
+    }
+    static invalidate() {
+        TokenStateMachine.invalidationGeneration += 1;
+    }
+    async getValidAccessToken() {
+        await this.accessTokenService.hydrate();
+        if (this.accessTokenService.isValid()) {
+            return this.accessTokenService.get();
+        }
+        return this.refreshAccessToken();
+    }
+    forceExpireAccessToken() {
+        this.accessTokenService.clear();
+        this.generation += 1;
+    }
+    async refreshAccessToken() {
+        if (!this.inFlight) {
+            this.inFlight = this.refreshOnce().finally(() => {
+                this.inFlight = undefined;
+            });
+        }
+        return this.inFlight;
+    }
+    async refreshOnce() {
+        const startGeneration = this.generation;
+        const startInvalidationGeneration = TokenStateMachine.invalidationGeneration;
+        const refreshToken = await this.refreshTokenService.get();
+        if (!refreshToken) {
+            throw new Error("Missing refresh token. Please login again.");
+        }
+        const pair = await executeRefresh(refreshToken, this.options.refreshEndpoint, this.options.timeoutMs);
+        // Guard against stale refresh completion writing over newer state.
+        if (startGeneration !== this.generation ||
+            startInvalidationGeneration !==
+                TokenStateMachine.invalidationGeneration) {
+            return this.accessTokenService.get() ?? pair.accessToken;
+        }
+        await rotateTokens(pair, this.accessTokenService, this.refreshTokenService);
+        this.generation += 1;
+        return pair.accessToken;
+    }
+}

package/dist/auth/session/types.d.ts

@@ -0,0 +1,35 @@
+import { RuntimeEnv } from "../../types/runtime-env.js";
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+    accessTokenExpiresAt?: number;
+    refreshTokenExpiresAt?: number;
+    tokenType?: "Bearer";
+}
+export interface TokenClaims {
+    sub?: string;
+    login?: string;
+    teams?: string[];
+    email?: string;
+    avatarUrl?: string;
+    exp?: number;
+    iat?: number;
+    [key: string]: unknown;
+}
+export interface SessionState {
+    accessToken?: string;
+    refreshToken?: string;
+    accessTokenExpiresAt?: number;
+    refreshTokenExpiresAt?: number;
+    claims?: TokenClaims;
+}
+export interface SessionAuthOptions {
+    targetEnv: RuntimeEnv;
+}
+export interface SessionBootstrapConfig {
+    auth: {
+        loginEndpoint: string;
+        refreshEndpoint: string;
+        revokeEndpoint?: string;
+    };
+}

package/dist/auth/session/types.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/storage/keychain.d.ts

@@ -0,0 +1,16 @@
+import { SecureStore } from "./types.js";
+export interface KeychainStoreOptions {
+    service?: string;
+    account?: string;
+}
+export declare class KeychainStore implements SecureStore {
+    private readonly service;
+    private readonly account;
+    constructor(options?: KeychainStoreOptions);
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+    private accountFor;
+    private assertPlatformSupported;
+    private escapePs;
+}

package/dist/auth/storage/keychain.js

@@ -0,0 +1,107 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export class KeychainStore {
+    service;
+    account;
+    constructor(options = {}) {
+        this.service = options.service ?? "viza-cli-dispatcher";
+        this.account = options.account ?? "refresh-token";
+        this.assertPlatformSupported();
+    }
+    async get(key) {
+        if (process.platform === "darwin") {
+            try {
+                const { stdout } = await execFileAsync("security", [
+                    "find-generic-password",
+                    "-a",
+                    this.accountFor(key),
+                    "-s",
+                    this.service,
+                    "-w",
+                ]);
+                const value = stdout.trim();
+                return value.length > 0 ? value : null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const script = [
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault",
+            `$cred = $vault.Retrieve('${this.escapePs(this.service)}','${this.escapePs(this.accountFor(key))}')`,
+            "$cred.RetrievePassword()",
+            "Write-Output $cred.Password",
+        ].join(";");
+        try {
+            const { stdout } = await execFileAsync("powershell", ["-NoProfile", "-Command", script]);
+            const value = stdout.trim();
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(key, value) {
+        if (process.platform === "darwin") {
+            await execFileAsync("security", [
+                "add-generic-password",
+                "-U",
+                "-a",
+                this.accountFor(key),
+                "-s",
+                this.service,
+                "-w",
+                value,
+            ]);
+            return;
+        }
+        const script = [
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault",
+            `$cred = New-Object Windows.Security.Credentials.PasswordCredential('${this.escapePs(this.service)}','${this.escapePs(this.accountFor(key))}','${this.escapePs(value)}')`,
+            "$vault.Add($cred)",
+        ].join(";");
+        await execFileAsync("powershell", ["-NoProfile", "-Command", script]);
+    }
+    async remove(key) {
+        if (process.platform === "darwin") {
+            try {
+                await execFileAsync("security", [
+                    "delete-generic-password",
+                    "-a",
+                    this.accountFor(key),
+                    "-s",
+                    this.service,
+                ]);
+            }
+            catch {
+                // noop
+            }
+            return;
+        }
+        const script = [
+            "$vault = New-Object Windows.Security.Credentials.PasswordVault",
+            `$cred = $vault.Retrieve('${this.escapePs(this.service)}','${this.escapePs(this.accountFor(key))}')`,
+            "$vault.Remove($cred)",
+        ].join(";");
+        try {
+            await execFileAsync("powershell", ["-NoProfile", "-Command", script]);
+        }
+        catch {
+            // noop
+        }
+    }
+    accountFor(key) {
+        return `${this.account}:${key}`;
+    }
+    assertPlatformSupported() {
+        if (process.platform === "darwin" || process.platform === "win32") {
+            return;
+        }
+        throw new Error("Secure refresh-token storage is unsupported on this platform. " +
+            "Linux requires an explicit secure backend integration.");
+    }
+    escapePs(value) {
+        return value.replace(/'/g, "''");
+    }
+}

package/dist/auth/storage/memory.d.ts

@@ -0,0 +1,10 @@
+export declare class MemoryTokenStore {
+    private accessToken;
+    private accessTokenExpiresAt;
+    setAccessToken(token?: string, expiresAt?: number): void;
+    getAccessToken(): {
+        token: string | undefined;
+        expiresAt: number | undefined;
+    };
+    clear(): void;
+}

package/dist/auth/storage/memory.js

@@ -0,0 +1,15 @@
+export class MemoryTokenStore {
+    accessToken;
+    accessTokenExpiresAt;
+    setAccessToken(token, expiresAt) {
+        this.accessToken = token;
+        this.accessTokenExpiresAt = expiresAt;
+    }
+    getAccessToken() {
+        return { token: this.accessToken, expiresAt: this.accessTokenExpiresAt };
+    }
+    clear() {
+        this.accessToken = undefined;
+        this.accessTokenExpiresAt = undefined;
+    }
+}

package/dist/auth/storage/types.d.ts

@@ -0,0 +1,5 @@
+export interface SecureStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    remove(key: string): Promise<void>;
+}

package/dist/auth/storage/types.js

@@ -0,0 +1 @@
+export {};