npm - @vruum/skills-operator - Versions diffs - 0.1.0 → 0.1.1 - Mend

@vruum/skills-operator 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/install.js +76 -4
package/package.json +1 -1

package/install.js CHANGED Viewed

@@ -234,6 +234,49 @@ async function discoverAuthServer() {
   });
 }
+async function registerClient(registrationEndpoint, redirectUri) {
+  // RFC 7591 Dynamic Client Registration. Supabase's auth server requires a
+  // client_id on authorize and token calls; it advertises a
+  // registration_endpoint in the OAuth metadata so public CLI apps can
+  // register themselves. We register a fresh public client per full auth flow
+  // (loopback redirect_uri varies by OS-picked port, so reuse isn't robust)
+  // and cache the returned client_id in auth.json for refresh calls.
+  const body = JSON.stringify({
+    client_name: 'Vruum Operator Skills CLI',
+    redirect_uris: [redirectUri],
+    token_endpoint_auth_method: 'none',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+  });
+  const parsed = new URL(registrationEndpoint);
+  return new Promise((resolve, reject) => {
+    const req = https.request({
+      method: 'POST',
+      hostname: parsed.hostname,
+      port: parsed.port || 443,
+      path: parsed.pathname + parsed.search,
+      headers: {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(body),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          try { resolve(JSON.parse(data)); }
+          catch { reject(new Error('Registration response is not JSON')); }
+        } else {
+          reject(new Error(`Client registration returned ${res.statusCode}: ${data}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.write(body);
+    req.end();
+  });
+}
 function tryOpenBrowser(urlToOpen) {
   const cmd = process.platform === 'darwin' ? 'open'
             : process.platform === 'win32'  ? 'start'
@@ -251,6 +294,9 @@ async function loopbackAuthFlow() {
   if (!meta.authorization_endpoint || !meta.token_endpoint) {
     throw new Error('OAuth metadata missing authorization_endpoint or token_endpoint');
   }
+  if (!meta.registration_endpoint) {
+    throw new Error('OAuth metadata missing registration_endpoint — cannot register public client');
+  }
   const state = base64UrlEncode(crypto.randomBytes(32));
   const verifier = base64UrlEncode(crypto.randomBytes(32));
@@ -259,12 +305,27 @@ async function loopbackAuthFlow() {
   // Start listener on an OS-picked port.
   return await new Promise((resolve, reject) => {
     const server = http.createServer();
-    server.listen(0, '127.0.0.1', () => {
+    server.listen(0, '127.0.0.1', async () => {
       const { port } = server.address();
       const redirectUri = `http://127.0.0.1:${port}/callback`;
+      // Register a fresh public client for this auth flow. Supabase requires
+      // exact redirect_uri match, so we can't reuse a cached client_id across
+      // runs (the OS-picked port changes). The client_id is cached for
+      // refresh-token calls, which don't require a redirect_uri.
+      let clientId;
+      try {
+        const client = await registerClient(meta.registration_endpoint, redirectUri);
+        clientId = client.client_id;
+      } catch (e) {
+        server.close();
+        reject(new Error(`OAuth client registration failed: ${e.message}`));
+        return;
+      }
       const authUrl = new URL(meta.authorization_endpoint);
       authUrl.searchParams.set('response_type', 'code');
+      authUrl.searchParams.set('client_id', clientId);
       authUrl.searchParams.set('redirect_uri', redirectUri);
       authUrl.searchParams.set('state', state);
       authUrl.searchParams.set('code_challenge', challenge);
@@ -310,11 +371,13 @@ async function loopbackAuthFlow() {
             code,
             redirect_uri: redirectUri,
             code_verifier: verifier,
+            client_id: clientId,
           });
           res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
           res.end('<html><body><h3>Signed in to Vruum.</h3><p>You can close this tab.</p></body></html>');
           clearTimeout(timeout); server.close();
-          resolve(tokens);
+          // Thread client_id through so writeAuthFile can persist it for refresh calls.
+          resolve({ ...tokens, _client_id: clientId });
         } catch (e) {
           res.writeHead(500, { 'Content-Type': 'text/plain' });
           res.end(`Token exchange failed: ${e.message}`);
@@ -370,6 +433,8 @@ function writeAuthFile(tokens) {
   const payload = {
     access_token: tokens.access_token,
     refresh_token: tokens.refresh_token,
+    // client_id is required on Supabase refresh-token calls for public clients.
+    client_id: tokens.client_id || tokens._client_id,
     expires_at: tokens.expires_at || (Math.floor(Date.now() / 1000) + (tokens.expires_in || 3600)),
     token_type: tokens.token_type || 'bearer',
     written_at: nowIso(),
@@ -390,10 +455,17 @@ async function refreshTokens(auth) {
   if (!auth || !auth.refresh_token) return null;
   const meta = await discoverAuthServer();
   try {
-    return await postTokenRequest(meta.token_endpoint, {
+    const params = {
       grant_type: 'refresh_token',
       refresh_token: auth.refresh_token,
-    });
+    };
+    // Supabase requires client_id on public-client refresh calls. Auth files
+    // written before the DCR fix won't have it — missing client_id forces a
+    // full re-auth via loopbackAuthFlow().
+    if (auth.client_id) params.client_id = auth.client_id;
+    const tokens = await postTokenRequest(meta.token_endpoint, params);
+    // Preserve client_id across refresh writes.
+    return { ...tokens, client_id: auth.client_id };
   } catch { return null; }
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@vruum/skills-operator",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OAuth-gated installer for Vruum operator skills. Pulls the operator skill bundle from api.vruum.ai and symlinks it into your AI assistant's skill directory.",
   "license": "MIT",
   "repository": {