@vymalo/opencode-oauth2 0.12.0 → 0.14.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cache.d.ts +6 -6
- package/dist/cache.js +100 -104
- package/dist/cache.js.map +1 -1
- package/dist/config.d.ts +107 -107
- package/dist/config.js +173 -182
- package/dist/config.js.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/lib.js +1 -0
- package/dist/lib.js.map +1 -1
- package/dist/logging.d.ts +6 -6
- package/dist/logging.js +57 -56
- package/dist/logging.js.map +1 -1
- package/dist/model-discovery.d.ts +3 -3
- package/dist/model-discovery.js +61 -66
- package/dist/model-discovery.js.map +1 -1
- package/dist/model-normalization.js +84 -73
- package/dist/model-normalization.js.map +1 -1
- package/dist/oauth/browser.js +29 -25
- package/dist/oauth/browser.js.map +1 -1
- package/dist/oauth/client.d.ts +46 -46
- package/dist/oauth/client.js +411 -430
- package/dist/oauth/client.js.map +1 -1
- package/dist/oauth/device-code.d.ts +23 -23
- package/dist/oauth/device-code.js +225 -235
- package/dist/oauth/device-code.js.map +1 -1
- package/dist/oauth/discovery.d.ts +5 -5
- package/dist/oauth/discovery.js +34 -34
- package/dist/oauth/discovery.js.map +1 -1
- package/dist/oauth/http-utils.d.ts +27 -27
- package/dist/oauth/http-utils.js +96 -107
- package/dist/oauth/http-utils.js.map +1 -1
- package/dist/oauth/local-callback.d.ts +5 -5
- package/dist/oauth/local-callback.js +76 -74
- package/dist/oauth/local-callback.js.map +1 -1
- package/dist/oauth/pkce.d.ts +2 -2
- package/dist/oauth/pkce.js +9 -5
- package/dist/oauth/pkce.js.map +1 -1
- package/dist/oauth/subject-token.d.ts +15 -15
- package/dist/oauth/subject-token.js +68 -73
- package/dist/oauth/subject-token.js.map +1 -1
- package/dist/opencode.d.ts +15 -15
- package/dist/opencode.js +477 -497
- package/dist/opencode.js.map +1 -1
- package/dist/plugin.d.ts +39 -39
- package/dist/plugin.js +270 -277
- package/dist/plugin.js.map +1 -1
- package/dist/responses-repair.d.ts +12 -35
- package/dist/responses-repair.js +119 -125
- package/dist/responses-repair.js.map +1 -1
- package/dist/scheduler.d.ts +5 -5
- package/dist/scheduler.js +43 -45
- package/dist/scheduler.js.map +1 -1
- package/dist/types.d.ts +25 -25
- package/dist/types.js +1 -0
- package/dist/types.js.map +1 -1
- package/package.json +3 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"
|
|
1
|
+
{"mappings":"AAEA,SAAS,kBAAkB;AAC3B,SACE,2BAA2B,2BAC3B,oBACK;AACP,SAAS,wBAAwB;AAEjC,MAAM,yBAAyB;AAC/B,MAAM,gCAAgC;AACtC,MAAM,8BAA8B;AACpC,MAAM,2BAA2B;;;;;;AAMjC,MAAM,4BAA4B;AA0ClC,SAAS,aAAa,IAA2B;CAC/C,OAAO,IAAI,SAAS,YAAY;EAC9B,WAAW,SAAS,EAAE;CACxB,CAAC;AACH;AAEA,eAAe,wBAAwB,UAAqC;CAC1E,OAAO,0BAA0B,UAAU,wBAAwB;AACrE;AAEA,SAAS,iCAAiC,SAA+C;CACvF,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;EAC3C,MAAM,IAAI,MAAM,oDAAoD;CACtE;CAEA,MAAM,SAAS;CACf,MAAM,aAAa,OAAO;CAC1B,MAAM,WAAW,OAAO;CACxB,MAAM,kBAAkB,OAAO;CAC/B,MAAM,YAAY,OAAO;CAEzB,IAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;EAC7D,MAAM,IAAI,MAAM,sDAAsD;CACxE;CACA,IAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;EACzD,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,IAAI,OAAO,oBAAoB,YAAY,gBAAgB,WAAW,GAAG;EACvE,MAAM,IAAI,MAAM,2DAA2D;CAC7E;CACA,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,GAAG;EAClF,MAAM,IAAI,MAAM,6DAA6D;CAC/E;CAEA,MAAM,0BACJ,OAAO,OAAO,8BAA8B,YAC5C,OAAO,0BAA0B,SAAS,IACtC,OAAO,4BACP;CAEN,MAAM,WACJ,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,OAAO,QAAQ,KAAK,OAAO,WAAW,IACzF,KAAK,KAAK,OAAO,QAAQ,IACzB;CAEN,OAAO;EACL,aAAa;EACb,WAAW;EACX,kBAAkB;EAClB,2BAA2B;EAC3B,YAAY;EACZ;CACF;AACF;AAEA,OAAO,eAAe,0BACpB,SACmB;CACnB,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,EAAE,QAAQ,aAAa;;;;;;;;CAS7B,MAAM,UAAU,QAAQ,SAAS;CACjC,MAAM,OAAO,UAAU,iBAAiB,IAAI;;CAG5C,MAAM,iBAAiB,IAAI,gBAAgB;EACzC,WAAW,QAAQ;EACnB,OAAO,QAAQ,OAAO,KAAK,GAAG;CAChC,CAAC;CAED,IAAI,MAAM;EACR,eAAe,IAAI,kBAAkB,KAAK,SAAS;EACnD,eAAe,IAAI,yBAAyB,MAAM;CACpD;CAEA,IAAI,QAAQ,cAAc;EACxB,eAAe,IAAI,iBAAiB,QAAQ,YAAY;CAC1D;CAEA,MAAM,uBAAuB,IAAI,gBAAgB;CACjD,MAAM,oBAAoB,iBAAiB,qBAAqB,MAAM,GAAG,QAAQ,SAAS;CAE1F,IAAI;CACJ,IAAI;EACF,qBAAqB,MAAM,UAAU,QAAQ,6BAA6B;GACxE,QAAQ;GACR,SAAS;IACP,gBAAgB;IAChB,QAAQ;GACV;GACA,MAAM;GACN,QAAQ,qBAAqB;EAC/B,CAAC;CACH,UAAU;EACR,aAAa,iBAAiB;CAChC;CAEA,IAAI,CAAC,mBAAmB,IAAI;EAC1B,MAAM,UAAU,MAAM,wBAAwB,kBAAkB;;;;;EAKhE,OAAO,MAAM,qCAAqC;GAChD;GACA,QAAQ,mBAAmB;GAC3B,aAAa,UAAU,aAAa,OAAO,IAAI;EACjD,CAAC;EACD,MAAM,IAAI,MAAM,wCAAwC,mBAAmB,OAAO,EAAE;CACtF;CAEA,MAAM,oBAAqB,MAAM,mBAAmB,KAAK;CACzD,MAAM,aAAa,iCAAiC,iBAAiB;CAErE,MAAM,kBAAkB,WAAW,6BAA6B,WAAW;;;;CAK3E,OAAO,KAAK,4BAA4B;EACtC;EACA,UAAU,WAAW;EACrB,WAAW,WAAW;EACtB;CACF,CAAC;;;CAID,QAAQ,OAAO,MACb,6CAA6C,SAAS,cAAc,gBAAgB,aAAa,WAAW,UAAU,kBAAkB,WAAW,WAAW,OAChK;;CAGA,IAAI,kBAAkB,WAAW,YAAY;CAC7C,MAAM,aAAa,IAAI,IAAI,WAAW,aAAa;CACnD,IAAI,+BAA+B;CAEnC,OAAO,MAAM;EACX,MAAM,cAAc,aAAa,IAAI;EACrC,IAAI,eAAe,GAAG;GACpB,MAAM,IAAI,MAAM,oDAAoD;EACtE;EAEA,MAAM,MAAM,KAAK,IAAI,kBAAkB,KAAM,WAAW,CAAC;EAEzD,MAAM,WAAW,IAAI,gBAAgB;GACnC,YAAY;GACZ,aAAa,WAAW;GACxB,WAAW,QAAQ;EACrB,CAAC;EAED,IAAI,MAAM;GACR,SAAS,IAAI,iBAAiB,KAAK,QAAQ;EAC7C;EAEA,IAAI,QAAQ,cAAc;GACxB,SAAS,IAAI,iBAAiB,QAAQ,YAAY;EACpD;EAEA,MAAM,iBAAiB,IAAI,gBAAgB;EAC3C,MAAM,cAAc,iBAAiB,eAAe,MAAM,GAAG,QAAQ,SAAS;EAE9E,IAAI;EACJ,IAAI;GACF,eAAe,MAAM,UAAU,QAAQ,eAAe;IACpD,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,QAAQ;IACV;IACA,MAAM;IACN,QAAQ,eAAe;GACzB,CAAC;;;;GAID,+BAA+B;EACjC,SAAS,OAAO;;;;;;;GAOd,IAAI,iBAAiB,WAAW;IAC9B,OAAO,MAAM,iCAAiC;KAC5C;KACA,OAAO,MAAM;IACf,CAAC;IACD,MAAM;GACR;GACA;;;;;;GAMA,kBAAkB,KAAK,IACrB,kBAAkB,6BAClB,yBACF;GACA,OAAO,KAAK,0CAA0C;IACpD;IACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5D,qBAAqB;IACrB,qBAAqB;GACvB,CAAC;GACD;EACF,UAAU;GACR,aAAa,WAAW;EAC1B;EAEA,IAAI,aAAa,IAAI;GACnB,MAAM,UAAW,MAAM,aAAa,KAAK;GACzC,MAAM,QAAQ,WAAW,SAAS,EAAE,qBAAqB,KAAK,CAAC;GAE/D,OAAO,KAAK,6BAA6B;IACvC;IACA,iBAAiB;GACnB,CAAC;GAED,OAAO;EACT;EAEA,IAAI,aAAa,UAAU,OAAO,aAAa,SAAS,KAAK;GAC3D,IAAI,eAAkC,CAAC;GACvC,MAAM,OAAO,MAAM,wBAAwB,YAAY;GACvD,IAAI;IACF,IAAI,KAAK,SAAS,GAAG;KACnB,eAAe,KAAK,MAAM,IAAI;IAChC;GACF,QAAQ,CAER;GAEA,MAAM,YAAY,aAAa;GAE/B,IAAI,cAAc,yBAAyB;IACzC;GACF;GAEA,IAAI,cAAc,aAAa;IAC7B,mBAAmB;IACnB;GACF;GAEA,IAAI,cAAc,iBAAiB;IACjC,MAAM,IAAI,MAAM,yDAAyD;GAC3E;GAEA,IAAI,cAAc,iBAAiB;IACjC,MAAM,IAAI,MAAM,0CAA0C;GAC5D;GAEA,OAAO,MAAM,iCAAiC;IAC5C;IACA,QAAQ,aAAa;IACrB,WAAW,aAAa;;;;;IAKxB,aAAa,OAAO,aAAa,IAAI,IAAI;GAC3C,CAAC;GACD,MAAM,IAAI,MACR,kCAAkC,aAAa,OAAO,GAAG,YAAY,KAAK,cAAc,IAC1F;EACF;;EAGA,MAAM,UAAU,MAAM,wBAAwB,YAAY;EAC1D,OAAO,MAAM,iCAAiC;GAC5C;GACA,QAAQ,aAAa;GACrB,aAAa,UAAU,aAAa,OAAO,IAAI;EACjD,CAAC;EACD,MAAM,IAAI,MAAM,kCAAkC,aAAa,OAAO,EAAE;CAC1E;AACF","names":[],"sources":["../../src/oauth/device-code.ts"],"version":3,"file":"device-code.js","sourceRoot":""}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
export interface OidcMetadata {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
2
|
+
issuer: string;
|
|
3
|
+
authorization_endpoint?: string;
|
|
4
|
+
token_endpoint: string;
|
|
5
|
+
device_authorization_endpoint?: string;
|
|
6
|
+
jwks_uri?: string;
|
|
7
7
|
}
|
|
8
8
|
export declare function discoverOidcMetadata(issuer: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<OidcMetadata>;
|
package/dist/oauth/discovery.js
CHANGED
|
@@ -1,38 +1,38 @@
|
|
|
1
1
|
function buildWellKnownUrl(issuer) {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
2
|
+
const normalizedIssuer = issuer.endsWith("/") ? issuer : `${issuer}/`;
|
|
3
|
+
const url = new URL(".well-known/openid-configuration", normalizedIssuer);
|
|
4
|
+
return url.toString();
|
|
5
5
|
}
|
|
6
|
-
export async function discoverOidcMetadata(issuer, fetchImpl = fetch, timeoutMs =
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
}
|
|
6
|
+
export async function discoverOidcMetadata(issuer, fetchImpl = fetch, timeoutMs = 15e3) {
|
|
7
|
+
const url = buildWellKnownUrl(issuer);
|
|
8
|
+
const controller = new AbortController();
|
|
9
|
+
const timeout = setTimeout(() => controller.abort(), timeoutMs);
|
|
10
|
+
try {
|
|
11
|
+
const response = await fetchImpl(url, {
|
|
12
|
+
method: "GET",
|
|
13
|
+
headers: { Accept: "application/json" },
|
|
14
|
+
signal: controller.signal
|
|
15
|
+
});
|
|
16
|
+
if (!response.ok) {
|
|
17
|
+
throw new Error(`OIDC discovery failed (${response.status})`);
|
|
18
|
+
}
|
|
19
|
+
const metadata = await response.json();
|
|
20
|
+
// Only the token_endpoint is universally required — every grant we support
|
|
21
|
+
// needs it. authorization_endpoint and device_authorization_endpoint are
|
|
22
|
+
// grant-specific; callers validate per their chosen flow.
|
|
23
|
+
if (!metadata.token_endpoint) {
|
|
24
|
+
throw new Error("OIDC metadata is missing token_endpoint");
|
|
25
|
+
}
|
|
26
|
+
return {
|
|
27
|
+
issuer: metadata.issuer ?? issuer,
|
|
28
|
+
authorization_endpoint: metadata.authorization_endpoint,
|
|
29
|
+
token_endpoint: metadata.token_endpoint,
|
|
30
|
+
device_authorization_endpoint: metadata.device_authorization_endpoint,
|
|
31
|
+
jwks_uri: metadata.jwks_uri
|
|
32
|
+
};
|
|
33
|
+
} finally {
|
|
34
|
+
clearTimeout(timeout);
|
|
35
|
+
}
|
|
37
36
|
}
|
|
37
|
+
|
|
38
38
|
//# sourceMappingURL=discovery.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"
|
|
1
|
+
{"mappings":"AAYA,SAAS,kBAAkB,QAAwB;CACjD,MAAM,mBAAmB,OAAO,SAAS,GAAG,IAAI,SAAS,GAAG,OAAO;CACnE,MAAM,MAAM,IAAI,IAAI,oCAAoC,gBAAgB;CACxE,OAAO,IAAI,SAAS;AACtB;AAEA,OAAO,eAAe,qBACpB,QACA,YAA0B,OAC1B,YAAY,MACW;CACvB,MAAM,MAAM,kBAAkB,MAAM;CACpC,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,UAAU,iBAAiB,WAAW,MAAM,GAAG,SAAS;CAE9D,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,KAAK;GACpC,QAAQ;GACR,SAAS,EAAE,QAAQ,mBAAmB;GACtC,QAAQ,WAAW;EACrB,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,IAAI,MAAM,0BAA0B,SAAS,OAAO,EAAE;EAC9D;EAEA,MAAM,WAAY,MAAM,SAAS,KAAK;;;;EAItC,IAAI,CAAC,SAAS,gBAAgB;GAC5B,MAAM,IAAI,MAAM,yCAAyC;EAC3D;EAEA,OAAO;GACL,QAAQ,SAAS,UAAU;GAC3B,wBAAwB,SAAS;GACjC,gBAAgB,SAAS;GACzB,+BAA+B,SAAS;GACxC,UAAU,SAAS;EACrB;CACF,UAAU;EACR,aAAa,OAAO;CACtB;AACF","names":[],"sources":["../../src/oauth/discovery.ts"],"version":3,"file":"discovery.js","sourceRoot":""}
|
|
@@ -1,33 +1,33 @@
|
|
|
1
1
|
/**
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
2
|
+
* Strip credentials (`user:pass@`) and the query string from a URL before
|
|
3
|
+
* including it in user-facing error messages or thrown exceptions. The query
|
|
4
|
+
* string can contain access tokens, session ids, or other secrets supplied by
|
|
5
|
+
* caller-controlled config — `baseURL` and `issuer` are not validated as
|
|
6
|
+
* credential-free.
|
|
7
|
+
*/
|
|
8
8
|
export declare function redactUrl(rawUrl: string): string;
|
|
9
9
|
/**
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
10
|
+
* Read at most `maxChars` characters from a `Response`'s body without
|
|
11
|
+
* buffering the rest. Cancels the underlying stream once the cap is reached so
|
|
12
|
+
* the network isn't drained on a huge error page.
|
|
13
|
+
*
|
|
14
|
+
* Returns an empty string if the body is unreadable or empty.
|
|
15
|
+
*/
|
|
16
16
|
export declare function readResponseBodyPreview(response: Response, maxChars?: number): Promise<string>;
|
|
17
17
|
/**
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
18
|
+
* Mask token/credential substrings inside an arbitrary text body before it
|
|
19
|
+
* lands in a structured log entry. Field-name-based redaction in upstream
|
|
20
|
+
* loggers only matches whole field NAMES — it does not scrub secrets embedded
|
|
21
|
+
* in arbitrary string VALUES (like an IdP error body that echoes back the
|
|
22
|
+
* client_secret it received).
|
|
23
|
+
*
|
|
24
|
+
* Catches:
|
|
25
|
+
* - JSON: `"access_token": "..."` and the other SECRET_FIELD_NAMES
|
|
26
|
+
* - form bodies: `client_secret=...`
|
|
27
|
+
* - Bearer/Basic auth headers
|
|
28
|
+
* - bare JWT-shaped strings
|
|
29
|
+
*
|
|
30
|
+
* Anything not matching stays intact, so error messages keep their diagnostic
|
|
31
|
+
* value (status code, error kind, descriptions, etc.).
|
|
32
|
+
*/
|
|
33
33
|
export declare function scrubSecrets(text: string): string;
|
package/dist/oauth/http-utils.js
CHANGED
|
@@ -1,129 +1,118 @@
|
|
|
1
1
|
/**
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
2
|
+
* Strip credentials (`user:pass@`) and the query string from a URL before
|
|
3
|
+
* including it in user-facing error messages or thrown exceptions. The query
|
|
4
|
+
* string can contain access tokens, session ids, or other secrets supplied by
|
|
5
|
+
* caller-controlled config — `baseURL` and `issuer` are not validated as
|
|
6
|
+
* credential-free.
|
|
7
|
+
*/
|
|
8
8
|
export function redactUrl(rawUrl) {
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
.replace(/\/\/[^/@]*@/, "//")
|
|
22
|
-
.replace(/\?.*$/, "")
|
|
23
|
-
.replace(/#.*$/, "");
|
|
24
|
-
}
|
|
9
|
+
try {
|
|
10
|
+
const url = new URL(rawUrl);
|
|
11
|
+
url.username = "";
|
|
12
|
+
url.password = "";
|
|
13
|
+
url.search = "";
|
|
14
|
+
url.hash = "";
|
|
15
|
+
return url.toString();
|
|
16
|
+
} catch {
|
|
17
|
+
// Not a parseable URL — strip anything that looks like a query and any
|
|
18
|
+
// userinfo separator, then return.
|
|
19
|
+
return rawUrl.replace(/\/\/[^/@]*@/, "//").replace(/\?.*$/, "").replace(/#.*$/, "");
|
|
20
|
+
}
|
|
25
21
|
}
|
|
26
22
|
/**
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
23
|
+
* Read at most `maxChars` characters from a `Response`'s body without
|
|
24
|
+
* buffering the rest. Cancels the underlying stream once the cap is reached so
|
|
25
|
+
* the network isn't drained on a huge error page.
|
|
26
|
+
*
|
|
27
|
+
* Returns an empty string if the body is unreadable or empty.
|
|
28
|
+
*/
|
|
33
29
|
export async function readResponseBodyPreview(response, maxChars = 500) {
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
try {
|
|
68
|
-
await reader.cancel();
|
|
69
|
-
}
|
|
70
|
-
catch {
|
|
71
|
-
// best-effort
|
|
72
|
-
}
|
|
73
|
-
}
|
|
74
|
-
return collected;
|
|
30
|
+
if (!response.body) {
|
|
31
|
+
// Some runtimes attach the body lazily; fall back to text() but still cap.
|
|
32
|
+
try {
|
|
33
|
+
const text = await response.text();
|
|
34
|
+
return text.slice(0, maxChars);
|
|
35
|
+
} catch {
|
|
36
|
+
return "";
|
|
37
|
+
}
|
|
38
|
+
}
|
|
39
|
+
const reader = response.body.getReader();
|
|
40
|
+
const decoder = new TextDecoder("utf-8", { fatal: false });
|
|
41
|
+
let collected = "";
|
|
42
|
+
try {
|
|
43
|
+
while (collected.length < maxChars) {
|
|
44
|
+
const { done, value } = await reader.read();
|
|
45
|
+
if (done) {
|
|
46
|
+
break;
|
|
47
|
+
}
|
|
48
|
+
if (!value) {
|
|
49
|
+
continue;
|
|
50
|
+
}
|
|
51
|
+
collected += decoder.decode(value, { stream: true });
|
|
52
|
+
if (collected.length >= maxChars) {
|
|
53
|
+
collected = collected.slice(0, maxChars);
|
|
54
|
+
break;
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
} catch {} finally {
|
|
58
|
+
try {
|
|
59
|
+
await reader.cancel();
|
|
60
|
+
} catch {}
|
|
61
|
+
}
|
|
62
|
+
return collected;
|
|
75
63
|
}
|
|
76
64
|
// Names of token/credential fields commonly echoed back by misbehaving IdPs in
|
|
77
65
|
// error responses. Used both for JSON-style ("name":"value") and form-style
|
|
78
66
|
// (name=value&...) substitution.
|
|
79
67
|
const SECRET_FIELD_NAMES = [
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
68
|
+
"access_token",
|
|
69
|
+
"refresh_token",
|
|
70
|
+
"id_token",
|
|
71
|
+
"client_secret",
|
|
72
|
+
"client_assertion",
|
|
73
|
+
"code",
|
|
74
|
+
"device_code",
|
|
75
|
+
"password",
|
|
76
|
+
"assertion",
|
|
77
|
+
"subject_token",
|
|
78
|
+
"actor_token"
|
|
91
79
|
];
|
|
92
80
|
const REDACTED = "[redacted]";
|
|
93
81
|
// Pre-built patterns so we don't re-compile on every call.
|
|
94
82
|
const SECRET_JSON_PATTERN = new RegExp(
|
|
95
|
-
// "name" : "value" (also handles escaped quotes inside value)
|
|
96
|
-
`("(?:${SECRET_FIELD_NAMES.join("|")})"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`,
|
|
83
|
+
// "name" : "value" (also handles escaped quotes inside value)
|
|
84
|
+
`("(?:${SECRET_FIELD_NAMES.join("|")})"\\s*:\\s*)"(?:\\\\.|[^"\\\\])*"`,
|
|
85
|
+
"gi"
|
|
86
|
+
);
|
|
97
87
|
const SECRET_FORM_PATTERN = new RegExp(
|
|
98
|
-
// name=value (terminated by & or end-of-string)
|
|
99
|
-
`(\\b(?:${SECRET_FIELD_NAMES.join("|")}))=([^&\\s]+)`,
|
|
88
|
+
// name=value (terminated by & or end-of-string)
|
|
89
|
+
`(\\b(?:${SECRET_FIELD_NAMES.join("|")}))=([^&\\s]+)`,
|
|
90
|
+
"gi"
|
|
91
|
+
);
|
|
100
92
|
// Bearer / Basic prefixes in headers/messages, plus bare JWT-shaped strings.
|
|
101
93
|
const BEARER_PATTERN = /\b(Bearer|Basic)\s+([A-Za-z0-9._\-+/=]+)/g;
|
|
102
94
|
const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
|
|
103
95
|
/**
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
96
|
+
* Mask token/credential substrings inside an arbitrary text body before it
|
|
97
|
+
* lands in a structured log entry. Field-name-based redaction in upstream
|
|
98
|
+
* loggers only matches whole field NAMES — it does not scrub secrets embedded
|
|
99
|
+
* in arbitrary string VALUES (like an IdP error body that echoes back the
|
|
100
|
+
* client_secret it received).
|
|
101
|
+
*
|
|
102
|
+
* Catches:
|
|
103
|
+
* - JSON: `"access_token": "..."` and the other SECRET_FIELD_NAMES
|
|
104
|
+
* - form bodies: `client_secret=...`
|
|
105
|
+
* - Bearer/Basic auth headers
|
|
106
|
+
* - bare JWT-shaped strings
|
|
107
|
+
*
|
|
108
|
+
* Anything not matching stays intact, so error messages keep their diagnostic
|
|
109
|
+
* value (status code, error kind, descriptions, etc.).
|
|
110
|
+
*/
|
|
119
111
|
export function scrubSecrets(text) {
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
.replace(SECRET_JSON_PATTERN, `$1"${REDACTED}"`)
|
|
125
|
-
.replace(SECRET_FORM_PATTERN, `$1=${REDACTED}`)
|
|
126
|
-
.replace(BEARER_PATTERN, `$1 ${REDACTED}`)
|
|
127
|
-
.replace(JWT_PATTERN, REDACTED);
|
|
112
|
+
if (!text) {
|
|
113
|
+
return text;
|
|
114
|
+
}
|
|
115
|
+
return text.replace(SECRET_JSON_PATTERN, `$1"${REDACTED}"`).replace(SECRET_FORM_PATTERN, `$1=${REDACTED}`).replace(BEARER_PATTERN, `$1 ${REDACTED}`).replace(JWT_PATTERN, REDACTED);
|
|
128
116
|
}
|
|
117
|
+
|
|
129
118
|
//# sourceMappingURL=http-utils.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"
|
|
1
|
+
{"mappings":";;;;;;;AAOA,OAAO,SAAS,UAAU,QAAwB;CAChD,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,IAAI,WAAW;EACf,IAAI,WAAW;EACf,IAAI,SAAS;EACb,IAAI,OAAO;EACX,OAAO,IAAI,SAAS;CACtB,QAAQ;;;EAGN,OAAO,OACJ,QAAQ,eAAe,IAAI,CAAC,CAC5B,QAAQ,SAAS,EAAE,CAAC,CACpB,QAAQ,QAAQ,EAAE;CACvB;AACF;;;;;;;;AASA,OAAO,eAAe,wBAAwB,UAAoB,WAAW,KAAsB;CACjG,IAAI,CAAC,SAAS,MAAM;;EAElB,IAAI;GACF,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,OAAO,KAAK,MAAM,GAAG,QAAQ;EAC/B,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,UAAU,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC;CACzD,IAAI,YAAY;CAEhB,IAAI;EACF,OAAO,UAAU,SAAS,UAAU;GAClC,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;IACR;GACF;GACA,IAAI,CAAC,OAAO;IACV;GACF;GACA,aAAa,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;GACnD,IAAI,UAAU,UAAU,UAAU;IAChC,YAAY,UAAU,MAAM,GAAG,QAAQ;IACvC;GACF;EACF;CACF,QAAQ,CAER,UAAU;EACR,IAAI;GACF,MAAM,OAAO,OAAO;EACtB,QAAQ,CAER;CACF;CAEA,OAAO;AACT;;;;AAKA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,WAAW;;AAGjB,MAAM,sBAAsB,IAAI;;CAE9B,QAAQ,mBAAmB,KAAK,GAAG,EAAE;CACrC;AACF;AACA,MAAM,sBAAsB,IAAI;;CAE9B,UAAU,mBAAmB,KAAK,GAAG,EAAE;CACvC;AACF;;AAEA,MAAM,iBAAiB;AACvB,MAAM,cAAc;;;;;;;;;;;;;;;;;AAkBpB,OAAO,SAAS,aAAa,MAAsB;CACjD,IAAI,CAAC,MAAM;EACT,OAAO;CACT;CACA,OAAO,KACJ,QAAQ,qBAAqB,MAAM,SAAS,EAAE,CAAC,CAC/C,QAAQ,qBAAqB,MAAM,UAAU,CAAC,CAC9C,QAAQ,gBAAgB,MAAM,UAAU,CAAC,CACzC,QAAQ,aAAa,QAAQ;AAClC","names":[],"sources":["../../src/oauth/http-utils.ts"],"version":3,"file":"http-utils.js","sourceRoot":""}
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
export interface OAuthCallbackResult {
|
|
2
|
-
|
|
3
|
-
|
|
2
|
+
code: string;
|
|
3
|
+
state: string;
|
|
4
4
|
}
|
|
5
5
|
export interface LocalCallbackServer {
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
6
|
+
redirectUri: string;
|
|
7
|
+
waitForCode: (timeoutMs?: number) => Promise<OAuthCallbackResult>;
|
|
8
|
+
close: () => Promise<void>;
|
|
9
9
|
}
|
|
10
10
|
export declare function startLocalCallbackServer(callbackPath?: string, port?: number): Promise<LocalCallbackServer>;
|