@vymalo/opencode-oauth2 0.14.1 → 0.15.0

package/dist/oauth/subject-token.js

@@ -1,81 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { DEFAULT_K8S_SA_TOKEN_PATH } from "../config.js";
-import { readResponseBodyPreview, scrubSecrets } from "./http-utils.js";
-/**
-* Read the platform-supplied JWT that the plugin will present as the subject
-* token (or assertion) for the `jwt_bearer` and `token_exchange` flows.
-*
-* Each source resolves fresh on every call — we never cache the JWT itself,
-* only the OIDC access token it gets exchanged for. K8s projected SA tokens
-* rotate; GHA OIDC tokens are short-lived (~10 min); both are cheap to
-* re-fetch on demand.
-*/
-export async function resolveSubjectToken(source, options = {}) {
-	switch (source.type) {
-		case "github_actions": return resolveGithubActionsToken(source.audience, options);
-		case "kubernetes_sa": return readJwtFile(source.tokenPath ?? DEFAULT_K8S_SA_TOKEN_PATH, "kubernetes_sa");
-		case "file": return readJwtFile(source.path, "file");
-		case "env": return resolveEnvToken(source.var, options.env ?? process.env);
-	}
-}
-async function readJwtFile(path, sourceLabel) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch (error) {
-		const code = error.code;
-		if (code === "ENOENT") {
-			throw new Error(`subjectTokenSource (${sourceLabel}): no file at ${path} — check the mount/path`);
-		}
-		throw new Error(`subjectTokenSource (${sourceLabel}): failed to read ${path}: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const trimmed = raw.trim();
-	if (trimmed.length === 0) {
-		throw new Error(`subjectTokenSource (${sourceLabel}): file at ${path} is empty`);
-	}
-	return trimmed;
-}
-function resolveEnvToken(name, env) {
-	const value = env[name];
-	if (typeof value !== "string" || value.trim().length === 0) {
-		throw new Error(`subjectTokenSource (env): ${name} is not set or is empty`);
-	}
-	return value.trim();
-}
-async function resolveGithubActionsToken(audience, options) {
-	const env = options.env ?? process.env;
-	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
-	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-	if (!requestUrl || !requestToken) {
-		throw new Error(`subjectTokenSource (github_actions): ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN must be set — this only works inside a GitHub Actions job with \`permissions: { id-token: write }\``);
-	}
-	const url = new URL(requestUrl);
-	url.searchParams.set("audience", audience);
-	const fetchImpl = options.fetchImpl ?? fetch;
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 15e3);
-	let response;
-	try {
-		response = await fetchImpl(url.toString(), {
-			method: "GET",
-			headers: {
-				Authorization: `Bearer ${requestToken}`,
-				Accept: "application/json"
-			},
-			signal: controller.signal
-		});
-	} finally {
-		clearTimeout(timer);
-	}
-	if (!response.ok) {
-		const preview = await readResponseBodyPreview(response, 500);
-		throw new Error(`subjectTokenSource (github_actions): OIDC token request failed (${response.status})${preview ? `: ${scrubSecrets(preview)}` : ""}`);
-	}
-	const payload = await response.json();
-	if (typeof payload.value !== "string" || payload.value.length === 0) {
-		throw new Error("subjectTokenSource (github_actions): response had no `value` field — GitHub may have changed the API shape");
-	}
-	return payload.value;
-}
-
-//# sourceMappingURL=subject-token.js.map

package/dist/oauth/subject-token.js.map

@@ -1 +0,0 @@
-{"mappings":"AAAA,SAAS,gBAAgB;AAEzB,SAAS,iCAA0D;AACnE,SAAS,yBAAyB,oBAAoB;;;;;;;;;;AAqBtD,OAAO,eAAe,oBACpB,QACA,UAAsC,CAAC,GACtB;CACjB,QAAQ,OAAO,MAAf;EACE,KAAK,kBACH,OAAO,0BAA0B,OAAO,UAAU,OAAO;EAC3D,KAAK,iBACH,OAAO,YAAY,OAAO,aAAa,2BAA2B,eAAe;EACnF,KAAK,QACH,OAAO,YAAY,OAAO,MAAM,MAAM;EACxC,KAAK,OACH,OAAO,gBAAgB,OAAO,KAAK,QAAQ,OAAO,QAAQ,GAAG;CACjE;AACF;AAEA,eAAe,YAAY,MAAc,aAAsC;CAC7E,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,SAAS,MAAM,MAAM;CACnC,SAAS,OAAO;EACd,MAAM,OAAQ,MAAgC;EAC9C,IAAI,SAAS,UAAU;GACrB,MAAM,IAAI,MACR,uBAAuB,YAAY,gBAAgB,KAAK,wBAC1D;EACF;EACA,MAAM,IAAI,MACR,uBAAuB,YAAY,oBAAoB,KAAK,IAC1D,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;CACF;CACA,MAAM,UAAU,IAAI,KAAK;CACzB,IAAI,QAAQ,WAAW,GAAG;EACxB,MAAM,IAAI,MAAM,uBAAuB,YAAY,aAAa,KAAK,UAAU;CACjF;CACA,OAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,KAAiD;CACtF,MAAM,QAAQ,IAAI;CAClB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG;EAC1D,MAAM,IAAI,MAAM,6BAA6B,KAAK,wBAAwB;CAC5E;CACA,OAAO,MAAM,KAAK;AACpB;AAEA,eAAe,0BACb,UACA,SACiB;CACjB,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,MAAM,aAAa,IAAI;CACvB,MAAM,eAAe,IAAI;CAEzB,IAAI,CAAC,cAAc,CAAC,cAAc;EAChC,MAAM,IAAI,MACR,0MACF;CACF;CAEA,MAAM,MAAM,IAAI,IAAI,UAAU;CAC9B,IAAI,aAAa,IAAI,YAAY,QAAQ;CAEzC,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,GAAG,QAAQ,aAAa,IAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,UAAU,IAAI,SAAS,GAAG;GACzC,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,QAAQ;GACV;GACA,QAAQ,WAAW;EACrB,CAAC;CACH,UAAU;EACR,aAAa,KAAK;CACpB;CAEA,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,UAAU,MAAM,wBAAwB,UAAU,GAAG;EAC3D,MAAM,IAAI,MACR,mEAAmE,SAAS,OAAO,GACjF,UAAU,KAAK,aAAa,OAAO,MAAM,IAE7C;CACF;CAEA,MAAM,UAAW,MAAM,SAAS,KAAK;CACrC,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,WAAW,GAAG;EACnE,MAAM,IAAI,MACR,4GACF;CACF;CACA,OAAO,QAAQ;AACjB","names":[],"sources":["../../src/oauth/subject-token.ts"],"version":3,"file":"subject-token.js","sourceRoot":""}