@wix/himalaya-cli 0.1458.0 → 0.1459.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/serve-runtime/src/wix-bridge.d.ts

@@ -1,3 +1,4 @@
+export declare const WIX_API = "https://www.wixapis.com";
 /** The narrow Wix consumer endpoints allowed to receive credentials for SSE. */
 export declare function isAllowedConsumerStreamTarget(raw: string): boolean;
 /** Classify an absolute-URL rejection: an off-gateway Wix account host is a

package/dist/cli.mjs

@@ -1059,8 +1059,8 @@ function toBase64(bytes2) {
 function utf8Decode(bytes2) {
   return new TextDecoder("utf-8").decode(bytes2);
 }
-function fromBase64Url(b64url3) {
-  const std = b64url3.replace(/-/g, "+").replace(/_/g, "/");
+function fromBase64Url(b64url4) {
+  const std = b64url4.replace(/-/g, "+").replace(/_/g, "/");
   return fromBase64(std + "=".repeat((4 - std.length % 4) % 4));
 }
 function toBase64Url(bytes2) {
@@ -160096,6 +160096,122 @@ var init_pinned_read = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/member-exchange.ts
+function hopAllowed(url, firstHost) {
+  if (url.protocol !== "https:" || url.port !== "" && url.port !== "443" || url.username || url.password) return false;
+  const host = url.hostname.toLowerCase();
+  return host === firstHost || host === "wix.com" || host.endsWith(".wix.com") || host.endsWith(".wixsite.com") || host === "wixapis.com" || host.endsWith(".wixapis.com");
+}
+async function exchangeMemberSession(input, fetchImpl = fetch, random = randomBytes6, now = Date.now, redirectUri = REGISTERED_REDIRECT_URI) {
+  const { clientId, sessionToken } = input;
+  if (typeof sessionToken !== "string" || !sessionToken || sessionToken.length > MAX_SESSION_TOKEN_LENGTH) {
+    return { ok: false, code: "bad_request" };
+  }
+  const call = async (url2, init) => {
+    try {
+      return await fetchImpl(url2, { ...init, signal: AbortSignal.timeout(STEP_TIMEOUT_MS) });
+    } catch {
+      return null;
+    }
+  };
+  const json8 = async (res) => {
+    try {
+      const v2 = await res.json();
+      return v2 && typeof v2 === "object" ? v2 : {};
+    } catch {
+      return {};
+    }
+  };
+  let visitor;
+  try {
+    visitor = await mintAnonymousVisitor(clientId, (u2, i2) => call(String(u2), i2 ?? {}).then((r2) => {
+      if (!r2) throw new Error("unreachable");
+      return r2;
+    }));
+  } catch (e2) {
+    return { ok: false, code: e2?.message === "unreachable" ? "unreachable" : "visitor_token_failed" };
+  }
+  const verifier = b64url2(random(32));
+  const challenge = b64url2(sha256(verifier));
+  const state = b64url2(random(8));
+  const rsRes = await call(`${WIX_API}/_api/redirects-api/v1/redirect-session`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${visitor}` },
+    body: JSON.stringify({ auth: { authRequest: {
+      clientId,
+      responseType: "code",
+      responseMode: "fragment",
+      redirectUri,
+      scope: "offline_access",
+      state,
+      nonce: state,
+      codeChallenge: challenge,
+      codeChallengeMethod: "S256",
+      sessionToken
+    }, prompt: "none" } })
+  });
+  if (!rsRes) return { ok: false, code: "unreachable" };
+  const rs2 = await json8(rsRes);
+  const fullUrl = rs2.redirectSession?.fullUrl;
+  if (!rsRes.ok || typeof fullUrl !== "string") return { ok: false, code: "redirect_session_failed", status: rsRes.status };
+  let url;
+  try {
+    url = new URL(fullUrl);
+  } catch {
+    return { ok: false, code: "redirect_session_failed", status: rsRes.status };
+  }
+  const firstHost = url.hostname.toLowerCase();
+  let code;
+  let lastStatus;
+  for (let hop = 0; hop < MAX_HOPS; hop++) {
+    if (!hopAllowed(url, firstHost)) return { ok: false, code: "authorize_host_refused" };
+    const res = await call(url.toString(), { method: "GET", redirect: "manual", headers: { "User-Agent": "Mozilla/5.0" } });
+    if (!res) return { ok: false, code: "unreachable" };
+    lastStatus = res.status;
+    const location = res.headers.get("location");
+    if (!location) return { ok: false, code: res.status >= 400 ? "authorize_refused" : "authorize_no_code", status: res.status };
+    if (location.startsWith(redirectUri)) {
+      const params = new URLSearchParams(location.slice(redirectUri.length).replace(/^[?#]/, ""));
+      if (params.get("state") !== state) return { ok: false, code: "authorize_state_mismatch" };
+      code = params.get("code") ?? void 0;
+      break;
+    }
+    try {
+      url = new URL(location, url);
+    } catch {
+      return { ok: false, code: "authorize_no_code", status: res.status };
+    }
+  }
+  if (!code) return { ok: false, code: "authorize_no_code", ...lastStatus !== void 0 ? { status: lastStatus } : {} };
+  const tokRes = await call(`${WIX_API}/oauth2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ clientId, grantType: "authorization_code", code, codeVerifier: verifier, redirectUri })
+  });
+  if (!tokRes) return { ok: false, code: "unreachable" };
+  const tok = await json8(tokRes);
+  if (!tokRes.ok || typeof tok.access_token !== "string" || !tok.access_token) return { ok: false, code: "token_exchange_failed", status: tokRes.status };
+  const expiresIn = typeof tok.expires_in === "number" ? tok.expires_in : Number(tok.expires_in);
+  return { ok: true, accessToken: tok.access_token, expiresAt: now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600) * 1e3 };
+}
+var REGISTERED_REDIRECT_URI, MAX_HOPS, STEP_TIMEOUT_MS, MAX_SESSION_TOKEN_LENGTH, b64url2, randomBytes6;
+var init_member_exchange = __esm({
+  "../../core/serve-runtime/src/member-exchange.ts"() {
+    init_sha256();
+    init_wix_bridge();
+    REGISTERED_REDIRECT_URI = "himalaya-appsmith://oauth/callback";
+    MAX_HOPS = 8;
+    STEP_TIMEOUT_MS = 8e3;
+    MAX_SESSION_TOKEN_LENGTH = 4096;
+    b64url2 = (bytes2) => {
+      let s2 = "";
+      for (const b2 of bytes2) s2 += String.fromCharCode(b2);
+      return btoa(s2).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    };
+    randomBytes6 = (n2) => globalThis.crypto.getRandomValues(new Uint8Array(n2));
+  }
+});
+
 // ../../core/serve-runtime/package-share.ts
 function parseStored(bytes2, id) {
   if (!bytes2) return null;
@@ -160930,6 +161046,32 @@ ${releaseId}`;
         }
         return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
       }
+      if (request.method === "POST" && path2 === "/v1/__webwix/member-exchange") {
+        const noStore = { "cache-control": "no-store" };
+        if (opts.webwixBridge === false) return json5(503, { error: "webwix_bridge_disabled" }, noStore);
+        if (!opts.previewTokenSecret) return json5(503, { error: "preview_token_unavailable" }, noStore);
+        const exchangeApp = resolveApp(request, url);
+        if (!exchangeApp) return json5(400, { error: "app_required" }, noStore);
+        const exchangePin = resolvePin(request, url);
+        if (!exchangePin || !resolvePreviewToken(request, url)) return json5(403, { error: "draft_preview_required" }, noStore);
+        const exchangeCfg = await appConfigFor(request, url, exchangeApp);
+        if (!exchangeCfg.ok) return exchangeCfg.response;
+        if ((await manifest(exchangeApp))?.releaseId === exchangePin || await isRingRelease(exchangeApp, exchangePin)) {
+          return json5(403, { error: "draft_preview_required" }, noStore);
+        }
+        const exchangeClient = wixClientIdOf(utf8Decode(exchangeCfg.bytes));
+        if ("error" in exchangeClient) return json5(501, { error: `member_exchange_${exchangeClient.error}` }, noStore);
+        let exchangeBody;
+        try {
+          exchangeBody = await request.json();
+        } catch {
+          return json5(400, { error: "bad_request" }, noStore);
+        }
+        if (!exchangeBody || typeof exchangeBody !== "object") return json5(400, { error: "bad_request" }, noStore);
+        const exchanged = await exchangeMemberSession({ clientId: exchangeClient.clientId, sessionToken: exchangeBody.sessionToken }, webwixFetch);
+        if (exchanged.ok) return json5(200, { accessToken: exchanged.accessToken, expiresAt: exchanged.expiresAt }, noStore);
+        return json5(exchanged.code === "bad_request" ? 400 : 502, { error: exchanged.code, ...exchanged.status !== void 0 ? { status: exchanged.status } : {} }, noStore);
+      }
       if (request.method === "POST" && path2 === "/v1/__webwix/call") {
         const served = { rung: "none" };
         let status = 500;
@@ -161546,6 +161688,7 @@ var init_server2 = __esm({
     init_base64();
     init_contract();
     init_pinned_read();
+    init_member_exchange();
     init_package_share();
     init_wix_bridge();
     init_account_rung();
@@ -162598,14 +162741,14 @@ var init_embedded_bundles = __esm({
 // ../store-release/register-bundle.ts
 import { readFileSync as readFileSync88 } from "node:fs";
 import { createPrivateKey as createPrivateKey4, sign as sign2 } from "node:crypto";
-function b64url2(b2) {
+function b64url3(b2) {
   return Buffer.from(b2).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function ascJwt(keyId, issuerId, p8, now) {
-  const header = b64url2(JSON.stringify({ alg: "ES256", kid: keyId, typ: "JWT" }));
-  const payload = b64url2(JSON.stringify({ iss: issuerId, iat: now, exp: now + 1200, aud: "appstoreconnect-v1" }));
+  const header = b64url3(JSON.stringify({ alg: "ES256", kid: keyId, typ: "JWT" }));
+  const payload = b64url3(JSON.stringify({ iss: issuerId, iat: now, exp: now + 1200, aud: "appstoreconnect-v1" }));
   const key3 = createPrivateKey4(p8);
-  const sig = b64url2(sign2("sha256", Buffer.from(`${header}.${payload}`), { key: key3, dsaEncoding: "ieee-p1363" }));
+  const sig = b64url3(sign2("sha256", Buffer.from(`${header}.${payload}`), { key: key3, dsaEncoding: "ieee-p1363" }));
   return `${header}.${payload}.${sig}`;
 }
 function bundleIdBody(identifier, name, platform = "IOS") {
@@ -167782,7 +167925,7 @@ var init_connector_token = __esm({
 });
 
 // ../../core/functions-secrets/src/vault.ts
-import { createCipheriv, createDecipheriv as createDecipheriv2, randomBytes as randomBytes6 } from "node:crypto";
+import { createCipheriv, createDecipheriv as createDecipheriv2, randomBytes as randomBytes7 } from "node:crypto";
 import { mkdir, readFile as readFile2, rename, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname44 } from "node:path";
 function createJsonSecretStore(filePath) {
@@ -167840,7 +167983,7 @@ function createSecretVault(options) {
       environment: input.environment,
       name: input.name,
       version: input.version,
-      iv: randomBytes6(12).toString("base64url"),
+      iv: randomBytes7(12).toString("base64url"),
       ciphertext: "",
       authTag: ""
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1458.0",
+  "version": "0.1459.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9dd290be2b59a0845d75b156a968a16e615c0d3de4e9dc4a0f01cda6"
+  "falconPackageHash": "db96f8e1d9f3f0a55120ae97f89b4211fed249d7a3f98225dc9269b1"
 }