@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/snowflake-Cu1ZyOp6.mjs

@@ -0,0 +1,151 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import "./src-BhinCSpi.mjs";
+import { _ as LoginCancelledError, h as OAuthError, y as OnPromptRequiredError } from "./error-8LVo7tug.mjs";
+import { h as isRecord } from "./cascade-BWjRTD1q.mjs";
+import { i as authPolicyFor, r as OAuthCallbackFlow, t as normalizeSnowflakeAccountUrl } from "./snowflake-B_jap6lz.mjs";
+import { t as generatePKCE } from "./pkce-DO-jBJLV.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/snowflake.ts
+const SNOWFLAKE_OAUTH_CLIENT_ID = "LOCAL_APPLICATION";
+function snowflakeCallbackPort() {
+	const port = authPolicyFor("snowflake")?.callbackPort;
+	if (port === void 0) throw new Error("Snowflake auth policy is missing callback-port");
+	return port;
+}
+async function parseTokenResponse(response, kind, signal) {
+	signal?.throwIfAborted();
+	if (!response.ok) throw new OAuthError(`Snowflake token ${kind === "token-exchange" ? "exchange" : "refresh"} failed (${response.status})`, {
+		kind,
+		provider: "snowflake",
+		status: response.status
+	});
+	let body;
+	try {
+		body = await response.json();
+	} catch (error) {
+		signal?.throwIfAborted();
+		if (error instanceof Error && error.name === "AbortError") throw error;
+		throw new OAuthError("Snowflake returned an invalid token response", {
+			kind: "validation",
+			provider: "snowflake"
+		});
+	}
+	signal?.throwIfAborted();
+	if (!isRecord(body) || typeof body.access_token !== "string" || !body.access_token.trim() || typeof body.expires_in !== "number" || !Number.isFinite(body.expires_in) || body.expires_in <= 0 || body.refresh_token !== void 0 && (typeof body.refresh_token !== "string" || !body.refresh_token.trim())) throw new OAuthError("Snowflake returned an invalid token response", {
+		kind: "validation",
+		provider: "snowflake"
+	});
+	const lifetimeMs = body.expires_in * 1e3;
+	if (!Number.isFinite(lifetimeMs) || lifetimeMs <= 0) throw new OAuthError("Snowflake returned an invalid token lifetime", {
+		kind: "validation",
+		provider: "snowflake"
+	});
+	return {
+		access: body.access_token,
+		refresh: body.refresh_token,
+		expires: Date.now() + lifetimeMs
+	};
+}
+var SnowflakeOAuthFlow = class extends OAuthCallbackFlow {
+	#accountUrl;
+	#verifier = "";
+	constructor(ctrl, accountUrl) {
+		super(ctrl, {
+			preferredPort: snowflakeCallbackPort(),
+			callbackPath: "/",
+			callbackHostname: "127.0.0.1"
+		});
+		this.#accountUrl = accountUrl;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const { verifier, challenge } = await generatePKCE();
+		this.#verifier = verifier;
+		const params = new URLSearchParams({
+			client_id: SNOWFLAKE_OAUTH_CLIENT_ID,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: "refresh_token",
+			state,
+			code_challenge: challenge,
+			code_challenge_method: "S256"
+		});
+		return {
+			url: `${this.#accountUrl}/oauth/authorize?${params.toString()}`,
+			instructions: "Sign in to Snowflake in your browser and approve access for omp."
+		};
+	}
+	async exchangeToken(code, _state, redirectUri) {
+		const signal = this.ctrl.signal;
+		const fetchImpl = this.ctrl.fetch ?? fetch;
+		let tokens;
+		try {
+			tokens = await parseTokenResponse(await fetchImpl(`${this.#accountUrl}/oauth/token-request`, {
+				method: "POST",
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					grant_type: "authorization_code",
+					code,
+					redirect_uri: redirectUri,
+					code_verifier: this.#verifier,
+					client_id: SNOWFLAKE_OAUTH_CLIENT_ID
+				}),
+				signal,
+				redirect: "error"
+			}), "token-exchange", signal);
+		} catch (error) {
+			if (signal?.aborted) throw new LoginCancelledError();
+			throw error;
+		}
+		return {
+			...tokens,
+			refresh: tokens.refresh ?? "",
+			enterpriseUrl: this.#accountUrl
+		};
+	}
+};
+async function loginSnowflake(ctrl) {
+	if (!ctrl.onPrompt) throw new OnPromptRequiredError("Snowflake");
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	const account = await ctrl.onPrompt({
+		message: "Enter your Snowflake account identifier or URL",
+		placeholder: "myorg-myaccount"
+	});
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	return new SnowflakeOAuthFlow(ctrl, normalizeSnowflakeAccountUrl(account)).login();
+}
+async function refreshSnowflakeToken(credentials, signal) {
+	if (!credentials.refresh.trim()) {
+		if (Date.now() < credentials.expires) return credentials;
+		throw new OAuthError("Snowflake did not issue a refresh token; run /login snowflake again or use SNOWFLAKE_ACCOUNT and SNOWFLAKE_PAT", {
+			kind: "token-refresh",
+			provider: "snowflake"
+		});
+	}
+	let accountUrl;
+	try {
+		accountUrl = normalizeSnowflakeAccountUrl(credentials.enterpriseUrl ?? "");
+	} catch {
+		throw new OAuthError("Invalid Snowflake account; run /login snowflake again", {
+			kind: "validation",
+			provider: "snowflake"
+		});
+	}
+	const tokens = await parseTokenResponse(await fetch(`${accountUrl}/oauth/token-request`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: credentials.refresh,
+			client_id: SNOWFLAKE_OAUTH_CLIENT_ID
+		}),
+		signal,
+		redirect: "error"
+	}), "token-refresh", signal);
+	return {
+		...credentials,
+		...tokens,
+		refresh: tokens.refresh ?? credentials.refresh
+	};
+}
+//#endregion
+export { loginSnowflake, refreshSnowflakeToken };