checkly 9.5.0 → 10.0.0-rc.1

package/dist/auth/api-key.js

@@ -0,0 +1,104 @@
+import axios, { isAxiosError } from 'axios';
+import * as os from 'os';
+import { jwtDecode } from 'jwt-decode';
+import { getDefaults as getApiDefaults } from '../rest/api.js';
+import { handleErrorResponse } from '../rest/errors.js';
+import { assignProxy } from '../services/proxy.js';
+function createDefaultClient(accessToken) {
+    // Keep axios instance stateless
+    const { baseURL } = getApiDefaults();
+    const axiosConf = assignProxy(baseURL, {
+        baseURL,
+        headers: {
+            Accept: 'application/json, text/plain, */*',
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    return axios.create(axiosConf);
+}
+const defaultDeps = {
+    createClient: createDefaultClient,
+    hostname: () => os.hostname(),
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+};
+// The device code is spent once its tokens are issued, so an exchange that
+// fails here costs the user another approval in the browser; ride out a
+// brief API hiccup first.
+const RETRY_DELAYS_MS = [1_000, 3_000];
+// Failures where the request never reached the server.
+const NOT_SENT_CODES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
+/**
+ * Any brief failure: for requests that are safe to repeat. Wider than the
+ * shared API client's policy (rest/retry.ts), which leaves out 500 and 408:
+ * here giving up costs the user another browser approval, not just a
+ * failed command.
+ */
+function isTransient(error) {
+    const status = error.response?.status;
+    return status === undefined || status >= 500 || status === 408 || status === 429;
+}
+/**
+ * A failure the server certainly did not act on: for creating an API key,
+ * where repeating a request that was processed but whose answer was lost
+ * would leave an extra long-lived key nobody holds.
+ */
+function wasNotProcessed(error) {
+    if (error.response) {
+        return error.response.status === 503 || error.response.status === 429;
+    }
+    return NOT_SENT_CODES.has(error.code ?? '');
+}
+async function withRetries(sleep, request, retryable) {
+    for (const delayMs of RETRY_DELAYS_MS) {
+        try {
+            return await request();
+        }
+        catch (error) {
+            if (!isAxiosError(error) || !retryable(error)) {
+                throw error;
+            }
+            await sleep(delayMs);
+        }
+    }
+    return request();
+}
+/**
+ * Trades an Auth0 access token for a long-lived Checkly API key, registering
+ * the user with Checkly first when the Auth0 identity is not known yet
+ * (that is what a fresh sign-up looks like from the CLI's point of view).
+ */
+export async function exchangeAccessTokenForApiKey(accessToken, deps = {}) {
+    const { createClient, hostname, sleep } = { ...defaultDeps, ...deps };
+    const client = createClient(accessToken);
+    try {
+        // Repeating this is safe: a registration that went through is seen by
+        // the next GET, so it is not attempted again.
+        await withRetries(sleep, async () => {
+            try {
+                await client.get('/users/me');
+            }
+            catch (error) {
+                if (error.response?.status === 401) {
+                    await client.post('/users/', { accessToken });
+                }
+                else {
+                    throw error;
+                }
+            }
+        }, isTransient);
+        const apiKeyName = `CLI User Key (${hostname()})`;
+        const { data } = await withRetries(sleep, () => client.post(`/users/me/api-keys?name=${apiKeyName}`), wasNotProcessed);
+        return data;
+    }
+    catch (error) {
+        // The same typed errors as the regular API client, so callers can tell a
+        // failed or unreachable Checkly API from other failures.
+        handleErrorResponse(error);
+    }
+}
+export async function credentialsFromTokens(tokens, deps = {}) {
+    const { name } = jwtDecode(tokens.idToken);
+    const { key } = await exchangeAccessTokenForApiKey(tokens.accessToken, deps);
+    return { name, key };
+}
+//# sourceMappingURL=api-key.js.map

package/dist/auth/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../src/auth/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,YAAY,EAAuC,MAAM,OAAO,CAAA;AAChF,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAQlD,SAAS,mBAAmB,CAAE,WAAmB;IAC/C,gCAAgC;IAChC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE;QACrC,OAAO;QACP,OAAO,EAAE;YACP,MAAM,EAAE,mCAAmC;YAC3C,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,WAAW,GAAuB;IACtC,YAAY,EAAE,mBAAmB;IACjC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAC7D,CAAA;AAED,2EAA2E;AAC3E,wEAAwE;AACxE,0BAA0B;AAC1B,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAEtC,uDAAuD;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;AAE1E;;;;;GAKG;AACH,SAAS,WAAW,CAAE,KAAiB;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAA;IACrC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAE,KAAiB;IACzC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;IACvE,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAoC,EACpC,OAAyB,EACzB,SAAyC;IAEzC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM,KAAK,CAAA;YACb,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,EAAE,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAmB,EACnB,OAAoC,EAAE;IAEtC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAA;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAExC,IAAI,CAAC;QACH,sEAAsE;QACtE,8CAA8C;QAC9C,MAAM,WAAW,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAK,KAAoB,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnD,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;gBAC/C,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAA;QAEf,MAAM,UAAU,GAAG,iBAAiB,QAAQ,EAAE,GAAG,CAAA;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAAC,KAAK,EACtC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,CAAC,EAAE,eAAe,CAAC,CAAA;QAE9E,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,yDAAyD;QACzD,mBAAmB,CAAC,KAAc,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAgD,EAChD,OAAoC,EAAE;IAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAmB,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IAC5E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AACtB,CAAC"}

package/dist/auth/device-flow.d.ts

@@ -0,0 +1,57 @@
+export declare const AUTH0_CLIENT_ID = "mBtwLFVm39GVZ1HpSRBSdRiLFucYxmMb";
+export interface DeviceAuthorization {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    /** Epoch milliseconds after which the device code is no longer valid. */
+    expiresAt: number;
+    intervalMs: number;
+}
+export interface DeviceTokens {
+    accessToken: string;
+    idToken: string;
+}
+export interface OAuthResponse {
+    status: number;
+    data: any;
+}
+export interface DeviceFlowDeps {
+    /** Must resolve for non-2xx responses too; the flow reads OAuth error codes from the body. */
+    post: (url: string, params: URLSearchParams) => Promise<OAuthResponse>;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+}
+export declare class DeviceFlowError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+/** The Auth0 client does not have the device_code grant enabled. */
+export declare class DeviceFlowNotAllowedError extends DeviceFlowError {
+    constructor(message: string);
+}
+export declare class DeviceFlow {
+    #private;
+    constructor(deps?: Partial<DeviceFlowDeps>);
+    requestAuthorization(): Promise<DeviceAuthorization>;
+    /**
+     * Polls until the user approves or the code expires. When the answers keep
+     * coming from something other than the login server (a proxy or captive
+     * portal), `onUnexpectedAnswers` is called once per such run with the latest one, and
+     * polling goes on: the user may still be getting past a captive portal,
+     * and the code stays valid.
+     */
+    pollForTokens(auth: DeviceAuthorization, { onUnexpectedAnswers }?: {
+        onUnexpectedAnswers?: (failure: string) => void;
+    }): Promise<DeviceTokens>;
+    /**
+     * A single token request without waiting, so a caller can check a stored
+     * code and return at once. `tokens` once the user has approved; otherwise
+     * `failure` says why the login server could not answer, if it could not
+     * (the user may then have approved without the CLI seeing it yet).
+     */
+    pollOnce(auth: DeviceAuthorization): Promise<{
+        tokens?: DeviceTokens;
+        failure?: string;
+    }>;
+}

package/dist/auth/device-flow.js

@@ -0,0 +1,221 @@
+import axios from 'axios';
+import { assignProxy } from '../services/proxy.js';
+import config from '../services/config.js';
+// OAuth 2.0 Device Authorization Grant (RFC 8628) against Checkly's Auth0 tenant.
+// The user opens a URL on any device and enters a short code; the CLI polls for
+// the tokens. Unlike the authorization-code flow this needs no local callback
+// server, so it works over SSH, in containers and from agent sandboxes.
+export const AUTH0_CLIENT_ID = 'mBtwLFVm39GVZ1HpSRBSdRiLFucYxmMb';
+const deviceCodeUrl = () => `${config.getAuthUrl()}/oauth/device/code`;
+const tokenUrl = () => `${config.getAuthUrl()}/oauth/token`;
+const AUTH0_SCOPES = 'openid profile email';
+const DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_INTERVAL_MS = 5_000;
+const SLOW_DOWN_STEP_MS = 5_000;
+// Upper bound for the time between polls, from the server's interval or
+// after backing off: a delay beyond setTimeout's range would fire at once,
+// and a long one would notice an approval late. Deliberately departs from
+// RFC 8628's "add 5 seconds on every slow_down" once reached; no login server
+// we use needs a minute between polls.
+const MAX_INTERVAL_MS = 60_000;
+// How many answers in a row that did not come from the login server (a proxy
+// or captive portal) a waiting login takes before it reports them.
+const MAX_UNEXPECTED_RESPONSES = 5;
+const REQUEST_TIMEOUT_MS = 30_000;
+export class DeviceFlowError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+        this.name = 'DeviceFlowError';
+    }
+}
+/** The Auth0 client does not have the device_code grant enabled. */
+export class DeviceFlowNotAllowedError extends DeviceFlowError {
+    constructor(message) {
+        super('unauthorized_client', message);
+        this.name = 'DeviceFlowNotAllowedError';
+    }
+}
+const defaultDeps = {
+    post: async (url, params) => {
+        const { status, data } = await axios.post(url, params, assignProxy(url, {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Accept-Encoding': '*',
+            },
+            validateStatus: () => true,
+            timeout: REQUEST_TIMEOUT_MS,
+        }));
+        return { status, data };
+    },
+    sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+};
+function errorFrom(data, fallback) {
+    const code = data?.error ?? fallback;
+    const message = data?.error_description ?? `Authentication failed (${code})`;
+    if (code === 'unauthorized_client') {
+        return new DeviceFlowNotAllowedError(message);
+    }
+    return new DeviceFlowError(code, message);
+}
+function notFromLoginServer(what) {
+    return `${what} that did not come from the login server; check your network or proxy settings`;
+}
+function unexpectedResponseError() {
+    return new DeviceFlowError('invalid_response', 'The login server returned an unexpected response. Check your network or proxy settings and try again.');
+}
+/**
+ * Names a failed request by its error code only: error messages can carry
+ * request or proxy URLs, credentials included.
+ */
+function transportFailure(error) {
+    const code = error?.code;
+    return typeof code === 'string' ? code : 'network error';
+}
+function tokenParams(auth) {
+    return new URLSearchParams({
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: auth.deviceCode,
+        client_id: AUTH0_CLIENT_ID,
+    });
+}
+export class DeviceFlow {
+    #deps;
+    constructor(deps = {}) {
+        this.#deps = { ...defaultDeps, ...deps };
+    }
+    async requestAuthorization() {
+        const params = new URLSearchParams({
+            client_id: AUTH0_CLIENT_ID,
+            scope: AUTH0_SCOPES,
+        });
+        let response;
+        try {
+            response = await this.#deps.post(deviceCodeUrl(), params);
+        }
+        catch (error) {
+            throw new DeviceFlowError('network_error', `Could not reach the login server (${transportFailure(error)}). `
+                + 'Check your network or proxy settings and try again.', { cause: error });
+        }
+        const { status, data } = response;
+        // A proxy or captive portal can answer in place of the login server, with
+        // an HTML page and any status; without these checks the user would see an
+        // unhelpful error or "undefined" for the URL and the code.
+        if (status < 200 || status >= 300) {
+            if (typeof data?.error !== 'string') {
+                throw unexpectedResponseError();
+            }
+            throw errorFrom(data, 'device_authorization_failed');
+        }
+        const isText = (value) => typeof value === 'string' && value !== '';
+        if (!isText(data?.device_code) || !isText(data?.user_code) || !isText(data?.verification_uri)
+            || !(Number.isFinite(data?.expires_in) && data.expires_in > 0)) {
+            throw unexpectedResponseError();
+        }
+        // At least a second and at most MAX_INTERVAL_MS, whatever the response says.
+        const intervalSeconds = Number.isFinite(data.interval) && data.interval > 0
+            ? Math.min(MAX_INTERVAL_MS / 1000, Math.max(1, data.interval))
+            : DEFAULT_INTERVAL_MS / 1000;
+        return {
+            deviceCode: data.device_code,
+            userCode: data.user_code,
+            verificationUri: data.verification_uri,
+            verificationUriComplete: isText(data.verification_uri_complete)
+                ? data.verification_uri_complete
+                : data.verification_uri,
+            expiresAt: this.#deps.now() + data.expires_in * 1000,
+            intervalMs: intervalSeconds * 1000,
+        };
+    }
+    /**
+     * Polls until the user approves or the code expires. When the answers keep
+     * coming from something other than the login server (a proxy or captive
+     * portal), `onUnexpectedAnswers` is called once per such run with the latest one, and
+     * polling goes on: the user may still be getting past a captive portal,
+     * and the code stays valid.
+     */
+    async pollForTokens(auth, { onUnexpectedAnswers } = {}) {
+        const params = tokenParams(auth);
+        let intervalMs = auth.intervalMs;
+        let lastFailure;
+        let unexpectedInARow = 0;
+        while (this.#deps.now() + intervalMs <= auth.expiresAt) {
+            await this.#deps.sleep(intervalMs);
+            const result = await this.#requestTokens(params);
+            lastFailure = result.failure;
+            unexpectedInARow = result.unexpected ? unexpectedInARow + 1 : 0;
+            if (unexpectedInARow === MAX_UNEXPECTED_RESPONSES) {
+                onUnexpectedAnswers?.(result.failure);
+            }
+            if (result.state === 'slow_down') {
+                intervalMs = Math.min(MAX_INTERVAL_MS, intervalMs + SLOW_DOWN_STEP_MS);
+            }
+            else if (result.state === 'approved') {
+                return result.tokens;
+            }
+        }
+        // A code the user approved can still expire here when the login server
+        // was unreachable at the end; say so rather than blaming the user.
+        throw new DeviceFlowError('expired_token', lastFailure
+            ? `The login code expired; the last attempt to reach the login server failed (${lastFailure}). `
+                + 'Please run the login again.'
+            : 'The login code expired before it was used. Please run the login again.');
+    }
+    /**
+     * A single token request without waiting, so a caller can check a stored
+     * code and return at once. `tokens` once the user has approved; otherwise
+     * `failure` says why the login server could not answer, if it could not
+     * (the user may then have approved without the CLI seeing it yet).
+     */
+    async pollOnce(auth) {
+        const result = await this.#requestTokens(tokenParams(auth));
+        return result.state === 'approved' ? { tokens: result.tokens } : { failure: result.failure };
+    }
+    /**
+     * One token request. Polling can last as long as the code is valid, often
+     * after the user has already approved it in the browser, so a network
+     * failure, a server-side error, a rate limit or an answer that did not come from the
+     * login server (e.g. a proxy's or captive portal's page) counts as "try
+     * again" rather than ending the login; only an OAuth error from the server
+     * is final.
+     */
+    async #requestTokens(params) {
+        let response;
+        try {
+            response = await this.#deps.post(tokenUrl(), params);
+        }
+        catch (error) {
+            return { state: 'pending', failure: transportFailure(error) };
+        }
+        const { status, data } = response;
+        if (status >= 200 && status < 300) {
+            if (!data?.access_token || !data?.id_token) {
+                return { state: 'pending', failure: notFromLoginServer('a response without tokens'), unexpected: true };
+            }
+            return { state: 'approved', tokens: { accessToken: data.access_token, idToken: data.id_token } };
+        }
+        // Not counted as unexpected: an outage of the login server itself is
+        // worth waiting out for as long as the code is valid.
+        if (status >= 500) {
+            return { state: 'pending', failure: `HTTP ${status}` };
+        }
+        if (data?.error === 'slow_down') {
+            return { state: 'slow_down' };
+        }
+        // Rate limited (by the login server or something in front of it): never
+        // a final answer, and it says nothing about whether the code was approved.
+        if (status === 429) {
+            return { state: 'slow_down', failure: 'HTTP 429' };
+        }
+        if (data?.error === 'authorization_pending') {
+            return { state: 'pending' };
+        }
+        if (typeof data?.error !== 'string') {
+            return { state: 'pending', failure: notFromLoginServer(`HTTP ${status}`), unexpected: true };
+        }
+        throw errorFrom(data, 'token_request_failed');
+    }
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/auth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,MAAM,MAAM,uBAAuB,CAAA;AAE1C,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AAExE,MAAM,CAAC,MAAM,eAAe,GAAG,kCAAkC,CAAA;AAEjE,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAA;AACtE,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,cAAc,CAAA;AAC3D,MAAM,YAAY,GAAG,sBAAsB,CAAA;AAC3C,MAAM,iBAAiB,GAAG,8CAA8C,CAAA;AACxE,MAAM,mBAAmB,GAAG,KAAK,CAAA;AACjC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAC/B,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,eAAe,GAAG,MAAM,CAAA;AAC9B,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAClC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAkCjC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAClB;IAAtB,YAAsB,IAAY,EAAE,OAAe,EAAE,OAAsB;QACzE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QADH,SAAI,GAAJ,IAAI,CAAQ;QAEhC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAa,OAAe;QAC1B,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,MAAM,WAAW,GAAmB;IAClC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE;YACtE,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,iBAAiB,EAAE,GAAG;aACvB;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;YAC1B,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC,CAAA;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACzB,CAAC;IACD,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5D,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACtB,CAAA;AAED,SAAS,SAAS,CAAE,IAAS,EAAE,QAAgB;IAC7C,MAAM,IAAI,GAAW,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAA;IAC5C,MAAM,OAAO,GAAW,IAAI,EAAE,iBAAiB,IAAI,0BAA0B,IAAI,GAAG,CAAA;IACpF,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAE,IAAY;IACvC,OAAO,GAAG,IAAI,gFAAgF,CAAA;AAChG,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,IAAI,eAAe,CAAC,kBAAkB,EAC3C,uGAAuG,CAAC,CAAA;AAC5G,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAE,KAAc;IACvC,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAA;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;AAC1D,CAAC;AAED,SAAS,WAAW,CAAE,IAAyB;IAC7C,OAAO,IAAI,eAAe,CAAC;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,SAAS,EAAE,eAAe;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,OAAO,UAAU;IACrB,KAAK,CAAgB;IAErB,YAAa,OAAgC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,EAAE,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,YAAY;SACpB,CAAC,CAAA;QAEF,IAAI,QAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAA;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,qCAAqC,gBAAgB,CAAC,KAAK,CAAC,KAAK;kBACxG,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;QAEjC,0EAA0E;QAC1E,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClC,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,uBAAuB,EAAE,CAAA;YACjC,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAA;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC;eACxF,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,uBAAuB,EAAE,CAAA;QACjC,CAAC;QAED,6EAA6E;QAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAA;QAE9B,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,eAAe,EAAE,IAAI,CAAC,gBAAgB;YACtC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC;gBAC7D,CAAC,CAAC,IAAI,CAAC,yBAAyB;gBAChC,CAAC,CAAC,IAAI,CAAC,gBAAgB;YACzB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;YACpD,UAAU,EAAE,eAAe,GAAG,IAAI;SACnC,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,IAAyB,EACzB,EAAE,mBAAmB,KAA0D,EAAE;QAEjF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAChC,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAChC,IAAI,WAA+B,CAAA;QACnC,IAAI,gBAAgB,GAAG,CAAC,CAAA;QAExB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;YAChD,WAAW,GAAG,MAAM,CAAC,OAAO,CAAA;YAC5B,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/D,IAAI,gBAAgB,KAAK,wBAAwB,EAAE,CAAC;gBAClD,mBAAmB,EAAE,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAA;YACxC,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,iBAAiB,CAAC,CAAA;YACxE,CAAC;iBAAM,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO,MAAM,CAAC,MAAM,CAAA;YACtB,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,WAAW;YACpD,CAAC,CAAC,8EAA8E,WAAW,KAAK;kBAC9F,6BAA6B;YAC/B,CAAC,CAAC,wEAAwE,CAAC,CAAA;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAE,IAAyB;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IAC9F,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAE,MAAuB;QAC3C,IAAI,QAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAA;QAC/D,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;QAEjC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YACzG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAA;QAClG,CAAC;QAED,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAA;QACxD,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAC/B,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;QACpD,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,KAAK,uBAAuB,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC7B,CAAC;QACD,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QAC9F,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;IAC/C,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -1,4 +1,5 @@
-export type AuthMode = 'signup' | 'login';
+/** 'any' leaves both login and sign-up enabled on the hosted page. */
+export type AuthMode = 'signup' | 'login' | 'any';
 export declare function generatePKCE(): {
     codeChallenge: string;
     codeVerifier: string;
@@ -7,9 +8,8 @@ export declare class AuthContext {
     #private;
     private mode;
     authenticationUrl: string;
-    constructor(mode: AuthMode);
-    getAuth0Credentials(): Promise<{
-        name: any;
-        key: any;
-    }>;
+    constructor(mode: AuthMode, { timeoutMs }?: {
+        timeoutMs?: number;
+    });
+    getAuth0Credentials(): Promise<import("./api-key.js").Credentials>;
 }

package/dist/auth/index.js

@@ -1,18 +1,25 @@
 import axios from 'axios';
-import * as os from 'os';
 import * as http from 'http';
 import * as crypto from 'crypto';
-import { jwtDecode } from 'jwt-decode';
-import { getDefaults as getApiDefaults } from '../rest/api.js';
-import { assignProxy } from '../services/proxy.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { fileURLToPath } from 'node:url';
+import { credentialsFromTokens } from './api-key.js';
+import { assignProxy } from '../services/proxy.js';
+import config from '../services/config.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const AUTH0_CLIENT_ID = 'mBtwLFVm39GVZ1HpSRBSdRiLFucYxmMb';
-const AUTH0_AUTHORIZATION_URL = 'https://auth.checklyhq.com/authorize';
+const authorizationUrl = () => `${config.getAuthUrl()}/authorize`;
+const tokenUrl = () => `${config.getAuthUrl()}/oauth/token`;
 const AUTH0_SCOPES = 'openid profile email';
 const AUTH0_CALLBACK_URL = 'http://localhost:4242';
+// Long enough to sign up (which can include confirming an email address),
+// short enough not to block an inline login for long; within what other CLIs
+// use for a browser login (AWS CLI and Heroku wait 10 minutes).
+const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+function escapeHtml(value) {
+    return (value ?? '').replace(/[&<>"']/g, char => `&#${char.charCodeAt(0)};`);
+}
 export function generatePKCE() {
     const codeVerifier = crypto
         .randomBytes(64)
@@ -39,8 +46,10 @@ export class AuthContext {
     #codeVerifier;
     #accessToken;
     #idToken;
-    constructor(mode) {
+    #timeoutMs;
+    constructor(mode, { timeoutMs = LOGIN_TIMEOUT_MS } = {}) {
         this.mode = mode;
+        this.#timeoutMs = timeoutMs;
         const { codeChallenge, codeVerifier } = generatePKCE();
         this.#codeChallenge = codeChallenge;
         this.#codeVerifier = codeVerifier;
@@ -52,15 +61,10 @@ export class AuthContext {
             throw new Error('There was an unexpected error retrieving Auth0 token. Please try again or contact '
                 + 'support@checklyhq.com if this problem persists');
         }
-        const { name } = jwtDecode(this.#idToken);
-        const { key } = await this.#getApiKey();
-        return {
-            name,
-            key,
-        };
+        return credentialsFromTokens({ accessToken: this.#accessToken, idToken: this.#idToken });
     }
     #generateAuthenticationUrl() {
-        const url = new URL(AUTH0_AUTHORIZATION_URL);
+        const url = new URL(authorizationUrl());
         const params = new URLSearchParams({
             client_id: AUTH0_CLIENT_ID,
             code_challenge: this.#codeChallenge,
@@ -71,30 +75,61 @@ export class AuthContext {
             state: this.#codeVerifier,
             mode: this.mode === 'signup' ? 'signUp' : '',
             allowLogin: this.mode === 'signup' ? 'false' : 'true',
-            allowSignUp: this.mode === 'signup' ? 'true' : 'false',
+            allowSignUp: this.mode === 'login' ? 'false' : 'true',
         });
         url.search = params.toString();
         return url.toString();
     }
     #startServer() {
         return new Promise((resolve, reject) => {
+            // The CLI may keep running after the login (an authenticated command
+            // logging in inline), so nothing here may keep the process alive
+            // afterwards: every request gets an answer, the response that settles
+            // the login closes its connection instead of keeping it alive for the
+            // browser's next request, and the server stops listening.
             const server = http.createServer();
+            // Nobody may ever finish the login in the browser; without a deadline
+            // the process (and an authenticated command logging in inline) would
+            // wait forever. No response carries `Connection: close` in that case,
+            // so connections the browser keeps alive are dropped explicitly.
+            const timer = setTimeout(() => {
+                server.close();
+                server.closeAllConnections();
+                reject(new Error('The login was not completed in time. Please run the login again.'));
+            }, this.#timeoutMs);
+            const stop = () => {
+                clearTimeout(timer);
+                server.close();
+            };
             server.on('request', (req, res) => {
                 if (req.url?.endsWith('.svg')) {
-                    res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
                     fs.readFile(path.join(__dirname, `.${req.url}`), 'utf8', (err, data) => {
-                        if (!err)
-                            res.end(data);
+                        if (err) {
+                            res.writeHead(404).end();
+                        }
+                        else {
+                            res.writeHead(200, { 'Content-Type': 'image/svg+xml' }).end(data);
+                        }
                     });
+                }
+                else if (req.url?.includes('favicon.ico')) {
+                    res.writeHead(404).end();
                     // `req.url` has a '/' char at the beginning which needs removed to be valid searchParams input
                 }
-                else if (!req.url?.includes('favicon.ico')) {
+                else {
                     const responseParams = new URLSearchParams(req.url?.substring(1));
                     const code = responseParams.get('code');
                     const state = responseParams.get('state');
                     const error = responseParams.get('error');
                     const errorDescription = responseParams.get('error_description');
-                    if (code && state === this.#codeVerifier) {
+                    // A code or an error that answers this login (the state matches)
+                    // settles it, as the device flow does; anything else, such as a
+                    // stray request, leaves the server waiting for the real callback.
+                    const settles = state === this.#codeVerifier && Boolean(code || error);
+                    if (settles) {
+                        res.setHeader('Connection', 'close');
+                    }
+                    if (code && settles) {
                         res.write(`
         <html>
             <style>
@@ -131,6 +166,7 @@ export class AuthContext {
         </body>
         </html>
       `);
+                        stop();
                         resolve(code);
                     }
                     else {
@@ -138,24 +174,24 @@ export class AuthContext {
         <html>
         <body>
           <div style="height:100%;width:100%;inset:0;position:absolute;display:grid;place-items:center;background-color:#EFF2F7;text-align:center;font-family:Inter;">
-            <h3 style="font-weight:200;">Login failed, please try again!</h3>
+            <h3 style="font-weight:200;">${settles ? 'Login failed. Go back to your terminal; you can close this tab.' : 'Login failed, please try again!'}</h3>
             <p>
-              <b>${error}</b>: ${errorDescription}
+              <b>${escapeHtml(error)}</b>: ${escapeHtml(errorDescription)}
             </p>
           </div>
         </body>
         </html>
       `);
+                        if (settles) {
+                            stop();
+                            reject(new Error(`Login failed: ${errorDescription || error}`));
+                        }
                     }
                     res.end();
                 }
             });
-            const signals = ['SIGTERM', 'SIGHUP', 'SIGINT'];
-            signals.forEach(signal => process.on(signal, () => {
-                server.close();
-                process.exitCode = 1;
-            }));
             server.listen(4242).on('error', (err) => {
+                clearTimeout(timer);
                 if (err.code === 'EADDRINUSE') {
                     reject(new Error('Unable to start a local server on port 4242.'
                         + ' Please check that `checkly login` isn\'t already running in a separate tab.'
@@ -176,51 +212,15 @@ export class AuthContext {
             code,
             redirect_uri: AUTH0_CALLBACK_URL,
         });
-        const tokenResponse = await this.#axiosInstance.post('https://auth.checklyhq.com/oauth/token', tokenParams, {
+        const tokenResponse = await axios.post(tokenUrl(), tokenParams, assignProxy(tokenUrl(), {
             headers: {
                 'Content-Type': 'application/x-www-form-urlencoded',
                 'Accept-Encoding': '*',
             },
-        });
+        }));
         const { access_token: accessToken, id_token: idToken } = tokenResponse.data;
         this.#accessToken = accessToken;
         this.#idToken = idToken;
     }
-    async #getApiKey() {
-        try {
-            await this.#fetchUser();
-        }
-        catch (error) {
-            if (error.response?.status === 401) {
-                await this.#registerUser();
-            }
-            else {
-                throw error;
-            }
-        }
-        const apiKeyName = `CLI User Key (${os.hostname()})`;
-        const { data } = await this.#axiosInstance.post(`/users/me/api-keys?name=${apiKeyName}`);
-        return data;
-    }
-    async #fetchUser() {
-        const { data } = await this.#axiosInstance.get('/users/me');
-        return data;
-    }
-    async #registerUser() {
-        const { data } = await this.#axiosInstance.post('/users/', { accessToken: this.#accessToken });
-        return data;
-    }
-    get #axiosInstance() {
-        // Keep axios instance stateless
-        const { baseURL } = getApiDefaults();
-        const axiosConf = assignProxy(baseURL, {
-            baseURL,
-            headers: {
-                Accept: 'application/json, text/plain, */*',
-                Authorization: `Bearer ${this.#accessToken}`,
-            },
-        });
-        return axios.create(axiosConf);
-    }
 }
 //# sourceMappingURL=index.js.map