chofex-cli 0.1.147 → 0.1.148

package/dist/index.js

@@ -58828,6 +58828,39 @@ var ChallengeCatalogSchema = exports_Schema.Struct({
 });
 
 // ../../packages/registration-contract/src/index.ts
+var campaignAttributionHandoffHeader = "x-chofex-campaign-attribution";
+var eventUuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function campaignAttributionHandoffValue(handoff) {
+  if (!eventUuidPattern.test(handoff.landingId))
+    return;
+  if (!Number.isSafeInteger(handoff.capturedAt) || handoff.capturedAt < 0)
+    return;
+  return `${handoff.landingId}.${handoff.capturedAt}`;
+}
+function campaignAttributionHandoffFromValue(value3) {
+  if (!value3)
+    return;
+  const separator = value3.lastIndexOf(".");
+  if (separator < 0)
+    return;
+  const landingId = value3.slice(0, separator);
+  const capturedAt = Number(value3.slice(separator + 1));
+  const handoff = { capturedAt, landingId };
+  if (campaignAttributionHandoffValue(handoff) !== value3)
+    return;
+  return handoff;
+}
+function campaignAttributionFromOAuthState(expectedState, returnedState) {
+  if (returnedState === expectedState)
+    return { valid: true };
+  const prefix = `${expectedState}.`;
+  if (!returnedState?.startsWith(prefix))
+    return { valid: false };
+  const handoff = campaignAttributionHandoffFromValue(returnedState.slice(prefix.length));
+  if (!handoff)
+    return { valid: false };
+  return { valid: true, handoff };
+}
 var nonBlank = (maximum) => exports_Schema.Trim.pipe(exports_Schema.check(exports_Schema.isMinLength(1), exports_Schema.isMaxLength(maximum)));
 var optionalText = (maximum) => exports_Schema.optional(nonBlank(maximum));
 var nullableOptionalText = (maximum) => exports_Schema.optional(exports_Schema.NullOr(nonBlank(maximum)));
@@ -59140,11 +59173,13 @@ import { createServer } from "node:http";
 
 // src/config.ts
 var oauthIssuer = process.env.CHOFEX_OAUTH_ISSUER ?? "https://clerk.hacktheandes.com";
+var publicSiteUrl = process.env.CHOFEX_PUBLIC_SITE_URL ?? "https://hacktheandes.com";
 var config = {
   apiUrl: process.env.CHOFEX_API_URL ?? "https://hacktheandes.com",
-  publicSiteUrl: process.env.CHOFEX_PUBLIC_SITE_URL ?? "https://hacktheandes.com",
+  publicSiteUrl,
   oauthClientId: process.env.CHOFEX_OAUTH_CLIENT_ID ?? "HddO78wKpq5PFIEl",
   authorizationUrl: `${oauthIssuer}/oauth/authorize`,
+  authorizationBridgeUrl: `${publicSiteUrl}/api/v1/oauth/authorize`,
   tokenUrl: `${oauthIssuer}/oauth/token`,
   revocationUrl: `${oauthIssuer}/oauth/token/revoke`
 };
@@ -59304,7 +59339,7 @@ var tokenEndpointError = (status, body) => {
   const detail = description ? `: ${description}` : "";
   return new Error(`Clerk OAuth token endpoint returned ${status}${detail}`);
 };
-var credentialsFromToken = (body, previousRefreshToken) => {
+var credentialsFromToken = (body, previousRefreshToken, campaignAttribution) => {
   if (typeof body.access_token !== "string") {
     let detail = "";
     if (typeof body.error_description === "string") {
@@ -59322,6 +59357,7 @@ var credentialsFromToken = (body, previousRefreshToken) => {
   }
   return {
     accessToken: body.access_token,
+    campaignAttribution,
     refreshToken,
     expiresAt
   };
@@ -59360,20 +59396,26 @@ var refresh = async (credentials) => {
     refresh_token: credentials.refreshToken,
     client_id: config.oauthClientId
   });
-  const updated = credentialsFromToken(body, credentials.refreshToken);
+  const updated = credentialsFromToken(body, credentials.refreshToken, credentials.campaignAttribution);
   await saveCredentials(updated);
   return updated;
 };
-var accessToken = async (forceRefresh = false) => {
-  if (process.env.CHOFEX_TOKEN)
-    return process.env.CHOFEX_TOKEN;
+var authentication = async (forceRefresh = false) => {
+  if (process.env.CHOFEX_TOKEN) {
+    return { accessToken: process.env.CHOFEX_TOKEN };
+  }
   const credentials = await readCredentials();
   if (!credentials)
     throw new Error("Not logged in. Run `chofex login`.");
   if (forceRefresh || credentials.expiresAt !== undefined && credentials.expiresAt <= Date.now() + 30000) {
-    return (await refresh(credentials)).accessToken;
+    return await refresh(credentials);
   }
-  return credentials.accessToken;
+  return credentials;
+};
+var bridgedAuthorizationUrl = (bridgeUrl, authorizationUrl) => {
+  const bridge = new URL(bridgeUrl);
+  bridge.search = new URL(authorizationUrl).search;
+  return bridge.toString();
 };
 var browserCommand = (url2, platform = process.platform) => {
   if (platform === "darwin")
@@ -59412,7 +59454,8 @@ var login = async () => {
     }
     const error2 = url2.searchParams.get("error");
     const authorizationCode = url2.searchParams.get("code");
-    if (url2.searchParams.get("state") !== state || error2 || !authorizationCode) {
+    const attributionState = campaignAttributionFromOAuthState(state, url2.searchParams.get("state"));
+    if (!attributionState.valid || error2 || !authorizationCode) {
       response.writeHead(400, { "content-type": "text/plain" }).end("Chofex login failed. You can close this window.");
       let message = "Invalid OAuth callback";
       if (error2)
@@ -59421,7 +59464,10 @@ var login = async () => {
       return;
     }
     response.writeHead(200, { "content-type": "text/plain" }).end("Chofex login complete. You can close this window.");
-    finish(authorizationCode);
+    finish({
+      authorizationCode,
+      campaignAttribution: attributionState.handoff
+    });
   });
   await new Promise((resolve4, reject) => {
     server.once("error", reject);
@@ -59448,23 +59494,24 @@ var login = async () => {
     server.close();
     throw error2;
   }
+  const browserUrl = bridgedAuthorizationUrl(config.authorizationBridgeUrl, authorizationUrl.toString());
   console.error(`Sign in here (waiting up to five minutes):
 
-  ${authorizationUrl}
+  ${browserUrl}
 
 If the browser did not open automatically, open that URL yourself.`);
-  openBrowser(authorizationUrl.toString());
+  openBrowser(browserUrl);
   const timeout3 = setTimeout(() => fail11(new Error("Login timed out after five minutes")), 300000);
   try {
-    const authorizationCode = await code;
+    const callback4 = await code;
     const body = await tokenRequest({
       grant_type: "authorization_code",
       client_id: config.oauthClientId,
-      code: authorizationCode,
+      code: callback4.authorizationCode,
       redirect_uri: redirectUri,
       code_verifier: verifier
     });
-    const credentials = credentialsFromToken(body);
+    const credentials = credentialsFromToken(body, undefined, callback4.campaignAttribution);
     await saveCredentials(credentials);
     return credentials.accessToken;
   } finally {
@@ -59537,20 +59584,27 @@ var exitCodeFor = (error2) => {
 
 // src/api-client.ts
 var endpoint = (apiUrl, path4) => `${apiUrl.replace(/\/$/, "")}${path4}`;
-var resolveAccessToken = (suppliedToken, forceRefresh = false) => {
-  if (suppliedToken)
-    return exports_Effect.succeed(suppliedToken);
+var resolveAuthentication = (suppliedToken, campaignAttribution, forceRefresh = false) => {
+  if (suppliedToken) {
+    return exports_Effect.succeed({ accessToken: suppliedToken, campaignAttribution });
+  }
   return exports_Effect.tryPromise({
-    try: () => accessToken(forceRefresh),
+    try: () => authentication(forceRefresh),
     catch: (error2) => cliError("AUTHENTICATION_REQUIRED", String(error2), false)
   });
 };
-var sendRequest = (options, path4, init, token) => exports_Effect.tryPromise({
+var sendRequest = (options, path4, init, credentials) => exports_Effect.tryPromise({
   try: () => {
     const headers = new Headers(init.headers);
     headers.set("accept", "application/json");
-    if (token)
-      headers.set("authorization", `Bearer ${token}`);
+    if (credentials) {
+      headers.set("authorization", `Bearer ${credentials.accessToken}`);
+      if (credentials.campaignAttribution) {
+        const handoff = campaignAttributionHandoffValue(credentials.campaignAttribution);
+        if (handoff)
+          headers.set(campaignAttributionHandoffHeader, handoff);
+      }
+    }
     headers.set("x-request-id", crypto.randomUUID());
     if (init.body !== undefined) {
       headers.set("content-type", "application/json");
@@ -59579,11 +59633,11 @@ var decodeHttpBody = exports_Effect.fn("decodeHttpBody")(function* (response, de
 });
 var request3 = exports_Effect.fn("apiRequest")(function* (options, path4, init, decodeResponse) {
   const suppliedToken = options.token ?? process.env.CHOFEX_TOKEN;
-  let token = yield* resolveAccessToken(suppliedToken);
-  let response = yield* sendRequest(options, path4, init, token);
+  let credentials = yield* resolveAuthentication(suppliedToken, options.campaignAttribution);
+  let response = yield* sendRequest(options, path4, init, credentials);
   if (response.status === 401 && !suppliedToken) {
-    token = yield* resolveAccessToken(undefined, true);
-    response = yield* sendRequest(options, path4, init, token);
+    credentials = yield* resolveAuthentication(undefined, undefined, true);
+    response = yield* sendRequest(options, path4, init, credentials);
   }
   return yield* decodeHttpBody(response, decodeResponse);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chofex-cli",
-  "version": "0.1.147",
+  "version": "0.1.148",
   "description": "Command-line client for Hack the Andes",
   "type": "module",
   "bin": {