datagrok-tools 6.5.10 → 6.6.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Datagrok-tools changelog
 
+## 6.6.0 (WIP)
+
+* The developer key is sent in the `Authorization` header (`Dev <key>`) instead of the URL path. `POST /users/login/dev/<key>` and `POST /packages/dev/<key>/<package>` put a long-lived credential into every nginx access log, proxy log and shell history along the way; the key-less routes (`/users/login/dev`, `/packages/dev/<package>`) take it as a header. Servers that predate the header form answer 404/401 and the old URL is used instead, so publishing to an older server still works - but a server from 1.28 on rejects the URL form and asks for datagrok-tools 6.6.0 or later.
+
 ## 6.5.10 (2026-09-11)
 
 * `grok s pull` — a bundle file name is capped at 200 bytes plus a digest of the full name, so it stays unique and stable across pulls. A nested view under a long space spells a longer name than a path component may hold (255 bytes on ext4 and NTFS): one TWIG snapshot reached 268 and the write failed with `ENAMETOOLONG`, taking down the whole part rather than the entity — a `--by-namespace` part that only touched the space as a dependency died with it.

package/CLAUDE.md

@@ -94,7 +94,9 @@ The `publish` command executes these steps:
 3. Process environment variables in `/connections/*.json` files (replace `${VAR}`)
 4. **Process Docker images** (see below)
 5. Create ZIP archive with archiver-promise (includes `image.json` metadata per container)
-6. Upload to server: `POST ${host}/packages/dev/${devKey}/${packageName}`
+6. Upload to server: `POST ${host}/packages/dev/${packageName}` with `Authorization: Dev ${devKey}`
+   (older servers only know `POST ${host}/packages/dev/${devKey}/${packageName}`; `devKeyFetch` in
+   `bin/utils/dev-key.ts` falls back to it on 404/401)
 
 **Key flags:**
 - `--debug` (default) - Package visible only to developer

package/README.md

@@ -100,6 +100,11 @@ For more information on configuring connections, refer to the [Connections](http
   - `--suffix`: a string containing package version hash
 
   Running `grok publish` is the same as running `grok publish defaultHost --build --debug`.
+- `report` works with user error reports on a Datagrok instance (the instance is a server alias from
+  `config.yaml`): `grok report fetch <instance> <number>` downloads the report zip, `grok report read
+  <zip|json|instance number>` prints one normalized JSON object (flags `--extract-screenshot`,
+  `--extract-d42`, `--extract-client-log`), `grok report resolve <instance> <number>` marks it resolved.
+  `ticket`, `comment`, `label`, `attach` talk to JIRA with `JIRA_TOKEN`. See `grok report --help`.
 - `check` checks package content (function signatures, import statements of external modules,
   etc.). The check is also run during package publication.
 - `init` modifies a package template by adding config files for linters, IDE, and so on

package/bin/_deprecated/upload.js

@@ -72,7 +72,8 @@ async function processPackage() {
   let timestamps = {};
   if (debug) {
     try {
-      timestamps = await (await fetch(`${host}/packages/dev/${devKey}/${packageName}/timestamps`)).json();
+      timestamps = await (await fetch(`${host}/packages/dev/${packageName}/timestamps`,
+        {headers: {Authorization: `Dev ${devKey}`}})).json();
       if (timestamps['#type'] === 'ApiError') {
         console.log(timestamps.message);
         return 1;
@@ -134,8 +135,9 @@ async function processPackage() {
 
   //upload
   const uploadPromise = new Promise((resolve, reject) => {
-    fetch(`${host}/packages/dev/${devKey}/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
+    fetch(`${host}/packages/dev/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
       method: 'POST',
+      headers: {Authorization: `Dev ${devKey}`},
       body: zip,
     }).then((body) => body.json()).then((j) => resolve(j)).catch((err) => {
       reject(err);

package/bin/commands/help.js

@@ -371,10 +371,17 @@ Usage: grok report <subcommand> [args]
 Manage Datagrok user error reports
 
 Subcommands:
-    fetch    Download a report zip from a managed instance
+    fetch    Download a report zip from a managed instance (writes <stem>_meta.json next to it)
     read     Normalize a report (zip or json) into one JSON object on stdout
-    resolve  Mark a report as resolved
-    ticket   Create a JIRA ticket for a report via the Datlas API
+    resolve  Mark a report as resolved (needs the _meta.json written by fetch)
+    ticket   Create a JIRA ticket for a report directly in JIRA (no dedup; the key is NOT
+             written back to the report — prefer POST /reports/{id}/jira for that)
+    comment  Add a comment to a JIRA ticket (--body <text> | --body-file <path>)
+    label    Add labels to a JIRA ticket
+    attach   Attach a file to a JIRA ticket
+
+JIRA subcommands need JIRA_TOKEN (plus JIRA_USER for a user API token); ticket also needs
+--project or $JIRA_PROJECT.
 
 Read flags:
     --extract-screenshot <path>  Write the screenshot binary to <path>

package/bin/commands/publish.js

@@ -20,6 +20,7 @@ var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _check = require("./check");
 var _pythonCeleryGen = require("../utils/python-celery-gen");
 var _queueWorkerGen = require("../utils/queue-worker-gen");
+var _devKey = require("../utils/dev-key");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 // @ts-ignore
 
@@ -243,7 +244,7 @@ function listRecursive(basePath, rel) {
 async function getUserLogin(host, devKey) {
   let loginResp;
   try {
-    loginResp = await (0, _nodeFetch.default)(`${host}/users/login/dev/${devKey}`, {
+    loginResp = await (0, _devKey.devKeyFetch)(`${host}/users/login/dev`, `${host}/users/login/dev/${devKey}`, devKey, {
       method: 'POST'
     });
   } catch (e) {
@@ -485,9 +486,10 @@ async function fallbackImage(img, host, devKey, registry, version, contentHash)
 async function processPackage(debug, rebuild, host, devKey, packageName, dropDb, suffix, hostAlias, registry, rebuildDocker, skipDockerRebuild) {
   // Validate server connectivity and dev key
   let timestamps = {};
-  let url = `${host}/packages/dev/${devKey}/${packageName}`;
+  const url = `${host}/packages/dev/${packageName}`;
+  const legacyUrl = `${host}/packages/dev/${devKey}/${packageName}`;
   try {
-    const checkResp = await (0, _nodeFetch.default)(url + '/timestamps');
+    const checkResp = await (0, _devKey.devKeyFetch)(`${url}/timestamps`, `${legacyUrl}/timestamps`, devKey);
     const checkData = await checkResp.json();
     if (checkData['#type'] === 'ApiError') {
       color.error(checkData.message);
@@ -614,12 +616,12 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
   });
 
   // Upload
-  url += `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
-  if (suffix) url += `&suffix=${suffix.toString()}`;
+  let query = `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
+  if (suffix) query += `&suffix=${suffix.toString()}`;
   await zip.finalize();
   const zipBuffer = Buffer.concat(chunks);
   try {
-    const body = await (0, _nodeFetch.default)(url, {
+    const body = await (0, _devKey.devKeyFetch)(url + query, legacyUrl + query, devKey, {
       method: 'POST',
       body: zipBuffer
     });

package/bin/utils/dev-key.js

@@ -0,0 +1,31 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.devKeyFetch = devKeyFetch;
+exports.devKeyHeaders = devKeyHeaders;
+const fetch = require('node-fetch');
+
+/** `Authorization` header carrying the developer key. */
+function devKeyHeaders(key, headers = {}) {
+  return {
+    ...headers,
+    'Authorization': `Dev ${key}`
+  };
+}
+
+/**
+ * Calls [url] with the developer key in the `Authorization` header, falling back to
+ * [legacyUrl] - which carries the key as a path segment - for servers that predate the
+ * header form. Those answer 404 (no such route) or 401 (the route-less path is not on
+ * their anonymous allow-list); a server that knows the header form answers neither.
+ */
+async function devKeyFetch(url, legacyUrl, key, init = {}) {
+  const response = await fetch(url, {
+    ...init,
+    headers: devKeyHeaders(key, init.headers)
+  });
+  if (response.status !== 404 && response.status !== 401) return response;
+  return await fetch(legacyUrl, init);
+}

package/bin/utils/node-dapi.js

@@ -68,7 +68,15 @@ class NodeApiClient {
     this.devKey = devKey;
   }
   static async login(baseUrl, devKey) {
-    const res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
+    // Servers before 1.28 only knew the key-in-URL form, where it leaked into every
+    // access log on the way; they answer 404 or 401 to the key-less route.
+    let res = await fetch(`${baseUrl}/users/login/dev`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Dev ${devKey}`
+      }
+    });
+    if (res.status === 404 || res.status === 401) res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
       method: 'POST'
     });
     const json = (res.headers.get('content-type') ?? '').includes('application/json') ? await res.json() : null;

package/bin/utils/test-utils.js

@@ -35,6 +35,7 @@ var utils = _utils;
 var _puppeteer = _interopRequireDefault(require("puppeteer"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _papaparse = _interopRequireDefault(require("papaparse"));
+var _devKey = require("./dev-key");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const fetch = require('node-fetch');
 const grokDir = _path.default.join(_os.default.homedir(), '.grok');
@@ -57,7 +58,7 @@ async function getToken(url, key) {
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {
-      const response = await fetch(`${url}/users/login/dev/${key}`, {
+      const response = await (0, _devKey.devKeyFetch)(`${url}/users/login/dev`, `${url}/users/login/dev/${key}`, key, {
         method: 'POST'
       });
       const text = await response.text();

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/datagrok-ai/public.git"
   },
-  "version": "6.5.10",
+  "version": "6.6.0",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {