eas-cli 18.4.0 → 18.6.0

package/build/user/expoBrowserAuthFlowLauncher.js

@@ -4,20 +4,65 @@ exports.getSessionUsingBrowserAuthFlowAsync = getSessionUsingBrowserAuthFlowAsyn
 const tslib_1 = require("tslib");
 const assert_1 = tslib_1.__importDefault(require("assert"));
 const better_opn_1 = tslib_1.__importDefault(require("better-opn"));
+const crypto_1 = tslib_1.__importDefault(require("crypto"));
 const http_1 = tslib_1.__importDefault(require("http"));
-const querystring_1 = tslib_1.__importDefault(require("querystring"));
 const api_1 = require("../api");
+const fetch_1 = tslib_1.__importDefault(require("../fetch"));
 const log_1 = tslib_1.__importDefault(require("../log"));
+const CLIENT_ID = 'eas-cli';
+function generateCodeVerifier() {
+    return crypto_1.default.randomBytes(32).toString('base64url');
+}
+function generateCodeChallenge(codeVerifier) {
+    return crypto_1.default.createHash('sha256').update(codeVerifier).digest('base64url');
+}
+function generateState() {
+    return crypto_1.default.randomBytes(32).toString('base64url');
+}
+async function exchangeCodeForSessionSecretAsync({ code, codeVerifier, redirectUri, }) {
+    const tokenUrl = `${(0, api_1.getExpoApiBaseUrl)()}/v2/auth/token`;
+    const response = await (0, fetch_1.default)(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            code_verifier: codeVerifier,
+            client_id: CLIENT_ID,
+        }),
+    });
+    const result = await response.json();
+    const sessionSecret = result?.data?.session_secret;
+    if (!sessionSecret) {
+        throw new Error('Failed to obtain session secret from token exchange.');
+    }
+    return sessionSecret;
+}
 async function getSessionUsingBrowserAuthFlowAsync({ sso = false }) {
     const scheme = 'http';
     const hostname = 'localhost';
-    const path = '/auth/callback';
+    const callbackPath = '/auth/callback';
     const expoWebsiteUrl = (0, api_1.getExpoWebsiteBaseUrl)();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    const buildRedirectUri = (port) => `${scheme}://${hostname}:${port}${callbackPath}`;
     const buildExpoLoginUrl = (port, sso) => {
-        const params = querystring_1.default.stringify({
-            confirm_account: true,
-            app_redirect_uri: `${scheme}://${hostname}:${port}${path}`,
-        });
+        // Note: we avoid URLSearchParams here because better-opn calls encodeURI()
+        // on the URL before passing it to AppleScript, which would double-encode
+        // the percent-encoded values from URLSearchParams.toString().
+        const params = [
+            `client_id=${CLIENT_ID}`,
+            `redirect_uri=${buildRedirectUri(port)}`,
+            `response_type=code`,
+            `code_challenge=${codeChallenge}`,
+            `code_challenge_method=S256`,
+            `state=${state}`,
+            `confirm_account=true`,
+        ].join('&');
         return `${expoWebsiteUrl}${sso ? '/sso-login' : '/login'}?${params}`;
     };
     // Start server and begin auth flow
@@ -34,22 +79,34 @@ async function getSessionUsingBrowserAuthFlowAsync({ sso = false }) {
                         connection.destroy();
                     }
                 };
-                try {
+                const handleRequestAsync = async () => {
                     if (!(request.method === 'GET' && request.url?.includes('/auth/callback'))) {
                         throw new Error('Unexpected login response.');
                     }
                     const url = new URL(request.url, `http:${request.headers.host}`);
-                    const sessionSecret = url.searchParams.get('session_secret');
-                    if (!sessionSecret) {
-                        throw new Error('Request missing session_secret search parameter.');
+                    const code = url.searchParams.get('code');
+                    const returnedState = url.searchParams.get('state');
+                    if (!code) {
+                        throw new Error('Request missing code search parameter.');
+                    }
+                    if (returnedState !== state) {
+                        throw new Error('State mismatch. Possible CSRF attack.');
                     }
+                    const address = server.address();
+                    (0, assert_1.default)(address !== null && typeof address === 'object');
+                    const redirectUri = buildRedirectUri(address.port);
+                    const sessionSecret = await exchangeCodeForSessionSecretAsync({
+                        code,
+                        codeVerifier,
+                        redirectUri,
+                    });
                     resolve(sessionSecret);
                     redirectAndCleanup('success');
-                }
-                catch (error) {
+                };
+                handleRequestAsync().catch(error => {
                     redirectAndCleanup('error');
                     reject(error);
-                }
+                });
             });
             server.listen(0, hostname, () => {
                 log_1.default.log('Waiting for browser login...');

package/build/worker/upload.js

@@ -166,6 +166,7 @@ async function* batchUploadAsync(init, payloads, onProgressUpdate) {
         (() => {
             onProgressUpdate(getProgressValue());
         });
+    let firstError = null;
     try {
         let index = 0;
         while (index < payloads.length || queue.size > 0) {
@@ -177,27 +178,36 @@ async function* batchUploadAsync(init, payloads, onProgressUpdate) {
                         progressTracker[currentIndex] = progress;
                         sendProgressUpdate();
                     });
-                const uploadPromise = uploadAsync(initWithSignal, payload, onChildProgressUpdate).finally(() => {
+                const uploadPromise = uploadAsync(initWithSignal, payload, onChildProgressUpdate).then(result => {
                     queue.delete(uploadPromise);
                     progressTracker[currentIndex] = 1;
+                    return result;
+                }, error => {
+                    queue.delete(uploadPromise);
+                    firstError ??= error;
+                    controller.abort();
+                    throw error;
                 });
                 queue.add(uploadPromise);
                 yield { payload, progress: getProgressValue() };
             }
+            if (firstError) {
+                break;
+            }
             yield {
                 ...(await Promise.race(queue)),
                 progress: getProgressValue(),
             };
         }
-        if (queue.size > 0) {
-            controller.abort();
-        }
     }
     catch (error) {
         if (error.name !== 'AbortError') {
-            throw error;
+            firstError ??= error;
         }
     }
+    if (firstError) {
+        throw firstError;
+    }
 }
 function createProgressBar(label = 'Uploading assets') {
     const queueProgressBar = new cli_progress_1.default.SingleBar({ format: `|{bar}| {percentage}% ${label}` }, cli_progress_1.default.Presets.rect);